DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:to:references:from:subject:message-id:date
	:mime-version:in-reply-to:content-type; q=dns; s=default; b=srMe
	YM2aUIQeYMvRCWHpdv57ANy+oP451lS/2+krnVpmtPIKusXyZoCzbY2tZgWzIj2Z
	P9jAvdtQh3+L51BF/oC7NxyHxx8xFiYertnJkYnx+V5i/jYM+9h4qdcD+/j1Cv2F
	sFfv/JydN6MRPuCo/xgbSbU8Dsvz1wvGMw07iFI=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
To: cygwin AT cygwin DOT com
References: <1039329494 DOT 20190319152358 AT yandex DOT ru>
From: LRN <lrn1986 AT gmail DOT com>
Subject: Re: winsymlinks:nativestrict and Windows 10
Message-ID: <f4207a77-a8d4-6004-dd76-2bc789e8d34f@gmail.com>
Date: Tue, 19 Mar 2019 17:23:04 +0300
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3
MIME-Version: 1.0
In-Reply-To: <1039329494.20190319152358@yandex.ru>
Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="KuwZExmDQKdGxVmrMBCqUFKeORfDpewZo"

--KuwZExmDQKdGxVmrMBCqUFKeORfDpewZo
Content-Type: multipart/mixed; boundary="ry0n9SXkTt3GE4kbHbbbtaZSzW9Xnpg1f";
 protected-headers="v1"
From: LRN <lrn1986 AT gmail DOT com>
To: cygwin AT cygwin DOT com
Message-ID: <f4207a77-a8d4-6004-dd76-2bc789e8d34f AT gmail DOT com>
Subject: Re: winsymlinks:nativestrict and Windows 10


--ry0n9SXkTt3GE4kbHbbbtaZSzW9Xnpg1f
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

On 19.03.2019 15:23, Andrey Repin wrote:
> It's not a secret that in earlier Windows versions members of Administrat=
ors
> group require elevated shell to create symlinks.
> Win10 is supposed to be easier, but all I've found was pointing to some
> obscure "developer mode".

Newer Windows 10 added a feature where passing a certain flag
(SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) to a W32 API function that
creates symlink (CreateSymbolicLinkW) allows you to create symlinks without
being Administrator.

This flag only works if you put Windows into developer mode (you can toggle
this in Settings->Update & Security->For developers).

Newer versions of Cygwin know about this flag, and will always try to use i=
t.

Ironically, some programs built into Windows do *not* use this flag, and wi=
ll
continue to fail to create symlinks. Similarly, old versions of Cygwin or,
really, any Windows (MinGW/MSVC) program that does symlinks, will not be ab=
le
to use it, since they are not passing that flag. Any program that uses Cygw=
in
runtime will automatically benefit from this feature if Cygwin runtime itse=
lf
is new enough, since programs built against Cygwin just call `symlink()` and
don't have to know anything about implementation details.

> I wonder if it is possible to add some permission to the account instead =
and
> call it a day?
>=20

Devmode + SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE is the only way to
create symlinks without being Administrator (that i know of). You can't just
give some extra privileges to your non-administrator account. I know, i've =
tried.

Do note that this still doesn't fix the fundamental problem of NTFS symlinks
being either files or directories, but not both at the same time, unlike
symlink on other filesystems that have "dynamic" type and thus can be files=
 or
directories depending on what they are pointing to at any given moment. But=
 you
must already know what, since you're using nativestrict.


--ry0n9SXkTt3GE4kbHbbbtaZSzW9Xnpg1f--

--KuwZExmDQKdGxVmrMBCqUFKeORfDpewZo
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE4MWzR43wYaAzEA49ja3pJ2dZunQFAlyQ+00ACgkQja3pJ2dZ
unTPaBAAqjBwjSpC/10JViKfpiIVARzKmezTPT72ahkl4OsU/w9jWQT3tFEEgzgm
p+I1rVS8bIUxc/PgBT6sn23MrKap0nqOsHSm3hBXTvPXNfugIVlw7LOANoRdjQfX
x/THH4jModVxoLzBW+UbaVFU1n8HR6eGqxk379vWalgHCyFxsw/3FH+DXcNn8eE+
6MYl9KZLA+l6f4Gpz7iz9xCL7Ads8HkppaLiiz8S+2y0AhmdGSR8vtXO/RXZIZGn
kX6VjWWNJ6pZhbc1Uku3mNl2JyBJFel3D8IBN3/ExhFLPVlVC9oEGJDhOeyhzoVO
W6fdZJbypBoIUmEL2cGnzikR1dh8H2kWSM/TXr6E8JGJ7+dwj2GVQizff1l6LaIH
VF/0yJF+6N9ryWkLDImX8f7cnqeTdCbxGkrjvpgHexFjdwc68a6iG8MGzkZgCSbN
u5TdmNHMQLs3RSSFsfk3YKRQ37Z9jGNgK7nL6Q0KuDLJ3GXCufmLhPn7mrJtu/fK
lTaSEw0Ip63FB3msYa4PJtUW/BdFXQDrAm3Pcp1jB+2bwFAuJrsDxDj0r6w4AIzI
Dq76zu1w3+1i4z/8+FpJ2K0ONn/QAtaTTRl0TUwHu5oUWku1R6NI+43c7XbDGESs
Uqa/Zjn0EvsMRy48S4c1czx8ieZd9eFxnxjAf6/qjs/hJM5/7eE=
=tPFJ
-----END PGP SIGNATURE-----

--KuwZExmDQKdGxVmrMBCqUFKeORfDpewZo--