DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:reply-to:message-id:to:subject
	:in-reply-to:references:mime-version:content-type
	:content-transfer-encoding; q=dns; s=default; b=VhfZ+t7oPZgsGE2U
	0qjkdbQmGDdysi8A6EzZOCqVzkHQ0VVjS8PnOsaHv0R0RLvUjxbZCF0P+67AvoCF
	+Pv8uz6gV+PWjr/bdtdRty2PrNXQyDdDdhSwX/QcLTqYcgKp4j7I4+1AMXKZ2H9R
	cr2u48zG3J9r4t7NgX01wMB7A6Q=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Date: Tue, 19 Mar 2019 20:11:28 +0300
From: Andrey Repin <anrdaemon AT yandex DOT ru>
Reply-To: cygwin AT cygwin DOT com
Message-ID: <1585347268.20190319201128@yandex.ru>
To: LRN <lrn1986 AT gmail DOT com>, cygwin AT cygwin DOT com
Subject: Re: winsymlinks:nativestrict and Windows 10
In-Reply-To: <f4207a77-a8d4-6004-dd76-2bc789e8d34f@gmail.com>
References: <1039329494 DOT 20190319152358 AT yandex DOT ru> <f4207a77-a8d4-6004-dd76-2bc789e8d34f AT gmail DOT com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Greetings, LRN!

> On 19.03.2019 15:23, Andrey Repin wrote:
>> It's not a secret that in earlier Windows versions members of Administrators
>> group require elevated shell to create symlinks.
>> Win10 is supposed to be easier, but all I've found was pointing to some
>> obscure "developer mode".

> Newer Windows 10 added a feature where passing a certain flag
> (SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) to a W32 API function that
> creates symlink (CreateSymbolicLinkW) allows you to create symlinks without
> being Administrator.

> This flag only works if you put Windows into developer mode (you can toggle
> this in Settings->Update & Security->For developers).

> Newer versions of Cygwin know about this flag, and will always try to use it.

> Ironically, some programs built into Windows do *not* use this flag, and will
> continue to fail to create symlinks. Similarly, old versions of Cygwin or,
> really, any Windows (MinGW/MSVC) program that does symlinks, will not be able
> to use it, since they are not passing that flag. Any program that uses Cygwin
> runtime will automatically benefit from this feature if Cygwin runtime itself
> is new enough, since programs built against Cygwin just call `symlink()` and
> don't have to know anything about implementation details.

>> I wonder if it is possible to add some permission to the account instead and
>> call it a day?
>> 

> Devmode + SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE is the only way to
> create symlinks without being Administrator (that i know of). You can't just
> give some extra privileges to your non-administrator account. I know, i've tried.

> Do note that this still doesn't fix the fundamental problem of NTFS symlinks
> being either files or directories, but not both at the same time, unlike
> symlink on other filesystems that have "dynamic" type and thus can be files or
> directories depending on what they are pointing to at any given moment. But you
> must already know what, since you're using nativestrict.

It's even worse than that. Windows 10 fully resolves symlinks BEFORE passing
them to any application.
Say, you want to start X:\Y\z which is a symlink to A:\B\c.
On Win7, the command line will be X:\Y\z
On Win10, it will be A:\B\c. All relative paths inside program will be
relative to "A:\B".
No way to have program mode switching by name, like it is often seen in *NIX.
This shit completely ruined my setup.


-- 
With best regards,
Andrey Repin
Tuesday, March 19, 2019 19:59:00

Sorry for my terrible english...


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple