Mastering Symlink Ownership in Linux: What You Need to Know

In Linux and other Unix-like systems, symbolic links (symlinks) are widely used to create shortcuts or references to other files and directories. They are powerful tools that make system management and software deployment easier. However, many developers and system administrators get confused when it comes to changing ownership of symlinks.

This article will walk you through how symlink ownership works, how to set it properly, and what pitfalls you need to be aware of.

Understanding Symlinks

A symbolic link is a special type of file that points to another file or directory. Think of it as a shortcut on Windows — it doesn’t hold data itself but tells the system where the real file is located.

When you run ls -l, symlinks are displayed with an arrow:

lrwxrwxrwx 1 root root 12 Aug 20 12:00 mylink -> /path/to/file

Here:

• l at the beginning means it’s a symlink.
• root root shows the owner and group of the symlink itself.
• mylink -> /path/to/file shows the link target.

Changing Ownership of a Symlink

By default, if you run chown on a symlink, Linux will change the ownership of the target file, not the symlink itself.

For example:

sudo chown sony:www-data mylink

This changes the ownership of /path/to/file, not mylink.

If you want to change ownership of the symlink itself, you need to use the -h (or --no-dereference) option:

sudo chown -h sony:www-data mylink

Now, the symlink mylink is owned by sony and belongs to the www-data group, while the target file may still have a different owner.

Verifying Ownership

To confirm:

ls -l

You will see something like:

lrwxrwxrwx 1 sony www-data 12 Aug 20 12:00 mylink -> /path/to/file

Important Considerations

1. Not All Filesystems Support Symlink Ownership

Some filesystems (e.g., ext4 supports it, but others may ignore it) don’t store symlink ownership. Even if you run chown -h, the change may not matter because the system always checks the target file’s permissions, not the symlink’s.

2. Security Implications

Changing the ownership of symlinks is usually less important than controlling access to the target file. For instance, if a symlink points to /etc/passwd, ownership of the symlink itself doesn’t matter — what matters is who can write to /etc/passwd.

3. Preserving Symlinks in Copy/Move Operations

When copying or moving files with commands like cp or rsync, symlinks can either be preserved as links or resolved into real files. To keep them as symlinks:

With rsync:

rsync -aH source_dir/ target_dir/

With cp:

cp -a source_dir target_dir

This ensures ownership and permissions of the symlink itself remain intact.

4. When to Actually Care About Symlink Ownership

In most day-to-day operations, symlink ownership is irrelevant because access control is determined by the target file. However, there are situations where it matters:

• When auditing ownership for consistency.
• When symlinks exist inside directories managed by different users.
• In shared hosting or container environments where symlink manipulation could be a vector for privilege escalation.

5. Best Practice for System Management

• Always confirm whether you want to change the symlink or the target.
• Use chown -h explicitly when modifying symlink ownership.
• Keep in mind that target ownership always overrides symlink ownership in terms of access control.

Finally

Managing symlink ownership in Linux can be tricky if you don’t understand how it works. By default, chown changes the target’s ownership, not the symlink’s. If you want to change the symlink itself, use chown -h.

Still, in most cases, what really matters is the ownership and permissions of the target file, since that is what controls access. The ownership of the symlink is more about bookkeeping and consistency than actual security.

So, the next time you run into ownership issues, remember: check whether you’re dealing with the link or the target — and use the right command accordingly.

Support Us