Symlinks on Windows require privilege escalation

[dimo414]

On Windows bkt fails with this error:

> /bkt.exe -- ipconfig
bkt: Cache write failed: A required privilege is not held by the client. (os error 1314)

This comes from the call to std::os::windows::fs::symlink_file which actually doesn't work in most cases. Specifically, Windows treats symlink creation as a privileged action and there aren't a lot of good ways around it.

• Python suggests running as an administrator, enabling Developer Mode, or setting SeCreateSymbolicLinkPrivilege
  • Setting the create symlink privilege doesn't always work either; administrators seemingly can't set this for themselves; UAC would need to be disabled
• Some users report success calling mklink in a subprocess, but doesn't work for me, at least. For posterity:

  #[cfg(windows)]
  fn symlink<P: AsRef<Path>, Q: AsRef<Path>>(original: P, link: Q) -> Result<()> {
      let result = Command::new("cmd")
          .arg("/C").arg("mklink")
          .arg(link.as_ref().as_os_str())
          .arg(original.as_ref().as_os_str())
          .output().context("mklink subprocess failed")?;
      if !result.status.success() {
          return Err(Error::msg("Failed to create symlink"))
              .context(format!("Details: {:?}", result));
      }
      Ok(())
  }
  

• GoLang appears to have given up on symlinks outright and just does extra copies

Rather than making users jump through these hoops, it might be easiest to just manually reimplement "symlinks" as vanilla text files, so the key file would simply contain the path to the data file and lookup() would read that file to find where the data is stored.

[W1M0R]

Rather than making users jump through these hoops, it might be easiest to just manually reimplement "symlinks" as vanilla text files, so the key file would simply contain the path to the data file and lookup() would read that file to find where the data is stored.

I like this solution.

Is there an existing workaround on the software side? I hit this issue on a pipeline runner, and don't necessarily want to make changes on the os-level.

[dimo414]

Any workaround would involve fixing the permissions on the OS unfortunately, if you're interested in submitting a PR it should be an easy change. Otherwise I will try to prioritize this in the next couple of weeks.

[W1M0R]

Thanks @dimo414. I would like to attempt a solution, but I'm honestly a bit swamped right now.

[W1M0R]

If it is of any help, it looks like Scoop uses junctions by default and only reverts to copies if the no_junction config value is set:

https://github.com/ScoopInstaller/Scoop/blob/859d1db51bcc840903d5280567846ae2f7207ca2/lib/install.ps1#L804-L824