[issue31512] Add non-elevated symlink support for dev mode Windows 10

[Steve Dower]

Steve Dower  added the comment:

Done

--
resolution:  -> fixed
stage: patch review -> resolved
status: open -> closed

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31512] Add non-elevated symlink support for dev mode Windows 10

[Steve Dower]

Steve Dower  added the comment:


New changeset 0e10766574f4e287cd6b5e5860a1ca75488f4119 by Steve Dower (Vidar 
Tonaas Fauske) in branch 'master':
bpo-31512: Add non-elevated symlink support for Windows (GH-3652)
https://github.com/python/cpython/commit/0e10766574f4e287cd6b5e5860a1ca75488f4119


--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31512] Add non-elevated symlink support for dev mode Windows 10

[Eryk Sun]

Eryk Sun  added the comment:

:ping: It seems this was ready to be merged a while ago.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31512] Add non-elevated symlink support for dev mode Windows 10

[Vidar Fauske]

Vidar Fauske  added the comment:

Thanks! I addressed the comment, so hopefully this should be OK now.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31512] Add non-elevated symlink support for dev mode Windows 10

[Steve Dower]

Steve Dower  added the comment:

Thanks for the ping (I don't see GitHub notifications - I get 1000s per day and 
it's not feasible to read them).

I left one more comment on the PR, but then it's good to go!

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31512] Add non-elevated symlink support for dev mode Windows 10

[Vidar Fauske]

Vidar Fauske  added the comment:

The PR has been sitting for a while now with all previous concerns addressed. 
There has been a few pings on the PR without anything new happening, so I 
thought I would ping this issue as well: are there any other concerns about 
this PR, or anything else that is preventing it from being merged?

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31512] Add non-elevated symlink support for dev mode Windows 10

[Terry J. Reedy]

Change by Terry J. Reedy :


--
versions: +Python 3.8 -Python 3.6, Python 3.7

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31512] Add non-elevated symlink support for dev mode Windows 10

[Alexey Izbyshev]

Change by Alexey Izbyshev :


--
nosy: +izbyshev

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31512] Add non-elevated symlink support for dev mode Windows 10

[Vidar Fauske]

Vidar Fauske added the comment:

Thanks for the informative comments. I opened a PR based on this feedback. 
Would you mind checking if it conforms to what you had in mind?

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31512] Add non-elevated symlink support for dev mode Windows 10

[Vidar Fauske]

Changes by Vidar Fauske :


--
pull_requests: +3645
stage:  -> patch review

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31512] Add non-elevated symlink support for dev mode Windows 10

[Eryk Sun]

Eryk Sun added the comment:

Py_CreateSymbolicLinkW can be removed in 3.5+ because Windows XP is no longer 
supported and calling enable_symlink() is pointless. 

The Windows API uses some privileges simply to determine which security 
principals can access a capability. Whether the privilege is currently enabled 
or disabled in the current access token doesn't matter because functions 
automatically enable it for the current thread (in an impersonation token). 

In this case, CreateSymbolicLink calls RtlAcquirePrivilege to enable 
SeCreateSymbolicLinkPrivilege for the current thread; sets the symlink reparse 
point; and then reverts the current thread via RtlReleasePrivilege. It goes 
through these same steps whether or not the privilege is already enabled in the 
process, so there's no chance of a race condition between competing threads.

Also, as a side note, the linked blog makes the following claim, which paints 
an incomplete picture:

> However, for Windows users, due to Windows Vista’s security 
> requirements, users needed local admin rights and, importantly, 
> had to run mklink in a command-line console elevated as 
> administrator to create/modify symlinks. 

SeCreateSymbolicLinkPrivilege can be added to a standard user account, and it 
doesn't get filtered out from the user's token. So in general you do not need 
administrator access. However, the above is describing the case for most 
developers, who use a administrator account that's subject to UAC restrictions.

--
nosy: +eryksun

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31512] Add non-elevated symlink support for dev mode Windows 10

[Vidar Fauske]

New submission from Vidar Fauske:

As explained in this Microsoft blogpost 
(https://blogs.windows.com/buildingapps/2016/12/02/symlinks-windows-10/), it is 
possible on newer versions of Windows 10 for non-privileged users to create 
symlinks when the machine is in developer mode. However, to ensure backwards 
compatibility, this behavior requires a flag to be passed to the 
CreateSymbolicLink function.

I think this is something that Python can benefit from having. It would go from 
"symlinks on Windows rarely work" to "symlinks on Windows work in developer 
mode (and rarely otherwise)".

I've attached a proof of concept patch to enable this behavior (a Windows 10 
machine with the 'Creators Update' is required to test it). In summary, it 
enables the flag by default, and updates enable_symlink to prevent lacking 
privilege from disabling symlinks on machines in developer mode.

--
components: Library (Lib), Windows
files: devsymlink.patch
keywords: patch
messages: 302482
nosy: paul.moore, steve.dower, tim.golden, vidartf, zach.ware
priority: normal
severity: normal
status: open
title: Add non-elevated symlink support for dev mode Windows 10
type: enhancement
versions: Python 3.6, Python 3.7
Added file: https://bugs.python.org/file47150/devsymlink.patch

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com