Overview
Linux lets one file be reachable by more than one name through links. There are two kinds — hard links and symbolic (soft) links — and they behave differently in important ways. This lesson explains both and when each is used.
Learning objectives
- Distinguish hard links from symbolic links.
- Explain the role of the inode.
- Recognize practical and security implications of links.
Core concept
Every file's data is tracked by an inode (an internal structure holding the file's metadata and pointers to its data); a filename is just a directory entry pointing to an inode.
- Hard link — an additional directory entry pointing to the same inode. The file's data persists as long as at least one hard link remains; all hard links are equal references to the same data. Hard links generally cannot span filesystems or link directories.
- Symbolic (soft) link — a small special file that points to another path (a name), like a shortcut. If the target is moved or deleted, the symlink breaks (dangling). Symlinks can cross filesystems and point to directories.
How it works
Because a hard link references the inode directly, deleting one name does not remove the data while other hard links exist — the data is freed only when the last link is gone. A symbolic link, by contrast, stores a path to its target; accessing the symlink redirects to that path, and if the path no longer exists, the link is dangling. ls -l shows a symlink with an l type and an arrow (->) to its target; the command ln creates hard links, and ln -s creates symbolic links.
Practical example
$ ln -s /var/log/syslog ~/current-log
$ ls -l ~/current-log
lrwxrwxrwx 1 alice alice 16 Sep 21 10:00 current-log -> /var/log/syslog
Here ~/current-log is a symbolic link pointing to the system log, so reading it reads the log. If /var/log/syslog were removed, current-log would become a dangling link pointing at nothing.
Cybersecurity relevance
Links carry security implications. Symbolic links are involved in symlink attacks, where a program is tricked into following a link to a sensitive file it did not intend to touch (e.g. during careless handling of files in shared directories like /tmp). Understanding that a symlink is just a path pointer — and can point anywhere the creator chooses — is important when writing scripts or programs that handle files, and when investigating suspicious files on a system.
Common mistakes
- Confusing hard and symbolic links — hard links share an inode; symlinks store a path and can dangle.
- Assuming deleting a file frees its data when other hard links still reference the inode.
- Ignoring symlink risks when handling files in shared/world-writable directories.
Key takeaways
- A filename points to an inode; a hard link is another name for the same inode, while a symbolic link is a pointer to a path (like a shortcut).
- Hard links keep data alive until the last link is removed and usually can't cross filesystems or link directories; symlinks can cross filesystems and break if their target disappears.
lnmakes hard links,ln -smakes symlinks; symlink behavior underlies certain attacks, so careful file handling matters.
Check your understanding
- What is the key difference between a hard link and a symbolic link in how they reference a file?
- Why does a symbolic link "break" if its target is deleted, while a hard link does not lose the data?