A symlink basically is a special file containing the path to the symlink target. So if you restrict access to the symlink itself to root
you prevent all other users from reading the content of the symlink, which results in a "permission denied" error when ls
tries to read the symlink to identify the target.
To prevent ls
from following the symlink (reading its content), use ls -P
.
You can still remove the symlink (or actually any file not owned/accessible by yourself) as long as you have write access to the directory the symlink is in. A directory is basically an index, you can add/remove entries from it even without having access to the content of these entries.