rrsync: keep remote files-from out of write-only mode

Browse Source

Write-only mode rejects ordinary downloads, but a remote --files-from
makes the receiving child open a server-side file and send it back over
the upload protocol.  Reject server-local --files-from paths under -wo,
keeping the exact "-" sentinel that a client-local files-from upload
sends.

The control now uploads a second, unlisted source file and requires it
NOT to arrive.  With a single file present an ordinary recursive upload
looks identical, so the control passed whether or not the list selected
anything.

The wrapper is handed a shim rather than RSYNC directly: RSYNC is a
multi-word command whenever the runner forces --protocol=N, and rrsync
execlp()s its RSYNC as a single executable name, so this test died
before reaching the policy under test.  A fleet run caught it on the
protocol columns of three targets.

Known gap: this closes the argv route only.  A per-directory merge
filter delivered over the protocol still reads a file outside the
restricted directory and returns its content in an "Unknown filter rule"
error -- reproduced with a stock client against -wo.  rsync's existing
filter-file confinement does not apply because it is gated on am_daemon
and an rrsync server is not a daemon.  Tracked separately.

(cherry picked from commit 576ce422fe)

...

This commit is contained in:

500 Internal Server Error

Gitea Version: 1.28.0+dev-477-g8b6ad49a5f