From 32ef91adcb241e1fe6f032174f30e4eb5596ce9b Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Sat, 27 Jun 2026 18:05:20 +1000 Subject: [PATCH] docs: record the recent security hardenings in NEWS.md and SECURITY.md NEWS.md: extend the robustness-hardening section with the second-pass source audit (hashtable/flist size-computation integer overflows, non-positive MSG_IO_TIMEOUT reject, async-signal-safe SIGUSR2 handler) and the source-side xattr/ACL metadata read confinement plus the fake-super cross-tree metadata-apply fd-pin. SECURITY.md: note in the operator-directory residual writeup that the cross-tree metadata apply on a --temp-dir/--backup-dir leaf is fd-pinned the same way the reads now are, including under --fake-super (previously am_root >= 0 only). --- NEWS.md | 13 +++++++++++++ SECURITY.md | 9 ++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/NEWS.md b/NEWS.md index 43095040..3daab0f7 100644 --- a/NEWS.md +++ b/NEWS.md @@ -174,6 +174,19 @@ are length-bounded; peer-requested xattr expansion is capped; and rsync-ssl in stunnel mode now requires certificate verification unless an explicit insecure opt-out is set. +A second-pass source audit (reported by Leonid Bugaev) hardened several memory- +safety and robustness paths: the hashtable and file-list size computations are +guarded against a 32-bit integer overflow that a peer's entry count could +otherwise wrap into an under-allocation; a non-positive `MSG_IO_TIMEOUT` from the +peer is rejected rather than disabling the receiver's own I/O timeout; and the +`SIGUSR2` handler is now async-signal-safe (it only sets a flag, deferring the +summary/close-out work to safe poll points). Separately, the xattr/ACL metadata +copy now reads the *source* through a held no-follow fd as well as writing the +destination through one -- closing a parent-symlink race on the `--copy-dest` and +backup source -- and the cross-tree operator-path metadata apply is now fd-pinned +under `--fake-super` too (previously it fell back to a path-based set for a +`fake super = yes` daemon staging through an absolute `--temp-dir`/`--backup-dir`). + ### BEHAVIOR CHANGES: - A non-daemon receiver follows an operator-named symlinked destination directory diff --git a/SECURITY.md b/SECURITY.md index eb57ff2f..5bd0a23a 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -400,7 +400,14 @@ The following are documented as out of scope for this release: `copy_file()`/`copy_xattrs()` source read goes through the held basis content fd (`sys_fgetxattr`), and `make_backup()` reads the backed-up file's ACL/xattrs through a `backup_source_fd()`-pinned fd -- so a parent-component flip can no - longer redirect them to disclose an out-of-module value. Two narrow follow-ons + longer redirect them to disclose an out-of-module value. The cross-tree + metadata *apply* on those leaves (the `%stat`/ACL/xattr write on a + `--temp-dir`/`--backup-dir` staging file) is fd-pinned the same way, now + including under `--fake-super`: the `set_file_attrs()` no-follow leaf fd was + previously opened only when `am_root >= 0`, so a `fake super = yes` daemon fell + back to a path-based `sys_lsetxattr()`/chmod a raced parent could redirect; the + pin is now opened for fake-super too (a raced leaf is refused, not redirected). + Two narrow follow-ons re-resolve the (now-validated) operator path by name and remain a *post-validation* parent-component race: * the in-place backup (`--inplace --backup`) writes the backup file's data