Document sec-patches4

NEWS.md

@@ -1,4 +1,31 @@
-# NEWS for rsync 3.4.1 SECURITY UPDATE (UNRELEASED)
+# NEWS for rsync 3.4.1-sec-patches4 (UNRELEASED)
+
+This update corrects regressions and edge cases in the path-confinement
+hardening published in `3.4.1-sec-patches3`. It contains no new features or
+protocol changes and is validated against the current security regression
+suite.
+
+## Corrections in this patch set:
+- Directory authority fds use search-only opens where supported, restoring
+  traversal through directories that are searchable but not readable.
+- Operator paths correctly handle `/dev/stdin`, `/dev/stdout`, `/dev/stderr`,
+  `/dev/fd/N`, process-substitution pipes and user-namespace fd pins without
+  weakening `--confine-root`.
+- FIFO and process-substitution input works again with `--read-batch`.
+- `--max-alloc=0` again means the largest limit supported by each peer while
+  retaining the hardened parser ceiling.
+- Restricted `rrsync` paths rooted at `/` are resolved beneath the configured
+  restricted directory rather than rejected or duplicated.
+- Local and remote-shell `--files-from` paths no longer receive the daemon's
+  module-boundary treatment. Daemon-controlled paths remain confined.
+- Explicit sender roots may traverse trusted-owned ancestor symlinks while
+  recursive scans and file leaves remain confined and race-resistant.
+- Alternate-destination leaves no longer follow symlinks and forged
+  partial-directory state cannot enable in-place output.
+- Untrusted-owner symlink refusals now include an actionable diagnostic.
+
+------------------------------------------------------------------------------
+# NEWS for rsync 3.4.1-sec-patches3
 
 This is a security-only update to the 3.4.1 maintenance release.  It backports
 the path-handling and daemon-protocol security fixes from the 3.5.0 audit onto

rsync.1.md

@@ -1333,10 +1333,12 @@ expand it.
 
 0.  `--confine-root=DIR`
 
-    This bounds where the paths listed under [`--insecure-links`](#opt) are
-    allowed to resolve: one that ends up outside DIR is refused, even if every
-    symlink along it was owned by a trusted user.  The ownership walk asks who
-    planted a link; this asks where the path came out.
+    In the default symlink mode this bounds where operator option paths and
+    paths selected from a [`--files-from`](#opt) list are allowed to resolve:
+    one that ends up outside DIR is refused, even if every symlink along it was
+    owned by a trusted user. Explicit source roots remain operator-selected
+    transfer roots. The ownership walk asks who planted a link; this asks where
+    the path came out.
 
     DIR must be absolute.  Nothing is confined by default, and
     `--confine-root=/` is a no-op.
@@ -2251,8 +2253,12 @@ expand it.
     See the [`--max-size`](#opt) option for a description of how SIZE can be
     specified.  The default suffix if none is given is bytes.
 
-    Beginning in 3.2.7, a value of 0 is an easy way to specify SIZE_MAX (the
-    largest limit possible).
+    A value of 0 means the largest limit this build supports. It resolves to
+    the same ceiling an explicit SIZE is checked against, so it cannot select
+    a limit higher than one that could be written explicitly. The literal 0 is
+    passed to the remote rsync, allowing each peer to resolve it for its own
+    word size. A daemon administrator can refuse all client-supplied values,
+    including 0, with `refuse options = max-alloc`.
 
     You can set a default value using the environment variable
     [`RSYNC_MAX_ALLOC`](#) using the same SIZE values as supported by this

testsuite/skiplist/backport.txt

@@ -25,6 +25,11 @@ daemon-refuse-compress-threads-alias    # --compress-threads arrived in 3.4.2
 daemon-zstd-thread-exhaustion           # --compress-threads arrived in 3.4.2
 partial_nowrite                         # receiver chmod-on-denied-open (3.5.0)
 partial-protected-regular-retry-policy  # EACCES recovery path (3.5.0, macOS-only test)
+contimeout-rsh                          # daemon-over-rsh timeout support (3.5.1)
+daemon-stdin-local-socket               # local-socket inetd detection (3.5.1)
+install-strip                           # configurable install-strip tool (3.5.1)
+rsync-ssl-type-option                   # flexible rsync-ssl --type placement (3.5.1)
+write-touched-blocks                    # protocol-33 logical-block statistics (3.5.1)
 
 # The suite's per-platform skip lists describe the tests IT ships, so they do
 # not describe a build of this branch.