From a504944bb1db8abc14890061c442de2afa0deef8 Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Fri, 31 Jul 2026 15:05:40 +1000 Subject: [PATCH] rrsync: refuse a peer-selected --debug The --debug=FILTER traces print rule text and merge-file names that came out of a file's contents -- and a word-split per-dir merge (":w- FILE") turns every word of a file into a merge-file name, so the trace echoes what the syntax errors no longer do, with nothing failing to parse. Redacting every trace would mean carrying provenance on each rule, which a deferred ":" merge does not currently keep. For a restricted account the cheaper answer is to deny the peer the switch: server_options() only ever forwards --info, so no stock client sends --debug to a server and the only way it arrives is a deliberate -M--debug=. An operator debugging their own server is unaffected. Disabled rather than deleted from the table, because that table is generated by the cull-options script and a regeneration would put the line back; the test would then catch it. (cherry picked from commit 631f9bd46403415d2c4c62c624a61a7f7d67769f) --- support/rrsync | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/support/rrsync b/support/rrsync index 10a5a609..45404088 100755 --- a/support/rrsync +++ b/support/rrsync @@ -51,7 +51,7 @@ long_opts = { 'copy-devices': -1, 'copy-unsafe-links': 0, 'daemon': -1, - 'debug': 1, + 'debug': -1, 'delay-updates': 0, 'delete': 0, 'delete-after': 0,