mirror of
https://github.com/RsyncProject/rsync.git
synced 2026-09-14 14:18:23 -04:00
Andrew TridgellandOmar Elsayed
4705b6fb92
The TOCTOU / symlink-race suite for the secure resolver and operator-supplied paths: chdir/chmod/rename/mknod/source/dest symlink races, relative make_path and symlinked-parent cases, the operator-path matrix (--temp/partial/backup-dir, alt-dest basis, files-from, log-file, insecure-links), and the admin-file opens (--password-file / daemon secrets / config / log-file / early-input symlinks), plus the daemon module-confinement and chroot inner-module cases. Co-authored-by: Omar Elsayed <omarelsayed161@gmail.com>
34 lines
1.3 KiB
Python
34 lines
1.3 KiB
Python
#!/usr/bin/env python3
|
|
# --backup-dir symlink policy matrix. An operator --backup-dir must follow a
|
|
# symlink only when owned by uid 0 or the euid, refusing an attacker's plant --
|
|
# absolute AND relative, leaf and parent, with --insecure-links as the local
|
|
# opt-out. See run_symlink_matrix() in rsyncfns. RED on this branch: absolute
|
|
# cross-uid follows the attacker symlink (escape); relative refuses even the
|
|
# operator's own symlink (diverges from the uniform policy).
|
|
|
|
import subprocess
|
|
|
|
from rsyncfns import rsync_argv, run_symlink_matrix, plant_operator_symlink
|
|
|
|
NFILES = 6
|
|
|
|
|
|
def case(ctx):
|
|
src = ctx.base / 'src'
|
|
dest = ctx.base / 'dest'
|
|
src.mkdir()
|
|
dest.mkdir()
|
|
for i in range(NFILES):
|
|
(src / f'f{i}').write_text("NEW-PUSHED-CONTENT\n") # distinct -> overwrite -> backup
|
|
(dest / f'f{i}').write_text("OLD\n")
|
|
opt, _escape = plant_operator_symlink(ctx, dest) # rel --backup-dir anchors at dest
|
|
extra = ['--insecure-links'] if ctx.insecure else []
|
|
subprocess.run(
|
|
rsync_argv('-a', '--backup', f'--backup-dir={opt}', *extra, 'src/', 'dest/'),
|
|
cwd=str(ctx.base), stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
|
|
return any(p.is_file() for p in ctx.outside.rglob('*')) # backup escaped?
|
|
|
|
|
|
run_symlink_matrix('--backup-dir', case)
|
|
print("--backup-dir symlink policy matrix: enforced")
|