Andrew Tridgell 27be267ee3 testsuite: regression tests for the temp-dir injection and copy-dest read-leak ...

Pin the two cross-uid operator-path races fixed in "confine the remaining
cross-tree operator-path syscalls" and "copy_file: confine an absolute operator
source ...":

  temp-dir-symlink-injection  absolute --temp-dir rename pulls an attacker's
                              out-of-tree file into the destination (do_rename_at
                              absolute-side confinement)
  copy-dest-symlink-readleak  --copy-dest basis read follows a flipped foreign
                              parent symlink, leaking out-of-tree content into
                              the destination (copy_file source confinement, KI-46)

Both root+nobody gated (the cross-uid plant needs root), RED on stock 3.4.x and
under --insecure-links, GREEN on the fix; cygwin runs make check non-root so
they skip there (added to its RSYNC_EXPECT_SKIPPED).

2026-07-20 14:05:32 +10:00

..

workflows

testsuite: regression tests for the temp-dir injection and copy-dest read-leak

2026-07-20 14:05:32 +10:00

FUNDING.yml

fix funding github username

2026-06-15 13:58:46 +10:00