Andrew Tridgell 0f84b4a776 testsuite: regression test for the --backup-dir trust-laundering race ...

Pins the fix in "backup: confine cross-tree operator-path metadata via a pinned
fd".  A root operator runs `rsync -a -b --backup-dir=<abs> ...` while a non-root
attacker flips a backup parent component between a real dir and a foreign-owned
symlink -> outside; pre-fix, rsync's own backup-dir attribute mirroring lchowns
the planted symlink to root, laundering it into a trusted symlink the owner-walk
then follows, so the backup escapes the tree.

Root+nobody gated (cross-uid plant needs root); RED on stock 3.2.7 and under
--insecure-links, GREEN on the fix.  Uses the compiled flipper for a reliable
RED oracle.  cygwin runs make check non-root so the test skips there -- add it to
that workflow's RSYNC_EXPECT_SKIPPED; the root workflows (almalinux-8 container,
sudo ubuntu/macos) run it for real.

2026-07-20 14:05:31 +10:00

..

workflows

testsuite: regression test for the --backup-dir trust-laundering race

2026-07-20 14:05:31 +10:00

FUNDING.yml

fix funding github username

2026-06-15 13:58:46 +10:00