mirror of
https://github.com/RsyncProject/rsync.git
synced 2026-09-13 05:38:57 -04:00
Andrew Tridgell
0f84b4a776
Pins the fix in "backup: confine cross-tree operator-path metadata via a pinned fd". A root operator runs `rsync -a -b --backup-dir=<abs> ...` while a non-root attacker flips a backup parent component between a real dir and a foreign-owned symlink -> outside; pre-fix, rsync's own backup-dir attribute mirroring lchowns the planted symlink to root, laundering it into a trusted symlink the owner-walk then follows, so the backup escapes the tree. Root+nobody gated (cross-uid plant needs root); RED on stock 3.2.7 and under --insecure-links, GREEN on the fix. Uses the compiled flipper for a reliable RED oracle. cygwin runs make check non-root so the test skips there -- add it to that workflow's RSYNC_EXPECT_SKIPPED; the root workflows (almalinux-8 container, sudo ubuntu/macos) run it for real.