mirror of
https://github.com/RsyncProject/rsync.git
synced 2026-09-15 14:51:20 -04:00
Andrew Tridgell
ca9f33f231
The earlier copy-unsafe-links denial left the rrsync wrapper short of the 3.5.0 restricted-dir hardening, so a daemon-side rrsync still followed a symlinked --log-file, created device/special files, and had a realpath-vs-exec TOCTOU. Replace support/rrsync with the fully-hardened 3.5.0 wrapper (version-agnostic; verified functional with this rsync): - safe_open_logfile(): open the log file O_NOFOLLOW + S_ISREG + inode re-check so a planted symlink/special is refused; - force --no-D in a restricted (non-"/") dir so `rsync -a` strips device/ special semantics instead of creating them; - inode-pin each realpath-validated arg via O_PATH + /proc/self/fd/N (where available) so the exec'd rsync can't be race-flipped after the check; fall through unpinned where /proc/self/fd is unavailable. Tests: rrsync-logfile-symlink, rrsync-specials-denied, rrsync-symlink, rrsync-copy-unsafe-links-denied, rrsync-archive-mode.