3c55673deb
Resolves: RHEL-70209 - --safe-links option bypass leads to path traversal Resolves: RHEL-72502 - Race Condition in rsync Handling Symbolic Links Resolves: RHEL-70157 - Info Leak via Uninitialized Stack Contents
142 lines
3.9 KiB
Diff
142 lines
3.9 KiB
Diff
diff --git a/checksum.c b/checksum.c
|
|
index cb21882..66e8089 100644
|
|
--- a/checksum.c
|
|
+++ b/checksum.c
|
|
@@ -406,7 +406,7 @@ void file_checksum(const char *fname, const STRUCT_STAT *st_p, char *sum)
|
|
|
|
memset(sum, 0, MAX_DIGEST_LEN);
|
|
|
|
- fd = do_open(fname, O_RDONLY, 0);
|
|
+ fd = do_open_checklinks(fname);
|
|
if (fd == -1)
|
|
return;
|
|
|
|
diff --git a/generator.c b/generator.c
|
|
index 110db28..3f13bb9 100644
|
|
--- a/generator.c
|
|
+++ b/generator.c
|
|
@@ -1867,7 +1867,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
|
|
}
|
|
|
|
/* open the file */
|
|
- if ((fd = do_open(fnamecmp, O_RDONLY, 0)) < 0) {
|
|
+ if ((fd = do_open_checklinks(fnamecmp)) < 0) {
|
|
rsyserr(FERROR, errno, "failed to open %s, continuing",
|
|
full_fname(fnamecmp));
|
|
pretend_missing:
|
|
diff --git a/receiver.c b/receiver.c
|
|
index 8031b8f..edfbb21 100644
|
|
--- a/receiver.c
|
|
+++ b/receiver.c
|
|
@@ -775,7 +775,7 @@ int recv_files(int f_in, int f_out, char *local_name)
|
|
if (fd1 == -1 && protocol_version < 29) {
|
|
if (fnamecmp != fname) {
|
|
fnamecmp = fname;
|
|
- fd1 = do_open(fnamecmp, O_RDONLY, 0);
|
|
+ fd1 = do_open_nofollow(fnamecmp, O_RDONLY);
|
|
}
|
|
|
|
if (fd1 == -1 && basis_dir[0]) {
|
|
diff --git a/sender.c b/sender.c
|
|
index 2bbff2f..a4d46c3 100644
|
|
--- a/sender.c
|
|
+++ b/sender.c
|
|
@@ -350,7 +350,7 @@ void send_files(int f_in, int f_out)
|
|
exit_cleanup(RERR_PROTOCOL);
|
|
}
|
|
|
|
- fd = do_open(fname, O_RDONLY, 0);
|
|
+ fd = do_open_checklinks(fname);
|
|
if (fd == -1) {
|
|
if (errno == ENOENT) {
|
|
enum logcode c = am_daemon
|
|
diff --git a/syscall.c b/syscall.c
|
|
index 47c5ea5..c55ae5f 100644
|
|
--- a/syscall.c
|
|
+++ b/syscall.c
|
|
@@ -45,6 +45,8 @@ extern int preallocate_files;
|
|
extern int preallocate_files;
|
|
extern int preserve_perms;
|
|
extern int preserve_executability;
|
|
+extern int copy_links;
|
|
+extern int copy_unsafe_links;
|
|
|
|
#ifndef S_BLKSIZE
|
|
# if defined hpux || defined __hpux__ || defined __hpux
|
|
@@ -575,3 +575,21 @@ int do_open_nofollow(const char *pathname, int flags)
|
|
|
|
return fd;
|
|
}
|
|
+
|
|
+/*
|
|
+ varient of do_open/do_open_nofollow which does do_open() if the
|
|
+ copy_links or copy_unsafe_links options are set and does
|
|
+ do_open_nofollow() otherwise
|
|
+
|
|
+ This is used to prevent a race condition where an attacker could be
|
|
+ switching a file between being a symlink and being a normal file
|
|
+
|
|
+ The open is always done with O_RDONLY flags
|
|
+ */
|
|
+int do_open_checklinks(const char *pathname)
|
|
+{
|
|
+ if (copy_links || copy_unsafe_links) {
|
|
+ return do_open(pathname, O_RDONLY, 0);
|
|
+ }
|
|
+ return do_open_nofollow(pathname, O_RDONLY);
|
|
+}
|
|
diff --git a/t_unsafe.c b/t_unsafe.c
|
|
index 010cac5..e10619a 100644
|
|
--- a/t_unsafe.c
|
|
+++ b/t_unsafe.c
|
|
@@ -28,6 +28,9 @@ int am_root = 0;
|
|
int human_readable = 0;
|
|
int preserve_perms = 0;
|
|
int preserve_executability = 0;
|
|
+int copy_links = 0;
|
|
+int copy_unsafe_links = 0;
|
|
+
|
|
short info_levels[COUNT_INFO], debug_levels[COUNT_DEBUG];
|
|
|
|
int
|
|
diff --git a/tls.c b/tls.c
|
|
index e6b0708..858f8f1 100644
|
|
--- a/tls.c
|
|
+++ b/tls.c
|
|
@@ -49,6 +49,9 @@ int list_only = 0;
|
|
int preserve_executability = 0;
|
|
int preallocate_files = 0;
|
|
int inplace = 0;
|
|
+int safe_symlinks = 0;
|
|
+int copy_links = 0;
|
|
+int copy_unsafe_links = 0;
|
|
|
|
#ifdef SUPPORT_XATTRS
|
|
|
|
diff --git a/trimslash.c b/trimslash.c
|
|
index 1ec928c..f2774cd 100644
|
|
--- a/trimslash.c
|
|
+++ b/trimslash.c
|
|
@@ -26,6 +26,8 @@ int am_root = 0;
|
|
int preserve_executability = 0;
|
|
int preallocate_files = 0;
|
|
int inplace = 0;
|
|
+int copy_links = 0;
|
|
+int copy_unsafe_links = 0;
|
|
|
|
int
|
|
main(int argc, char **argv)
|
|
diff --git a/util.c b/util.c
|
|
index f260d39..d84bc41 100644
|
|
--- a/util.c
|
|
+++ b/util.c
|
|
@@ -365,7 +365,7 @@ int copy_file(const char *source, const char *dest, int tmpfilefd, mode_t mode)
|
|
int len; /* Number of bytes read into `buf'. */
|
|
OFF_T prealloc_len = 0, offset = 0;
|
|
|
|
- if ((ifd = do_open(source, O_RDONLY, 0)) < 0) {
|
|
+ if ((ifd = do_open_nofollow(source, O_RDONLY)) < 0) {
|
|
int save_errno = errno;
|
|
rsyserr(FERROR_XFER, errno, "open %s", full_fname(source));
|
|
errno = save_errno;
|