A program for synchronizing files over a network
cc69bbdd82
Backport upstream patches to fix CVE-2026-29518, a TOCTOU race condition in rsync daemon configured with "use chroot = no". A local attacker with write access to a module could replace a parent directory component with a symlink between the receiver's path validation and file open, allowing reads and writes outside the module boundary. The fix adds secure_relative_open() which walks parent components under RESOLVE_BENEATH (Linux 5.6+) or equivalent, anchored at a trusted directory fd. Includes a build fix adding missing includes for openat2 and syscall headers. CVE: CVE-2026-29518 Upstream patches: - https://github.com/RsyncProject/rsync/commit/1a5ad81a.patch - https://github.com/RsyncProject/rsync/commit/99b36291.patch - https://github.com/RsyncProject/rsync/commit/24852cda.patch - https://github.com/RsyncProject/rsync/commit/d22b6bc7.patch - https://github.com/RsyncProject/rsync/commit/39b3074a.patch - https://github.com/RsyncProject/rsync/commit/a277a06b.patch - https://github.com/RsyncProject/rsync/commit/7c8a647c.patch Adding a couple of patches commited after the fix for the CVE. The CVE fixes introduced a couple of regressions: - https://github.com/RsyncProject/rsync/commit/f6b39cca - https://github.com/RsyncProject/rsync/commit/5ce33659 - https://github.com/RsyncProject/rsync/commit/3526884f - https://github.com/RsyncProject/rsync/commit/7192db98 Resolves: RHEL-174953 |
||
|---|---|---|
| .fmf | ||
| .gitignore | ||
| ci.fmf | ||
| gating.yaml | ||
| Makefile | ||
| plans.fmf | ||
| rpminspect.yaml | ||
| rsync-3.0.6-iconv-logging.patch | ||
| rsync-3.2.2-runtests.patch | ||
| rsync-3.2.3-filtering-rules.patch | ||
| rsync-3.2.5-cve-2024-12085.patch | ||
| rsync-3.2.5-cve-2024-12086.patch | ||
| rsync-3.2.5-cve-2024-12087.patch | ||
| rsync-3.2.5-cve-2024-12088.patch | ||
| rsync-3.2.5-cve-2024-12747.patch | ||
| rsync-3.2.5-cve-2025-10158.patch | ||
| rsync-3.2.5-cve-2026-41035.patch | ||
| rsync-3.2.5-default-compression.patch | ||
| rsync-3.2.5-fix-cve-2026-29518-regressions.patch | ||
| rsync-3.2.5-fix-cve-2026-29518.patch | ||
| rsync-3.2.5-rrsync-man.patch | ||
| rsync-3.2.5-ssh-askpass.patch | ||
| rsync-man.patch | ||
| rsync-noatime.patch | ||
| rsync.spec | ||
| rsyncd.conf | ||
| rsyncd.service | ||
| rsyncd.socket | ||
| rsyncd.sysconfig | ||
| rsyncd@.service | ||
| sources | ||