Add a new daemon security option: "munge symlinks".

[rsync/rsync.git] / clientserver.c

diff --git a/clientserver.c b/clientserver.c
index 8cbde16..cb17438 100644 (file)
--- a/clientserver.c
+++ b/clientserver.c
@@ -23,6 +23,7 @@
 #include "ifuncs.h"
 
 extern int verbose;
+extern int dry_run;
 extern int output_motd;
 extern int list_only;
 extern int am_sender;
@@ -39,6 +40,7 @@ extern int remote_protocol;
 extern int protocol_version;
 extern int io_timeout;
 extern int no_detach;
+extern int write_batch;
 extern int default_af_hint;
 extern int logfile_format_has_i;
 extern int logfile_format_has_o_or_i;
@@ -56,6 +58,7 @@ extern char curr_dir[];
 char *auth_user;
 int read_only = 0;
 int module_id = -1;
+int munge_symlinks = 0;
 struct chmod_mode_struct *daemon_chmod_modes;
 
 /* module_dirlen is the length of the module_dir string when in daemon
@@ -622,6 +625,18 @@ static int rsync_module(int f_in, int f_out, int i, char *addr, char *host)
                sanitize_paths = 1;
        }
 
+       if ((munge_symlinks = lp_munge_symlinks(i)) < 0)
+               munge_symlinks = !use_chroot;
+       if (munge_symlinks) {
+               STRUCT_STAT st;
+               if (stat(SYMLINK_PREFIX, &st) == 0 && S_ISDIR(st.st_mode)) {
+                       rprintf(FLOG, "Symlink munging is unsupported when a %s directory exists.\n",
+                               SYMLINK_PREFIX);
+                       io_printf(f_out, "@ERROR: daemon security issue -- contact admin\n", name);
+                       exit_cleanup(RERR_UNSUPPORTED);
+               }
+       }
+
        if (am_root) {
                /* XXXX: You could argue that if the daemon is started
                 * by a non-root user and they explicitly specify a
@@ -681,6 +696,8 @@ static int rsync_module(int f_in, int f_out, int i, char *addr, char *host)
        am_server = 1; /* Don't let someone try to be tricky. */
        if (lp_ignore_errors(module_id))
                ignore_errors = 1;
+       if (write_batch < 0)
+               dry_run = 1;
 
        if (lp_fake_super(i))
                am_root = -1;