<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Indeed, we have “use chroot = false” – our application is a file distribution system where users authenticate as themselves and run rsync daemonized over ssh transport, rrsync-style. We can’t run with “use chroot = true” as a workaround
since the users are not root, and the chroot() system call failing is fatal for the rsync server process.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It’s our intention to let them access the entire host filesystem according to filesystem permissions alone. And that worked fine until someone observed that his links from his home directory into ../../../../../etc were being sanitized.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I had a poke at the overall logic and ended up pondering the same fix it sounds like you’re settling on, but I wasn’t confident of my analysis so I went for the shortest patch that I was
<i>sure </i>impacted only my use case.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thor<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Wayne Davison <wayne@opencoder.net> <br>
<b>Sent:</b> Tuesday, September 20, 2022 1:11 AM<br>
<b>To:</b> Thor Simon <Thor.Simon@twosigma.com><br>
<b>Cc:</b> rsync@lists.samba.org<br>
<b>Subject:</b> Re: Patch: disable path sanitization for modules rooted at "/"<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Wed, Sep 7, 2022 at 6:25 AM Thor Simon wrote:<o:p></o:p></p>
</div>
<div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">When running in daemon mode with a module rooted at “/” [...] it seems to me that path sanitization is not useful in this case.<o:p></o:p></p>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">In a typical Linux install, the default of "use chroot = true" already results in sanitize_paths = 0 for a path "/' module, so you must have "use chroot = false" set in your config file. The test you added is already a part of the prior
"if" since module_dirlen is 0 when the module_dir is "/".<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thus, the weird part is why the code thinks that we need to force sanitation on for all use-chroot=off cases (especially when a chroot("/") doesn't accomplish anything extra for a "/" path). In looking at the various module configuration
possibilities, if we're not chrooted and not serving "/", then a check of just module_dirlen is sufficient to get sanitation enabled. If we are chrooted and we have an inner module_dirlen, that also triggers the sanitization. So it seems to me that the earlier
check can be changed to be just "if (module_dirlen)". I'll probably make that change after a bit more contemplation.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">..wayne..<o:p></o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>