Rsync-daemon security advisories for writable daemons

[Paul Slootman]

On Tue 27 Nov 2007, Wayne Davison wrote:
> 
> Starting with the 3.0.0-pre6 release, there will be a new daemon option
> available: "munge symlinks".  This will allow an rsync daemon to accept
> symlinks and return them intact (with even a leading slash still there,
> which is new for a non-chroot daemon), but will not allow the symlinks
> to be used while they are in the daemon's hierarchy.  For those running
> 2.6.9, there is a patch to enable this option:
> 
>     http://rsync.samba.org/ftp/rsync/munge-symlinks-2.6.9.diff

It seems that people running the Debian 2.6.9-5.1 version which has this
patch applied. are running into problems where rsync wants to set
permissions on symlinks. The bug report and extra info is at
http://bugs.debian.org/455194 .  I can't dig into this until tomorrow,
so if someone wants to have a look in the meantime...


Paul Slootman