Re: Rsync-daemon security advisories for writable daemons

2007-12-16 Thread Wayne Davison
On Mon, Dec 10, 2007 at 04:30:55PM -0500, Matt McCutchen wrote: The current development rsync ignores all errors, but errors other than ENOSYS might be significant. Yeah, good idea. I've changed the dev version to only ignore ENOSYS. ..wayne.. -- To unsubscribe or change options:

Re: Bug#455194: Rsync-daemon security advisories for writable daemons

2007-12-11 Thread Paul Slootman
On Mon 10 Dec 2007, Matt McCutchen wrote: On Mon, 2007-12-10 at 21:20 +0100, Paul Slootman wrote: It seems that people running the Debian 2.6.9-5.1 version which has this patch applied. are running into problems where rsync wants to set permissions on symlinks. In the report rsync seems

Re: Rsync-daemon security advisories for writable daemons

2007-12-10 Thread Paul Slootman
On Tue 27 Nov 2007, Wayne Davison wrote: Starting with the 3.0.0-pre6 release, there will be a new daemon option available: munge symlinks. This will allow an rsync daemon to accept symlinks and return them intact (with even a leading slash still there, which is new for a non-chroot

Re: Rsync-daemon security advisories for writable daemons

2007-12-10 Thread Matt McCutchen
On Mon, 2007-12-10 at 21:20 +0100, Paul Slootman wrote: It seems that people running the Debian 2.6.9-5.1 version which has this patch applied. are running into problems where rsync wants to set permissions on symlinks. In the report rsync seems to want to set mtimes, not permissions. The

Re: Rsync-daemon security advisories for writable daemons

2007-12-10 Thread Olivier Thauvin
Le lundi 10 décembre 2007, Matt McCutchen a écrit : On Mon, 2007-12-10 at 21:20 +0100, Paul Slootman wrote: It seems that people running the Debian 2.6.9-5.1 version which has this patch applied. are running into problems where rsync wants to set permissions on symlinks. In the report

Re: Rsync-daemon security advisories for writable daemons

2007-12-10 Thread Matt McCutchen
On Mon, 2007-12-10 at 22:20 +0100, Olivier Thauvin wrote: I don't how to really fix into rsync, except checking uname to get the running kernel's version. It would seem much more direct to simply attempt the lutimes and ignore an error of ENOSYS (Function not implemented). I don't think it's

Rsync-daemon security advisories for writable daemons

2007-11-27 Thread Wayne Davison
There are two security advisories for people who run a writable rsync daemon. One affects only those with use chroot = no (which is not a very safe combination in general), and one affects a daemon that has daemon-excluded files that are being hidden in a module's hierarchy. Included are simple