feat: per-attribute preservation flags -p/-t/-o/-g with --no-* negations (protocol 2.22.0)

Split FastSync's single use_metadata bundle into four independent rsync-parity attributes: preserve_perms, preserve_times, preserve_owner, preserve_group. use_metadata is now a derived transport bit (config_derived_use_metadata).

CLI: real -p/--perms, -t/--times, -o/--owner, -g/--group plus --no-perms/--no-times/--no-owner/--no-group (short and long) and --no-preserve; -a is now rsync -rlptgoD; --preserve = -pt; -A implies -p; -X does not; --chmod implies -p; --usermap/--groupmap/--chown imply owner/group per side; --incremental/--delta still auto-preserve unless negated.

Receiver: per-attribute FileAttrPolicy gating for files, dirs (modes applied at end of transfer), symlinks and specials; rsync -E read-bit rule; new files get source_mode & ~umask sanitized (no group/other write); per-side identity resolution; deferred directory metadata; batch dir-metadata replay; daemon modules without 'client owner = yes' no longer refuse plain -a but force super off (no ownership) with a warning.

Wire: PROTOCOL_VERSION 2.21.0 -> 2.22.0 (four appended config bools, golden 653 / 95530566005420798). FileMetadata/chunk/batch framing unchanged. Docs/CHANGELOG/CMake updated to 2.22.0.

src/server/receiver.c

@@ -470,11 +470,12 @@ static bool receiver_save_file(File* file, void* context_pointer) {
   } else {
     result = file_save_to_disk_full(context->config->receive_root_directory, file, context->config);
   }
-  /* A directory's times are deferred, never applied inline: collect the
-     metadata now and apply it at the end.  -O/--omit-dir-times is honored by
-     dir_time_list_apply's caller (see receiver_send_success_frame). */
+  /* A directory's metadata is deferred, never applied inline: collect it now
+     and apply it at the end.  -O/--omit-dir-times and --preserve_perms/-times
+     are honored by dir_metadata_list_apply's caller (see
+     receiver_send_success_frame). */
   if (result != FILE_SAVE_ERROR && file->is_dir && file->metadata &&
-      dir_times_should_capture(context->config) &&
+      dir_metadata_should_capture(context->config) &&
       !dir_time_list_add(&context->dir_times, file->path, file->metadata)) {
     file_destroy(file);
     return false;
@@ -514,7 +515,8 @@ static bool receiver_send_success_frame(int fd, void* context_pointer) {
      phases have committed, so it is finally safe to stamp directory times.
      This runs after the deferred deletion because receiver_process commits it
      before calling this success frame. */
-  dir_time_list_apply(&context->dir_times, context->config->receive_root_directory);
+  dir_metadata_list_apply(&context->dir_times, context->config->receive_root_directory,
+                          context->config);
   return receiver_send_final_success(fd, context->config, &context->outcomes);
 }
 

src/server/receiver_pipeline.c

@@ -220,7 +220,7 @@ int write_thread(void* pipeline_context) {
        write would clobber them); accumulate the metadata here and let the
        caller apply it once every writer has drained. */
     if (!dry_run && result != FILE_SAVE_ERROR && file->is_dir && file->metadata &&
-        dir_times_should_capture(context->config) &&
+        dir_metadata_should_capture(context->config) &&
         !dir_time_list_add(&context->dir_times, file->path, file->metadata)) {
       file_destroy(file);
       pipeline_context_receiver_note_bytes_released(context, file_bytes);

src/server/server.c

@@ -389,8 +389,12 @@ static const char* module_gate_check_ownership(const Config* config, const Daemo
                                                ModuleGateContext* gate_ctx) {
   if (module->client_owner)
     return NULL;
-  /* Ownership: refuse the whole transfer up front (a clear failure). */
-  if (identity_ownership_requested(config)) {
+  /* Ownership: refuse the whole transfer up front (a clear failure) for a
+   * client-CHOSEN owner/group request.  A plain -o/-g/-a preserve-source
+   * request is deliberately not in this narrow set: it falls through to the
+   * super-mode override below, which forces all ownership activity off for this
+   * connection so no chown happens (the transfer itself still succeeds). */
+  if (identity_explicit_ownership_requested(config)) {
     log_message(LOG_LEVEL_ERROR,
                 "daemon module '%s' refuses client-chosen ownership/super-user activities "
                 "(no `client owner = yes` opt-in); refusing",
@@ -737,6 +741,14 @@ void handler(int file_descriptor) {
    * received config. */
   if (gate_ctx.super_mode_override != -1)
     config->super_mode = (SuperMode)gate_ctx.super_mode_override;
+  /* If the client requested ownership but the effective super mode forbids it
+   * (operator --no-super, a privileged standalone receiver's secure default, or
+   * a daemon module without `client owner = yes`), say so ONCE per connection so
+   * a successful -a/-o/-g transfer is not mistaken for preserved ownership. */
+  if (config->super_mode == SUPER_MODE_OFF && identity_ownership_requested(config))
+    log_message(LOG_LEVEL_WARNING,
+                "requested ownership will NOT be applied: super-user activities are disabled "
+                "for this connection (operator veto, or module without `client owner = yes`)");
   protocol_set_8_bit_output(config->eight_bit_output);
   /* Server-side per-message protocol deadline for every frame from here on.
    * `timeout` is not serialized, so this is the server's own config (the server
@@ -959,7 +971,7 @@ void handler(int file_descriptor) {
          to stamp directory times; a directory's mtime must not be clobbered by
          its children or by an extra removal. */
       if (transfer_ok)
-        dir_time_list_apply(&context->dir_times, config->receive_root_directory);
+        dir_metadata_list_apply(&context->dir_times, config->receive_root_directory, config);
     }
     if (transfer_ok) {
       if (!receiver_send_final_success(file_descriptor, config, &context->outcomes))
@@ -1127,10 +1139,18 @@ static bool daemonize(void) {
   if (chdir("/") != 0)
     log_message(LOG_LEVEL_WARNING, "daemon: chdir to / failed: %s", strerror(errno));
   umask(0);
+  /* Refresh the cached umask: main() captured the launch umask before this
+   * (single-threaded) umask(0), and file_mode_base() must see the daemon's
+   * actual umask. */
+  file_umask_capture();
   return true;
 }
 
 int main(int argc, char* argv[]) {
+  /* Capture the process umask now, while still single-threaded: the cached
+   * value is what file_mode_base() uses, and reading it later would race with
+   * receiver threads creating files. */
+  file_umask_capture();
   ServerCliOptions opts;
   char cli_err[512];
   int parse_result = server_cli_parse(argc, argv, &opts, cli_err, sizeof(cli_err));