feat(xattr): carry and apply symlink xattrs (protocol 2.29.0)
This commit is contained in:
@@ -832,7 +832,7 @@ before the module list, before authentication, and the connecting peer address
|
||||
|
||||
## Protocol and Security
|
||||
|
||||
FastSync protocol version `2.28.0` is shared by the client and server. The
|
||||
FastSync protocol version `2.29.0` is shared by the client and server. The
|
||||
current protocol is sender-driven and includes configuration negotiation,
|
||||
including the maximum allocation limit, incremental checks, checksums,
|
||||
manifests, keep-alives, abort handling, per-file remove-source results, and
|
||||
|
||||
+2
-2
@@ -339,7 +339,7 @@ why plain `--append` works on the normal atomic path, not only with `--inplace`.
|
||||
| `-E`, `--executability` | Preserve executability | ✅ Parity | Preserves executable permission bits (implies metadata preservation) |
|
||||
| `--chmod=CHMOD` | Affect file permissions | ✅ Parity | Faithful port of rsync 3.4.1's `parse_chmod`/`tweak_mode`: numeric octal and symbolic `ugo`/`rwx` changes, `D`/`F` directory/file selectors, `X` (execute only on directories or already-executable files), `s`/`t` setuid/setgid/sticky, and append semantics — repeated clauses and repeated `--chmod` options accumulate in order (joined with commas). The changes are applied to the new mode **without sanitization** (matching rsync), except that setuid/setgid/sticky are masked when the connection forbids super-user activities (audit-cycle fix, see `-p`), and `--chmod` does **not** imply `-p` (rsync parity). Applied to files and directories on the receiver |
|
||||
| `-A`, `--acls` | Preserve ACLs | ✅ Parity | Implemented on Linux via the POSIX-ACL xattr representation: the sender captures the `system.posix_acl_access` / `system.posix_acl_default` xattrs and the receiver re-applies them fd-relative. A differential test with `setfacl` confirms the complete access and default ACL sets (including `mask`) are identical to rsync's on a directory. libacl is not required; a `fsetxattr` an unprivileged receiver may not perform is logged and skipped, never fatal. Only the `system.posix_acl_*` namespaces plus `user.*` are ever applied; privileged namespaces are never applied. Implies metadata transmission |
|
||||
| `-X`, `--xattrs` | Preserve extended attributes | ❌ Divergent | Deliberately restricted to unprivileged `user.*` extended attributes plus the two POSIX ACL xattrs; `security.*` (SELinux, capabilities, ...) and `trusted.*` are **never** captured or applied — a client can never force a privileged attribute onto the destination, and the receiver independently re-validates every incoming name against the whitelist. This is a security-policy divergence from rsync, which can preserve the privileged namespaces with the needed privilege; implementing them would defeat FastSync's privilege-escalation guard. `user.*` capture/apply matches rsync in a differential test. Payloads are bounded on both ends. Incompatible with `-s`. **Also divergent: symlink xattrs/ACLs are not captured or applied** — `-X`/`-A` with `-l` carries only the link's owner/times/mode, not its xattrs (the capture uses path-following `listxattr`/`getxattr`, so the link's own xattrs are never read, and the receiver's symlink write path applies no xattr block). Closing this needs a dedicated symlink-xattr wire block and a `PROTOCOL_VERSION` bump |
|
||||
| `-X`, `--xattrs` | Preserve extended attributes | ❌ Divergent | Deliberately restricted to unprivileged `user.*` extended attributes plus the two POSIX ACL xattrs; `security.*` (SELinux, capabilities, ...) and `trusted.*` are **never** captured or applied — a client can never force a privileged attribute onto the destination, and the receiver independently re-validates every incoming name against the whitelist. This is a security-policy divergence from rsync, which can preserve the privileged namespaces with the needed privilege; implementing them would defeat FastSync's privilege-escalation guard. `user.*` capture/apply matches rsync in a differential test. Payloads are bounded on both ends. Incompatible with `-s`. **Symlink xattrs are now carried (protocol 2.29.0):** a symlink entry appends the same bounded trailing xattr block to its `STATUS_SYMLINK` frame as every other entry kind, captured with `llistxattr`/`lgetxattr` so the link's OWN attributes are read and never the referent's, and re-applied no-follow with `lsetxattr` through the already-confined parent directory (`fsetxattr` cannot target a symlink: there is no `*at` xattr syscall and an `O_PATH` fd is rejected). On Linux the VFS refuses to associate xattrs with a symlink at all — every `lsetxattr` on a link fails with `EPERM` for `user.*`, `trusted.*` and `security.*`, even as root, verified in the CI container — so on FastSync's supported platforms the captured block is always empty and the apply is a no-op; the wire block is present for correctness and for a filesystem/platform that does support symlink xattrs. rsync 3.4.1's `--fake-super` is not a counterexample: it stores a symlink as a regular file whose `user.rsync.%stat` records the `S_IFLNK` mode bits, not an xattr on a real symlink. The row stays divergent only for the never-preserved privileged namespaces above |
|
||||
| `-H`, `--hard-links` | Preserve hard links | ✅ Parity | Files on the source that share an inode (`st_dev`+`st_ino`, e.g. a `cp -al` tree) are re-created as hard links to one another on the destination, so duplicate links stay deduplicated and only the first member's data is sent (later members are transmitted as payload-less `STATUS_HARDLINK` frames). The receiver links each sibling to the first member's installed file with an atomic link + rename; on `link()` failure it falls back to a byte-identical local copy of the first member, never a partial/corrupt file. Requires the sequential scan for ordering (the first member is always emitted and installed before any sibling is linked). Works single-threaded and under `-j`/`--threads`, `--inplace`, `--delay-updates` (links staged and published by rename) and `--partial`. Crosses the wire (`preserve_hard_links` bool; `PROTOCOL_VERSION` bumped **2.11.0 → 2.12.0**, peers must match). Incompatible with `-s` (chunk serialization) and `--append`/`--append-verify`, rejected up front with a distinct error. See the Phase-4 hard-links notes below |
|
||||
| `-D` | Same as --devices --specials | ✅ Parity | Implies `--devices --specials`. `-D` was unassigned in FastSync (verified: no collision), so it is free to imply both device-node and special-file preservation. As of protocol 2.23.0 `--specials` genuinely covers **both FIFOs and unix sockets**, so `-D` covers the full rsync set. See the `--devices`/`--specials` rows and the Phase-4 devices notes below |
|
||||
| `--devices` | Preserve device files | ⚠️ Caveat | Recreates char/block device nodes with `mknodat` (type + rdev strictly validated, confined fd-relative below the receive root). A device whose `mknodat` fails with `EPERM`/`EACCES` (no `CAP_MKNOD`, or super-user activity forbidden) is a **per-entry failure**: FastSync logs `cannot create device ...` (rsync logs `mknod ... failed`), counts it, **continues with the remaining files**, and ends the run with a non-OK terminal status. rsync parity: rsync likewise continues and exits partial (23). Residuals: (1) FastSync's default AUTO still *attempts* the node on a non-root receiver and therefore reports the per-entry failure, whereas rsync without `--super` silently ignores `--devices` and skips the non-regular entry with exit 0 — use `--no-super` for rsync's silent-skip behavior; (2) FastSync's process exit code for a receiver-side per-entry failure is the general error code 1, not rsync's partial 23 (a client exit-code-mapping residual that applies to every receiver file error, not just this branch); (3) with `--remove-source-files`, the non-OK terminal status means successfully transferred sources are not removed on a partial run. `--specials` (FIFOs and unix sockets) keeps the unprivileged skip path and remains parity |
|
||||
@@ -964,7 +964,7 @@ These are the last compatibility items and the closing phase toward rsync flag p
|
||||
|
||||
**Wire:** two trailing config-frame blocks after the `--iconv` spec, in fixed order — `send_privilege_options`/`receive_privilege_options` (one `super_mode` int, validated `0..2`), then `send_copy_as_options`/`receive_copy_as_options` (presence int + two int32 ids, validated `>= 0`, with `copy_as_set ⇒ use_metadata`). `PROTOCOL_VERSION` bumped **2.17.0 → 2.18.0**. **Divergences from rsync:** rsync's `--super` elevates the receiver and `--copy-as` actually switches its credentials; FastSync never elevates and only permits/forwards confined attempts, and `--copy-as` forces ownership rather than switching identity.
|
||||
|
||||
**Honest status after the parity 2.29 cycle (protocol 2.28.0, no wire change), updated by the parity cycle 2.29 pass, the audit-cycle follow-ups, the triage cycle, and a later no-wire parity pass.** ✅ Parity 119 / ⚠️ Caveat 14 / ❌ Divergent 24 = 157 rows. The no-wire parity pass accepted `--inc-recursive`/`--no-inc-recursive` as inert no-ops (❌ → ✅, since FastSync's full scan is rsync's `--no-inc-recursive` and the destination is identical), narrowed the `--temp-dir` divergence by accepting an absolute path that canonicalizes inside the receive root (the row stays ❌ for out-of-root absolute paths), closed the `--delete-before` phase-0 divergence (⚠️ → ✅: both the single-threaded and the `--threads` data passes now replay the pre-scan file list, so a source file created after the scan is neither transferred nor kept, matching rsync), and moved `--fake-super` and `--devices` ❌ → ⚠️ (`--fake-super` now writes/reads rsync's exact `user.rsync.%stat` key and `<octal-mode> <rdev_major>,<rdev_minor> <uid>:<gid>` grammar, interoperating with real rsync 3.4.1 for regular files and faking char/block devices as regular files carrying the real rdev; `--devices` now logs a failed device `mknod` as a per-entry failure that continues the transfer instead of a silent non-root skip — see those rows for the remaining directory-faking and exit-code residuals). A review pass then hardened the fake-super stat parser (strict range-checked parsing), made rsync-style daemon modules read-only by default with a startup warning for accepted-but-unenforced access-control keys, and extended the `--delete-before` replay to the `--threads` path. The 2.29 cycle closed the scanner-order, delete-timing, relative-basis, and fuzzy-eligibility residuals (moving `-n`/`--delete`/`--del`/`--delete-delay` to ✅) and improved the `--info`/`--stats`/`--debug` partial rows; the triage cycle moved `-F` and `-i`/`--itemize-changes` ✅ → ⚠️ for their documented residuals. The remaining ⚠️ rows are `--info`, `--debug`, `--msgs2stderr`, `--stats`, `--progress`, `-i`, `--filter`, `-F`, the three basis-dir options, `-y/--fuzzy`, `--fake-super`, and `--devices`. Earlier: **Honest status after the parity 2.28.0 cycle (protocol 2.28.0), updated by the rsync-parity-stats, rsync-parity-options, rsync-parity-fs, parity-review, no-wire parity-track-1/2b and wire parity-track-4a/5a passes.** ✅ Parity 116 / ⚠️ Caveat 14 / ❌ Divergent 27 = 157 rows. Earlier revisions of this document reported "143 ✅ / 0 divergence / 0 partial"; that conflated "parsed and tested" with "rsync parity", because many rows carried documented behavioral differences and some short options were not parsed at all. This reclassification makes every difference explicit. The completion wave closed 23 previously-caveated rows (9 that triage showed were already parity, plus 14 genuine fixes) and turned the 17 inherently non-rsync rows — native daemon config/auth, the FastSync batch container, the safe-subset device/privilege flags, `-X`'s privileged namespaces, `--fake-super`'s native xattr format, and the `--old-args` no-op — into explicit ❌ divergences. The stats pass flipped `--delete-delay` to ✅ (actual-removal accounting), but the parity-review pass moved it back to ⚠️ because FastSync charged the `--max-delete` budget at plan/snapshot time and left a refilled snapshotted directory in place, whereas rsync charges on actual removals and recursively removes a queued directory (including content created after its plan). The no-wire parity-track-1 pass fixed both (actual-removal charging plus recursive deferred removal with an independent deferred-list cap), narrowing the caveat to the partial-delete ordering. The stats pass also reclassified `--out-format` to ❌ (protocol-specific `%b`/delta-`%c`), and sharpened the `--stats`/`--progress`/`--checksum-choice` residuals. The options pass flipped `--bwlimit` and `--ignore-errors` to ✅ (rsync-exact size parsing and ~100 ms leaky-bucket throttling, and rsync's skip-unreadable-subdir plus IO-error-suppressed deletion with exit 23) and emits rsync-format `--info=name/flist/del/remove/nonreg/progress` lines (real-run `deleting`/`*deleting` carried over a new trailing `report_deletes` wire bool, `PROTOCOL_VERSION` 2.26.0 → 2.27.0), while reclassifying `-M` over daemon/TCP
|
||||
**Honest status after the parity 2.29 cycle (protocol 2.29.0 since the symlink-xattr wire wave, which adds no config-frame field and leaves this matrix unchanged), updated by the parity cycle 2.29 pass, the audit-cycle follow-ups, the triage cycle, and a later no-wire parity pass.** ✅ Parity 119 / ⚠️ Caveat 14 / ❌ Divergent 24 = 157 rows. The no-wire parity pass accepted `--inc-recursive`/`--no-inc-recursive` as inert no-ops (❌ → ✅, since FastSync's full scan is rsync's `--no-inc-recursive` and the destination is identical), narrowed the `--temp-dir` divergence by accepting an absolute path that canonicalizes inside the receive root (the row stays ❌ for out-of-root absolute paths), closed the `--delete-before` phase-0 divergence (⚠️ → ✅: both the single-threaded and the `--threads` data passes now replay the pre-scan file list, so a source file created after the scan is neither transferred nor kept, matching rsync), and moved `--fake-super` and `--devices` ❌ → ⚠️ (`--fake-super` now writes/reads rsync's exact `user.rsync.%stat` key and `<octal-mode> <rdev_major>,<rdev_minor> <uid>:<gid>` grammar, interoperating with real rsync 3.4.1 for regular files and faking char/block devices as regular files carrying the real rdev; `--devices` now logs a failed device `mknod` as a per-entry failure that continues the transfer instead of a silent non-root skip — see those rows for the remaining directory-faking and exit-code residuals). A review pass then hardened the fake-super stat parser (strict range-checked parsing), made rsync-style daemon modules read-only by default with a startup warning for accepted-but-unenforced access-control keys, and extended the `--delete-before` replay to the `--threads` path. The 2.29 cycle closed the scanner-order, delete-timing, relative-basis, and fuzzy-eligibility residuals (moving `-n`/`--delete`/`--del`/`--delete-delay` to ✅) and improved the `--info`/`--stats`/`--debug` partial rows; the triage cycle moved `-F` and `-i`/`--itemize-changes` ✅ → ⚠️ for their documented residuals. The remaining ⚠️ rows are `--info`, `--debug`, `--msgs2stderr`, `--stats`, `--progress`, `-i`, `--filter`, `-F`, the three basis-dir options, `-y/--fuzzy`, `--fake-super`, and `--devices`. Earlier: **Honest status after the parity 2.28.0 cycle (protocol 2.28.0), updated by the rsync-parity-stats, rsync-parity-options, rsync-parity-fs, parity-review, no-wire parity-track-1/2b and wire parity-track-4a/5a passes.** ✅ Parity 116 / ⚠️ Caveat 14 / ❌ Divergent 27 = 157 rows. Earlier revisions of this document reported "143 ✅ / 0 divergence / 0 partial"; that conflated "parsed and tested" with "rsync parity", because many rows carried documented behavioral differences and some short options were not parsed at all. This reclassification makes every difference explicit. The completion wave closed 23 previously-caveated rows (9 that triage showed were already parity, plus 14 genuine fixes) and turned the 17 inherently non-rsync rows — native daemon config/auth, the FastSync batch container, the safe-subset device/privilege flags, `-X`'s privileged namespaces, `--fake-super`'s native xattr format, and the `--old-args` no-op — into explicit ❌ divergences. The stats pass flipped `--delete-delay` to ✅ (actual-removal accounting), but the parity-review pass moved it back to ⚠️ because FastSync charged the `--max-delete` budget at plan/snapshot time and left a refilled snapshotted directory in place, whereas rsync charges on actual removals and recursively removes a queued directory (including content created after its plan). The no-wire parity-track-1 pass fixed both (actual-removal charging plus recursive deferred removal with an independent deferred-list cap), narrowing the caveat to the partial-delete ordering. The stats pass also reclassified `--out-format` to ❌ (protocol-specific `%b`/delta-`%c`), and sharpened the `--stats`/`--progress`/`--checksum-choice` residuals. The options pass flipped `--bwlimit` and `--ignore-errors` to ✅ (rsync-exact size parsing and ~100 ms leaky-bucket throttling, and rsync's skip-unreadable-subdir plus IO-error-suppressed deletion with exit 23) and emits rsync-format `--info=name/flist/del/remove/nonreg/progress` lines (real-run `deleting`/`*deleting` carried over a new trailing `report_deletes` wire bool, `PROTOCOL_VERSION` 2.26.0 → 2.27.0), while reclassifying `-M` over daemon/TCP
|
||||
and receiver-side `protect`/`risk` re-derivation to ❌ (no argv channel /
|
||||
receiver filter engine); the wire parity-track-4a pass later added that
|
||||
receiver filter engine, flipping `--filter=RULE` back to ✅ (see above; the
|
||||
|
||||
@@ -654,7 +654,11 @@ static bool send_symlink_entry(const Client* client, File* file, const Config* c
|
||||
if (!send_status(fd, STATUS_SYMLINK) || !send_wire_str(fd, file_wire_path(file)) ||
|
||||
!send_wire_str(fd, file->symlink_target))
|
||||
return false;
|
||||
return !config->use_metadata || metadata_send(fd, file->metadata);
|
||||
if (config->use_metadata && !metadata_send(fd, file->metadata))
|
||||
return false;
|
||||
/* Symlink xattrs/ACLs (-X/-A) ride the same trailing block as regular files
|
||||
and directories when the xattr transport was negotiated. */
|
||||
return !config->use_xattrs || xattr_send(fd, file->xattrs);
|
||||
}
|
||||
|
||||
// Send a single file directly via sendfile (non-incremental path).
|
||||
|
||||
@@ -282,11 +282,15 @@ bool entry_passes_selection(const FileListSet* file_list, const FilterRuleList*
|
||||
}
|
||||
|
||||
/* Best-effort capture of the file's whitelisted xattrs (-X/-A). A failure to
|
||||
* read xattrs is non-fatal: the file is transferred without them. */
|
||||
* read xattrs is non-fatal: the file is transferred without them. A symlink
|
||||
* entry reads the LINK's own xattrs (never the referent's) with the no-follow
|
||||
* variant; on Linux the VFS refuses xattrs on symlinks, so that yields NULL. */
|
||||
void scanner_capture_xattrs(const DirectoryScanner* scanner, File* file) {
|
||||
if (!scanner || !file || !(scanner->options.preserve_xattrs || scanner->options.preserve_acls))
|
||||
return;
|
||||
file->xattrs = xattr_capture_path(file->path, scanner->options.preserve_acls);
|
||||
file->xattrs = file->is_symlink
|
||||
? xattr_capture_path_nofollow(file->path, scanner->options.preserve_acls)
|
||||
: xattr_capture_path(file->path, scanner->options.preserve_acls);
|
||||
}
|
||||
|
||||
/* Apply --hard-links (-H) detection to one regular File. On a sibling (a
|
||||
|
||||
@@ -428,7 +428,9 @@ static void scan_root_entry(const ScannerOptions* options, const FilterNode* roo
|
||||
}
|
||||
if ((options->preserve_xattrs || options->preserve_acls) &&
|
||||
!(file->link_group != 0 && !file->link_first))
|
||||
file->xattrs = xattr_capture_path(file->path, options->preserve_acls);
|
||||
file->xattrs = file->is_symlink
|
||||
? xattr_capture_path_nofollow(file->path, options->preserve_acls)
|
||||
: xattr_capture_path(file->path, options->preserve_acls);
|
||||
if (!array_list_add(root_files, file)) {
|
||||
free(rel);
|
||||
file_destroy(file);
|
||||
|
||||
+15
-2
@@ -83,7 +83,7 @@ typedef struct {
|
||||
typedef enum SuperMode { SUPER_MODE_AUTO = 0, SUPER_MODE_ON = 1, SUPER_MODE_OFF = 2 } SuperMode;
|
||||
|
||||
/* ===========================================================================
|
||||
* Config wire-field table (single source of truth for protocol 2.28.0).
|
||||
* Config wire-field table (single source of truth for protocol 2.29.0).
|
||||
*
|
||||
* Every field below crosses the wire. The table is the ONLY place a
|
||||
* serialized field is named: config.h expands CONFIG_WIRE_FIELDS() to declare
|
||||
@@ -1071,7 +1071,20 @@ typedef struct Config {
|
||||
* filter rules so the receiver can protect DESTINATION-ONLY entries from
|
||||
* --delete with `protect`/`risk` rules (rsync parity). The block appends after
|
||||
* compression_algo; see CONFIG_WIRE_PROTECT_FIELDS. */
|
||||
#define PROTOCOL_VERSION "2.28.0"
|
||||
/* (10) Symlink xattrs/ACLs (protocol 2.29.0): the config-frame LAYOUT is
|
||||
* unchanged (the derived use_xattrs bit already crosses the wire), but the
|
||||
* STATUS_SYMLINK frame BODY grows a trailing bounded xattr block when -X/-A is
|
||||
* negotiated -- exactly the block STATUS_MKDIR, STATUS_DIR_TIMES and regular
|
||||
* files already carry. The sender captures the symlink's OWN xattrs with
|
||||
* llistxattr/lgetxattr (so it can never attach the REFERENT's attributes to the
|
||||
* link) and the receiver re-applies them to the link itself with lsetxattr on a
|
||||
* confined /proc/self/fd/<parent>/<leaf> path (there is no *at xattr syscall and
|
||||
* fsetxattr cannot target a symlink). A 2.28 peer that does not consume the new
|
||||
* trailing block would desynchronize after every symlink, so the protocol
|
||||
* version must bump; the strict same-version handshake (config_receive rejects a
|
||||
* mismatched version before parsing anything else) keeps a 2.29 client and a
|
||||
* 2.28 server from ever reaching that state. */
|
||||
#define PROTOCOL_VERSION "2.29.0"
|
||||
#define DEFAULT_CHUNK_SIZE (10 * 1024 * 1024)
|
||||
/* Upper bound on total basis-dir entries (rsync caps --link-dest at 20). */
|
||||
#define MAX_BASIS_DIRS 64
|
||||
|
||||
@@ -482,6 +482,14 @@ File* file_receive_symlink(int file_descriptor, const Config* config) {
|
||||
return NULL;
|
||||
}
|
||||
}
|
||||
/* Symlink xattrs/ACLs (-X/-A) arrive in the same trailing block as the other
|
||||
entry kinds; the block is present iff use_xattrs (which itself implies
|
||||
use_metadata, so the metadata frame above is always consumed first). */
|
||||
if (config && !receive_file_xattrs(file, file_descriptor, config)) {
|
||||
file_destroy(file);
|
||||
free(target);
|
||||
return NULL;
|
||||
}
|
||||
file->is_symlink = true;
|
||||
file->symlink_target = target;
|
||||
return file;
|
||||
|
||||
@@ -923,6 +923,19 @@ static FileSaveResult file_save_symlink_to_disk(const FileSavePlan* plan, bool*
|
||||
ok = file_restore_symlink_metadata(link_path, file->metadata, link_policy,
|
||||
config->omit_link_times);
|
||||
}
|
||||
/* -X/-A: apply the symlink's OWN xattrs with a no-follow primitive. The
|
||||
confined parent directory is the anchor and the final component is applied
|
||||
with lsetxattr, so the referent is never touched. Best-effort: on Linux
|
||||
the VFS refuses xattrs on symlinks, so this is normally a no-op. */
|
||||
if (ok && config && config->use_xattrs && file->xattrs) {
|
||||
char* leaf = NULL;
|
||||
int parent_fd = file_open_secure_parent(link_path, &leaf, false);
|
||||
if (parent_fd >= 0) {
|
||||
xattr_apply_path_nofollow(parent_fd, leaf, file->xattrs);
|
||||
close(parent_fd);
|
||||
}
|
||||
free(leaf);
|
||||
}
|
||||
if (ok && created && !link_existed)
|
||||
*created = true;
|
||||
free(link_path);
|
||||
|
||||
+63
-5
@@ -134,16 +134,23 @@ static bool xattr_name_is_posix_acl(const char* name) {
|
||||
|
||||
/* ---- SENDER: capture ---- */
|
||||
|
||||
FileXattrList* xattr_capture_path(const char* path, bool preserve_acls) {
|
||||
/* The two syscall families differ only in whether the FINAL component is
|
||||
* followed (`listxattr`/`getxattr` follow; `llistxattr`/`lgetxattr` do not), so
|
||||
* one common implementation backs both public entry points. */
|
||||
typedef ssize_t (*XattrListFn)(const char* path, char* list, size_t size);
|
||||
typedef ssize_t (*XattrGetFn)(const char* path, const char* name, void* value, size_t size);
|
||||
|
||||
static FileXattrList* xattr_capture_common(const char* path, bool preserve_acls,
|
||||
XattrListFn list_fn, XattrGetFn get_fn) {
|
||||
if (!path)
|
||||
return NULL;
|
||||
ssize_t list_size = listxattr(path, NULL, 0);
|
||||
ssize_t list_size = list_fn(path, NULL, 0);
|
||||
if (list_size <= 0)
|
||||
return NULL; /* no xattrs, ENOTSUP, or error: nothing appliable */
|
||||
char* names = malloc((size_t)list_size);
|
||||
if (!names)
|
||||
return NULL;
|
||||
ssize_t got = listxattr(path, names, (size_t)list_size);
|
||||
ssize_t got = list_fn(path, names, (size_t)list_size);
|
||||
if (got < 0) {
|
||||
free(names);
|
||||
return NULL;
|
||||
@@ -166,7 +173,7 @@ FileXattrList* xattr_capture_path(const char* path, bool preserve_acls) {
|
||||
negotiated. Without it a plain -X capture never carries an ACL. */
|
||||
if (!xattr_name_appliable(name, preserve_acls))
|
||||
continue;
|
||||
ssize_t value_size = getxattr(path, name, NULL, 0);
|
||||
ssize_t value_size = get_fn(path, name, NULL, 0);
|
||||
if (value_size < 0)
|
||||
continue;
|
||||
if (value_size > XATTR_VALUE_MAX)
|
||||
@@ -179,7 +186,7 @@ FileXattrList* xattr_capture_path(const char* path, bool preserve_acls) {
|
||||
free(names);
|
||||
return NULL;
|
||||
}
|
||||
ssize_t read_len = getxattr(path, name, buffer, (size_t)value_size);
|
||||
ssize_t read_len = get_fn(path, name, buffer, (size_t)value_size);
|
||||
if (read_len < 0 || read_len != value_size) {
|
||||
free(buffer);
|
||||
continue;
|
||||
@@ -201,6 +208,14 @@ FileXattrList* xattr_capture_path(const char* path, bool preserve_acls) {
|
||||
return list;
|
||||
}
|
||||
|
||||
FileXattrList* xattr_capture_path(const char* path, bool preserve_acls) {
|
||||
return xattr_capture_common(path, preserve_acls, listxattr, getxattr);
|
||||
}
|
||||
|
||||
FileXattrList* xattr_capture_path_nofollow(const char* path, bool preserve_acls) {
|
||||
return xattr_capture_common(path, preserve_acls, llistxattr, lgetxattr);
|
||||
}
|
||||
|
||||
/* ---- WIRE ---- */
|
||||
|
||||
bool xattr_send(int fd, const FileXattrList* list) {
|
||||
@@ -364,6 +379,49 @@ bool xattr_apply_fd(int fd, const FileXattrList* list) {
|
||||
return true;
|
||||
}
|
||||
|
||||
/* Symlink counterpart of xattr_apply_fd(): target the link ITSELF, never its
|
||||
* referent. fsetxattr cannot be used (no *at xattr syscall exists, and the
|
||||
* kernel rejects xattr syscalls on an O_PATH descriptor), so the already-open,
|
||||
* confinement-checked parent directory is addressed through /proc/self/fd and
|
||||
* the final component is applied with lsetxattr, which does not follow it. */
|
||||
bool xattr_apply_path_nofollow(int parent_fd, const char* leaf, const FileXattrList* list) {
|
||||
if (parent_fd < 0 || !leaf || leaf[0] == '\0' || strchr(leaf, '/') != NULL || !list)
|
||||
return false;
|
||||
if (list->count == 0)
|
||||
return true;
|
||||
char prefix[64];
|
||||
int prefix_len = snprintf(prefix, sizeof(prefix), "/proc/self/fd/%d/", parent_fd);
|
||||
if (prefix_len < 0 || (size_t)prefix_len >= sizeof(prefix))
|
||||
return false;
|
||||
size_t leaf_len = strlen(leaf);
|
||||
char* path = malloc((size_t)prefix_len + leaf_len + 1);
|
||||
if (!path)
|
||||
return false;
|
||||
memcpy(path, prefix, (size_t)prefix_len);
|
||||
memcpy(path + prefix_len, leaf, leaf_len + 1);
|
||||
bool warned = false;
|
||||
int first_errno = 0;
|
||||
for (int i = 0; i < list->count; i++) {
|
||||
const FileXattr* xa = &list->items[i];
|
||||
/* Defense in depth: even a hand-crafted list can never apply the reserved
|
||||
--fake-super key (only fake_super_store_fd may write it). */
|
||||
if (strcmp(xa->name, FAKESUPER_XATTR) == 0)
|
||||
continue;
|
||||
if (lsetxattr(path, xa->name, xa->value, xa->value_len, 0) != 0) {
|
||||
if (!warned) {
|
||||
warned = true;
|
||||
first_errno = errno;
|
||||
}
|
||||
}
|
||||
}
|
||||
if (warned)
|
||||
log_message(LOG_LEVEL_WARNING,
|
||||
"could not set one or more xattrs on the destination symlink: %s",
|
||||
strerror(first_errno));
|
||||
free(path);
|
||||
return true;
|
||||
}
|
||||
|
||||
/* ---- --fake-super: park ownership/mode/rdev in a reserved xattr ---- */
|
||||
|
||||
void fake_super_store_fd(int fd, uint32_t uid, uint32_t gid, uint32_t mode, uint32_t rdev_major,
|
||||
|
||||
+29
-2
@@ -26,8 +26,11 @@
|
||||
* and total bytes) on BOTH ends to prevent OOM/memory abuse; an oversized
|
||||
* or malformed frame is a clean protocol rejection, never an allocation
|
||||
* blowup.
|
||||
* * Application is confined to the exact destination file descriptor
|
||||
* (fsetxattr on the just-written fd), never a caller-controlled path.
|
||||
* * Application is confined to the exact destination entry: fsetxattr on the
|
||||
* just-written fd for regular files/directories, and for a symlink an
|
||||
* lsetxattr on "/proc/self/fd/<parent_fd>/<leaf>" reached through the
|
||||
* already-opened, confinement-checked parent directory -- never a
|
||||
* caller-controlled path, and never following the link.
|
||||
*/
|
||||
|
||||
/* Reserved key used by --fake-super to park the source's privileged ownership
|
||||
@@ -79,6 +82,17 @@ bool xattr_name_appliable(const char* name, bool preserve_acls);
|
||||
* distinct from NULL. */
|
||||
FileXattrList* xattr_capture_path(const char* path, bool preserve_acls);
|
||||
|
||||
/* Sender: like xattr_capture_path() but reads the xattrs of `path` ITSELF,
|
||||
* never following a final symlink (llistxattr/lgetxattr). A symlink entry must
|
||||
* use this so the scanner never captures the REFERENT's attributes onto the
|
||||
* link (the path-following variant would). On Linux the VFS refuses to
|
||||
* associate xattrs with symlinks at all, so this normally returns NULL; it is
|
||||
* still correct and portable for a filesystem/platform that supports them.
|
||||
* The same whitelist/bounds as xattr_capture_path() apply. Returns NULL when
|
||||
* the link has no appliable xattrs (or the filesystem does not support them);
|
||||
* an empty-but-valid list is never returned distinct from NULL. */
|
||||
FileXattrList* xattr_capture_path_nofollow(const char* path, bool preserve_acls);
|
||||
|
||||
/* Wire: bounded serialization. xattr_send returns false on write failure; an
|
||||
* empty/NULL list transmits a zero-count block. xattr_receive returns NULL and
|
||||
* sets *ok = 0 on any malformed / oversized / non-whitelisted entry. When
|
||||
@@ -94,6 +108,19 @@ FileXattrList* xattr_receive(int fd, int* ok, bool preserve_acls);
|
||||
* true when apply was attempted (allowing callers to treat it as best-effort). */
|
||||
bool xattr_apply_fd(int fd, const FileXattrList* list);
|
||||
|
||||
/* Receiver: apply every entry to the symlink named by (parent_fd, leaf) WITHOUT
|
||||
* following it, via lsetxattr() on the confined path
|
||||
* "/proc/self/fd/<parent_fd>/<leaf>". A symlink cannot be targeted by the
|
||||
* fd-relative fsetxattr() path: there is no *at() xattr syscall and the kernel
|
||||
* rejects xattr syscalls on an O_PATH descriptor, so the already-opened,
|
||||
* confinement-checked parent directory is the anchor and only the final
|
||||
* component is the (no-follow) link. `leaf` must be a single path component.
|
||||
* Best-effort exactly like xattr_apply_fd(): a per-attribute failure (on Linux
|
||||
* every set on a symlink fails with EPERM) is logged once and skipped, never
|
||||
* fatal. Returns false only for an invalid anchor/list; true when an apply was
|
||||
* attempted. The reserved --fake-super key is never applied. */
|
||||
bool xattr_apply_path_nofollow(int parent_fd, const char* leaf, const FileXattrList* list);
|
||||
|
||||
/* --fake-super: write the source uid/gid/mode/rdev record into the reserved
|
||||
* FAKESUPER_XATTR on `fd`, using rsync 3.4.1's exact grammar (see the key
|
||||
* comment above). `mode` is the full st_mode including its S_IFMT bits.
|
||||
|
||||
@@ -36,7 +36,7 @@ from common import ( # noqa: E402
|
||||
verify_transfer,
|
||||
)
|
||||
|
||||
PROTOCOL_VERSION = b"2.28.0"
|
||||
PROTOCOL_VERSION = b"2.29.0"
|
||||
STATUS_MANIFEST = 5
|
||||
STATUS_OK = 0
|
||||
|
||||
|
||||
@@ -6637,6 +6637,56 @@ class TestExtendedAttributes:
|
||||
received = get_dest_received_dir(dest, source)
|
||||
assert os.getxattr(os.path.join(received, "data.txt"), "user.k") == b"v"
|
||||
|
||||
@pytest.mark.ci
|
||||
def test_symlink_own_xattrs_never_referent(self, shared_server):
|
||||
"""Protocol 2.29.0: a symlink's STATUS_SYMLINK frame carries a trailing
|
||||
xattr block captured with llistxattr/lgetxattr (no follow) and applied
|
||||
with lsetxattr on the link itself. Linux's VFS refuses to associate
|
||||
xattrs with a symlink at all, so the portable guarantee asserted here is
|
||||
the no-follow one: a referent that carries user.* must NOT have those
|
||||
attributes appear on the destination symlink entry (the old
|
||||
path-following capture would have copied the referent's attrs onto the
|
||||
link). On a platform/filesystem that does support symlink xattrs the
|
||||
full round-trip of the link's own attribute is asserted too."""
|
||||
source, dest = self._source_and_dest("symlink_xattr")
|
||||
target = os.path.join(source, "target.txt")
|
||||
with open(target, "wb") as fh:
|
||||
fh.write(b"referent payload\n")
|
||||
if not _xattr_supported(target):
|
||||
pytest.skip("filesystem does not support user xattrs")
|
||||
os.setxattr(target, "user.referent-only", b"referent-value")
|
||||
|
||||
link = os.path.join(source, "link")
|
||||
os.symlink("target.txt", link)
|
||||
link_xattr_supported = False
|
||||
try:
|
||||
os.setxattr(link, "user.link-own", b"link-value", follow_symlinks=False)
|
||||
link_xattr_supported = os.getxattr(
|
||||
link, "user.link-own", follow_symlinks=False
|
||||
) == b"link-value"
|
||||
except (OSError, AttributeError, NotImplementedError):
|
||||
link_xattr_supported = False
|
||||
|
||||
result, _ = run_client(source, dest, flags=["-aX"], port=shared_server.port)
|
||||
assert result.returncode == 0, \
|
||||
f"-aX symlink sync failed: {(result.stderr or result.stdout)[:300]}"
|
||||
received = get_dest_received_dir(dest, source)
|
||||
dst_link = os.path.join(received, "link")
|
||||
assert os.path.islink(dst_link), "destination link entry is not a symlink"
|
||||
assert os.readlink(dst_link) == "target.txt"
|
||||
|
||||
# The no-follow guarantee: the referent's attribute must never leak onto
|
||||
# the symlink entry.
|
||||
link_names = os.listxattr(dst_link, follow_symlinks=False)
|
||||
assert "user.referent-only" not in link_names, (
|
||||
"the destination symlink captured its REFERENT's xattr "
|
||||
"(path-following capture bug)"
|
||||
)
|
||||
if link_xattr_supported:
|
||||
assert os.getxattr(
|
||||
dst_link, "user.link-own", follow_symlinks=False
|
||||
) == b"link-value", "the symlink's own xattr did not round-trip"
|
||||
|
||||
@pytest.mark.ci
|
||||
def test_acls_via_posix_acl_xattr(self, shared_server):
|
||||
source, dest = self._source_and_dest("acl")
|
||||
|
||||
@@ -133,14 +133,14 @@ def _seed_protocol_source(source):
|
||||
class TestProtocol:
|
||||
@pytest.mark.ci
|
||||
def test_protocol_current_version_accepted(self, shared_server):
|
||||
"""--protocol=2.28.0 (the current PROTOCOL_VERSION) is accepted and the
|
||||
"""--protocol=2.29.0 (the current PROTOCOL_VERSION) is accepted and the
|
||||
transfer completes normally."""
|
||||
source = os.path.join(TEST_DATA_DIR, "proto_ok_src")
|
||||
dest = os.path.join(TEST_DATA_DIR, "proto_ok_dst")
|
||||
shutil.rmtree(dest, ignore_errors=True)
|
||||
os.makedirs(dest)
|
||||
_seed_protocol_source(source)
|
||||
result, _ = run_client(source, dest, flags=["--protocol=2.28.0"],
|
||||
result, _ = run_client(source, dest, flags=["--protocol=2.29.0"],
|
||||
port=shared_server.port)
|
||||
assert result.returncode == 0, \
|
||||
f"--protocol current run failed: {(result.stderr or result.stdout)[:400]}"
|
||||
|
||||
@@ -352,7 +352,7 @@ static void test_parse_args_protocol_accept_current() {
|
||||
Config* cfg = valid_client_config();
|
||||
EXPECT_NOT_NULL(cfg);
|
||||
char* argv_equals[] = {"fastsync", "--source-dir", "/src",
|
||||
"--dest-dir", "/dst", "--protocol=2.28.0"};
|
||||
"--dest-dir", "/dst", "--protocol=2.29.0"};
|
||||
int positional_args[2];
|
||||
int positional_count = 0;
|
||||
EXPECT_EQ_INT(parse_args(cfg, 6, argv_equals, positional_args, &positional_count), 0);
|
||||
@@ -362,7 +362,7 @@ static void test_parse_args_protocol_accept_current() {
|
||||
cfg = valid_client_config();
|
||||
EXPECT_NOT_NULL(cfg);
|
||||
char* argv_space[] = {"fastsync", "--source-dir", "/src", "--dest-dir",
|
||||
"/dst", "--protocol", "2.28.0"};
|
||||
"/dst", "--protocol", "2.29.0"};
|
||||
positional_count = 0;
|
||||
EXPECT_EQ_INT(parse_args(cfg, 7, argv_space, positional_args, &positional_count), 0);
|
||||
EXPECT_EQ_STR(cfg->version, PROTOCOL_VERSION);
|
||||
@@ -375,7 +375,7 @@ static void test_parse_args_protocol_rejects_other_versions() {
|
||||
static const char* const bad_versions[] = {"2.17", "2.16", "2.15.0", "2.16.0", "2.17.0",
|
||||
"2.18.0", "2.19.0", "2.20.0", "2.21.0", "2.22.0",
|
||||
"2.23.0", "2.24.0", "2.25.0", "2.26.0", "2.27.0",
|
||||
"216", "31", "abc", ""};
|
||||
"2.28.0", "216", "31", "abc", ""};
|
||||
for (size_t i = 0; i < sizeof(bad_versions) / sizeof(bad_versions[0]); i++) {
|
||||
Config* cfg = valid_client_config();
|
||||
EXPECT_NOT_NULL(cfg);
|
||||
|
||||
+8
-5
@@ -2924,7 +2924,7 @@ static void golden_config_populate(Config* c) {
|
||||
array_list_add(c->filters, str_dup("- /sub/dir/"));
|
||||
}
|
||||
|
||||
/* The pinned golden frame (protocol 2.28.0). The values below are the only
|
||||
/* The pinned golden frame (protocol 2.29.0). The values below are the only
|
||||
* thing that ties the generated table to the historical wire format; update
|
||||
* them ONLY with a PROTOCOL_VERSION bump and a documented reason. The 2.24.0
|
||||
* delete-plan wave changed only the version string; 2.25.0 appended the
|
||||
@@ -2933,10 +2933,13 @@ static void golden_config_populate(Config* c) {
|
||||
* appended the receiver-side delete-protection rule block (the STATUS_STATS
|
||||
* body also grew, but that is not part of this frame). Track 5a appends the
|
||||
* FastSync-only verify_basis bool to the basis block WITHOUT a version bump
|
||||
* (project decision), so the frame grew by one int to 886 bytes. The
|
||||
* byte-exact values are recomputed for the merged layout. */
|
||||
* (project decision), so the frame grew by one int to 886 bytes. The 2.29.0
|
||||
* symlink-xattr wave changes only the version string: the config-frame layout
|
||||
* is unchanged (use_xattrs already crosses the wire); the STATUS_SYMLINK frame
|
||||
* body grows instead. The byte-exact values are recomputed for the merged
|
||||
* layout. */
|
||||
#define GOLDEN_WIRE_LEN 886
|
||||
#define GOLDEN_WIRE_HASH 5809509022716816757ULL
|
||||
#define GOLDEN_WIRE_HASH 17827864270611927842ULL
|
||||
|
||||
static unsigned long long fnv1a_64(const unsigned char* buf, size_t len) {
|
||||
unsigned long long h = 1469598103934665603ULL;
|
||||
@@ -3018,7 +3021,7 @@ static unsigned long long capture_wire_hash(const Config* cfg, size_t* out_len)
|
||||
return h;
|
||||
}
|
||||
|
||||
/* Byte-for-byte wire compatibility guard (protocol 2.28.0). The expected hash
|
||||
/* Byte-for-byte wire compatibility guard (protocol 2.29.0). The expected hash
|
||||
* pins the pre-X-macro byte stream; the refactor MUST NOT change it. */
|
||||
static void test_config_wire_golden() {
|
||||
if (is_running_under_valgrind())
|
||||
|
||||
@@ -1,9 +1,12 @@
|
||||
#include "test_xattr.h"
|
||||
#include "xattr.h"
|
||||
#include "charset.h"
|
||||
#include "config.h"
|
||||
#include "file.h"
|
||||
#include "file_receive.h"
|
||||
#include "file_save.h"
|
||||
#include "identity.h"
|
||||
#include "metadata.h"
|
||||
#include "protocol.h"
|
||||
#include "test_utils.h"
|
||||
#include <fcntl.h>
|
||||
@@ -11,6 +14,7 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <sys/socket.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/wait.h>
|
||||
#include <sys/xattr.h>
|
||||
@@ -660,8 +664,187 @@ static void test_file_save_directory_applies_xattrs() {
|
||||
rmdir(root);
|
||||
}
|
||||
|
||||
/* Symlink xattrs (protocol 2.29.0): the no-follow capture must read the LINK's
|
||||
* OWN attributes and never the REFERENT's. Linux's VFS refuses to associate
|
||||
* xattrs with a symlink at all, so the nofollow capture returns NULL while the
|
||||
* path-following capture sees the referent's attribute -- which is exactly the
|
||||
* bug the no-follow variant exists to prevent (a symlink entry must not carry
|
||||
* its target's attributes). Guarded on filesystem xattr support. */
|
||||
static void test_xattr_capture_symlink_nofollow() {
|
||||
const char* target = "test_symlink_xattr_capture_target";
|
||||
const char* link = "test_symlink_xattr_capture_link";
|
||||
unlink(link);
|
||||
unlink(target);
|
||||
int fd = open(target, O_WRONLY | O_CREAT | O_TRUNC, 0600);
|
||||
if (fd < 0)
|
||||
return;
|
||||
bool has_xattr = setxattr(target, "user.symref", "referent", 8, 0) == 0;
|
||||
close(fd);
|
||||
if (!has_xattr) {
|
||||
unlink(target);
|
||||
return; /* filesystem without xattr support */
|
||||
}
|
||||
if (symlink(target, link) != 0) {
|
||||
unlink(target);
|
||||
return;
|
||||
}
|
||||
|
||||
/* The no-follow capture must never pick up the referent's attributes. */
|
||||
FileXattrList* nofollow = xattr_capture_path_nofollow(link, false);
|
||||
EXPECT_NULL(nofollow);
|
||||
|
||||
/* The path-following capture does, proving the referent really carries one
|
||||
and that the no-follow variant differs. */
|
||||
FileXattrList* follow = xattr_capture_path(link, false);
|
||||
bool saw = false;
|
||||
for (int i = 0; follow && i < follow->count; i++) {
|
||||
if (strcmp(follow->items[i].name, "user.symref") == 0)
|
||||
saw = true;
|
||||
}
|
||||
EXPECT_TRUE(saw);
|
||||
xattr_list_free(follow);
|
||||
xattr_list_free(nofollow);
|
||||
unlink(link);
|
||||
unlink(target);
|
||||
}
|
||||
|
||||
/* Symlink xattrs (protocol 2.29.0): the no-follow apply must target the LINK,
|
||||
* never its referent. On Linux the LSETXATTR is refused (the VFS does not
|
||||
* allow symlink xattrs), but the critical guarantee is observable: the
|
||||
* referent's attributes are UNCHANGED. A regression from lsetxattr to the
|
||||
* path-following setxattr would rewrite the referent here and fail this test. */
|
||||
static void test_xattr_apply_path_nofollow_does_not_follow() {
|
||||
const char* root = "test_symlink_xattr_apply_tmp";
|
||||
const char* target = "test_symlink_xattr_apply_tmp/target";
|
||||
const char* link = "test_symlink_xattr_apply_tmp/link";
|
||||
unlink(link);
|
||||
unlink(target);
|
||||
rmdir(root);
|
||||
EXPECT_EQ_INT(mkdir(root, 0700), 0);
|
||||
int tfd = open(target, O_WRONLY | O_CREAT | O_TRUNC, 0600);
|
||||
if (tfd < 0) {
|
||||
rmdir(root);
|
||||
return;
|
||||
}
|
||||
bool has_xattr = setxattr(target, "user.orig", "orig", 4, 0) == 0;
|
||||
close(tfd);
|
||||
if (!has_xattr) {
|
||||
unlink(target);
|
||||
rmdir(root);
|
||||
return; /* filesystem without xattr support */
|
||||
}
|
||||
EXPECT_EQ_INT(symlink("target", link), 0);
|
||||
|
||||
FileXattrList* list = xattr_list_new();
|
||||
EXPECT_NOT_NULL(list);
|
||||
EXPECT_TRUE(xattr_list_append(list, "user.orig", "hacked", 6));
|
||||
EXPECT_TRUE(xattr_list_append(list, "user.added", "x", 1));
|
||||
|
||||
/* Invalid anchors are refused before any syscall (no fd/leaf/list). */
|
||||
EXPECT_FALSE(xattr_apply_path_nofollow(-1, "link", list));
|
||||
EXPECT_FALSE(xattr_apply_path_nofollow(0, "", list));
|
||||
EXPECT_FALSE(xattr_apply_path_nofollow(0, "a/b", list));
|
||||
EXPECT_FALSE(xattr_apply_path_nofollow(0, "link", NULL));
|
||||
|
||||
/* The confined parent directory is the anchor; the final component is the
|
||||
link. Best-effort: returns true even when the kernel refuses. */
|
||||
int dir_fd = open(root, O_RDONLY | O_DIRECTORY);
|
||||
EXPECT_TRUE(dir_fd >= 0);
|
||||
EXPECT_TRUE(xattr_apply_path_nofollow(dir_fd, "link", list));
|
||||
close(dir_fd);
|
||||
|
||||
/* The referent must be untouched: a following apply would have set user.orig
|
||||
to "hacked" and created user.added on the target. */
|
||||
char buf[16];
|
||||
ssize_t got = getxattr(target, "user.orig", buf, sizeof(buf));
|
||||
EXPECT_EQ_INT(4, (int)got);
|
||||
if (got == 4)
|
||||
EXPECT_TRUE(memcmp(buf, "orig", 4) == 0);
|
||||
EXPECT_TRUE(getxattr(target, "user.added", buf, sizeof(buf)) < 0);
|
||||
|
||||
/* If the platform DOES support symlink xattrs, they must have landed on the
|
||||
link itself; on Linux the VFS refuses them, so the link stays empty. */
|
||||
if (llistxattr(link, NULL, 0) > 0) {
|
||||
ssize_t n = lgetxattr(link, "user.added", buf, sizeof(buf));
|
||||
EXPECT_EQ_INT(1, (int)n);
|
||||
if (n == 1)
|
||||
EXPECT_TRUE(buf[0] == 'x');
|
||||
}
|
||||
|
||||
xattr_list_free(list);
|
||||
unlink(link);
|
||||
unlink(target);
|
||||
rmdir(root);
|
||||
}
|
||||
|
||||
/* Protocol 2.29.0: a STATUS_SYMLINK frame followed by an -X/-A xattr block is
|
||||
* decoded by file_receive_symlink() with the block attached to the File. This
|
||||
* is the wire round-trip for the new trailing symlink xattr block. */
|
||||
static void run_recv_symlink_with_xattrs(int fd) {
|
||||
/* Stack-allocated so the forked child leaks nothing at _exit() (a
|
||||
config_create() in the parent would be inherited and never freed here). */
|
||||
Config config;
|
||||
memset(&config, 0, sizeof(config));
|
||||
config.use_metadata = true;
|
||||
config.use_xattrs = true;
|
||||
config.preserve_xattrs = true;
|
||||
File* file = file_receive_symlink(fd, &config);
|
||||
if (!file)
|
||||
_exit(1);
|
||||
bool ok = file->is_symlink && file->symlink_target != NULL &&
|
||||
strcmp(file->symlink_target, "target") == 0;
|
||||
ok = ok && file->xattrs != NULL && file->xattrs->count == 1 &&
|
||||
strcmp(file->xattrs->items[0].name, "user.sym") == 0 &&
|
||||
file->xattrs->items[0].value_len == 3 && memcmp(file->xattrs->items[0].value, "sym", 3) == 0;
|
||||
file_destroy(file);
|
||||
_exit(ok ? 0 : 1);
|
||||
}
|
||||
|
||||
static void test_symlink_frame_carries_xattrs() {
|
||||
int p[2];
|
||||
EXPECT_EQ_INT(socketpair(AF_UNIX, SOCK_STREAM, 0, p), 0);
|
||||
io_set_fds(p[0], p[1]);
|
||||
io_set_bwlimit(0);
|
||||
|
||||
pid_t pid = fork();
|
||||
if (pid == 0) {
|
||||
close(p[1]);
|
||||
io_set_fds(p[0], p[0]);
|
||||
io_set_bwlimit(0);
|
||||
run_recv_symlink_with_xattrs(p[0]);
|
||||
}
|
||||
close(p[0]);
|
||||
io_set_fds(p[1], p[1]);
|
||||
io_set_bwlimit(0);
|
||||
|
||||
FileMetadata m;
|
||||
memset(&m, 0, sizeof(m));
|
||||
m.mode = S_IFLNK | 0777;
|
||||
m.uid = (uint32_t)geteuid();
|
||||
m.gid = (uint32_t)getegid();
|
||||
m.mtime_sec = 1700000000;
|
||||
|
||||
FileXattrList* list = xattr_list_new();
|
||||
EXPECT_NOT_NULL(list);
|
||||
EXPECT_TRUE(xattr_list_append(list, "user.sym", "sym", 3));
|
||||
|
||||
/* Exactly the sender's order: path, target, metadata, xattr block. */
|
||||
bool wrote = send_wire_str(p[1], "link") && send_wire_str(p[1], "target") &&
|
||||
metadata_send(p[1], &m) && xattr_send(p[1], list);
|
||||
xattr_list_free(list);
|
||||
close(p[1]);
|
||||
|
||||
int status = 0;
|
||||
waitpid(pid, &status, 0);
|
||||
EXPECT_TRUE(wrote);
|
||||
EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0);
|
||||
}
|
||||
|
||||
void test_xattr() {
|
||||
test_xattr_list_clone();
|
||||
test_xattr_capture_symlink_nofollow();
|
||||
test_xattr_apply_path_nofollow_does_not_follow();
|
||||
test_symlink_frame_carries_xattrs();
|
||||
test_xattr_wire_roundtrip();
|
||||
test_xattr_reject_privileged_namespace();
|
||||
test_xattr_reject_oversized_value();
|
||||
|
||||
Reference in New Issue
Block a user