fix(p7-privilege): close re-review gaps (implicit dir ownership, daemon --super, write-devices gate)

src/server/server.c

@@ -195,6 +195,17 @@ static const char* server_module_gate(const Config* config, void* context) {
                                  "client-chosen ownership); refusing");
     return "--copy-as is not permitted by this daemon";
   }
+  /* --super (SUPER_MODE_ON) with no explicit identity policy implies raw
+     numeric-id ownership, i.e. a client-chosen owner.  A daemon has no
+     per-module opt-in, so refuse the explicit ON request for the same reason it
+     refuses --copy-as; the pre-existing --numeric-ids/--chown/--usermap surfaces
+     are unchanged (documented daemon trust model).  --no-super still works. */
+  if (g_daemon_conf != NULL && config->super_mode == SUPER_MODE_ON) {
+    log_message(LOG_LEVEL_ERROR,
+                "--super is refused by the daemon (no per-module opt-in for client-chosen "
+                "ownership); refusing");
+    return "--super is not permitted by this daemon";
+  }
   /* Operator veto: --no-super forces SUPER_MODE_OFF for this connection before
      the copy-as gate is evaluated, and the caller clamps the accepted config
      again after this returns so the ownership/device gates see it too. */
@@ -202,8 +213,13 @@ static const char* server_module_gate(const Config* config, void* context) {
   if (server_no_super)
     effective->super_mode = SUPER_MODE_OFF;
   if (identity_copy_as_refused(effective)) {
-    log_message(LOG_LEVEL_ERROR, "--copy-as requires a privileged receiver (root); refusing");
-    return "--copy-as requires a privileged receiver (root)";
+    if (geteuid() != 0)
+      log_message(LOG_LEVEL_ERROR, "--copy-as requires a privileged receiver (root); refusing");
+    else
+      log_message(LOG_LEVEL_ERROR,
+                  "--copy-as refused: super-user activities are disabled by the server "
+                  "(--no-super); refusing");
+    return "cannot perform --copy-as on this receiver";
   }
   /* --iconv (protocol 2.16.0): the receiver's exact conversion direction (the
      client spec's wire charset into this server's local charset, including a
@@ -606,6 +622,9 @@ static void print_server_usage(void) {
   printf("  -6, --ipv6          Bind an IPv6 socket\n");
   printf("  --allow-delete      Permit manifest deletion\n");
   printf("  --trust-sender      Trust the remote sender's file list\n");
+  printf("  --no-super          Operator veto: never attempt super-user activities\n");
+  printf("                      (ownership, device nodes) even as root, and refuse\n");
+  printf("                      any client --copy-as/--super request\n");
   printf("  --iconv=LOCAL[,REMOTE]  Declare this server's LOCAL charset for file-name\n");
   printf("                      conversion: received names are translated to this\n");
   printf("                      charset (the wire charset still comes from the\n");

src/shared/file.c

@@ -16,6 +16,7 @@
 #include "data.h"
 #include "delta.h"
 #include "file.h"
+#include "identity.h"
 #include "log.h"
 #include "metadata.h"
 #include "utils.h"
@@ -572,8 +573,19 @@ int file_open_secure_parent(const char* path, char** leaf_out, bool create_dirs)
     if (strcmp(component, ".") != 0) {
       int next = openat(fd, component, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
       if (next < 0 && create_dirs && errno == ENOENT) {
-        if (mkdirat(fd, component, 0755) == 0 || errno == EEXIST)
+        bool created = mkdirat(fd, component, 0755) == 0;
+        if (created || errno == EEXIST) {
+          /* P7 Wave E: --copy-as owns EVERY entry, including the intermediate
+             directories this walk creates implicitly.  Its target ids are a
+             global policy, so they are available here without per-entry source
+             metadata.  Only a directory this walk actually created is chowned
+             (a pre-existing destination directory is left alone, matching
+             rsync's transferred-entry scope); the helper is a no-op unless an
+             identity policy is active. */
+          if (created && identity_copy_as_active())
+            identity_apply_ownership_link(fd, component, 0, 0);
           next = openat(fd, component, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+        }
       }
       /* --keep-dirlinks (-K): a path component that is an existing symlink to
          an in-root directory is used as THAT directory rather than failing the

src/shared/file_receive.c

@@ -357,13 +357,15 @@ static FileSaveResult file_save_special_to_disk(const char* root_directory, cons
     if (!config || !config->preserve_devices)
       return FILE_SAVE_SKIPPED;
     /* --super / --no-super (P7 Wave E): char/block device-node creation is a
-       super-user activity.  --no-super forbids it even for a root receiver; the
-       default AUTO only attempts it when already root.  Pure FIFO creation is
-       unprivileged and deliberately NOT gated here. */
-    if (!privilege_super_permitted()) {
+       super-user activity.  --no-super forbids it even for a root receiver;
+       AUTO and --super attempt it (an unprivileged attempt is refused by the
+       kernel and skipped).  The helper is evaluated against THIS config's mode
+       so the policy does not depend on a prior identity_set_active().  Pure
+       FIFO creation is unprivileged and deliberately NOT gated here. */
+    if (!privilege_super_mode_permitted(config->super_mode)) {
       log_message(LOG_LEVEL_WARNING,
                   "skipping %s: super-user device-node creation is not permitted "
-                  "(--no-super, or the receiver is not privileged)",
+                  "(super-user activities disabled by --no-super)",
                   file->path);
       return FILE_SAVE_SKIPPED;
     }
@@ -586,9 +588,19 @@ FileSaveResult file_save_to_disk_full(const char* root_directory, const File* fi
      writing content (privilege-gated, confined, rdev-validated). */
   if (file->is_special)
     return file_save_special_to_disk(root_directory, file, config);
-  /* --write-devices: write straight into an existing device node. */
-  if (config && config->write_devices)
+  /* --write-devices: write straight into an existing device node.  Writing
+     into a device is a super-user activity, so --no-super must suppress it just
+     like device-node creation; the default AUTO/--super attempt it (the wide
+     open below keeps its own confinement and best-effort skip semantics). */
+  if (config && config->write_devices) {
+    if (!privilege_super_mode_permitted(config->super_mode)) {
+      log_message(LOG_LEVEL_WARNING,
+                  "write-devices: %s skipped: super-user activities disabled by --no-super",
+                  file->path ? file->path : "(null)");
+      return FILE_SAVE_SKIPPED;
+    }
     return file_save_write_device(root_directory, file);
+  }
 
   /* Explicit directory entries (--dirs) carry an empty payload; the entry is
      created as a directory under the receive root, applying the same secure

src/shared/identity.c

@@ -93,7 +93,6 @@ void identity_set_active(const Config* config) {
       g_identity.groupmap_count = config->groupmap_count;
     }
   }
-  g_identity.super_mode = config->super_mode;
   g_identity.set = true;
   /* A root receiver would honor any client-supplied ownership request (a
      --usermap/--groupmap/--chown/--copy-as, or raw ids under --numeric-ids).
@@ -467,7 +466,7 @@ int identity_parse_copy_as(Config* config, const char* value) {
     return -1;
   }
   char* user_token = spec;
-  char* group_token = NULL;
+  const char* group_token = NULL;
   char* colon = strchr(spec, ':');
   if (colon) {
     *colon = '\0';
@@ -726,5 +725,5 @@ void identity_apply_ownership_link(int parent_fd, const char* leaf, int32_t sour
   if (!identity_resolve_targets(&st, source_uid, source_gid, &uid, &gid))
     return;
   if (fchownat(parent_fd, leaf, uid, gid, AT_SYMLINK_NOFOLLOW) != 0)
-    identity_log_chown_failure("symlink", uid, gid);
+    identity_log_chown_failure("no-follow entry", uid, gid);
 }