7 Commits

Include renames

Author	SHA1	Message	Date
TapTap	6d32bc795b	fix(p8h-core): escape log paths, fail closed on identity activation, tidy server gate ... - A6: escape attacker-controlled file paths and the receive root in log lines (file_receive, server, protocol DEBUG) with output_escape() - A8: identity_set_active() returns bool and fails closed when a requested usermap/groupmap cannot be deep-copied; handler refuses the connection - remove the const cast and duplicate super_mode clamp from server_module_gate via an explicit override the handler applies once - release the identity snapshot on the queue_create failure path - refactor identity_parse_copy_as to a single cleanup tail and drop the duplicated group error format specifier	2026-09-12 15:03:54 +02:00
TapTap	e3840c8326	fix(p8-security): enforce daemon ownership policy, gate fake-super replay, drop implicit numeric-ids, make copy-as failures per-entry ... A1: daemon refuses every client-chosen ownership/super-user request (--numeric-ids/--chown/--usermap/--groupmap/--fake-super/--copy-as/--super) unless the selected module opts in with 'client owner = yes'. A2: fake-super owner replay requires an explicit ownership identity policy. A3: --super no longer implies --numeric-ids (ownership stays opt-in). A5: a failed --copy-as chown marks the entry failed instead of reporting success with the wrong owner.	2026-09-12 14:00:55 +02:00
TapTap	fdc0f238c9	fix(p7-privilege): harden copy-as/super gates, own dirs/specials ... - fake-super owner replay honors --no-super and an active --copy-as - copy-as/identity ownership now applied to directories and special nodes - reject copy_as_set && !use_metadata (receiver + client --no-preserve) - daemon refuses --copy-as; add server-side --no-super operator veto - implement identity_copy_as_refused/identity_copy_as_active - reject copy-as ids that overflow int32; escape spec in log errors - copy-as chown EPERM/EACCES logged at ERROR (still non-fatal) - identity_wire_valid copy-as bounds; CLI help and RSYNC_COMPAT docs - add unit tests and root-gated integration coverage	2026-09-12 12:34:43 +02:00
TapTap	f2ba8211ce	fix(p7-output-fs): address c-review (fake-super mode sanitization HIGH; sparse/preallocate precedence; partial no_replace guard; stronger tests) ... - fake_super_restore_fd now sanitizes mode like metadata_mode (never grants S_IWGRP|S_IWOTH; 0666 -> 0644), fixing a privilege regression - --sparse takes precedence over --preallocate (skip posix_fallocate when sparse) so holes are not re-allocated; docs corrected - --partial retention disabled under --no_replace (ignore/existing) and only marks write_attempted after the write begins (no empty-temp retention) - accept --block-size=SIZE / --delta-block=SIZE inline forms; neutral messages - fake-super EPERM/EACCES skipped silently (docs aligned); EINVAL still logged - sparse unit test now memcmp's the full buffer; TestBlockSize integration keeps the destination basis so delta is genuinely exercised - unit 37/37, cppcheck 0, clang-format 0	2026-09-12 09:55:40 +02:00
TapTap	47de05d215	feat(p7-output-fs): sparse hole preservation (-S), partial retention (-P), fake-super replay; block-size verified; crtimes/stderr -> Impossible/Divergence (Wave B) ... - write_all_sparse: skips all-zero runs >= 4096 bytes via lseek(SEEK_CUR) and ftruncates the final size, wired into the atomic temp+rename and --inplace paths with no wire change (full image already in memory). - --partial retention: on a save failure after the temp held data, rename the already-written temp to the destination path (best-effort; falls through to unlink; never retains when --partial is off) so --append/--append-verify can resume; tested by forcing futimens EINVAL with an out-of-range nsec. - --block-size aliases --delta-block; verified config->delta_block_size is honored by the delta engine end-to-end (unit + integration tests). - fake_super_restore_fd: parses and re-applies user.fastsync.stat fd-relative (fchown best-effort/non-root skipped, fchmod, futimens); a save under --fake-super now both records and re-applies. - -N/--crtimes and --stderr=client promoted to a new 'Impossible/Divergence' status bucket (Summary: 136/2/4/3/2 = 147). - cppcheck/clang-format clean; unit 37/37; integration 407 passed.	2026-09-11 15:58:20 +02:00
TapTap	5a00a4fe2b	style: cppcheck — drop redundant if(fd>=0) in test_xattr copy-fallback test ... EXPECT_TRUE(fd >= 0) already guards; the enclosing if is flagged always-true by cppcheck. read(-1) is safe.	2026-09-08 22:46:43 +02:00
TapTap	747946c318	acls/xattrs: -X/--xattrs, -A/--acls, --fake-super ... New src/shared/xattr.{c,h}: capture user.* + POSIX ACL xattrs, transmit a bounded per-file block, re-apply fd-relative. security.*/trusted.*/other system.* never transmitted/applied (receiver re-validates). Bounds: name<=255 value<=1MiB count <=256 total<=4MiB. --fake-super records uid:gid:mode:mtime in reserved user.fastsync.stat (receiver-only). PROTOCOL_VERSION 2.12.0->2.13.0. Review fixes: reserved key not forwardable, link/hardlink copy-fallback preserves xattrs, no const-param mutation, per-file warning dedup.	2026-09-08 22:27:53 +02:00