regression: symbolic links out of module not allowed

[rrotter]

The mitigation for CVE-2026-43619 in 3.4.3 seems to assume that all symlinks pointing out of a module are malicious. Relative symbolic links pointing out of a module previously worked with "use chroot = no". Now, when I try to follow these links rsync fails with the error: failed: Invalid cross-device link.

It appears that this was intentionally supported, per rsyncd.conf(5):

use chroot […] has the disadvantage[…] of not being able to follow symbolic links that are either absolute or outside of the new root path

Since I'm running rsync as root I was able to work around this by setting "use chroot = yes" and adding the "/./" chroot divider. Still, the old documented behavior should either be restored, or the documentation updated to clarify that "use chroot = no" now bars such symlinks.

[tridge]

thanks for reporting
this is already fixed in master and will be in the next release

[VARhimank]

Hi @tridge @rrotter,
Can you confirm which commit this "fix" is a part of? and mention the release as well. Thanks!

[rrotter]

@VARhimank, the v3.4.4 release notes say it's fixed there. Also, scroll down in #980, and you'll see reference to this being backported to older LTS releases.

I've not tried the "fix" yet, looks like there is a new --insecure-links option that may be required.

[steadytao]

The compatibility option for this issue was added in 502fb58 and is included in 3.5.0. --insecure-links is required to restore the legacy behaviour of following receiver-side symlinks outside a daemon module; confinement remains the default.