dave2wave commented on code in PR #1592:
URL:
https://github.com/apache/tooling-trusted-releases/pull/1592#discussion_r3991208818
##########
atr/ssh.py:
##########
@@ -290,11 +290,12 @@ async def server_stop(server: asyncssh.SSHAcceptor) ->
None:
log.info("SSH server stopped")
-def _build_rsync_write_argv(argv: list[str], path: safe.StatePath) ->
list[str]:
+def _build_rsync_write_argv(argv: list[str]) -> list[str]:
"""Build the rsync command for a write, adding enforced server side
limits."""
if len(argv) < 2 or argv[-2] != ".":
raise RuntimeError("Validated rsync write argv must end with '.' and
the destination path")
- return [*argv[:-2], f"--max-size={_RSYNC_MAX_UPLOAD_SIZE}",
"--info=skip2", ".", str(path)]
+ # Use exactly '.' so rsync does not reopen ancestors outside the Landlock
sandbox
Review Comment:
It would be best to make multiple PRs and issues. The fix in your initial PR
is for a Blocker issue. Where as this one is for a false positive, and better
raised as an Issue first.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
