Bug ID: 13827
           Summary: despite --copy-unsafe-links, rsync does not copy the
                    referent of symlinks that point one level outside the
                    copied tree
           Product: rsync
           Version: 3.1.3
          Hardware: All
                OS: All
            Status: NEW
          Severity: major
          Priority: P5
         Component: core
        QA Contact:

Created attachment 14913
short shell script demonstrating the bug

Despite --copy-unsafe-links, rsync does not copy the referent of symlinks that
point one level outside the copied tree. The short shell script attached
demonstrates the problem. It also demonstrates two other cases where the checks
work as intended. The problem appears to be an off-by-one error in a check.

Accessing things outside the copied tree through a symlink is probably a
security problem. However, the restriction to only one directory level too far
makes it more difficult to expoit.

Tested on Lubuntu 18.04.1 LTS

rsync version 3.1.2, protocol version 31
(The most current version of rsync is 3.1.3. But its release notes do not
mention this bug to be fixed.)
The change & release notes of Lubuntu 18.04.1 do not mention rsync.
The bug tracker Ubuntu Launchpad does not mention this bug.

I expected any symlink pointing outside the copied tree to be converted into a
copy, when I use --copy-unsafe-links.

A symlink pointing just one level outside the copied tree is not converted.
This is always reproducible, see the demo script attached.

I submitted this bug to Ubuntu Launchpad first. But they told me to submit it
here. (Since I declared it a security relevant bug, it became non-public by

You are receiving this mail because:
You are the QA Contact for the bug.

Please use reply-all for most replies to avoid omitting the mailing list.
To unsubscribe or change options:
Before posting, read:
  • [Bug 13827] New: desp... just subscribed for rsync-qa from bugzilla via rsync

Reply via email to