Rsync 3.5.0 Patches 33 Security Flaws in Path and Daemon Handling

Rsync 3.5.0 ships after a months-long, intensive security audit, closing 33 distinct vulnerabilities. Most stem from classic symlink-following TOCTOU races (CWE-59/61): a local user controlling one path component could trick a privileged rsync process into reading, writing, or deleting files outside the intended tree. Affected surfaces span --filter merge files, --files-from, --password-file, --log-file, --write-batch/--read-batch, and daemon module chroot handling.

What matters for engineers is the systematic nature of the fix: operator-supplied paths are now resolved component-by-component via openat(O_PATH|O_NOFOLLOW) with ownership checks, and sensitive operations like ACL/xattr application pin the target inode by file descriptor before acting on it. CVE IDs were assigned by VulnCheck, each with a precise 'introduced in' version range rather than a blanket 'everything before 3.5.0' warning, letting teams assess actual exposure per deployment.

Any operator running rsync as root, as a daemon, or in environments where untrusted users influence source/destination paths should treat this as a priority upgrade. Every fix includes a regression test that fails on the unpatched tree, reducing the risk of these bug classes resurfacing.