This release closes an rsync --delete gap where an unscoped destination, including one that came from empty variables, was allowed at every protection level.
Added
- Added an
rsync.deleterule that blocksrsyncdelete modes (--delete,--del, and abbreviations such as--delete-af) when the destination is outside the current directory, outside a trusted temp root, or supplied through a variable. Mirroring inside the workspace or between trusted temp paths stays allowed, except under paranoidrm, which blocks it too. (#271) - Added catastrophic handling for
rsyncdelete destinations: root,~, and$HOMEare denied asrm.recursive-force-root-or-home, and a.gitdestination is denied asrm.git-metadata. Neither denial can be turned off by policy.
Changed
- Changed
rsyncinto a built-in analyzed command, so wrappers such astimeoutandnicehand off to the new analysis, andrsynccan no longer be listed intransparent_wrappers. - Changed destination detection to fail closed: every operand after the source is checked as a possible destination, options placed after the operands or after
--are still read, and-n/--dry-runis evaluated like a real run. Remote destinations such asuser@host:/pathare skipped. Setrsync.deletetooffif a multi-source command is too strictly blocked.
Fixed
- Fixed
find {,} -deletebeing allowed: an empty brace expansion no longer counts as a scoped delete target.