Stéphane Graber b46c2b45f1 incusd: Don't follow symlinks when receiving migration data ...

The migration source controls the rsync and btrfs streams and can plant
a symlink, such as rootfs pointing at /, then write through it while the
transfer is still running, before the post-transfer symlink check.
Bind-mount the receive path with nosymfollow for the duration of the
receive and refuse a block volume file that was replaced by a symlink.

This addresses GHSA-579w-c4rw-c8q3 (CVE pending)

Signed-off-by: Stéphane Graber <[email protected]>

2026-09-24 18:48:50 -04:00

..

rsync.go

incusd: Don't follow symlinks when receiving migration data

2026-09-24 18:48:50 -04:00