master at 7fef1c8 (includes #1054), Linux.
Inside a user namespace that does not map the host's root uid, /proc/self and /dev/fd stat as the overflow uid, and ona_open() refuses to follow them. The /dev/fd/N path that shell process substitution produces therefore still fails there, although #1054 made it work outside:
$ unshare --user --map-root-user --mount --pid --fork --mount-proc bash -c '
stat -c "%u %n" /proc/self /dev/fd
rsync -a --exclude-from=<(printf "skip\n") src/ dst/; echo rc=$?'
65534 /proc/self
65534 /dev/fd
refusing to follow a symlink owned by an untrusted user; use --insecure-links locally or "insecure links = yes" in a daemon module ONLY if every path component is trusted
rsync: [client] failed to open exclude file /dev/fd/63: Too many levels of symbolic links (40)
rsync error: error in file IO (code 11) at exclude.c(1719) [client=3.5.0]
rc=11
The same command outside the namespace exits 0.
Also reproduced under bubblewrap and in a rootless podman container. Under bubblewrap the sandbox's own /dev/fd is owned by the sandbox user and only /proc/self reports the overflow uid, and the command fails the same way, so the refusal is at /proc/self:
65534 /proc/self
1000 /dev/fd
#1048 added an exemption for exactly these two links, but only while pin_transit is set, i.e. under --confine-root (int namespace_pin = pin_transit && ... in syscall.c). The unconfined walk added by #1054 goes through the same two links without it.
Debian builds packages in sbuild's unshare mode, where the pseudo-paths and read-batch-pipe tests fail with the message above.
--insecure-links makes the command succeed, at the cost of disabling the symlink check for every path in that run.
master at 7fef1c8 (includes #1054), Linux.
Inside a user namespace that does not map the host's root uid, /proc/self and /dev/fd stat as the overflow uid, and ona_open() refuses to follow them. The /dev/fd/N path that shell process substitution produces therefore still fails there, although #1054 made it work outside:
The same command outside the namespace exits 0.
Also reproduced under bubblewrap and in a rootless podman container. Under bubblewrap the sandbox's own /dev/fd is owned by the sandbox user and only /proc/self reports the overflow uid, and the command fails the same way, so the refusal is at /proc/self:
#1048 added an exemption for exactly these two links, but only while
pin_transitis set, i.e. under --confine-root (int namespace_pin = pin_transit && ...in syscall.c). The unconfined walk added by #1054 goes through the same two links without it.Debian builds packages in sbuild's unshare mode, where the pseudo-paths and read-batch-pipe tests fail with the message above.
--insecure-links makes the command succeed, at the cost of disabling the symlink check for every path in that run.