[seks99x]

When make_backup_inner() in backup.c backs up a symlink, it constructs a file_struct via make_file() and attempts link_or_rename(). If link_or_rename() fails (such as during a parent-directory swap race) make_backup_inner() falls back to recreating the symlink on disk via do_symlink_at(). Because F_SYMLINK(file) holds the unmunged target and do_symlink_at() did not perform munging, its created with the daemons running UID. root-owned/trsuted symlink could occur on the disk/daemon-module which could break the trusted symlink idea.

Fix: Centralize Munging in do_symlink_at()
Rather than scattering SYMLINK_PREFIX checks across individual callers like make_backup_inner(), we need to centralize symlink munging directly at the syscall wrapper boundary in do_symlink_at():

• Whenever munge_symlinks is active ( which is active by default in non-chroot daemon modules ), do_symlink_at() check whether the target lnk already begins with SYMLINK_PREFIX (/rsyncd-munged/).
• If lnk is not already prefixed, the wrapper prepends SYMLINK_PREFIX before invoking symlinkat()(returning ENAMETOOLONG if the combined length exceeds MAXPATHLEN).
• Links that were already munged by recv_file_entry() are not double-munged, while any internal code path that creates a symlink from an in-memory file_struct (such as make_backup_inner()) is guaranteed to never write an unmunged symlink to disk.

Tests

• Added testsuite/backup-munge-symlinks_test.py to verify that backup symlinks created via the make_backup_inner() fallback under a parent-swap race are properly prefixed with /rsyncd-munged/.
• Updated testsuite/filter-leak_test.py and testsuite/files-from-leak_test.py so their setup preconditions treat munged root-owned backup symlinks as mitigated rather than a test setup failure.