* SECURITY UPDATE: symlink attack on the daemon module-root chdir - debian/patches/els/0031-CVE-2026-53784.patch: add safe_open_no_attacker_symlinks() in util.c and confine the daemon module-root chdir under use-chroot=no. els/0006 had hardened only the relative branch of change_dir(); the absolute branch was still on a plain chdir(dir) - CVE-2026-53784 * SECURITY UPDATE: information disclosure and arbitrary write via symlinks planted on operator-supplied paths - debian/patches/els/0032-CVE-2026-53802-CVE-2026-53803.patch: open the secrets file, "pid file", --config, motd, --password-file, --log-file, --write-batch/--read-batch and the filter, merge-file, --exclude-from/--include-from paths through safe_open_no_attacker_symlinks() - debian/patches/els/0037-CVE-2026-53802-files-from.patch: the same for --files-from, which is opened in options.c and which upstream converted separately, in 3ee00e00 - CVE-2026-53802 - CVE-2026-53803 * SECURITY UPDATE: arbitrary file write via an absolute --temp-dir or --link-dest whose parent is flipped to a symlink mid-operation - debian/patches/els/0033-CVE-2026-53795.patch: confine do_rename() and do_link() in syscall.c through an ownership walk on the pinned parent directory fd - debian/patches/els/0039-CVE-2026-53795-exdev.patch: confine the same way the copy_file() opens and the do_unlink() that robust_rename() falls back to when the rename returns EXDEV, i.e. when an absolute --temp-dir or --partial-dir is on another filesystem (upstream bf79a2a0) - CVE-2026-53795 * These four CVEs were previously assessed as requiring the 3.5.0 path resolution rewrite (54965efc, defd7110, b62d7ed6) and closed Won't Fix. That assessment was wrong for CVE-2026-53784/53802/53803: upstream fixed them on 2026-06-12 in a7c49e93, f2941575, 9bfa07e3 and 62bf55fc, nine days before the rewrite and independent of it. CVE-2026-53795 does depend on the rewrite; els/0033 covers only the two sinks it names and documents what it leaves out * SECURITY UPDATE: TOCTOU on the non-daemon receiver's destination chdir - debian/patches/els/0034-CVE-2026-53796.patch: resolve the operator-named destination through safe_open_no_attacker_symlinks() + fchdir, for both the absolute and the relative branch of change_dir() - CVE-2026-53796 * SECURITY UPDATE: path confinement bypass for a daemon module with a /./ inner boundary marker - debian/patches/els/0035-CVE-2026-53793.patch: widen the four daemon symlink-confinement gates from "am_daemon && !am_chrooted" to "am_daemon && (!am_chrooted || module_dirlen)" so an inner module root is treated as the trust boundary - debian/patches/els/0040-CVE-2026-53793-basis-paths.patch: extend that boundary to the two alternate-basis paths the gates do not reach -- the generator's alt-dest basis stat (upstream 5ed0ab3f) and the peer-supplied basis xname the receiver joins to an operator basedir (upstream db284e22) - CVE-2026-53793 * SECURITY UPDATE: symlink race in the non-daemon sender's source traversal - debian/patches/els/0036-CVE-2026-53797.patch: open file content through secure_relative_open() anchored at the transfer root under default symlink handling, so a raced parent symlink cannot redirect the read - debian/patches/els/0038-CVE-2026-53797-noatime.patch: apply O_NOATIME in secure_relative_open() as do_open() did, so --noatime keeps working on that open (and on the els/0006 daemon-sender one) - CVE-2026-53797 * The three above come from openSUSE's backport of the same upstream commits to rsync 3.2.3 (openSUSE:Leap:15.5:Update/rsync.45907, hardening patches 0108, 0107 and 0100). Four further CVEs from this disclosure remain open against the package and are NOT addressed: CVE-2026-53785, CVE-2026-53801 and CVE-2026-70460 need the 3.5.0 held-dirfd resolver (upstream 3dddbde5; openSUSE 0093/0094/0101 pull in held_dfd_for, link_stat_at, do_mkdir_at and do_chmod_atfd), and CVE-2026-53799 needs the fd-based ACL/xattr family (openSUSE 0118-0124, ~3300 lines incl. libacl and configure work) * els/0037-0040 answer the code review of GitLab MR secure-libraries/els-os/rsync!30: two of them close real gaps in the patches above (--files-from, the EXDEV fallback), one restores --noatime, and one completes the inner-module boundary. Each is a distinct upstream commit, so each is a distinct patch rather than an edit of the patch it follows * The upstream regression tests named in the patch headers are not carried: upstream ships them only as pytest testsuite/*_test.py files and 3.1.3 has no pytest harness