Hi.
The current version of rsync is 3.4.1, from stable to sid. It was
released on 2025-01-16. That means it includes the following commit:
commit 0590b09d9a34ae72741b91ec0708a820650198b0
Author: Andrew Tridgell <andrew@tridgell.net>
Date: 2024-12-18 08:59:42 +1100
fixed symlink race condition in sender
when we open a file that we don't expect to be a symlink use
O_NOFOLLOW to prevent a race condition where an attacker could change
a file between being a normal file and a symlink
but not this one:
commit 992e10efaf42d9ec3dd43431350accf1becc1d00
Author: Krzysztof Płocharz <krzysztof@plocharz.info>
Date: 2025-01-27 17:20:47 +0100
Fix --open-noatime option not working on files
atime of source files could sometimes be overwritten
even though --open-noatime option was used.
To fix that, optional O_NOATIME flag was added
to do_open_nofollow which is also used to open regular
files since fix:
"fixed symlink race condition in sender"
Previously optional O_NOATIME flag was only in do_open.
As a result, the --open-noatime is broken (except when copying symlinks
targets).
Please consider applying the second commit to the Debian version.
Regards,