What's wrong with this entry?
Anonymous. No account, no email.
What
The file-history rewind (checkpoint restore) function now uses low-level file descriptors with O_NOFOLLOW to safely read backup files and write destination files, detecting symlink injection, hard links, FIFO substitution, and identity changes during the restore.
Details
- Backup source is opened with
O_RDONLY | O_NOFOLLOW | O_NONBLOCK;ELOOP/EMLINKmeans the backup became a symlink — restore is refused - Destination is opened with
O_WRONLY | O_CREAT | O_NOFOLLOW | O_NONBLOCK - Checks
nlink > 1and refuses to overwrite hard-linked files - Verifies
/proc/self/fd/<n>path matches the expected parent directory (Linux only) - Re-verifies
dev/inoidentity after opening, before truncating and writing - Returns
{ filesChanged, skippedLinks }instead of just an array; skipped-links count is surfaced to the caller
Evidence
Restore implementation (search for "FileHistory: [Rewind] Refusing to delete" or "destination is hard-linked").
Strings lifted out of the shipped bundle, so the claim above can be checked against them.