Openrsync imported into the tree
&gt; <i>The actual work of porting, however, is matching the security features provided by OpenBSD&#x27;s pledge(2) and unveil(2). These are critical elements to the functionality of the system. Without them, your system accepts arbitrary data from the public network. ... rsync has specific running modes for the super-user. It also pumps arbitrary data from the network onto your file-system. Do you want that running without specific mitigation in place?</i><p>This is a confusing claim. What exactly does &quot;accepts arbitrary data from the public network&quot; mean? (Most servers do that, they just choose not to <i>process</i> the data without additional validation.) And in what way is it critical to the <i>functionality</i> of the system?<p>Is the claim that, after calling pledge() and unveil(), the openrsync process is happy to satisfy arbitrary read&#x2F;write requests from the other side of the connection, and so without them it is insecure?<p>Does openrsync view peer-induced memory corruption after pledge() or unveil() as a vulnerability? Or is the idea that the attacker can already &quot;pump arbitrary data from the network onto your filesystem&quot; and that the attacker gaining control flow is not a meaningful escalation of privileges?<p>My impression is that pledge() and unveil() are <i>hardening</i> tools, intended to limit the damage from a process that has already gotten out of control (in the same way that e.g. running Apache as non-root does not mean that you&#x27;re actively fine letting attackers run code as www-data). Is that impression wrong? Is openrsync using them for the basic functionality of making sure that a file is only being rsynced to the filename given on the command line?