rclone (local backend, --links): When rclone copies from an untrusted remote with --links, it recreates symlinks

Impact

When rclone copies from an untrusted remote with --links, it recreates symlinks without validating the target, so a malicious remote plants a link that makes rclone write outside the destination directory. On a data-ingest node that is arbitrary file write as the mover's user - enough to drop a file into a systemd unit or an authorized_keys path.

Who can reach it

Anyone who controls content on a remote that your rclone job syncs down with --links enabled. In a GPU cluster that includes tenant-writable buckets used as ingest sources.

What to do

Upgrade rclone to the fixed release. Drop --links from jobs that pull from any source a tenant can write to, and run ingest jobs as an unprivileged user in a directory that contains nothing security-relevant.

References