#3621 PR `merged`: Add is_writable_only_by_owner function (improve trusted sourcing)¶

Labels: enhancement, fixed / solved / done, critical / security / legal

jsmeix opened issue at 2026-07-30 13:04:¶

Type: Enhancement
Impact: Critical
Reference to related issue (URL):

https://github.com/rear/rear/issues/3260
therein in particular
https://github.com/rear/rear/issues/3260#issuecomment-5131205171

How was this pull request tested?

Tested "rear mkrescue/mkbackup" and "rear recover"
on SLES 15 SP 6 with default btrfs structure
i.e. same kind of system as in
https://github.com/rear/rear/wiki/Test-Matrix-ReaR-2.8#sles-15-sp-6-with-default-btrfs-structure

Description of the changes in this pull request:

In _framework-setup-and-functions.sh
add is_writable_only_by_owner function to check
that none except the file owner has write permissions
and call that in the 'source' wrapper function
to improve enforcement of trusted sourcing.

For background information
how Gemini CLI helped me to make that function see
https://github.com/jsmeix/check_writable
therein in particular
https://github.com/jsmeix/check_writable/blob/main/check_writable.simplified.md

codacy-production commented at 2026-07-30 13:06:¶

Up to standards ✅¶

🟢 Issues 0 issues

>
> > **Results:** > `0` new issues > > [View in > Codacy](https://app.codacy.com/gh/rear/rear/pull-requests/3621/issues) >

_{NEW Get contextual insights on your PRs based on Codacy's
metrics, along with PR and Jira context, without leaving GitHub. Enable
AI
reviewer}
_{TIP This summary will be updated as you push new changes.}

jsmeix commented at 2026-07-31 12:34:¶

@gdha @pcahyna @rear/contributors
please review it (as time permits)
but - first and foremost - have a
relaxed and recovering weekend!

jsmeix commented at 2026-08-04 06:44:¶

I have to fix the logic.
Currently it is not right.

Reason:
Currently I misuse empty TRUSTED_OWNERS
in the is_writable_only_by_owner function
as a way out when some special file
is writable not only by its owner
but should be trusted nevertheless.

FWIW:
I had a bad feeling when I implemented that part
but that part was not my primary focus of mind
it was more like "I just need to do something here"
so the outcome was poor - but one (at least I) cannot
focus on more than one thing at a time...

Solution proposal:
My first idea was to introduce a separated

TRUSTED_FILES

config array where the user can specify files that are
trusted "as is" regardless of owner / path / permissions.
I didn't like the "yet another config variable" way
so I evaluated various other ideas but in the end
I always came back to my first idea to be the
most simple and straightforward solution
to allow any special cases.

jsmeix commented at 2026-08-04 12:32:¶

Tested "rear mkrescue+mkbackuponly" and "rear recover"
on SLES 15 SP 6 with default btrfs structure
in a "git clone" directory where I did

# chmod g+w usr/share/rear/init/default/001_verify_config_arrays.sh

plus in etc/rear/local.conf

TRUSTED_FILES=( '/root/rear.github.master.jsmeix-check_writable/usr/share/rear/init/default/001_verify_config_arrays.sh' )

because

# readlink -e usr/share/rear/init/default/001_verify_config_arrays.sh
/root/rear.github.master.jsmeix-check_writable/usr/share/rear/init/default/001_verify_config_arrays.sh

All works well.

Even "rear -D recover" just works because
within the ReaR recovery system:

RESCUE localhost:~ # find / -type f | grep '001_verify_config_arrays.sh'
/root/rear.github.master.jsmeix-check_writable/usr/share/rear/init/default/001_verify_config_arrays.sh

RESCUE localhost:~ # ls -l /usr/share/rear
lrwxrwxrwx 1 root root 66 Aug  4 13:21 /usr/share/rear -> ../../root/rear.github.master.jsmeix-check_writable/usr/share/rear

Sourcing it is reported in /var/log/rear/rear-localhost.log as

2026-08-04 14:16:49.489811775 Trusted sourcing '/usr/share/rear/init/default/001_verify_config_arrays.sh'

because the 'source' wrapper function
reports how it is called

function source () {
  { local source_file="$1"
    Debug "Trusted sourcing '$*'"

but the verfication functions
is_trusted_file is_trusted_owner is_writable_only_by_owner is_trusted_path
work with the actual file (i.e. with symlinks resolved).

jsmeix commented at 2026-08-04 12:35:¶

@gdha @pcahyna @rear/contributors
please review it (as time permits).

I would like to merge it on Thursday (06 July) afternoon
unless there are objections.

jsmeix commented at 2026-08-07 12:48:¶

Since
https://github.com/rear/rear/pull/3627
is merged the function 'is_writable_only_by_owner' is renamed into
'is_trusted_write' (abbreviation for 'is_trusted_write_permissions')
so all functions for trust checking have the same prefix 'is_trusted_'.

[Export of Github issue for rear/rear.]

#3621 PR merged: Add is_writable_only_by_owner function (improve trusted sourcing)¶