rsyslog: omfile dynaFile containment hardening (GHSA-xmp9-244p-5ggv)

[Rainer Gerhards <rgerhards () hq adiscon com>]

Hello,

rsyslog has published GHSA-xmp9-244p-5ggv covering hardening of
dynamic filename handling in the omfile output module:

https://github.com/rsyslog/rsyslog/security/advisories/GHSA-xmp9-244p-5ggv

The affected area is omfile configurations that use dynaFile. Dynamic
filenames are intentionally flexible: some established deployments
need that flexibility, including paths that cannot be restricted to
one static base directory. Consequently, preserving this mode is
important for compatibility.

Historically, configurations using this flexible behavior did not
provide a clear warning about the associated path-containment risk.
The secure configuration mechanisms have always been documented as the
recommended way to constrain dynamic output paths, but the legacy
behavior remained the default to avoid silently breaking existing
logging configurations.

The current hardening adds default lexical containment where a static
base path can be determined, together with diagnostics and an
explicit, per-action compatibility opt-in for configurations that
intentionally require path escape. This provides an additional
containment layer for users who need dynaFile flexibility; it is not
presented as a complete filesystem sandbox.

For deployments where untrusted data can influence dynamic filename
expansion, the recommended mitigation is to use the documented secure
path options, including securepath and the secpath-drop or
secpath-replace policies. These options are the reliable security
boundary and should be applied by affected users. Building a
universally complete sandbox around all legacy dynamic-path semantics
would be difficult to do reliably and would risk breaking legitimate
existing configurations.

The advisory intentionally avoids unnecessary reproduction details.
The attached patch is provided for downstream maintainers.

Regards,
Rainer Gerhards
rsyslog project

Attachment: 0001-omfile-harden-dynafile-default-containment.patch
Description: