v2.6.15

This release closes an rsync --delete gap where an unscoped destination, including one that came from empty variables, was allowed at every protection level.

Added

• Added an rsync.delete rule that blocks rsync delete modes (--delete, --del, and abbreviations such as --delete-af) when the destination is outside the current directory, outside a trusted temp root, or supplied through a variable. Mirroring inside the workspace or between trusted temp paths stays allowed, except under paranoid rm, which blocks it too. (#271)
• Added catastrophic handling for rsync delete destinations: root, ~, and $HOME are denied as rm.recursive-force-root-or-home, and a .git destination is denied as rm.git-metadata. Neither denial can be turned off by policy.

Changed

• Changed rsync into a built-in analyzed command, so wrappers such as timeout and nice hand off to the new analysis, and rsync can no longer be listed in transparent_wrappers.
• Changed destination detection to fail closed: every operand after the source is checked as a possible destination, options placed after the operands or after -- are still read, and -n/--dry-run is evaluated like a real run. Remote destinations such as user@host:/path are skipped. Set rsync.delete to off if a multi-source command is too strictly blocked.

Fixed

• Fixed find {,} -delete being allowed: an empty brace expansion no longer counts as a scoped delete target.