https://seclists.org/oss-sec/2026/q3/529: rsyslog: omfile dynaFile containment hardening (GHSA-xmp9-244p-5ggv)
Affected Software
Frequently Asked Questions
Which deployments need to assess this most closely?
Assess rsyslog configurations that use the omfile module with dynaFile, particularly where dynamic values can influence output paths. Deployments that intentionally allow paths outside a single static base directory are the relevant compatibility-sensitive cases.
Does the hardening constrain dynamic paths by default?
Where rsyslog can determine a static base path, the hardening adds default lexical containment. Earlier flexible behavior remained the default to avoid breaking existing logging configurations and did not provide a clear warning about path-containment risk.
What if an existing configuration intentionally requires paths to escape the base directory?
The hardening provides an explicit per-action compatibility opt-in for configurations that intentionally require path escape. This preserves the needed flexible behavior without making it the implicit default for applicable actions.
What can be done to reduce risk when unrestricted dynamic paths are not required?
Use the documented secure configuration mechanisms to constrain dynamic output paths. Those mechanisms were already the recommended approach for dynaFile configurations.
How can administrators identify configurations needing review?
Review omfile actions that use dynaFile and determine whether their generated filenames must remain under a static base path or intentionally escape it. The current hardening also adds diagnostics for the relevant dynamic-filename handling.