How to copy files to a sudo-protected path with rsync

Root-owned deployment trees should not become writable by the account used for file transfer. A restricted remote receiver lets rsync update one approved directory while the login account remains unable to run arbitrary commands as root.

The rrsync helper validates server-mode requests and anchors every accepted path under a fixed directory. A root-owned wrapper supplies the remote command to rrsync after rejecting unexpected argument characters, while write-only mode, deletion blocking, and symlink munging narrow what the receiver can do.

Use a dedicated SSH key for the deployment account and prepare the protected directory before applying the elevation rule. The client addresses the receiver's restricted root rather than the server filesystem root, and both traversal outside that root and direct sudo access to the rsync binary must fail.

1. Confirm that rrsync is installed on the remote server.

   $ ssh deploy@server.example.com 'command -v rrsync'
   /usr/bin/rrsync

   The wrapper below uses this exact path. Adjust /usr/bin/rrsync in the wrapper only when the remote package installs it elsewhere.

2. Check the protected destination before granting elevated access.

   $ ssh deploy@server.example.com 'stat -c "%A %U:%G %n" /srv/www/app'
   drwxr-xr-x root:root /srv/www/app

   The deploy account has no write bit on this root-owned directory.

3. Create the receiver wrapper as an administrator on the remote server.

   /usr/local/sbin/rsync-deploy

   #!/usr/bin/python3
    
   import os
   import re
   import sys
    
   RESTRICTED_DIR = "/srv/www/app"
   SAFE_ARGUMENT = re.compile(r"^[A-Za-z0-9_.,=+:/@%*~-]+$")
    
    
   def fail(message: str) -> None:
       print(f"rsync-deploy: {message}", file=sys.stderr)
       raise SystemExit(64)
    
    
   remote_args = sys.argv[1:]
    
   if os.geteuid() != 0:
       fail("must run through sudo")
    
   if not remote_args or remote_args[0] != "--server":
       fail("receiver mode is required")
    
   if any(not SAFE_ARGUMENT.fullmatch(arg) for arg in remote_args):
       fail("unsupported remote argument")
    
   os.environ["SSH_ORIGINAL_COMMAND"] = "rsync " + " ".join(remote_args)
   os.execv(
       "/usr/bin/rrsync",
       ["rrsync", "-wo", "-no-del", "-munge", RESTRICTED_DIR],
   )

   Keep this wrapper owned by root and non-writable by deploy. A deployment account that can replace the wrapper can replace the program that sudo runs as root.

4. Make the wrapper executable without granting write access to the deployment account.

   $ sudo chmod 0755 /usr/local/sbin/rsync-deploy

5. Grant passwordless sudo access to the wrapper only.

   /etc/sudoers.d/rsync-deploy

   deploy ALL=(root) NOPASSWD: /usr/local/sbin/rsync-deploy

   Do not grant deploy passwordless access to /usr/bin/rsync. The wrapper and rrsync path checks are the boundary that prevents an arbitrary root receiver.

6. Validate the sudoers file before opening a new deployment session.

   $ sudo visudo -cf /etc/sudoers.d/rsync-deploy
   /etc/sudoers.d/rsync-deploy: parsed OK

7. Confirm that the deployment account cannot start /usr/bin/rsync directly as root.

   $ ssh deploy@server.example.com 'sudo -n /usr/bin/rsync --version'
   sudo: a password is required

   The nonzero result is expected. Only /usr/local/sbin/rsync-deploy appears in the passwordless rule.

8. Test that rrsync rejects a destination outside the allowed subtree.

   $ ssh deploy@server.example.com 'sudo -n /usr/local/sbin/rsync-deploy --server . /../forbidden/'
   /usr/bin/rrsync error: do not use .. in arg (anchor the path at the root of your restricted dir)

   The deliberate traversal request must fail before a receiver starts.

9. Preview the release through the restricted receiver.

   $ rsync --archive --dry-run --itemize-changes --chown=root:root --rsync-path='sudo -n /usr/local/sbin/rsync-deploy' ./release/ deploy@server.example.com:/
   .d..t...... ./
   <f+++++++++ app.txt
   cd+++++++++ assets/
   <f+++++++++ assets/index.html

   The remote slash is the root of the rrsync restriction, not the server filesystem root. Review every itemized path before removing --dry-run.
   Related: How to preview rsync changes before syncing

10. Copy the reviewed release into the protected directory.

    $ rsync --archive --itemize-changes --chown=root:root --rsync-path='sudo -n /usr/local/sbin/rsync-deploy' ./release/ deploy@server.example.com:/
    .d..t...... ./
    <f+++++++++ app.txt
    cd+++++++++ assets/
    <f+++++++++ assets/index.html

11. Verify the receiver ownership on the transferred files.

    $ ssh deploy@server.example.com 'stat -c "%U:%G %n" /srv/www/app/app.txt /srv/www/app/assets/index.html'
    root:root /srv/www/app/app.txt
    root:root /srv/www/app/assets/index.html

12. Repeat the transfer as a checksum dry run through the same restricted receiver.

    $ rsync --archive --checksum --dry-run --itemize-changes --chown=root:root --rsync-path='sudo -n /usr/local/sbin/rsync-deploy' ./release/ deploy@server.example.com:/

    No output means rsync found no content or requested metadata changes, while the wrapper still confines the remote receiver to /srv/www/app.