Why doesn't rsync have a chroot option when started via SSH?

[sagb]

Suppose you want a multiuser rsync server in a zero-trust environment. You need a chroot.

1. You could run rsync in daemon mode or "chain-proxy" as described under "USING RSYNC-DAEMON FEATURES VIA A REMOTE-SHELL CONNECTION" in the man rsync. The major drawback is its reliance on its own password authentication instead of today's industry-standard SSH keys. Even if you find a trick to overcome this, the overall setup would be a security headache.

2. Rsync in non-daemon mode can be started from a chroot by an external program. This means the user will see the executable and libraries lying around, which might confuse them or provoke them to tamper with these files and attempt to escape.

3. As a final nail in the coffin, you might start filtering user input, trying to restrict them to specific directories, either with rrsync or, say, GNU Rush regexes. This approach is quite naive and only viable in an enterprise setting, but not against targeted attacks on the internet.

The solution would be the capability to chroot+chdir+setuid without daemon mode, controlled by command-line options that are forcibly set by sshd or a restricted shell.

The downside is that you need to run rsync as root, either using the SUID bit or running it from the aforementioned Rush, which is SUID. To me, this seems more manageable than the scenarios described in points (1), (2), and (3).