fileflags: portable BSD chflags + Linux chattr implementation

Squash of pr-fileflags work, rebased onto 3.4.3.  Original branch had
12 commits walking through:

  1. apply rsync-patches/fileflags.diff (BSD-only --fileflags option)
  2. testsuite/fileflags.test
  3. CI fixes
  4. portable stat -f %f readback
  5. phase-1 security: fd-based chflags, sender filter, daemon refuse
  6. phase-2 security: dirfd-anchored force_change recovery
  7. phase-3 security: secure_relative_open bound to dest subtree
  8. --force-change rebalance: default to USR_IMMUTABLE only
  9. set_refuse_options POPT_BIT_SET fix
 10. user-visible regressions on non-chflags builds
 11. t_stub fd-based stubs + weak curr_dir
 12. Linux port via FS_IOC_{GET,SET}FLAGS

Squashed and rebased because 3.4.3 (CVE-2026-29518 + family) overlaps
heavily with the security work in phases 1-3 -- master added
do_chmod_at / do_lchown_at / secure_relative_open hardening that
duplicates the bits the fileflags patch needed.  The fileflags work
keeps the original do_chmod / do_lchown signatures (no UNUSED arg
addition), so master's _at variants and call sites are unchanged.

Resulting feature set:

  --fileflags        preserve file flags (chflags on BSD,
                     chattr {+d, +i, +a} on Linux).  SAFE_FILEFLAGS
                     mask (UF_NODUMP|UF_IMMUTABLE|UF_APPEND[|UF_HIDDEN])
                     applied by default; sender-supplied SF_* and
                     UF_NOUNLINK dropped to avoid DoS where a hostile
                     source pins permanent flags on the receiver.
  --unsafe-fileflags widens the mask to the full sender value.
  --force-change     clear USR_IMMUTABLE (UF_*) on dest files being
                     updated/deleted so the op can proceed.
  --force-uchange    alias for --force-change.
  --force-schange    also clear SYS_IMMUTABLE (SF_*); separate opt-in.
  --no-force-{u,s,}change to clear bits.

Implementation:

  - lib/fileflags.c: portable rsync_fchflags / rsync_fgetflags /
    rsync_lgetflags / stat_x_get_fileflags + BSD<->Linux bit
    translation.  Wire format is BSD bits.  Linux side does
    read-modify-write of just LINUX_WIRE_MASK so the kernel doesn't
    reject the call when fs-internal bits like FS_EXTENT_FL would
    otherwise be cleared.
  - stat_x grows a (fileflags, fileflags_cached) pair so the per-file
    open()+ioctl cost on Linux happens at most once per stat_x life.
    init_stat_x() in ifuncs.h zeroes both.
  - syscall.c do_unlink / do_rmdir / do_chmod / do_lchown / do_rename
    grow dirfd-anchored force_change recovery using
    force_change_open_parent / force_change_open_target / fchflags /
    fchmod / fchown / unlinkat / renameat.  The recovery opens via
    secure_relative_open(curr_dir, dirpart, O_RDONLY|O_DIRECTORY|
    O_NOFOLLOW) so RESOLVE_BENEATH (where available) bounds the
    operation to the destination subtree.  Symlinks rejected at open.
  - Daemon mode refuses fileflags / unsafe-fileflags / force-change /
    force-uchange / force-schange / no-force-uchange / no-force-schange
    by default; opt-in per-module via "refuse options = !fileflags".
  - set_refuse_options POPT_BIT_SET / POPT_BIT_CLR fix: the original
    rsync check was `op->argInfo == POPT_ARG_VAL` literal, which
    missed POPT_BIT_SET (= POPT_ARG_VAL|POPT_ARGFLAG_OR).  Refused
    bit-set options slipped through.  Now masks via POPT_ARG_MASK.
  - testsuite/fileflags.test picks chflags(1) or chattr(1) depending
    on what's available; on Linux it parses lsattr down to the
    transferable letters (a, d, i, u).  On Linux non-root the uchg
    portion self-skips (CAP_LINUX_IMMUTABLE required).
  - CI: fileflags removed from RSYNC_EXPECT_SKIPPED on Linux jobs;
    Cygwin keeps it (no chattr).
  - Linux ioctl path is gated behind autoconf check for
    FS_IOC_GETFLAGS / FS_IOC_SETFLAGS / FS_NODUMP_FL / FS_IMMUTABLE_FL
    / FS_APPEND_FL in <linux/fs.h>; falls through to "no fileflags
    support" if absent (older kernels, non-Linux non-BSD).

Verified on Linux/ext4: 59 passed / 2 skipped / 0 failed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: tridge

.github/workflows/cygwin-build.yml

@@ -39,7 +39,7 @@ jobs:
     - name: info
       run: bash -c '/usr/local/bin/rsync --version'
     - name: check
-      run: bash -c 'RSYNC_EXPECT_SKIPPED=acls-default,acls,bare-do-open-symlink-race,chdir-symlink-race,chmod-symlink-race,chown,daemon-chroot-acl,devices,dir-sgid,open-noatime,protected-regular,sender-flist-symlink-leak,simd-checksum,symlink-dirlink-basis make check'
+      run: bash -c 'RSYNC_EXPECT_SKIPPED=acls-default,acls,bare-do-open-symlink-race,chdir-symlink-race,chmod-symlink-race,chown,daemon-chroot-acl,devices,dir-sgid,fileflags,open-noatime,protected-regular,sender-flist-symlink-leak,simd-checksum,symlink-dirlink-basis make check'
     - name: ssl file list
       run: bash -c 'PATH="/usr/local/bin:$PATH" rsync-ssl --no-motd download.samba.org::rsyncftp/ || true'
     - name: save artifact

Makefile.in

@@ -40,7 +40,8 @@ GENFILES=configure.sh aclocal.m4 config.h.in rsync.1 rsync.1.html \
 HEADERS=byteorder.h config.h errcode.h proto.h rsync.h ifuncs.h itypes.h inums.h \
 	lib/pool_alloc.h lib/mdigest.h lib/md-defines.h
 LIBOBJ=lib/wildmatch.o lib/compat.o lib/snprintf.o lib/mdfour.o lib/md5.o \
-	lib/permstring.o lib/pool_alloc.o lib/sysacls.o lib/sysxattrs.o @LIBOBJS@
+	lib/permstring.o lib/pool_alloc.o lib/sysacls.o lib/sysxattrs.o \
+	lib/fileflags.o @LIBOBJS@
 zlib_OBJS=zlib/deflate.o zlib/inffast.o zlib/inflate.o zlib/inftrees.o \
 	zlib/trees.o zlib/zutil.o zlib/adler32.o zlib/compress.o zlib/crc32.o
 OBJS1=flist.o rsync.o generator.o receiver.o cleanup.o sender.o exclude.o \
@@ -53,7 +54,7 @@ popt_OBJS= popt/popt.o  popt/poptconfig.o \
 	popt/popthelp.o popt/poptparse.o popt/poptint.o
 OBJS=$(OBJS1) $(OBJS2) $(OBJS3) $(DAEMON_OBJ) $(LIBOBJ) @BUILD_ZLIB@ @BUILD_POPT@
 
-TLS_OBJ = tls.o syscall.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/permstring.o lib/sysxattrs.o @BUILD_POPT@
+TLS_OBJ = tls.o syscall.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/permstring.o lib/sysxattrs.o lib/fileflags.o @BUILD_POPT@
 
 # Programs we must have to run the test cases
 CHECK_PROGS = rsync$(EXEEXT) tls$(EXEEXT) getgroups$(EXEEXT) getfsdev$(EXEEXT) \
@@ -171,19 +172,19 @@ getgroups$(EXEEXT): getgroups.o
 getfsdev$(EXEEXT): getfsdev.o
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ getfsdev.o $(LIBS)
 
-TRIMSLASH_OBJ = trimslash.o syscall.o util2.o t_stub.o lib/compat.o lib/snprintf.o
+TRIMSLASH_OBJ = trimslash.o syscall.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/fileflags.o
 trimslash$(EXEEXT): $(TRIMSLASH_OBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(TRIMSLASH_OBJ) $(LIBS)
 
-T_UNSAFE_OBJ = t_unsafe.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o
+T_UNSAFE_OBJ = t_unsafe.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/fileflags.o
 t_unsafe$(EXEEXT): $(T_UNSAFE_OBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_UNSAFE_OBJ) $(LIBS)
 
-T_CHMOD_SECURE_OBJ = t_chmod_secure.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o
+T_CHMOD_SECURE_OBJ = t_chmod_secure.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o lib/fileflags.o
 t_chmod_secure$(EXEEXT): $(T_CHMOD_SECURE_OBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_CHMOD_SECURE_OBJ) $(LIBS)
 
-T_SECURE_RELPATH_OBJ = t_secure_relpath.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o
+T_SECURE_RELPATH_OBJ = t_secure_relpath.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o lib/fileflags.o
 t_secure_relpath$(EXEEXT): $(T_SECURE_RELPATH_OBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_SECURE_RELPATH_OBJ) $(LIBS)
 

compat.c

@@ -40,13 +40,15 @@ extern int checksum_seed;
 extern int basis_dir_cnt;
 extern int prune_empty_dirs;
 extern int protocol_version;
+extern int force_change;
 extern int protect_args;
 extern int preserve_uid;
 extern int preserve_gid;
 extern int preserve_atimes;
 extern int preserve_crtimes;
 extern int preserve_acls;
 extern int preserve_xattrs;
+extern int preserve_fileflags;
 extern int xfer_flags_as_varint;
 extern int need_messages_from_generator;
 extern int delete_mode, delete_before, delete_during, delete_after;
@@ -87,7 +89,7 @@ struct name_num_item *xattr_sum_nni;
 int xattr_sum_len = 0;
 
 /* These index values are for the file-list's extra-attribute array. */
-int pathname_ndx, depth_ndx, atimes_ndx, crtimes_ndx, uid_ndx, gid_ndx, acls_ndx, xattrs_ndx, unsort_ndx;
+int pathname_ndx, depth_ndx, atimes_ndx, crtimes_ndx, uid_ndx, gid_ndx, fileflags_ndx, acls_ndx, xattrs_ndx, unsort_ndx;
 
 int receiver_symlink_times = 0; /* receiver can set the time on a symlink */
 int sender_symlink_iconv = 0;	/* sender should convert symlink content */
@@ -589,6 +591,8 @@ void setup_protocol(int f_out,int f_in)
 		uid_ndx = ++file_extra_cnt;
 	if (preserve_gid)
 		gid_ndx = ++file_extra_cnt;
+	if (preserve_fileflags || (force_change && !am_sender))
+		fileflags_ndx = ++file_extra_cnt;
 	if (preserve_acls && !am_sender)
 		acls_ndx = ++file_extra_cnt;
 	if (preserve_xattrs)
@@ -752,6 +756,10 @@ void setup_protocol(int f_out,int f_in)
 			fprintf(stderr, "Both rsync versions must be at least 3.2.0 for --crtimes.\n");
 			exit_cleanup(RERR_PROTOCOL);
 		}
+		if (!xfer_flags_as_varint && preserve_fileflags) {
+			fprintf(stderr, "Both rsync versions must be at least 3.2.0 for --fileflags.\n");
+			exit_cleanup(RERR_PROTOCOL);
+		}
 		if (am_sender) {
 			receiver_symlink_times = am_server
 			    ? strchr(client_info, 'L') != NULL

configure.ac

@@ -13,7 +13,7 @@ AC_CHECK_HEADERS(sys/fcntl.h sys/select.h fcntl.h sys/time.h sys/unistd.h \
     sys/acl.h acl/libacl.h attr/xattr.h sys/xattr.h sys/extattr.h dl.h \
     popt.h popt/popt.h linux/falloc.h netinet/in_systm.h netgroup.h \
     zlib.h xxhash.h openssl/md4.h openssl/md5.h zstd.h lz4.h sys/file.h \
-    bsd/string.h)
+    bsd/string.h linux/fs.h)
 AC_CHECK_HEADERS([netinet/ip.h], [], [], [[#include <netinet/in.h>]])
 AC_HEADER_MAJOR_FIXED
 
@@ -928,6 +928,35 @@ AC_PREPROC_IFELSE([AC_LANG_SOURCE([[
     ]
 )
 
+AC_MSG_CHECKING([for FS_IOC_GETFLAGS])
+AC_PREPROC_IFELSE([AC_LANG_SOURCE([[
+        #include <sys/ioctl.h>
+        #ifdef HAVE_LINUX_FS_H
+        #include <linux/fs.h>
+        #endif
+        #ifndef FS_IOC_GETFLAGS
+        #error FS_IOC_GETFLAGS is missing
+        #endif
+        #ifndef FS_IOC_SETFLAGS
+        #error FS_IOC_SETFLAGS is missing
+        #endif
+        #ifndef FS_NODUMP_FL
+        #error FS_NODUMP_FL is missing
+        #endif
+        #ifndef FS_IMMUTABLE_FL
+        #error FS_IMMUTABLE_FL is missing
+        #endif
+        #ifndef FS_APPEND_FL
+        #error FS_APPEND_FL is missing
+        #endif
+    ]])], [
+        AC_MSG_RESULT([yes])
+        AC_DEFINE([HAVE_FS_IOC_GETFLAGS], [1], [Define if FS_IOC_GETFLAGS / FS_IOC_SETFLAGS ioctls are available (Linux chattr-style file flags).])
+    ], [
+        AC_MSG_RESULT([no])
+    ]
+)
+
 AC_MSG_CHECKING([for FALLOC_FL_ZERO_RANGE])
 AC_PREPROC_IFELSE([AC_LANG_SOURCE([[
         #define _GNU_SOURCE 1

delete.c

@@ -25,6 +25,7 @@
 extern int am_root;
 extern int make_backups;
 extern int max_delete;
+extern int force_change;
 extern char *backup_dir;
 extern char *backup_suffix;
 extern int backup_suffix_len;
@@ -97,6 +98,10 @@ static enum delret delete_dir_contents(char *fname, uint16 flags)
 		}
 
 		strlcpy(p, fp->basename, remainder);
+#ifdef SUPPORT_FORCE_CHANGE
+		if (force_change)
+			make_mutable(fname, fp->mode, F_FFLAGS(fp), force_change);
+#endif
 		if (!(fp->mode & S_IWUSR) && !am_root && fp->flags & FLAG_OWNED_BY_US)
 			do_chmod_at(fname, fp->mode | S_IWUSR);
 		/* Save stack by recursing to ourself directly. */
@@ -144,6 +149,16 @@ enum delret delete_item(char *fbuf, uint16 mode, uint16 flags)
 	if (S_ISDIR(mode) && !(flags & DEL_DIR_IS_EMPTY)) {
 		/* This only happens on the first call to delete_item() since
 		 * delete_dir_contents() always calls us w/DEL_DIR_IS_EMPTY. */
+#ifdef SUPPORT_FORCE_CHANGE
+		if (force_change) {
+			STRUCT_STAT st;
+			if (x_lstat(fbuf, &st, NULL) == 0) {
+				uint32 ff = rsync_lgetflags(fbuf, st.st_mode, &st);
+				if (ff != NO_FFLAGS)
+					make_mutable(fbuf, st.st_mode, ff, force_change);
+			}
+		}
+#endif
 		ignore_perishable = 1;
 		/* If DEL_RECURSE is not set, this just reports emptiness. */
 		ret = delete_dir_contents(fbuf, flags);

flist.c

@@ -52,6 +52,7 @@ extern int preserve_links;
 extern int preserve_hard_links;
 extern int preserve_devices;
 extern int preserve_specials;
+extern int preserve_fileflags;
 extern int delete_during;
 extern int missing_args;
 extern int eol_nulls;
@@ -388,6 +389,9 @@ static void send_file_entry(int f, const char *fname, struct file_struct *file,
 	static time_t crtime;
 #endif
 	static mode_t mode;
+#ifdef SUPPORT_FILEFLAGS
+	static uint32 fileflags;
+#endif
 #ifdef SUPPORT_HARD_LINKS
 	static int64 dev;
 #endif
@@ -431,6 +435,14 @@ static void send_file_entry(int f, const char *fname, struct file_struct *file,
 		xflags |= XMIT_SAME_MODE;
 	else
 		mode = file->mode;
+#ifdef SUPPORT_FILEFLAGS
+	if (preserve_fileflags) {
+		if (F_FFLAGS(file) == fileflags)
+			xflags |= XMIT_SAME_FLAGS;
+		else
+			fileflags = F_FFLAGS(file);
+	}
+#endif
 
 	if (preserve_devices && IS_DEVICE(mode)) {
 		if (protocol_version < 28) {
@@ -592,6 +604,10 @@ static void send_file_entry(int f, const char *fname, struct file_struct *file,
 #endif
 	if (!(xflags & XMIT_SAME_MODE))
 		write_int(f, to_wire_mode(mode));
+#ifdef SUPPORT_FILEFLAGS
+	if (preserve_fileflags && !(xflags & XMIT_SAME_FLAGS))
+		write_int(f, (int)fileflags);
+#endif
 	if (atimes_ndx && !S_ISDIR(mode) && !(xflags & XMIT_SAME_ATIME))
 		write_varlong(f, atime, 4);
 	if (preserve_uid && !(xflags & XMIT_SAME_UID)) {
@@ -686,6 +702,9 @@ static struct file_struct *recv_file_entry(int f, struct file_list *flist, int x
 	static time_t crtime;
 #endif
 	static mode_t mode;
+#ifdef SUPPORT_FILEFLAGS
+	static uint32 fileflags;
+#endif
 #ifdef SUPPORT_HARD_LINKS
 	static int64 dev;
 #endif
@@ -803,6 +822,10 @@ static struct file_struct *recv_file_entry(int f, struct file_list *flist, int x
 #ifdef SUPPORT_CRTIMES
 			if (crtimes_ndx)
 				crtime = F_CRTIME(first);
+#endif
+#ifdef SUPPORT_FILEFLAGS
+			if (preserve_fileflags)
+				fileflags = F_FFLAGS(first);
 #endif
 			if (preserve_uid)
 				uid = F_OWNER(first);
@@ -887,6 +910,10 @@ static struct file_struct *recv_file_entry(int f, struct file_list *flist, int x
 
 	if (chmod_modes && !S_ISLNK(mode) && mode)
 		mode = tweak_mode(mode, chmod_modes);
+#ifdef SUPPORT_FILEFLAGS
+	if (preserve_fileflags && !(xflags & XMIT_SAME_FLAGS))
+		fileflags = (uint32)read_int(f);
+#endif
 
 	if (preserve_uid && !(xflags & XMIT_SAME_UID)) {
 		if (protocol_version < 30)
@@ -1068,6 +1095,10 @@ static struct file_struct *recv_file_entry(int f, struct file_list *flist, int x
 	}
 #endif
 	file->mode = mode;
+#ifdef SUPPORT_FILEFLAGS
+	if (preserve_fileflags)
+		F_FFLAGS(file) = fileflags;
+#endif
 	if (preserve_uid)
 		F_OWNER(file) = uid;
 	if (preserve_gid) {
@@ -1481,6 +1512,14 @@ struct file_struct *make_file(const char *fname, struct file_list *flist,
 	}
 #endif
 	file->mode = st.st_mode;
+#if defined SUPPORT_FILEFLAGS || defined SUPPORT_FORCE_CHANGE
+	if (fileflags_ndx) {
+		/* On BSD st.st_flags is free; on Linux the helper does an
+		 * open()+ioctl() per file -- but only when fileflags_ndx is
+		 * set, which only happens with --fileflags / --force-change. */
+		F_FFLAGS(file) = rsync_lgetflags(fname, st.st_mode, &st);
+	}
+#endif
 	if (preserve_uid)
 		F_OWNER(file) = st.st_uid;
 	if (preserve_gid)

generator.c

@@ -43,10 +43,13 @@ extern int preserve_devices;
 extern int preserve_specials;
 extern int preserve_hard_links;
 extern int preserve_executability;
+extern int preserve_fileflags;
+extern int preserve_unsafe_fileflags;
 extern int preserve_perms;
 extern int preserve_mtimes;
 extern int omit_dir_times;
 extern int omit_link_times;
+extern int force_change;
 extern int delete_mode;
 extern int delete_before;
 extern int delete_during;
@@ -492,6 +495,13 @@ int unchanged_attrs(const char *fname, struct file_struct *file, stat_x *sxp)
 			return 0;
 		if (perms_differ(file, sxp))
 			return 0;
+#ifdef SUPPORT_FILEFLAGS
+		if (preserve_fileflags) {
+			uint32 current = stat_x_get_fileflags(sxp, fname);
+			if (current != filter_recv_fileflags(F_FFLAGS(file), current))
+				return 0;
+		}
+#endif
 		if (ownership_differs(file, sxp))
 			return 0;
 #ifdef SUPPORT_ACLS
@@ -553,6 +563,13 @@ void itemize(const char *fnamecmp, struct file_struct *file, int ndx, int statre
 			iflags |= ITEM_REPORT_OWNER;
 		if (gid_ndx && !(file->flags & FLAG_SKIP_GROUP) && sxp->st.st_gid != (gid_t)F_GROUP(file))
 			iflags |= ITEM_REPORT_GROUP;
+#ifdef SUPPORT_FILEFLAGS
+		if (preserve_fileflags && !S_ISLNK(file->mode)) {
+			uint32 current = stat_x_get_fileflags(sxp, fnamecmp);
+			if (current != filter_recv_fileflags(F_FFLAGS(file), current))
+				iflags |= ITEM_REPORT_FFLAGS;
+		}
+#endif
 #ifdef SUPPORT_ACLS
 		if (preserve_acls && !S_ISLNK(file->mode)) {
 			if (!ACL_READY(*sxp))
@@ -1460,6 +1477,10 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 		if (!preserve_perms) { /* See comment in non-dir code below. */
 			file->mode = dest_mode(file->mode, sx.st.st_mode, dflt_perms, statret == 0);
 		}
+#ifdef SUPPORT_FORCE_CHANGE
+		if (force_change && !preserve_fileflags)
+			F_FFLAGS(file) = stat_x_get_fileflags(&sx, fname);
+#endif
 		if (statret != 0 && basis_dir[0] != NULL) {
 			int j = try_dests_non(file, fname, ndx, fnamecmpbuf, &sx, itemizing, code);
 			if (j == -2) {
@@ -1502,6 +1523,11 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 		 * readable and writable permissions during the time we are
 		 * putting files within them.  This is then restored to the
 		 * former permissions after the transfer is done. */
+#ifdef SUPPORT_FORCE_CHANGE
+		if (force_change && F_FFLAGS(file) & force_change
+		 && make_mutable(fname, file->mode, F_FFLAGS(file), force_change))
+			need_retouch_dir_perms = 1;
+#endif
 #ifdef HAVE_CHMOD
 		if (!am_root && (file->mode & S_IRWXU) != S_IRWXU && dir_tweaking) {
 			mode_t mode = file->mode | S_IRWXU;
@@ -1540,6 +1566,10 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
 		int exists = statret == 0 && stype != FT_DIR;
 		file->mode = dest_mode(file->mode, sx.st.st_mode, dflt_perms, exists);
 	}
+#ifdef SUPPORT_FORCE_CHANGE
+	if (force_change && !preserve_fileflags)
+		F_FFLAGS(file) = stat_x_get_fileflags(&sx, fname);
+#endif
 
 #ifdef SUPPORT_HARD_LINKS
 	if (preserve_hard_links && F_HLINK_NOT_FIRST(file)
@@ -2124,10 +2154,23 @@ static void touch_up_dirs(struct file_list *flist, int ndx)
 				st.st_mtime = file->modtime;
 #ifdef ST_MTIME_NSEC
 				st.ST_MTIME_NSEC = F_MOD_NSEC_or_0(file);
+#endif
+#ifdef SUPPORT_FORCE_CHANGE
+				st.st_mode = file->mode;
+#ifdef HAVE_CHFLAGS
+				/* Tell set_times' try_a_force_change there's nothing
+				 * to bypass yet; the real flags come from rsync_lgetflags.
+				 * On Linux STRUCT_STAT has no st_flags so this is a no-op. */
+				st.st_flags = 0;
+#endif
 #endif
 				set_times(fname, &st);
 			}
 		}
+#ifdef SUPPORT_FORCE_CHANGE
+		if (force_change && F_FFLAGS(file) & force_change)
+			undo_make_mutable(fname, F_FFLAGS(file));
+#endif
 		if (counter >= loopchk_limit) {
 			if (allowed_lull)
 				maybe_send_keepalive(time(NULL), MSK_ALLOW_FLUSH);

ifuncs.h

@@ -76,6 +76,10 @@ static inline void
 init_stat_x(stat_x *sx_p)
 {
 	sx_p->crtime = 0;
+#ifdef SUPPORT_FILEFLAGS
+	sx_p->fileflags = 0;
+	sx_p->fileflags_cached = 0;
+#endif
 #ifdef SUPPORT_ACLS
 	sx_p->acc_acl = sx_p->def_acl = NULL;
 #endif