> I tried to find options for tar to make this safe (ie. but not > extracting symlinks), but couldn't find any. Tar doesn't follow symlinks when creating an archive.. it shouldn't follow them when extracting it either. Of course: this would make tar slower, as the kernel doesn't support checking this automatically (open(2)'s O_NOFOLLOW isn't useful for this as it checks just the final path component).