Skip to content

v2025.2.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Feb 16:59
v2025.2.6
6ff9ea5

Changelog

v2025.2.6

💡 Features

  • Mkdir syscall (f25364d by desbma)
  • Track current dir (1d0080b by desbma)
  • Use current directory to resolve relative paths (b486593 by desbma)
  • Log whole syscall when handling fails (f8402d8 by desbma)
  • File system deny all + white list (502ca9d by desbma)
  • Filesystem exception whitelist merging (2263ab4 by desbma)
  • InaccessiblePaths systemd option (WIP) (aa76500 by desbma)
  • InaccessiblePaths dynamic whitelisting + auto merge options (53a3c10 by desbma)
  • Handle exec syscalls (31814d2 by desbma)
  • Support NoExecPaths systemd option + ExecPath whitelisting (dbf32a4 by desbma)
  • Handle PROT_EXEC memory mappings (16345ae by desbma)
  • Handle intermediate symlinks in all paths (3015caf by desbma)
  • Parse ELF header to get dynamic linker interpreter (6cef0c0 by desbma)
  • Parse shebang to handle exec'd scripts (1175415 by desbma)
  • Disable XxxPaths options if an exception for / makes them useless (4c97afb by desbma)
  • Auto remove .service suffix (1355caf by desbma)
  • Check for unsupported unit types (dd09b00 by desbma)
  • Losslessly simplify paths lists when length is below threshold (4307ef9 by desbma)
  • Prevent InaccessiblePaths/TemporaryFilesystem to be too easily disabled when / is read (WIP) (407876f by desbma)
  • Improve & re-enable InaccessiblePaths second option (cdba2f5 by desbma)
  • Improve null effect removal (f08380d by desbma)
  • Split option effects EmptyPath/RemovePath (5c6814c by desbma)
  • TemporaryFileSystem=xxx:ro & BindReadOnlyPaths=yyy support (191fb61 by desbma)
  • Go deeper when whitelisting with TemporaryFileSystem (d8b6ac5 by desbma)
  • Add systemd option whitelist for testing (1bd3d49 by desbma)
  • Prevent duplicate BindPaths/BindReadOnlyPaths exceptions + add tests for InaccessiblePaths (9c952b1 by desbma)
  • Log 'systemd-analyze security' "exposure level" (60d6309 by desbma)
  • More explicit error reporting (9d79ae3 by desbma)
  • Improve markdown option list output (f4f4c88 by desbma)
  • Detect another case of nullified option effect (5bd0532 by desbma)

🐛 Bug fixes

  • Absolute path computation (702ca50 by desbma)
  • Remove TODO obsolete comment (0b20d4b by desbma)
  • Test for char device defensively (65e8c74 by desbma)
  • Bind on port 0 handling (d81a660 by desbma)
  • InaccessiblePaths handling of Create and Exec action whitelisting (a358de9 by desbma)
  • Open with O_RDONLY (8014c66 by desbma)
  • Don't follow symlinks when resolving paths (de0d459 by desbma)
  • Open on symlink path (096fc4f by desbma)
  • Reading /dev/kmsg requires CAP_SYSLOG (2df9689 by desbma)
  • ProtectKernelLogs=true denies syslog (39e2aa4 by desbma)
  • PrivateDevices=true denies mknod and makes /dev noexec (7f5b3d5 by desbma)
  • Per option element '-' prefix (cc6fe8a by desbma)
  • Passing of network firewalling option (6d1a361 by desbma)
  • Bind port 0 (153531e by desbma)
  • tests: Dmesg tests depending on system logs (ed7f5cf by desbma)
  • Remove option negated by exception on / (023bb61 by desbma)
  • Sort paths (e2b75d5 by desbma)
  • Ensure paths in PATH env var are accessible (877f62a by desbma)
  • Don't make /proc or /run inaccessible (e66e342 by desbma)
  • Hide effect not incompatible with Create action (5cce1b1 by desbma)
  • Null effect removal inverted test (4c228df by desbma)
  • Debian man page names (4136bed by desbma)

🏃 Performance

  • Sort -> sort_unstable (a3bfba5 by desbma)
  • More &'static str conversion (5265b90 by desbma)

📗 Documentation

  • Add crates.io link & install instructions (8986cfb by desbma)
  • Improve description of --network-firewalling and --filesystem-whitelisting options (4f5a867 by desbma)
  • Add FAQ (8ab785e by desbma)
  • Comment typo (71548b6 by desbma)
  • Minor option description improvements (e39c0bc by desbma)
  • README: Add shh run examples (defe380 by desbma)

🧪 Testing

  • Fix sched_realtime integration test broken with Python 3.13 (4fa9d25 by desbma)
  • Add integration tests running systemd-run (b59c63d by desbma)
  • systemd-run: Log shh run options (efa12eb by desbma)
  • Simplify mmap W+X commands (2c83c5f by desbma)
  • Fix passing file via /tmp (b927803 by desbma)

🚜 Refactor

  • Simplify OptionValue::List (0e9a7fc by desbma)
  • Improve error handling for fd type conversions (db420d3 by desbma)
  • Add convenience constructors for PathDescription (f74cf59 by desbma)

🤖 Continuous integration

  • Enable systemd-run integration tests (c3b4d7f by desbma)

🧰 Miscellaneous tasks

  • Add cargo metadata & rename package to publish on crates.io (1214fee by desbma)
  • Lint (3763bc0 by desbma)
  • Update lints (418bb2a by desbma)
Assets 3
Loading