diff options
| author | Martin Pitt <martin.pitt@ubuntu.com> | 2016-06-22 13:22:47 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2016-06-22 13:22:47 +0200 |
| commit | 5cd118bab0c6f2f87236959b2a68098c5ba95c2e (patch) | |
| tree | 75d696d720f9bd6026c235dc8cf9b6eff6efa15c | |
| parent | 98471bf0fa040ead227630aee77cb3feb25cf3b0 (diff) | |
NEWS: start section for 231, with tmpfs.mount option changes (#3576)
This documents the "add nosuid and nodev options to tmp.mount" change from
commit 2f9df7c96a2.
| -rw-r--r-- | NEWS | 14 |
1 files changed, 14 insertions, 0 deletions
@@ -1,5 +1,19 @@ systemd System and Service Manager +CHANGES WITH 231: + + * When using systemd's default tmp.mount for /tmp, this will now be + mounted with the "nosuid" and "nodev" options. This avoids + privilege escalation attacks that put traps and exploits into /tmp. + However, this might cause some problems if you e. g. put container + images or overlays into /tmp; if you need this, override tmp.mount's + "Options=" with a drop-in, or mount /tmp from /etc/fstab with your + desired options. + + Contributions from: ... + + — Somewhere, 2016-XX-XX + CHANGES WITH 230: * DNSSEC is now turned on by default in systemd-resolved (in |