summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMartin Pitt <martin.pitt@ubuntu.com>2016-06-22 13:22:47 +0200
committerLennart Poettering <lennart@poettering.net>2016-06-22 13:22:47 +0200
commit5cd118bab0c6f2f87236959b2a68098c5ba95c2e (patch)
tree75d696d720f9bd6026c235dc8cf9b6eff6efa15c
parent98471bf0fa040ead227630aee77cb3feb25cf3b0 (diff)
NEWS: start section for 231, with tmpfs.mount option changes (#3576)
This documents the "add nosuid and nodev options to tmp.mount" change from commit 2f9df7c96a2.
-rw-r--r--NEWS14
1 files changed, 14 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index 788fb33853..7ecb10e216 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,19 @@
systemd System and Service Manager
+CHANGES WITH 231:
+
+ * When using systemd's default tmp.mount for /tmp, this will now be
+ mounted with the "nosuid" and "nodev" options. This avoids
+ privilege escalation attacks that put traps and exploits into /tmp.
+ However, this might cause some problems if you e. g. put container
+ images or overlays into /tmp; if you need this, override tmp.mount's
+ "Options=" with a drop-in, or mount /tmp from /etc/fstab with your
+ desired options.
+
+ Contributions from: ...
+
+ — Somewhere, 2016-XX-XX
+
CHANGES WITH 230:
* DNSSEC is now turned on by default in systemd-resolved (in