diff options
Diffstat (limited to 'NEWS')
| -rw-r--r-- | NEWS | 22 |
1 files changed, 22 insertions, 0 deletions
@@ -1,5 +1,27 @@ systemd System and Service Manager +CHANGES WITH 231: + + * When using systemd's default tmp.mount for /tmp, this will now be + mounted with the "nosuid" and "nodev" options. This avoids + privilege escalation attacks that put traps and exploits into /tmp. + However, this might cause some problems if you e. g. put container + images or overlays into /tmp; if you need this, override tmp.mount's + "Options=" with a drop-in, or mount /tmp from /etc/fstab with your + desired options. + + * systemd-resolved gained a new "Cache=" option in resolved.conf. + Local caching makes DNS poisoning attacks slightly easier and allows + a local user to detect whether any other user on the same machine has + recently visited a given DNS name (privacy). If that is a concern, + you can disable local caching with this option at the cost of slower + DNS resolution (which is particularly expensive with DNSSEC). The + default continues to be "yes" (i. e. caching is enabled). + + Contributions from: ... + + — Somewhere, 2016-XX-XX + CHANGES WITH 230: * DNSSEC is now turned on by default in systemd-resolved (in |