docs/release-notes: document dhcpd hardening
This commit is contained in:
parent
1c1ade5062
commit
79b4b7eaa1
|
@ -220,6 +220,23 @@
|
|||
removed due to it being an outdated version.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The DHCP server (<literal>services.dhcpd4</literal>,
|
||||
<literal>services.dhcpd6</literal>) has been hardened. The
|
||||
service is now using the systemd’s
|
||||
<literal>DynamicUser</literal> mechanism to run as an
|
||||
unprivileged dynamically-allocated user with limited
|
||||
capabilities. The dhcpd state files are now always stored in
|
||||
<literal>/var/lib/dhcpd{4,6}</literal> and the
|
||||
<literal>services.dhcpd4.stateDir</literal> and
|
||||
<literal>service.dhcpd6.stateDir</literal> options have been
|
||||
removed. If you were depending on root privileges or
|
||||
set{uid,gid,cap} binaries in dhcpd shell hooks, you may give
|
||||
dhcpd more capabilities with e.g.
|
||||
<literal>systemd.services.dhcpd6.serviceConfig.AmbientCapabilities</literal>.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The <literal>mailpile</literal> email webclient
|
||||
|
|
|
@ -76,6 +76,11 @@ In addition to numerous new and upgraded packages, this release has the followin
|
|||
|
||||
- `services.kubernetes.addons.dashboard` was removed due to it being an outdated version.
|
||||
|
||||
- The DHCP server (`services.dhcpd4`, `services.dhcpd6`) has been hardened.
|
||||
The service is now using the systemd's `DynamicUser` mechanism to run as an unprivileged dynamically-allocated user with limited capabilities.
|
||||
The dhcpd state files are now always stored in `/var/lib/dhcpd{4,6}` and the `services.dhcpd4.stateDir` and `service.dhcpd6.stateDir` options have been removed.
|
||||
If you were depending on root privileges or set{uid,gid,cap} binaries in dhcpd shell hooks, you may give dhcpd more capabilities with e.g. `systemd.services.dhcpd6.serviceConfig.AmbientCapabilities`.
|
||||
|
||||
- The `mailpile` email webclient (`services.mailpile`) has been removed due to its reliance on python2.
|
||||
|
||||
- The MoinMoin wiki engine (`services.moinmoin`) has been removed, because Python 2 is being retired from nixpkgs.
|
||||
|
|
Loading…
Reference in a new issue