# changelog

changelog:
  - Added symlink protection
  - Added graceful calls limiting

author:
  Alexey Berezhok <aberezhok@msvsphere-os.ru>, Anton Volkov <AV.Volkov@softline.com> - 2:2.4.62-1.inferit.4


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-11
changelog:
  - Resolves: #2162500 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write
    of zero byte
  - Resolves: #2162486 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting
  - Resolves: #2162510 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request
    smuggling


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-1
changelog:
  - Resolves: #2184403 - rebase httpd to 2.4.57
  - Resolves: #2177753 - CVE-2023-25690 httpd: HTTP request splitting with
    mod_rewrite and mod_proxy


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.57-2
changelog:
  - Resolves: #2186645 - Fix issue found by covscan in httpd package
  - Resolves: #2173295 - Include Apache httpd module mod_authnz_fcgi


author: Joe Orton <jorton@redhat.com> - 2.4.57-6
changelog:
  - Resolves: RHEL-5071 - mod_dav_fs: add DavLockDBType
  - mod_dav_fs: add global mutex around lockdb interaction


author: Joe Orton <jorton@redhat.com> - 2.4.57-8
changelog:
  - mod_xml2enc: fix media type handling
    Resolves: RHEL-17686
  - mod_dav: add DavBasePath
    Resolves: RHEL-6600


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.59-1
changelog:
  - new version 2.4.59
  - Resolves: RHEL-14668 - RFE: httpd rebase to 2.4.59
  - Resolves: RHEL-31856 - httpd: HTTP response splitting
    (CVE-2023-38709)
  - Resolves: RHEL-31859 - httpd: HTTP Response Splitting in multiple
    modules (CVE-2024-24795)


author: Anton Volkov <AV.Volkov@softline.com> - 0.1.1-1.inferit
changelog:
  - Added PID namespaces
  - Enable CAP_SYS_RESOURCE capability to disable disk quota limits
  - Added jail functions with flag for namespace usage


author: Anton Volkov <AV.Volkov@softline.com> - 0.1.5-1.inferit
changelog:
  - HST-318: bugfix to jail_ns function, related to pid namespace (part 2)
  - implemented enter-lfs utility
  - HST-318: bugfix to jail_ns function, related to pid namespace
  - switchuser.c: fix error messages


author: Anton Volkov <AV.Volkov@softline.com> - 0.1.6-1.inferit
changelog:
  - HST-323: create isolated tmp directories for users in /tmp (tmpfs)
  - enter-lfs.c: implemented -t option to use multiple threads
  - HST-325: call unshare(CLONE_FS) in enter_namespace() to make setns() work for multithreaded process
  - Fixed error including not system include but local include path
  - jail_ns: use shared lock instead of exclusive


author: Alexey Lyashkov <a.lyashkov@yandex.com> - 0.1.2-1.inferit
changelog:
  - Add ability to take a daemon statistics
  - Let set close on exec for client socket
  - Add connection idle handler
  - Add ability to change maximal clients count


changelog:
  - Don't fail a session restore if bad cookie
  - Reset errno before strtoll

author:
  Alexey Lyashkov <a.lyashkov@yandex.com>, Alexey Berezhok <alexey.berezhok@msvsphere-os.ru> - 0.1.3-1.inferit


author:
  Alexey Lyashkov <a.lyashkov@yandex.com>, Alexey Berezhok <alexey.berezhok@msvsphere-os.ru> - 0.1.5-1.inferit

changelog:
  - fix reseller defaults change. it had stored invalid data which reloaded after restart.
  - use a time() for log messages timeshtamp.
  - don't crash on exit.
  - force errors to be flushed to log.
  - restore locking for sessions.
  - lets add more error checks
  - increase connection number up to 512


author: Anton Volkov <AV.Volkov@softline.com> 0.1.3-1.inferit
changelog:
  - lfsctl --update: handle the case when src is symlink and dst is mounted directory
  - limited-fs.spec: run "lfsctl --update" in posttrans
  - lfsctl --update: added detection of empty-dirs.d and empty-files.d configuration changes
  - lfsctl --update: added detection of mounts.d configuration changes
  - bugfix for lfsctl --update: correctly detect need to recreate namespaces
  - evaluate realpath when comparing paths, create symlinks for /bin, /sbin, /lib, /lib64 instead of mounts
  - implemented black list of files (empty-files.d)


author: Anton Volkov <AV.Volkov@softline.com> 0.1.4-1.inferit
changelog:
  - HST-48: delete unused mount points in lfsctl --update
  - lfsctl --update detects change of PID namespace status; enable PID namespace by default
  - HST-289 lfsctl --update: correctly process files and directories from black list
  - added /run/cockpit and /etc/authselect to LimitedFS
  - etc/files.d/etc.conf: added /etc/vimrc, /etc/zshrc


author: Anton Volkov <AV.Volkov@softline.com> 0.1.6-1.inferit
changelog:
  - HST-312: make exim work inside LimitedFS
  - implemented UseLS option in limitedfs.json config file
  - do not use nosuid mount option by default, make it configurable
  - HST-48: delete unused mount points in lfsctl --update (do not fail on new clean install)


author: Anton Volkov <AV.Volkov@softline.com> 0.1.7-1.inferit
changelog:
  - HST-318: bugfix related to pid namespace
  - HST-315: implement cronjob to remount LimitedFS for new created users


author: Anton Volkov <AV.Volkov@softline.com> 0.1.8-1.inferit
changelog:
  - HST-323: create isolated tmp directories for users in /tmp (tmpfs)
  - limited-fs.spec: set 700 permissions to /usr/share/limitedfs directory
  - mounts.conf: added /run/passenger-instreg
  - added debug/trace.sh
  - added ftrace scripts for debug
  - HST-322: ability to mount custom script over files in black list
  - mounts.conf: added /run/mysqld
  - lfs-useradd-post.sh: supress error messages
  - added ability to disable LimitedFS daily cronjob


author: Anton Volkov <AV.Volkov@softline.com> 0.1.9-1.inferit
changelog:
  - HST-381: use hidepid=2 for /proc in LimitedFS only
  - HST-57: use pivot_root() instead of chroot()
  - HST-307: implement logging of lfsctl commands
  - lfsctl: kill unneeded ns-mount processes when pid namespace is switched off
  - HST-339: process system users correctly in "lfsctl --set-min-uid" command


author: Anton Volkov <AV.Volkov@softline.com> 0.1.11-1.inferit
changelog:
  - HST-398: clean up zombie processes in ns-mount
  - HST-397: enable/disable limitedfs service when running lfsctl --enable-lfs/--disable-lfs
  - HST-405: make sendmail work inside LimitedFS


author: Anton Volkov <AV.Volkov@softline.com> 0.1.1-1.inferit
changelog:
  - lfsctl: copy files by chunks to reduce memory consumption
  - set 0600 permissions to /var/log/limitedfs-service.log
  - generate etc files for users in remount and remount-all commands


author: Anton Volkov <AV.Volkov@softline.com> 0.1.2-1.inferit
changelog:
  - HST-60: use PID namespace for /proc isolation
  - implemented functions to detect if path is mounted or not
  - process all paths specified in /etc/files.d/* config files (not only /etc directory)
  - implemented /etc/limitedfs/symlinks.d configuration directory
  - HST-185, HST-186: removed extra data from /var and /run directories
  - bugfixes


author: Eduard Chitechyan <Eduard.Chitechyan@softline.com> 0.2.1-1.2.inderit
changelog:
  - Added integration with ispmanager user creation, editing
  - Rebuild LS activity plugin, User Statistics plugin


author: Eduard Chitechyan <Eduard.Chitechyan@softline.com> 0.3.1-1.inderit.1
changelog:
  - The form for editing limits has been redesigned
  - Add default limit changes form
  - Add templates for limit changes
  - Fixed errors for enable limitedfs
  - Fixed swap disabling errors
  - Change reports default period to 1 day


author: Anton Volkov <AV.Volkov@softline.com> 0.1.4-1.inferit.1
changelog:
  - HST-294: implemented --order-by option for sorting statistics
  - HST-304: print correct LS limits when there is no data in ls-stats.db (for ISP integration)
  - ls-stats: implemented --list-faults-only option to show specified faults only
  - ls-stats: implemented --faults-only option to show faults only
  - ls-stats-quota: changed default value for --limit option to -1 (no limit)
  - ls-stats: changed default value for --limit option to -1 (no limit)
  - HST-300: resume collecting statistics automatically after error connecting to klsd daemon
  - Make php killer disabled by default
  - ls-stats: mute "SLOW SQL" warnings to ensure consistency of output data format
  - HST-294: implemented --order-by option for sorting statistics (fix error message)


author: Anton Volkov <AV.Volkov@softline.com> 0.1.5-1.inferit
changelog:
  - HST-308: restart lsstats and lspm services while update of ls-stats rpm package
  - HST-313: vacuum DB automatically
  - ls-stats: implemented --db-path option


author: Eduard Chitechyan <Eduard.Chitechyan@softline.com> 0.2.1-1.inferit
changelog:
  - ls-stats isp back zero data
  - prometheus: ip filter, group label, cpu in seconds
  - data average for isp
  - prometheus config in comment
  - prometheus: add tls and basic auth


author: Anton Volkov <AV.Volkov@softline.com> 0.2.2-1.inferit
changelog:
  - HST-335: improved calculation of main loop interval
  - implement ls-stats-snapshot utility
  - HST-330: implement SaveLspsPlugin for ls-stats-daemon


author: Alexey Berezhok <alexey.berezhok@msvsphere-os.ru> 0.1.1-1.inferit
changelog:
  - Fixed destroy if limiting service return error
  - Added destroy-all
  - Fixed incorrect behaviour on incorrect parameters


changelog:
  - Show all local users in list command
  - Added raw option

author:
  Alexey Berezhok <alexey.berezhok@msvsphere-os.ru>, Eduard Chitechyan <Eduard.Chitechyan@softline.com> 0.2.2-1.inferit


