v0.38.1

A security fix for what an agent can reach through a link, and a task that can't start now says why at once.

If you're upgrading from before 0.38.0, read the 0.38.0 notes first.

Reads and writes for a session no longer carry group root

When the server reads or writes a session's files, it takes on the session's user and group. Through 0.38.0 it also kept root's supplementary group, so an agent could use a link to reach what group root (gid 0) can reach:

• Reading: a process of the agent's could swap a file for a link during a download, and read a file that only group root can read, such as one with mode 0640 owned by root.
• Writing: a link at one of the session's config paths could overwrite a file that group root can write, or create a file in a directory it can write.

On the default image this reaches very little: four empty lock files under /var, and creating files in /usr/share/man/man1, man5, man7, man8 and /var/cache/debconf/tmp.ci. No file under /data, and no existing file can be overwritten.

A volume you mount can hold more. If you mount files or directories that group root can read or write, and an agent you don't fully trust has run on this instance, treat what they hold as exposed: check them, and rotate any credential among them.

Files only their root owner can read or write were not reached, and still aren't. Each release now fails its check if the server holds a supplementary group.

A task that can't start says why

A link at one of those config paths used to make a follow-up wait about five and a half minutes, then report that no connection serves the model, which wasn't the reason. It now fails in under a second and says a file in the workspace can't be written. Once the link is gone, the same session carries on.

Any other failure to start now says the task couldn't start, and no longer blames your connections. It can still take those minutes to say so.

Questions a task asks

• A confirm has to offer both answers, or none for yes and no. A lone yes is refused, and the agent is told why.
• The question's text and the option's id are quoted when your answer goes back to the agent, so a question can't pass off its own words as a message from you.

Full Changelog: v0.38.0...v0.38.1