Skip to content

Reality Kernel 0.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Oct 17:20
· 59 commits to main since this release
v0.3.0
a7c58f2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Reality Kernel 0.3.0 is a security release. An external white-box review of 0.2.0 confirmed 26 issues; this release closes them or documents them as residual risks in the threat model.

⚠️ Upgrading from 0.2.0 — breaking changes. Read the "Upgrading from 0.2.0" section of CHANGELOG.md before upgrading. In short:

  • rk status and rk policy diff now require a policy admin (root or group rk).
  • rk audit verify fails in more cases (empty log, key change, removed oldest segments); new batches use trailer "v":2 (0.2.0 logs still verify).
  • Profiles with deny_raw_sockets can no longer create ICMP ping, UDP-Lite, SCTP, DCCP or MPTCP sockets.
  • Exec allowlists on btrfs are refused at apply time.
  • Kubernetes: while rk-sensor is down, rk-nri refuses non-exempt namespaces; set exemptNamespaces for your cluster's node-critical namespaces.

Highlights: btrfs device-identity fix for file/exec rules, transport-coverage closure, file create-invariant hooks (rename/link/symlink/mknod), control-plane DoS hardening, audit verifier hardening, and fail-closed launch/restart/binding. Full list in CHANGELOG.md.

Image: ghcr.io/keter-lab/reality-kernel:0.3.0 (linux/amd64, linux/arm64), signed. Every file is signed (*.sigstore.json), with SLSA provenance and an SPDX SBOM. Verify: docs/releases.md. Install: docs/install.md.

Assets 21
Loading