Release v0.10.1

A patch release. It fixes the disk encryption type on default Fedora
Workstation installs, keeps the policy stream alive across a suspend,
unblocks SELinux constraints in custom modules, and publishes signed
checksums with every release. No database migrations, no configuration
changes.

Bug Fixes

Disk Encryption

• LUKS volumes behind a btrfs root are discovered again. btrfs (and
  bcachefs) mounts carry an anonymous device number in mountinfo, so
  /sys/dev/block has no node for them and the walk to the dm-crypt
  container never started. On a default Fedora Workstation install the root
  volume was invisible: bor-agent luks status printed no volumes,
  bor-agent luks adopt found nothing, and the encryption check reported
  the root as unencrypted. The agent now resolves the mount source to its
  block node when the device number is anonymous.
• zram swap is compliant. RAM-backed swap never reaches a disk, yet the
  system-scope encryption check reported it as an unencrypted swap device,
  which made every default Fedora Workstation install non-compliant. Such
  devices are flagged during discovery and reported as compliant with the
  reason.
• The LUKS inventory flag reaches agents. AgentConfig.disk_encryption_inventory
  is documented as on by default, but the server never set it, so a node
  without a bound DiskEncryption policy reported no volumes and the Disk
  Encryption page stayed empty until a policy bound. The server now sends it
  as true.
• bor-agent luks adopt prompts on the terminal. systemd-ask-password
  only uses the TTY when stdin is one, and the generic command runner
  detaches the child, so adoption fell back to the password-agent protocol:
  a wall broadcast, with the typed passphrase echoed by the terminal. The
  tool now runs with the caller's stdin and stderr, and prints a hint when
  stdin is not a terminal. Adoption also reports the inventory before asking
  for the passphrase, so adopting a fresh node no longer fails with "LUKS
  volume not found" because the server had not yet learned the volume.
• A recovery-key rotation no longer breaks the protector binds that follow
  it. Rotation wipes the old Bor recovery slots once the new key is
  confirmed. Where the credential for the sync came from a server release
  (the active recovery key, handed out for a pending rotation), it stopped
  opening the volume the moment the rotation finished and the Tang bind right
  after it failed with "Error adding new binding". A reveal with
  rotate-after-reveal on a Tang-bound node hit this on every sync. Rotation
  now returns the key it enrolled and the sync continues with that credential
  for TPM 2.0, Tang and bootstrap retirement.
• Adding a Tang server works. Settings -> Tang Servers -> Add failed
  with an internal error because a new record was inserted with a nil
  advertised_thumbprints array, which PostgreSQL rejects for the NOT NULL
  column. A nil list is stored as an empty one.

Policy Streaming

• The agent notices a dead policy connection. After a suspend and resume,
  a NAT reset or a server restart, the node's TCP socket to the policy port
  can stay established while the server has already dropped the connection
  (its TCP user timeout fires as soon as a push goes unacknowledged for 20
  seconds). The agent then waited in Recv on a stream that no longer existed
  and saw no new bindings until it was restarted. The client now sends HTTP/2
  keepalive pings every 60 seconds with a 20 second timeout, which closes such
  a connection and lets the existing reconnect loop take over. The server's
  enforcement policy permits pings every 10 seconds.

SELinux

• Custom modules may use constrain. The CIL statement allowlist rejected
  it, which ruled out the one statement that can take a permission away from
  the unconfined domains (they hold allow rules for everything), so a module
  that keeps a service from being killed from a shell could not be authored.
  Constraints restructure nothing in the base policy, and a bad one is undone
  by removing the module. Statements that do restructure the base policy
  (classes, sids, users and roles, MLS, policy capabilities, kernel object
  contexts) are still refused.

Security

• The agent runs with an MCS category of its own on SELinux systems. The
  packaged unit sets SELinuxContext=-system_u:system_r:unconfined_service_t:s0:c1023,
  so the agent keeps its unconfined service domain but gets the level
  s0:c1023. The category confines nothing by itself: on the targeted policy
  MCS binds only container domains for file access. It lets an SELinux policy
  single the agent process out without a module per node, for example with a
  constrain statement that refuses signals from senders at a lower level, so
  that kill -9 from a root shell is denied while
  systemctl restart bor-agent keeps working. The leading - makes systemd
  ignore a policy that lacks the type, and the directive is skipped where
  SELinux is disabled. Documented in the hardening guide and on the SELinux
  policy type page.

Packaging & CI

• Signed SHA256SUMS with every release. A publish-checksums job runs
  once the agent and server packages of a GitHub release are uploaded. It
  assembles SHA256SUMS from the digests GitHub records for the assets
  (downloading and hashing only where a digest is missing), signs it with the
  release key that also signs the package repositories, verifies the signature
  and uploads SHA256SUMS and SHA256SUMS.asc to the release.

Upgrade Notes

• No database migrations and no new settings. Server and agent
  configuration from v0.10.0 is unchanged.
• Server and agent can be upgraded independently. The Tang server,
  SELinux constrain and LUKS inventory fixes are server-side; the volume
  discovery, zram, luks adopt, rotation-credential and keepalive fixes are
  agent-side. Upgrade both to get all of them.
• The agent package replaces bor-agent.service to add the
  SELinuxContext= directive. Local changes belong in a drop-in under
  /etc/systemd/system/bor-agent.service.d/; a modified unit file in
  /usr/lib/systemd/system/ is overwritten by the package.
• Nodes whose LUKS volumes were invisible report them after the agent
  upgrade. Once discovery works, the inventory arrives within 15 minutes and
  previously missing volumes appear on the Disk Encryption page, where they can
  be adopted.