v0.2.0

Sentry-v2 now notices when it keeps acting on the same unit and stops to
ask, leaves whole slices alone unless you say otherwise, and lets you see
what redaction leaves before anything goes out. One change needs a look
before you upgrade: if a policy of yours throttles a slice on purpose,
set protection.allow_slices first.

Added

• Published on PyPI as sentry-v2.
• sentry-v2ctl redact shows what the configured redaction leaves of a
  file or stdin, so you can check before anything reaches a sink.
• Redaction catches more by default: --password x and --db-password=x
  style flags, JSON-quoted secrets such as "Authorization": "Basic …",
  HTTP Digest response= values and JSON Web Tokens.
• sentry-v2ctl policy test --event takes a saved bundle as well as raw
  events, and replays its trigger and denials through the correlator and
  your policies.
• A flap guard. A unit that gets limits.flap_actions (3) enforced
  actions inside limits.flap_window (30 minutes) is put on hold: its
  current action expires as normal, new ones are refused, a critical
  flapping alert bundle goes out, and sentry-v2ctl ack UNIT releases
  it. Holds survive restarts. status lists held units and
  sentry_v2_units_held counts them.
• The Cockpit page lists held units with Allow actions again, and each
  incident's bundle shows a root ausearch … | audit2allow -w command for
  its own denials, so you can see why SELinux refused them before you
  change anything.

Fixed

• An AVC storm could overflow the audit socket and lose denials without a
  trace. The daemon now asks for an 8 MiB receive buffer (capped by
  net.core.rmem_max), counts kernel overruns and its own reader-queue
  drops as audit events dropped, and shows overruns and rcvbuf in the
  audit collector's health.

Changed

• Actions on .slice units are refused unless protection.allow_slices
  is true. A throttle or freeze on a slice reaches every unit under it, so
  a broad cgroups pattern could squeeze far more than one noisy job. If
  a policy of yours throttles a slice on purpose, set it before upgrading.