v0.1.9

linux-vault 0.1.9 – 2026-09-28

• This release just adds the message "Cannot create [name]: you already have a vault named [name] at [path]. When trying to make a new vault on a different path with the same name.

v0.1.8

linux-vault 0.1.8 – 2026-09-27

This release addresses the findings of an independent security and reliability audit. Upgrading is strongly recommended.

Security

• Plaintext is never deleted on assumption. When a vault folder and <name>.7z exist side by side, the folder is only removed if the archive is verifiably the one linux-vault wrote for that vault. Each vault's archive identity is recorded at lock time. A backup or unrelated file named <name>.7z can no longer cause the vault's contents to be deleted.
• Existing files are never overwritten. create and lock refuse when <name>.7z already exists, and unlock refuses when a non-empty folder already exists at the vault's path.
• Passphrase buffers are wiped. Every internal buffer that carries a passphrase is now zeroed after use, in both the helper and its worker.
• The worker is protected from inspection from its first instruction. The helper binary is installed as execute-only (0711).
• Error messages can't be spoofed by file names. 7-Zip failures are classified from 7-Zip's own output, not from text that includes the vault path.
• CI hardening: GitHub Actions are pinned to commit SHAs, and unneeded permissions are removed.

Fixed

• Upgrading no longer breaks the running helper. After a package upgrade, vault operations and locking at shutdown keep working until the next restart.
• One vault can't stop the service. A vault that can't be reconciled at startup (missing parent folder, undeletable contents, deleted owner, a filesystem without the immutable flag) is logged and marked as needing recovery; the service starts for everyone else.
• Shutdown handles interrupted operations. Vaults stuck mid-lock or mid-unlock are locked at shutdown when their passphrase is held.
• A lock already in progress at shutdown is allowed to finish instead of being killed and repeated.
• A cancelled shutdown no longer leaves the helper refusing every request until restart.
• Relative paths work: lve create Example now resolves against the current directory.
• Exit code 9 (not enough free space) is now returned when the disk fills during lock or unlock.

Added

• Nested vaults are refused. A vault can't be created inside another vault, or around one (Cannot create <name>: it is inside vault <other>., exit code 13). Existing nested vaults keep working, with a warning logged at startup.
• A damaged registry is preserved, not overwritten. If /var/lib/linux-vault/registry.json can't be read, it is moved to registry.json.broken-<timestamp>, and every operation is refused (exit code 14) until an administrator restores or fixes it, deletes registry.damaged, and restarts the helper.
• lve ls shows locked (not immutable) when a vault's archive is on a filesystem that doesn't support the immutable flag, so the archive isn't protected from deletion.

Exit codes

Code	Meaning
3	wrong password
9	not enough free space
11	vault not found
12	vault is empty
13	nested vault
14	registry damaged

Upgrading

Lock any vault that contains files before upgrading. For safety, the running helper is not restarted automatically, so held passphrases aren't lost. To use the new version immediately:

sudo systemctl stop linux-vault-helper
sudo dnf install ./linux-vault-0.1.8-1.fc44.x86_64.rpm

Stopping the helper locks every unlocked vault that contains files.

Known issues

• On Hyprland with focus-follows-mouse, the password prompt doesn't take keyboard focus automatically. Add:
  windowrulev2 = stayfocused, class:^(pinentry-qt)$
• Supported on Fedora Workstation 44 (x86_64) only. Fedora Atomic desktops are not supported.

v0.1.4

This is the second release of the tool. It's ready for use but not perfect, expect some issues.

Security

• Vaults are isolated per user. The registry, held passphrases, and per-vault locks are keyed by user ID and vault name, and ownership is verified before any operation. A vault owned by another user is indistinguishable from one that does not exist (vault not found, exit code 11).
• The vault registry is readable only by root (/var/lib/linux-vault is 0700, registry.json is 0600).
• Ownership checks fail closed: if a vault's owner cannot be confirmed, the operation is refused.
• The helper no longer reads or writes inside home directories. All file work runs in a worker process with the vault owner's identity; the root helper only sets or clears the immutable flag on a file descriptor passed to it.
• Child processes (7-Zip, pinentry) no longer inherit internal file descriptors.
• Vaults owned by root are refused.

Fixed

• Stopping the helper, or shutting down, now locks every unlocked vault that contains files.
• The password prompt now appears in the user's graphical session when started from the sandboxed helper.
• Passphrases are held correctly in a newly started helper.
• A lock that is refused or fails no longer leaves the vault stuck in locking; the state is always taken from what is on disk.
• Shutdown now aborts an unlock that is still extracting, and restores the archive's immutable flag.
• Creating a vault now adds a Nautilus bookmark. Missing bookmarks are restored on the next lock or unlock.
• The open-file check no longer refuses every lock. It is best-effort: a lock is refused only when a vault file is found open.

Changed

• A wrong passphrase prints Wrong password. (exit code 3). 7-Zip's output is logged to the journal at debug level instead of the terminal.
• Locking an empty vault is refused with <name> is empty; nothing to lock. (exit code 12).
• The journal records each 7-Zip invocation (never the passphrase), failed encryption checks, and the shutdown lock sequence.

Known issues

• On Hyprland with focus-follows-mouse, the password prompt does not take keyboard focus automatically. Add a window rule:
  windowrulev2 = stayfocused, class:^(pinentry-qt)$

v0.1.0

This is the first release of the tool. It's ready for use but not perfect, expect some issues.

• CLI
• LVE
• See README for more