From: Martin Pitt <martin.pitt@ubuntu.com>
Date: Wed, 22 Jun 2016 11:22:47 +0000 (+0200)
Subject: NEWS: start section for 231, with tmpfs.mount option changes (#3576)
X-Git-Tag: v231~135
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5cd118bab0c6f2f87236959b2a68098c5ba95c2e;p=thirdparty%2Fsystemd.git

NEWS: start section for 231, with tmpfs.mount option changes (#3576)

This documents the "add nosuid and nodev options to tmp.mount" change from
commit 2f9df7c96a2.
---

diff --git a/NEWS b/NEWS
index 788fb33853a..7ecb10e2162 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,19 @@
 systemd System and Service Manager
 
+CHANGES WITH 231:
+
+        * When using systemd's default tmp.mount for /tmp, this will now be
+          mounted with the "nosuid" and "nodev" options. This avoids
+          privilege escalation attacks that put traps and exploits into /tmp.
+          However, this might cause some problems if you e. g. put container
+          images or overlays into /tmp; if you need this, override tmp.mount's
+          "Options=" with a drop-in, or mount /tmp from /etc/fstab with your
+          desired options.
+
+        Contributions from: ...
+
+        — Somewhere, 2016-XX-XX
+
 CHANGES WITH 230:
 
         * DNSSEC is now turned on by default in systemd-resolved (in