- linux: do not clobber the mount root mode for proc, sysfs and mqueue. A 1.29 regression copied the mountpoint directory mode onto the root inode of freshly created typed mounts, breaking the /proc/<pid>/fd magic-symlink path (e.g. rpm-ostree failing with "Operation not supported") and a tmpfs /dev/shm created with mode=1777 ("could not open shared memory segment: Permission denied").
- linux: fix read-only /sys regression in the userns sysfs fallback. A spec asking for a read-only /sys silently got a writable one when the container has a user namespace. It is not a security issue since the user namespace has no write access to /sys anyway.
- linux: restore nosuid,noexec on precreated devices in a user namespace.
- linux: refresh the mount target after reopening it, fixing a "set propagation: Invalid argument" failure of the mount(2) fallback on kernels without mount_setattr() (< 5.12).
- linux: report the real reason when moving the masked directory mount fails instead of always logging "unknown error".
- cgroup: always thaw the cgroup on error paths in kill and pid migration, so a failed teardown can no longer leave the container permanently frozen and unresponsive.
- cgroup: tolerate a cgroup removed concurrently while killing or migrating its processes instead of failing the whole enumeration.
- utils: harden the AppArmor confined check so a short read, a profile named like "unconfined_foo", or an interrupted read no longer mis-report the process as unconfined.
- mempolicy: handle an empty memoryPolicy.nodes string, avoiding an undefined memcpy() from a NULL pointer.
Other Useful Business Software
Veeam Data Platform v13.1
Try Veeam Data Platform today. Experience the unified platform that's secure by design, portable by default, and proven to recover clean, fast, and anywhere.
Train ML Models With SQL You Already Know
Build and deploy ML models using familiar SQL. Automate data prep with built-in Gemini. Query 1 TB and store 10 GB free monthly.
