v2.0rc1
~~~~~~~
1) Added module license (GPL)

2) Capsel binary reads only configuration files with these extensions:
   '.cf', '.cfg', '.conf', '.config' or with no extension at all

3) Added BASEDIR to the Makefiles (for installing into arbitrary directory)

4) Copyrights and e-mails updated

5) Capsel binary automaticaly flushes unused rules if error occurs

6) Added CAPSELSTATUS ioctl call that returns basic module's informations

7) Read/write spinlocks changed to the non-irq versions (safe and faster)


v1.9.99pre5
~~~~~~~~~~~
1) Updated for 2.2.20

2) Ptrace protection in new_sys_execve() system call removed (redundant).

3) Minor security fix in new_sys_execve().
   Details:
   Some security checks were missing for readable binaries that were given 
   some extra privileges by capsel. It would allow to share parts of those 
   processes's structures (like fs, signals and files) with unprivileged
   processes that could lead to privilege compromise.
   However, that behavior was well documented in README file:
     Kernel does such a thing for setuid/setgid binaries, capsel does it 
     also for all binaries that user have no read permission to.
   Note, that those privileged binaries should not be readable by unprivileged
   users for other security reasons.

4) Minor Makefile fixes.


v1.9.99pre4
~~~~~~~~~~~
1) Configuration file line counter fixed.

2) Chroot system call checking code updated to 2.4.13 kernel.

3) Added missing SMP lock in fs.c.

4) Makefile changed to build capsel with best C compiler found.


v1.9.99pre3
~~~~~~~~~~~
1) Updated for 2.4.12.

2) Linux-Privs by Andrew Morgan has been removed from source tarball.


v1.9.99pre2
~~~~~~~~~~~
1) Updated for 2.2.19 and 2.4.2 kernels.

2) Added two new capabilities: mknod, lease (2.4.x).

3) Configuration file parser removed from kernel module.

4) Added user-level tool that parses configuration file and
   communicates with capsel via /dev/capsel (240,0) character device.
   The program is installed in /sbin/capsel.

5) Multiple configuration files may be used. They are read from /etc/capsel
   directory. /etc/capsel.conf is read as well.

6) ignore option is no longer used. If it is present in configuration 
   file it will be just ignored.
   
7) Added new euid/egid options to the rule. uid/gid options no longer cause
   capsel to check EUID/EGID of process. Use euid/egid instead.

8) sysctl and ptrace system calls are now restricted to privileged
   users only (/proc/sys sysctl entries are still available to unprivileged
   users but you may change mode of /proc/sys directory to something like
   0550 or use openwall kernel patch with restricted /proc option enabled).
   I'll probably add more syscalls in future releases.

9) Added bind_tcp and bind_udp options that restricts CAP_NET_BIND_SERVICE
   capability. If used privileged process may bind to specified TCP or UDP
   (protected) ports only.

10) Code completely rewritten.

11) SMP fixes. It seems to work on SMP platforms correctly since now.

12) Added get_realpath() function that resolves real file/directory name
    (related to filesystem's root directory). It is used in rootdir and
    exec options and for logging purposes.

13) Many major and minor fixes in new_sys_execve system call. Fixed two
    security problems: cap_permitted was not restored after unsuccesfull
    do_execve and anti-ptrace code that didn't work for scripts.

14) Many other minor changes.


v1.6.1
~~~~~~
1) Updated to 2.2.18 kernels - added keep_capabilities stuff.
   Since this version, uidcap option has no effect if process does
   prctl() and sets the keep_capabilities flag that causes to leave
   its capabilities unchanged while doing set*uid to non-zero UID.

2) Work around for missing includes in kernel header files.
   Thanks to Piotr Majka for reporting the problem.


v1.6.0
~~~~~~
1) Added clrenv option. If it is enabled environment variables are
   cleared for processes that are executed with modified privileges.

2) Added new chksetuid option that may prevent processes from calling
   set*uid() system calls with any of the UIDs equal to zero.
   
3) Added conf command line parameter that allows to change configuration
   file name to be used by the module.
   See ,,modinfo -p capsel''

4) Added synonym `on' for `true' and `yes' and added synonym
   `off' for `false' and `no'.
   
5) chroot and root options has been renamed into chkchroot and rootdir
   respectively. Old ones have been left for backward compatibility.

6) Added attrfix script in misc/ directory.
   This scripts is useful to remove read/write attributes from 
   miscellaneous executables.

7) Source code modified and ready to port to other platforms.

8) Minor fix in new_sys_execve() related to ch_root() returing errors.

9) config.c cleanup.

10) Faster memory allocation in get_exename() function.

11) log() function modified.

12) README and configuration examples updated.


v1.5.7
~~~~~~
1) Fixed race conditions in new_set*uid functions (securebits stuff)
   that might have leaded users to gain higher privileges in some
   circumstances.

2) Minor fixes in new_execve.

3) clear_environ() rewritten to be safe and portable.


v1.5.6
~~~~~~
1) Capsel now logs error message when it can't find its configuration 
   file.

2) Fixed condition in new_execve() that checks permission to execute 
   binary file if parts of the caller process are shared with other 
   processes.

3) Fixed name of the change_root function to ch_root because function
   with that name already exists in kernel sources.

4) Added new security feature that clears all environment if some
   unprivileged user executes some privileged executable (setuid binary
   or binary that has capabilities modified after start).
   You no longer need to patch your glibc in order to prevent your
   users from tricking your binaries with LD_PRELOAD stuff or even with 
   the latest glibc bugs.
   

v1.5.5
~~~~~~
1) Added useful mkchroot script that creates directory tree with needed
   libraries for chrooted executables.

2) Fixed stupid bug in code that sets new root directory after execve.
   Since now, it correctly changes current working directory to the new 
   root directory.
   Thanks to Miroslaw Ziemski for testing new 'root' feature and
   reporting the problem.

3) Fixed Makefile to properly compile with SMP kernels.
   Problem reported by Piotr Majka.

4) Added additional check in new_execve to prevent executing new file
   if some parts of the calling process are shared.


v1.5.4
~~~~~~
1) Fixed UIDs and GIDs checks in find_rule().

2) Fixed bug in 'gid' option parsing.

4) Added argument 'default' to the 'cap' and 'uidcap' options.

5) Fixed typos in sample configurations.

6) Added new 'root' option.


v1.5.3
~~~~~~
1) Fixed stupid race conditions with exename global variable.

2) Fixed serious bug in new_chroot() not checking filename argument before use.

3) Modified ptrace checks in new_execve().

4) Fixed expressions with kernel_cap_t type to compile correctly with
   STRICT_CAP_T_TYPECHECKS.

5) Minor changes in check_chroot() and resolve_path().

6) New configurations added + workaround in configuration for proftpd daemon
   for permission/CAP_DAC_READ_SEARCH kernel bug (should be fixed in 2.2.17).
   Thanks to Miroslaw Ziemski for reporting the chroot problem with proftpd.

7) Created source directory tree.

8) README updated.


v1.5.2
~~~~~~
1) Added 'conf' directory with common configuration for various
   programs.

2) Minor bugs fixed in new_execve function.
   Thanks to Wojciech Kaniewski for CAP_SYS_PTRACE fix.

3) Added workaround for kernels 2.1.x and 2.2.x that doesn't have VFS support
   for capabilities and do_execve may return -EPERM if caller doesn't have full
   capability set.


v1.5.1
~~~~~~
1) Added feature that prevents ptracing and dumping core of executables
   by users that have no permissions to read them (thx lcamtuf).


v1.5.0
~~~~~~
1) Updated to kernel version 2.2.16.

2) Added new 'uidcap' feature that allows to leave some privileges
   after changing process's UID from rule->uid to something else.

3) CAPABILITIES descriptions updated to 2.2.16.

4) Few little changes to the code.

5) README file ready.

6) Added sample configuration file.

7) Added Linux-Privs.tar archive of documents describing capability system
   by Andrew Morgan.


v1.4.1
~~~~~~
1) Added value 'any' into 'uid' and 'gid' options.


v1.4.0
~~~~~~
First release of this loadable Linux kernel module.
It has 1.4.0 version number because it is based on my old 'execve'
module which last version was 1.2.x.
