release: compartment 1.3.2 (compartment-bpf v0.7.2)
Portability, a correctness fix, and test/tooling additions surfaced by
Noble 6.8 (kernel 6.8) bring-up and an independent multi-angle review.
No ABI change (compartment-bpf 0x0007 unchanged). See compartment-bpf/CHANGELOG.md.
- Noble 6.8: dual inode_setattr wrapper (BTF-probed, autoload-gated); Ubuntu
24.04 is now a tested platform - Fix: hold one O_PATH fd per sealed inode for the daemon lifetime, closing
an inode-number-reuse stale-seal window (security-positive umount/remount
EBUSY side-effect) - Coverage-accountability: static surface->witness gate (coverage-map.py +
manifest + check-coverage-static), wired six orphaned witnesses into
make check, added strict check-release gate - Telemetry/tooling: COUNTERS.md, telemetry-smoke, deny-to-candidate
- Docs: removed in-tree experimental/ design specs (behavior documented in
HOWTO/LIMITATIONS/COUNTERS)
compartment.h + man pages: 1.3.1 -> 1.3.2.
Validated: make check-release PASS on Ubuntu 24.04/6.8 and the 7.0 dev kernel.