[ANN] [SECURITY] 9mount 1.6 released

[sqweek]

Hi all,

Almost 18 years since 1.3 was released, 9mount-1.6 is now available at https://sqweek.net/code/9mount/download

Direct link: https://sqweek.net/9p/9mount-1.6.tar.gz

1.5 and 1.6 are both security releases, which fix long-standing issues with 9mount that allow local privilege escalation. If you have 9mount installed on any machines which users other than yourself have access to, it is recommended to upgrade ASAP.

Summary of changes:

- "nodev" and "nosuid" mount options are now actually effective, and are always enforced for non-root users

- improved robustness of file permission checks to prevent race conditions (eg. an attacker pointing 9mount at an empty directory they have write access to, but replacing it with a symlink to an unwritable area after 9mount completes its permission checks)

Cheers,
-sqweek