Make sure we call setgroups() after setuid(). (Ethan Benson)

[rsync/rsync.git] / NEWS

diff --git a/NEWS b/NEWS
index b81dadd..0d1fc6a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,10 @@
 rsync 2.5.3 (not released yet)
 
 rsync 2.5.3 (not released yet)
 

+  SECURITY FIXES:
+
+    * Make sure that supplementary groups are removed from a server
+      process after changing uid and gid. (Ethan Benson)
+

   ENHANCEMENTS:
 
     * Command to initiate connections is only shown with -vv, rather
   ENHANCEMENTS:
 
     * Command to initiate connections is only shown with -vv, rather


@@ -7,3 +12,7 @@ rsync 2.5.3 (not released yet)
       what was historically used so as not to break scripts that try
       to parse the output.
 
       what was historically used so as not to break scripts that try
       to parse the output.
 

+    * Added --no-whole-file and --no-blocking-io options (Dave Dykstra)
+
+    * Made the --write-batch and --read-batch options actually work
+       and added documentation in the man page (Jos Backus)