autopkgtest (5.48) unstable; urgency=medium

  Security fixes involving many permission changes:
  * Several directories are now world-writeable only when used with
    suitably isolating virtualisation servers.  Previously they were
    world-writeable in circumstances where this wasn't safe.
  * autopkgtest-virt-null no longer advertises isolation-machine.
    This was a dangerous lie.  For environments where the caller provides
    isolation, there's a new --fake-capability option to restore the
    previous behaviour.
  * autopkgtest-virt-unshare no longer offers the `downtmp-host`
    capability, since it is not safe for host processes to directly copy
    to and from the testbed which has a different security context.
  * There's a new --insecure option to autopkgtest which enables some old,
    risky, behaviours, in some circumstances.
  * autopkgtest-virt-ssh should not be provided with a way to get root on
    the testbed, unless the whole testbed is fully isolated from any
    untrusted code.  This security restriction was always implied by the
    behaviour, but has now been documented.

 -- Ian Jackson <ijackson@chiark.greenend.org.uk>  Wed, 16 Apr 2025 19:38:57 +0100
