shelltrap.com
en de

Changelog

Changelog

Shelltrap is in its internal test stage on Panomity production hosts. This is what that stage has found so far — the unflattering entries included, because those are the ones worth reading.

Version numbers follow MAJOR.MINOR.PATCH. Everything below 1.0.0 is an internal test build: it runs on our own hosts under production load, it is not downloadable, and it is not covered by any customer promise. It is published here because a scanner that has never been wrong on a real machine has simply never been on one.

Release 1.0 carries the full scope: all platform tiers, the panel UI with roles, the FTP enqueuer, Full and Lite profiles with measurement, the complete CyberPanel platform matrix in CI, GDPR retention, and the repair path after a panel upgrade.

0.2.3 released

First licensed release: licence gate, signed feeds, WordPress core allowlists

  • added
    Licence activation with offline-verifiable Ed25519 tokens (shelltrap license activate); without a licence the daemon does not scan and receives no signature feeds.
  • added
    Signed vendor feed with 163 YARA rules (Panomity, MIT; curated Neo23x0 rules, DRL-1.1) and SHA-256 allowlists for WordPress core 5.8 to 6.9.
  • changed
    Allowlist hits override heuristics; documented library files stay below suspicious; scheduler aging prevents reconcile starvation after restarts.
  • changed
    Health names every degraded cause; stripped release binaries; activation corpus shipped with the package.
  • changed
    Known issue: a feed update under sustained scan load can block the daemon; fixed in the next release.
0.1.10 internal test stage

Packaging: example drop-ins in a canonical location

  • fixed
    Minimised Ubuntu images strip /usr/share/doc/* through a dpkg path-exclude, which also removed the shipped systemd drop-in examples. They are now additionally installed under /usr/share/shelltrap/systemd/.
  • changed
    The platform matrix verifies the canonical drop-in path on every image.
0.1.9 internal test stage

Notification crash and heuristic false positives

  • fixed
    Without a [notify] section a typed nil pointer reached the broker as a non-nil interface, so the first suspicious notification crashed the daemon into a restart loop. cmd/shelltrapd now filters typed nils and the digest notifier is nil-safe.
  • changed
    Entropy or a single long line alone never produces suspicious any more; an image file needs an explicit PHP tag with code before it is scored at all.
0.1.8 internal test stage

Only signed rule generations load

  • security
    The daemon loads a signature generation only when it is signed with a pinned Ed25519 key. Unsigned or unpinned generations are refused fail-closed.
  • added
    tools/feedbuild builds a local generation from sources plus a provenance CSV, so an operator without a vendor feed can still run the full rule pipeline.
0.1.7 internal test stage

systemd unit stops dropping CAP_SETUID

  • fixed
    An explicit User=root together with NoNewPrivileges=yes made systemd remove CAP_SETUID from the effective set, so worker start failed with operation not permitted. The unit no longer sets User=/Group=, and a packaging test enforces that.
0.1.6 internal test stage

Second observation build on the reference host

  • known issue
    Worker start could fail in a restart loop on hosts whose unit combined User=root with NoNewPrivileges=yes. Fixed in 0.1.7.
0.1.1 – 0.1.4 internal test stage

Everything the first production-load host exposed

  • fixed
    Stale fanotify handles scheduled reconciliation scans of the filesystem root.
  • fixed
    JPEGs were scored as scripts because of <? bytes plus entropy.
  • fixed
    degraded results and limit-driven unscanned results produced one finding per file and blew through the per-account finding cap.
  • fixed
    The audit chains in the JSONL log and in the store could diverge and block startup.
  • fixed
    SQLite found no temporary directory under ProtectSystem=strict.
  • fixed
    clamd refused descriptors handed over with FILDES from the systemd mount sandbox (AppArmor); the worker now falls back to INSTREAM automatically.
0.1.0 internal test stage

First internal test build

  • added
    Parser-free root broker, tier-A fanotify watcher with reconciliation, scanner worker with ClamAV, YARA 4 and hash sets, explainable heuristics, crash-safe quarantine transaction with restore, ignore lists, scheduler, JSON-capable CLI, mail notification, signed feed generations, package lifecycle, health metrics, PHP upload adapter and the per-domain policy model.
  • note
    Report-only by default on the test hosts: no automatic quarantine, no PHP adapter activation, fully reversible.

How to read the test-stage entries

Each of those fixes came out of running the scanner in report-only mode against real customer data on a live CyberPanel host: 328 accounts, 1.1 TB, on Ubuntu 24.04 with OpenLiteSpeed. That is the only environment that produces bugs like “clamd refuses descriptors handed over from a systemd mount sandbox because of an AppArmor profile” or “JPEGs are scored as scripts because they contain the two bytes <?”.

The rule we work to: if a defect was visible to an operator, it belongs in this list.