---
title: "1.24.12 — Reliable least-privilege identity helper startup"
description: "django-mojo 1.24.12 fixes MojoSec’s unprivileged identity helper startup on systemd: the helper can now read the live Yama safety setting while still hiding other users’ processes, keeping kernel tunables read-only, and retaining zero capabilities and no network. No migrations or consumer code chang…"
date: "2026-09-09"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-24-12/"
---

django-mojo 1.24.12 fixes MojoSec’s unprivileged identity helper startup on systemd: the helper can now read the live Yama safety setting while still hiding other users’ processes, keeping kernel tunables read-only, and retaining zero capabilities and no network. No migrations or consumer code changes are required.

### Fixed

- The process-identity helper no longer hides `/proc/sys` from its own live Yama startup condition, preventing repeated condition skips and socket rate-limit failures after deployment.

### Security

- `ProtectProc=invisible` continues to hide other users’ processes while same-UID JobEngine processes remain visible for exact identity proof.
- `ProcSubset=all` retains the read-only `/proc/sys` view required by the startup gate; `ProtectKernelTunables=true` prevents writes.
- The helper remains `ec2-user`, network-isolated, and has empty bounding and ambient capability sets. Node checks enforce the complete effective contract.

### Upgrade notes

- Enrolled hosts receive the corrected unit automatically during their next normal deployment; no manual service repair is required.