1.24.12 — Reliable least-privilege identity helper startup

2026-09-09

django-mojo 1.24.12 fixes MojoSec’s unprivileged identity helper startup on systemd: the helper can now read the live Yama safety setting while still hiding other users’ processes, keeping kernel tunables read-only, and retaining zero capabilities and no network. No migrations or consumer code changes are required.

Fixed

• The process-identity helper no longer hides /proc/sys from its own live Yama startup condition, preventing repeated condition skips and socket rate-limit failures after deployment.

Security

• ProtectProc=invisible continues to hide other users’ processes while same-UID JobEngine processes remain visible for exact identity proof.
• ProcSubset=all retains the read-only /proc/sys view required by the startup gate; ProtectKernelTunables=true prevents writes.
• The helper remains ec2-user, network-isolated, and has empty bounding and ambient capability sets. Node checks enforce the complete effective contract.

Upgrade notes

• Enrolled hosts receive the corrected unit automatically during their next normal deployment; no manual service repair is required.