---
title: "1.40.2 — MojoSec is a silent sensor again"
description: "The MojoSec process-lineage proof that cost 20–46 % of every 2-vCPU node is gone. The sensor now recognises the application account's own firewall-broker sudo from the sudo record alone, reads journald filtered at the source, and bounds its per-poll housekeeping; steady state should be at or under 3…"
date: "2026-10-28"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-40-2/"
---

The MojoSec process-lineage proof that cost 20–46 % of every 2-vCPU node is gone. The sensor now recognises the application account's own firewall-broker sudo from the sudo record alone, reads journald filtered at the source, and bounds its per-poll housekeeping; steady state should be at or under 3 % of one vCPU. The next deploy retires the resolver and audit-health units and the exec audit rules on every enrolled node. The new `al2023-web-v3` and `al2023-content-v2` profiles are opt-in. Work item: https://maestromojo.com/app/#/board/37?item=9769

### Changed
- On the next deploy of an enrolled node, convergence disables and removes `mojosec-proc-identity.socket`, `mojosec-proc-identity.service`, `mojosec-audit-health.timer` and `mojosec-audit-health.service`, the stable audit helper copy and the health sidecar, in either mode and with rollback. The `kernel.yama.ptrace_scope` sysctl stays in place, unmanaged.
- The managed Linux Audit policy is the sudo path watch alone. The four execve rules that recorded every root and app-user exec (about 800 kernel records a minute on a django-mojo node) are gone.
- The expected-automation check is a fixed predicate on the sudo record: exactly `/usr/local/sbin/mojo-firewall-broker`, target `root`, login UID equal to the configured app UID, no TTY, no SSH attribution. It is stamped `app_user_firewall_broker_v1` and kept local; every near miss stays an ordinary `auth.sudo_command` Event. The `jobman_firewall_operation_v1` classifier is retired.
- `auth.sudo_command` evidence no longer carries `proof_status`, `origin_kind`, `lineage`, `lineage_sha256`, `operation_id`, `execution_id`, `job_id`, `job_function` or `receipt_semantics`; historical receipts keep them.
- The journal collector filters at the source: journalctl is given match groups for sshd, sudo, the systemd PAM helper, PID 1, the kernel and the two Audit session records, and only the fields the detectors read.
- Per-poll housekeeping is bounded: the expected-change annotation pass runs only when a FIM change awaits it, the status file is written every 60 s or on a health transition instead of every 5 s, tiers scanning at least every 10 minutes keep their FIM baseline in memory, and a scan that changed nothing writes no baseline row.
- New packaged profiles `al2023-web-v3` and `al2023-content-v2` move `/usr/local/lib` (about 28k root-pip files) from the 60-second tier to the six-hour tier and set `rpm.skip_host_tier_roots` so no tree is walked twice. `al2023-web-v1`, `al2023-web-v2` and `al2023-content-v1` stay packaged for rollback identity.
- Expected steady-state sensor cost on a 2-vCPU AL2023 node: at or below 3 % of one vCPU, under 50 MB a minute of reads, resident memory well under 150 MiB. The sensor guide lists the commands that confirm it on a node.
- `check_node --section mojosec` fails while any retired unit or file remains or the active Audit rules still carry the retired exec keys; it no longer checks the resolver, Yama, sidecar or timer.
- `prune_mojosec_broker_flood` prunes tty-less broker sudos only; an interactive run of the broker is never pruned.

### Fixed
- A state file written before this release is drained of any held broker observation through the ordinary path before the seven lineage tables are dropped, counting an unreadable row instead of crash-looping the sensor on startup.
- The daemon's in-memory FIM baseline drops itself when the baseline CLI re-seeds the baseline from another process.

### Upgrade notes
- Nothing changes on a node until it is deployed. On that deploy the retired units and files are removed, the Audit policy is re-converged without exec rules, and on first start the sensor drops the lineage tables and vacuums its state file once.
- `al2023-web-v3` and `al2023-content-v2` are opt-in: set the profile in the fleet desired policy, deploy, then on each node preview every tier and initialize the exact printed digest. Until then the active profile stays whatever was last initialized, and after the policy change the integrity collector performs no FIM scan until the digest is initialized.
- An engine started from an SSH shell gives every broker sudo that shell's Audit session and raises one `auth.sudo_command` a minute until cron relaunches it. Let cron relaunch it, then prune the flood with `prune_mojosec_broker_flood`.