BastionGuard 2.0.4 is here

The BastionGuard project announces version 2.0.4, a security- and reliability-focused release built on the hardening work carried out after version 2.0.3.

This release focuses on reducing the attack surface of privileged operations, improving the handling of external commands and untrusted inputs, strengthening WebUI protections, improving native and service integration, and addressing compilation and packaging compatibility across Linux distributions.

The project maintainer reports successful testing of BastionGuard 2.0.4 on Debian, Ubuntu, Fedora, openSUSE Tumbleweed, openSUSE Leap, Arch Linux, OpenMandriva Lx 6 Rock, Mageia 10, Gentoo Linux, and Alpine Linux.

Security assurance statement: This release incorporates reviewed security hardening and passed the automated checks described below. The review described in this announcement is a developer-assisted source and regression assessment, not an independent security certification or a guarantee that the software is free of vulnerabilities. The most recent source independently examined for this report was a corrected pre-release baseline; the maintainer's distribution testing is reported separately.

Highlights

Reduced command-execution attack surface

– Removed executable calls to system() and popen() from the reviewed C/C++ source baseline.
– Migrated numerous operations to explicit argument-vector execution instead of assembling shell command strings.
– Strengthened argument handling for the setup wizard, certificate installation, firewall operations, file handling, and service management.
– Added regression coverage for hostile input, shell metacharacters, subprocess argument boundaries, and process output handling.

Important distinction: Eliminating system() and popen() does not eliminate every possible shell invocation. Explicit shell-based scripts and process-launch interfaces remain subject to separate validation.

WebUI and administration hardening

– Improved session revalidation, administrator authorization checks, and initial account setup safeguards.
– Moved sensitive SQLite authentication storage outside the public WebUI directory in the reviewed baseline.
– Strengthened CSRF handling, login throttling, and configuration persistence.
– Added authorization restrictions around administrative diagnostics and service actions.

Privilege and service-boundary improvements

– Reviewed Polkit and sudoers configuration and the authorization model for privileged actions.
– Added restrictions on the systemd units that administrative helpers may manage.
– Improved distinction between user and system services during session resume and service restart operations.
– Added tests for privileged command argument handling and service-unit allowlisting.

Safer inputs and networking

– Added or strengthened validation around firewall addresses, WireGuard IP/CIDR and DNS configuration, update-source URLs, and archive processing.
– Converted reviewed update/download paths to argument-based process execution rather than interpolating user-controlled values into shell strings.
– Retained certificate verification in reviewed banking-related TLS requests and browser certificate-error handling.
– Hardened update-source processing, including HTTPS-only external source URLs and safer asynchronous UI data capture.

Linux distribution and toolchain compatibility

– Integrated the RootGuard compatibility patch using __builtin_memcpy_inline at the three relevant sites for Clang 23 builds.
– Addressed GLib/glibmm compilation incompatibilities in the setup wizard.
– Corrected argument-type issues in the CA installer interface.
– Updated Arch-oriented CMake/PKGBUILD behavior, including package staging safety and avoidance of pacman -Sy partial-upgrade workflows.

Linux distribution validation

The following environments have been tested by the BastionGuard maintainer for version 2.0.4. This is a maintainer-reported compatibility matrix, not a separate test run performed by the reviewer of this document.

| Distribution | Maintainer-reported validation |
|—|—|
| Debian | Tested |
| Ubuntu | Tested |
| Fedora | Tested |
| openSUSE Tumbleweed | Tested |
| openSUSE Leap | Tested |
| Arch Linux | Tested |
| OpenMandriva Lx 6 Rock | Tested |
| Mageia 10 | Tested |
| Gentoo Linux | Tested |
| Alpine Linux | Tested |

Init-system note: BastionGuard includes systemd-specific components. On installations using another init system (notably common Alpine Linux and Gentoo configurations), service integration and feature availability depend on the actual init environment. The matrix above records the maintainer's tests; it is not a claim that every systemd-dependent function is universally available on every distribution or configuration.

—

Security Audit — Public Summary

Assessment period: October 2026
Assessment type: Targeted source-code and configuration review with automated regression testing
Reviewed baseline: Hardened BastionGuard pre-2.0.4 source and subsequent BG-01–BG-05 follow-up changes made available during release preparation
Release compatibility confirmation: Final 2.0.4 cross-distribution testing reported by the maintainer
Assurance level: Developer-assisted technical assessment; not third-party-certified and not an exhaustive penetration test

Audit scope

The security review addressed the following trust boundaries and components:

1. Native process execution: system(), popen(), argument-vector process execution, and remaining deliberate script invocation paths.
2. Privileges and services: Polkit policy, sudoers entries, privileged helpers, systemd service management, and administrative actions.
3. WebUI: Authentication, session management, authorization, CSRF controls, sensitive local storage, and administrative endpoints.
4. Untrusted input: Update sources, URLs, WireGuard configuration, IP addresses, archives, filesystem paths, and temporary files.
5. Network and browser security: TLS certificate checks, external data retrieval, banking-related navigation, and certificate trust behavior.
6. RootGuard and packaging: Unit tests, Clang 23 compatibility, Arch build definitions, and install staging controls.

This was a targeted repository-wide security survey, not a formal line-by-line proof of every execution path. Third-party dependency vulnerability scanning, fuzzing, formal verification, and independent penetration testing are not claimed in this report.

Security improvements observed in the reviewed source

| Area | Observed outcome |
|—|—|
| Native C/C++ system() / popen() | No executable occurrences found in the reviewed baseline; alternative shell entry points require their own controls. |
| WebUI authentication and sensitive data | Session and authorization safeguards, login throttling, and private data storage are present and covered by selected regression tests. |
| Firewall and archive inputs | Input validation and sandbox regressions pass. |
| Privileged service management | Systemd unit allowlisting and related tests pass. |
| Update sources and external URLs | Explicit argument passing and HTTPS-only additional update sources are covered by source-level regression guards. |
| WireGuard configuration | Address and DNS validation plus avoidance of shell interpolation in reviewed privileged operations. |
| Banking-related TLS and URL opening | TLS verification and safer URL invocation paths are present in the inspected source. |
| RootGuard / Clang 23 | Compatibility patch present; independent isolated RootGuard tests pass. |
| Distribution compatibility | Successful tests across the listed distributions reported by the maintainer. |

Verification results

These results were recorded during the release-preparation review of the available source snapshot. They should not be confused with an independently reproduced full 2.0.4 installation on every distribution.

| Check | Result | Scope |
|—|—|—|
| Security regression script | PASS | WebUI, archives, firewall argument validation, wizard quoting, safe-process handling, service management, packaging and relevant source guards. |
| RootGuard isolated unit tests | PASS — 3/3 | Policy, file identity and event tests. |
| BG-01–BG-05 follow-up checks | PASS — 11 checks | Source-level regression guards for the reported attack-path classes; not live exploit reproductions. |
| C/C++ search for executable system() and popen() | No executable matches in reviewed baseline | Does not cover every possible shell invocation. |
| Full 2.0.4 multi-distribution testing | Maintainer-confirmed | Debian, Ubuntu, Fedora, openSUSE Tumbleweed/Leap, Arch, OpenMandriva, Mageia, Gentoo and Alpine. |
| Independent end-to-end privileged integration testing on the final 2.0.4 artifact | Not evidenced by this review | No independent claim made for production Polkit, CA installation, dnsmasq, CEF, WireGuard or systemd deployment scenarios. |
| Final 2.0.4 SBOM, dependency CVE triage and immutable release checksum | Not included in this announcement | Refer to the actual published release artifacts and any separately maintained verification records. |

Responsible disclosure and security findings

Security reports received during the 2.0.4 development cycle informed the project's review of privileged operations, command injection, network trust boundaries and handling of untrusted configuration values. Defensive changes and regression checks are included in the assessed source.

Coordinated disclosure is respected: this announcement intentionally does not publish proof-of-concept payloads, reproduction commands, vulnerability details that could assist exploitation, or unassigned CVE identifiers. Separate advisories and researcher acknowledgments should be published only when coordinated with the affected parties and the responsible CVE Numbering Authority, where applicable.

The pre-release audit also tracked hardening considerations involving privileged CA installation, certificate trust scope and lifecycle, and subprocess robustness. This public summary does not independently attest that every such item was closed in the final 2.0.4 release artifact. Any remaining items must be reflected in the project's internal remediation and release records; passing regression tests alone does not constitute closure.

Interpretation of the audit

– What is supported: the described safeguards are present in the source snapshot examined during release preparation; the available automated security tests passed; the maintainer confirms distribution testing for version 2.0.4.
– What is not claimed: an independently certified security posture, a comprehensive penetration test, proof that all vulnerabilities have been removed, or independent reproducibility of the final release across every listed system.
– What users should do: install the official release package for their distribution, review the administrator setup and service-permission guidance, and keep the application and its dependencies updated.

Thank you to the developers, maintainers, testers and security researchers whose work contributes to making BastionGuard more reliable and secure.

BastionGuard 2.0.4 — Security hardening, broader Linux compatibility, and a continued commitment to transparent engineering.