0.9.4 Beta release notes

Release date: September 2026 Previous release: 0.9.3 Beta (May 2026)

Unprivileged user namespaces: restricted, not switched off

Arch removed bubblewrap-suid in September 2026. Ditana had relied on it to keep sandboxes working while unprivileged user namespaces stayed switched off, so its removal broke both halves of that setup simultaneously – and since the installer fetches its configuration at runtime, it broke installations from the already released 0.9.3 medium as well, not just those newly created.

There was no replacement to move to. Upstream removed setuid support in bubblewrap 0.12.0, one day after 0.11.2 fixed a privilege escalation that existed solely in that mode, and the 0.11.x branch that was made available to whoever still needed it was never adopted by anyone.

So the arrangement is now reversed. Rather than disabling user namespaces for all and making one binary exempt, Ditana allows them on a per-executable basis. A BPF program attached to the kernel’s userns_create hook refuses a namespace to anything that has not been declared, and the declaration sits in the configuration next to the package that needs it:

- name="flatpak" default-value=#true {
    arch-packages "flatpak"
    userns-allow "/usr/bin/bwrap"
  }

An essential point, since it determines the outcome in case of errors: a hook of this kind can only ever refuse, never grant. The sysctl that previously disabled user namespaces must be raised for the guard to have anything to act upon, and it is raised only by the service that has already loaded and attached the program. A machine that cannot load it keeps user namespaces entirely switched off. The failure forfeits your sandboxes but never your protection.

The guard is a separate package, ditana-userns-guard, installed together with the System Hardening option that used to be called “Disable unprivileged user namespaces”.

LibreWolf now comes from Arch

LibreWolf now comes from the Arch repositories rather than from Flathub, adhering to the preference hierarchy that puts a native package first. Brave continues to be available via the AUR; the rationale is detailed on the AUR vs Flatpak page.

Every sysctl value is declared as data

Every sysctl value the installer writes is now declared as data rather than assembled as shell text. Two settings that write the same key with different values stop the installation and are both named. Previously, both lines were written and the last one silently won.