openSUSE_Backports_SLE-16.0_PullRequest_2370__patchinfo.20260619112112585023.93181000773252 moderate openSUSE Backports SLE-16.0 PullRequest 2370 This update for shadowsocks-libev fixes the following issues: Changes in shadowsocks-libev: - Comprehensive systemd service hardening (bnc#1212862 and boo#1263916) * Add CAP_DAC_READ_SEARCH to AmbientCapabilities/CapabilityBoundingSet to allow reading certificates from restricted dynamic paths. * Ensures v2ray-plugin can access Let's Encrypt keys reliably. * Restrict root powers using CapabilityBoundingSet (minimal privileges). * Isolate filesystem via ProtectSystem=full and ProtectHome=true. * Whitelist binary and config access with ReadOnlyPaths. * Disable kernel/device modifications (ProtectKernel*, PrivateDevices). * Introduce SELinux and AppArmor as optional security hardening schemes, and add shadowsocks-libev-selinux and shadowsocks-libev-apparmory subpackages. - Integrate shadowsocks-sysuser for proper non-privileged user handling (boo#1264355). - Update version to 3.3.6 * Reduce memory copies in crypto encrypt/decrypt paths * Fix unbounded buffer growth in aead_decrypt chunk reassembly - Run ss-server with root privileges to allow binding to privileged ports and reading SSL certificates (boo#1263916) - All services have been switched to Type=simple mode, and PID file usage has been removed (boo#1263914) - Migrate to mbedtls 3(boo#1261529) - Create /run/shadowsocks using tmpfiles, otherwise systemd services fail to start libshadowsocks-libev2-3.3.6-bp160.999999.1.1.x86_64.rpm libshadowsocks-libev2-debuginfo-3.3.6-bp160.999999.1.1.x86_64.rpm shadowsocks-libev-3.3.6-bp160.999999.1.1.src.rpm shadowsocks-libev-3.3.6-bp160.999999.1.1.x86_64.rpm shadowsocks-libev-apparmor-3.3.6-bp160.999999.1.1.noarch.rpm shadowsocks-libev-debuginfo-3.3.6-bp160.999999.1.1.x86_64.rpm shadowsocks-libev-debugsource-3.3.6-bp160.999999.1.1.x86_64.rpm shadowsocks-libev-devel-3.3.6-bp160.999999.1.1.x86_64.rpm shadowsocks-libev-doc-3.3.6-bp160.999999.1.1.noarch.rpm shadowsocks-libev-selinux-3.3.6-bp160.999999.1.1.noarch.rpm libshadowsocks-libev2-3.3.6-bp160.999999.1.1.s390x.rpm libshadowsocks-libev2-debuginfo-3.3.6-bp160.999999.1.1.s390x.rpm shadowsocks-libev-3.3.6-bp160.999999.1.1.s390x.rpm shadowsocks-libev-debuginfo-3.3.6-bp160.999999.1.1.s390x.rpm shadowsocks-libev-debugsource-3.3.6-bp160.999999.1.1.s390x.rpm shadowsocks-libev-devel-3.3.6-bp160.999999.1.1.s390x.rpm libshadowsocks-libev2-3.3.6-bp160.999999.1.1.ppc64le.rpm libshadowsocks-libev2-debuginfo-3.3.6-bp160.999999.1.1.ppc64le.rpm shadowsocks-libev-3.3.6-bp160.999999.1.1.ppc64le.rpm shadowsocks-libev-debuginfo-3.3.6-bp160.999999.1.1.ppc64le.rpm shadowsocks-libev-debugsource-3.3.6-bp160.999999.1.1.ppc64le.rpm shadowsocks-libev-devel-3.3.6-bp160.999999.1.1.ppc64le.rpm libshadowsocks-libev2-3.3.6-bp160.999999.1.1.aarch64.rpm libshadowsocks-libev2-debuginfo-3.3.6-bp160.999999.1.1.aarch64.rpm shadowsocks-libev-3.3.6-bp160.999999.1.1.aarch64.rpm shadowsocks-libev-debuginfo-3.3.6-bp160.999999.1.1.aarch64.rpm shadowsocks-libev-debugsource-3.3.6-bp160.999999.1.1.aarch64.rpm shadowsocks-libev-devel-3.3.6-bp160.999999.1.1.aarch64.rpm