Gately v0.5.5.2 released

October 22, 2026

This is a security fix release. fnOS users should upgrade soon.

Download v0.5.5.2 · GitHub Release

File permissions in the config directory

Some filesystems ignore the permissions a program requests when it creates a file. For example, fnOS storage volumes mounted with trimacl create every new file and directory as 0755. On such volumes, the following content created by Gately was readable by other local users:

• Runtime logs (logs/) and the audit log (audit.log), which contain client IPs and domains;
• Config history (history/), including earlier versions of rules and credentials;
• Configs generated by the frp module (frp/), which contain the frp token;
• Subscribed IP list caches, local backups, the backups saved automatically before a restore, and the Tailscale state directory.

Module config files (*.json) have always been saved as 0600 and are not affected. Regular filesystems such as ext4 are not affected either.

This release sets permissions explicitly after creating files and directories, and on startup tightens existing content of the kinds above in the config directory to 0600 for files and 0700 for directories, logging how many items were changed in the system log. Programs you placed in bin/ and the config directory itself are left as they are.

Upgrade notes

• From v0.5.5, Linux binary installs upgrade directly from the About page; Docker pulls the new image and recreates the container; fnOS installs the new .fpk from the App Center; OpenWrt installs the new .ipk / .apk.
• "Check for updates" in v0.5.4 and earlier does not understand four-part version numbers. Use "Upload upgrade package" on the About page, or upgrade to v0.5.5 first.
• If you have copied files from the config directory elsewhere (for example to a NAS share as a backup), check the permissions of those copies yourself.