forked from systemd/systemd
-
Notifications
You must be signed in to change notification settings - Fork 1
/
NEWS
17573 lines (14223 loc) · 929 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
systemd System and Service Manager
CHANGES WITH 256 in spe:
Announcements of Future Feature Removals and Incompatible Changes:
* Support for flushing of the nscd user/group database caches will be
dropped in a future release.
* Support for cgroup v1 ('legacy' and 'hybrid' hierarchies) is now
considered obsolete and systemd by default will refuse to boot under
it. To forcibly reenable cgroup v1 support,
SYSTEMD_CGROUP_ENABLE_LEGACY_FORCE=1 must be set on kernel command
line. The meson option 'default-hierarchy=' is also deprecated, i.e.
only cgroup v2 ('unified' hierarchy) can be selected as build-time
default.
* Previously, systemd-networkd did not explicitly remove any bridge
VLAN IDs assigned on bridge master and ports. Since version 256, if a
.network file for an interface has at least one valid setting in the
[BridgeVLAN] section, then all assigned VLAN IDs on the interface
that are not configured in the .network file are removed.
* systemd-gpt-auto-generator will stop generating units for ESP or
XBOOTLDR partitions if it finds mount entries in the /boot/ or /efi/
hierarchies in fstab. This is to prevent the generator from
interfering with systems where ESP is explicitly configured to be
mounted at some path, for example /boot/efi/ (this type of setup is
obsolete but still commonly found).
* The behavior of systemd-sleep and systemd-homed has been updated to
freeze user sessions when entering the various sleep modes or when
locking a homed-managed home area. This is known to cause issues with
the proprietary NVIDIA drivers. Packagers of the NVIDIA proprietary
drivers may want to add drop-in configuration files that set
SYSTEMD_SLEEP_FREEZE_USER_SESSION=false for systemd-suspend.service
and related services, and SYSTEMD_HOME_LOCK_FREEZE_SESSION=false for
systemd-homed.service.
* systemd-tmpfiles and systemd-sysusers, when given a relative path
(with at least one directory separator '/'), will open the file
directly, instead of searching for the given partial path in the
standard locations. The old mode wasn't useful because tmpfiles.d and
sysusers.d configuration has a flat structure with no subdirectories
under the standard locations and this change makes it easier to work
with local files with those tools.
* systemd-tmpfiles now properly applies nested configuration to 'R' and
'D' stanzas. For example, with 'R /foo; x /foo/bar', /foo/bar will
now be excluded from removal.
General Changes and New Features:
* Various programs will load the main configuration from under
/usr/lib/, /usr/local/lib/, and /run/, not just from under /etc/. For
example, systemd-logind will look for /etc/systemd/logind.conf,
/run/systemd/logind.conf, /usr/local/lib/systemd/logind.conf, and
/usr/lib/systemd/logind.conf, and use the first file that is found.
This means that the location logic for the main config file and for
drop-ins is now the same.
ukify will look for the config files in /usr/lib/kernel/ and the
other locations, and now also supports drop-ins.
systemd-udevd now supports drop-ins for udev.conf.
* A new 'systemd-vpick' binary has been added. It implements the new
vpick protocol, where a .v directory may contain multiple files with
a version, following the UAPI version format specification, embedded
in the file name. The files are ordered by version and the newest one
is selected.
systemd-nspawn, systemd-dissect, and the RootDirectory=, RootImage=,
ExtensionImages=, and ExtensionDirectories= settings for units now
support the vpick protocol and allow the latest version to be
selected automatically if a "*.v/" directory is specified as the
source.
* Credentials can now be made accessible to and used by unprivileged
users. 'systemd-creds --user --uid=<user>' will encrypt or decrypt a
credential for a specific user.
* With systemd-homed, it is now possible to log in and activate an
encrypted home area over SSH.
homectl is now installed as a multi-call binary. When invoked as
systemd-home-fallback-shell it can be used as a temporary shell which
allows the home area to interactively unlocked. When the home area
becomes available, the temporary shell executes the normal one.
systemd-homed gained new methods
org.freedesktop.home1.Manager.RefHomeUnrestricted,
org.freedesktop.home1.Home.RefUnrestricted,
org.freedesktop.home1.Manager.ActivateHomeIfReferenced, and
org.freedesktop.home1.Home.ActivateIfReferenced to allow logging in
without activating the home area and then activating the home area
later.
* JSON User Records have been extended with a separate storage area
called "User Record Blob Directories". This is intended to store the
user's background image, avatar picture, and other similar items
which are too large to fit into the User Record itself.
systemd-homed, userdbctl, and homectl gained support for blob
directories.
* New command-line tool 'importctl' to download, import, and export
disk images via systemd-importd is added with the following verbs:
pull-tar, pull-raw, import-tar, import-raw, import-fs, export-tar,
export-raw, list-transfers, cancel-transfer.
Service Manager:
* New manager setting ProtectSystem= has been added. It is analogous to
the unit setting, but applies to the whole system. It is enabled by
default in the initrd.
* New unit setting WantsMountsFor= has been added. It is analogous to
RequiresMountsFor=, but with a Wants= dependency instead of
Requires=. This new logic is used in various places where mounts were
added as dependencies for other settings (WorkingDirectory=-…,
PrivateTmp=yes, cryptsetup lines with 'nofail').
* New unit setting MemoryZSwapWriteback= can be used to control the new
memory.zswap.writeback cgroup knob added in kernel 6.8.
* The manager gained a org.freedesktop.systemd1.StartAuxiliaryScope()
method to devolve some processes from a service into a new scope.
This new scope will remain even if the original service unit is
restarted. Cgroup properties of the new scope are copied from the
service, so various limits are retained.
* Units now expose properties EffectiveMemoryMax=,
EffectiveMemoryHigh=, and EffectiveTasksMax=, which report the
most stringent limit systemd is aware of for the given unit.
* A new specifier %D expands to $XDG_DATA_HOME.
* AllowedCPUs= now supports specifier expansion.
* What= setting in .mount and .swap units now accepts fstab-style
identifiers, for example UUID=… or LABEL=….
* RestrictNetworkInterfaces= now supports alternative network interface
names.
* PAMName= now implies SetLoginEnvironment=yes.
* homectl gained a new verb 'firstboot', and a new
systemd-homed-firstboot.service unit uses this verb to create users
in a first boot environment, either from credentials or by querying
interactively.
* systemd.firstboot=no can be used on the kernel command-line to
disable interactive queries, but allow other first boot configuration
to happen based on credentials.
* A new kernel command-line option systemd.default_debug_tty= can be
used to specify the TTY for the debug shell, independently of
enabling or disabling it.
* Systemd hostname can be configured via the systemd.hostname
credential.
The Journal:
* systemd-journald can now forward journal entries to a socket
(AF_INET, AF_INET6, AF_UNIX, or AF_VSOCK). The socket can be
specified in journald.conf via a new option ForwardAddress= or via
the 'journald.forward_address' credential.
* systemd-journal-remote now also accepts AF_VSOCK and AF_UNIX sockets
(so it can be used to receive entries forwarded by systemd-journald).
* systemd-vmspawn gained a new --forward-journal= option to forward the
virtual machine's journal entries to the host. This is done over a
AF_VSOCK socket, i.e. it does not require networking in the guest.
* journalctl gained option '-i' as a shortcut for --file=.
* journalctl gained a new -T/--exclude-identifier= option to filter
out certain syslog identifiers.
* journalctl gained a new --list-namespaces option.
* systemd-journal-gatewayd allows restricting the time range of
retrieved entries with realtime=[<since>]:[<until>].
Device Management:
* Udev now creates symlinks that combine by-path and by-{label,uuid}
information:
/dev/disk/by-path/<path>/by-<label|uuid|…>/<label|uuid|…>.
This allows distinguishing partitions with identical contents on
multiple storage devices. This is useful, for example, when copying
raw disk contents between devices.
* Udev now creates persistent /dev/media/by-path symlinks for media
controllers. For example, the uvcvideo driver may create /dev/media0
which will be linked as
/dev/media/by-path/pci-0000:04:00.3-usb-0:1:1.0-media-controller.
* An allowlist/denylist may be specified to filter which sysfs
attributes are used when crafting network interface names. Those
lists are stored as HWDB entries
ID_NET_NAME_ALLOW_<sysfsattr>=0|1
and
ID_NET_NAME_ALLOW=0|1.
The goal is to avoid unexpected changes to interface names when the
kernel is updated and new sysfs attributes become visible.
* A new unit tpm2.target has been added to provide a synchronization
point for units which expect the TPM hardware to be available.
* systemd-backlight now properly supports numbered devices which the
kernel creates to avoid collisions in the leds subsystem.
* systemd-hwdb update operation can be disabled with environment
variable SYSTEMD_HWDB_UPDATE_BYPASS=1.
* systemd-logind gained a new org.freedesktop.login1.Manager.Sleep()
method that automatically redirects to SuspendThenHibernate(),
Suspend(), HybridSleep(), or Hibernate(), depending on what is
supported and configured, a new configuration setting SleepOperation=,
and an accompanying helper method
org.freedesktop.login1.Manager.CanSleep() and property
org.freedesktop.login1.Manager.SleepOperation.
'systemctl sleep' calls the new method to automatically put the
machine to sleep in the most appropriate way.
* systemd-hostnamed now exposes the machine ID and boot ID via D-Bus.
* systemd-hostnamed now provides a Varlink interface.
* systemd-hostnamed exports the data in os-release(5) and
machine-info(5) via D-Bus and Varlink.
Network Management:
* systemd-networkd now provides a Varlink interface.
* systemd-networkd's proxy support gained a new option to configure
a private VLAN variant of the proxy ARP supported by the kernel
under the name IPv4ProxyARPPrivateVLAN=.
* systemd-networkd now exports the NamespaceId and NamespaceNSID
properties via D-Bus and Varlink.
* systemd-networkd now supports IPv6RetransmissionTimeSec= and
UseRetransmissionTime= settings in .network files to configure
retransmission time for IPv6 neighbor solicitation messages.
* networkctl gained new verbs 'mask' and 'unmask'.
* 'networkctl edit --runtime' allows editing volatile configuration
under /run/systemd/network/.
* The implementation behind TTLPropagate= network setting has been
removed and the setting is now ignored.
* systemd-network-generator will now pick up .netdev/.link/.network
configuration from credentials.
* systemd-networkd will now pick up wireguard configuration from
credentials.
* systemd-ssh-proxy is a new SSH client plugin that allows connecting
to AF_SOCK or AF_UNIX sockets.
* systemd-nspawn now provides a /run/systemd/nspawn/unix-export/
directory where the container payload can expose AF_UNIX sockets to
allow them them to be accessed from outside.
* systemd-nspawn will tint the background for container output.
This can be controller with the new --backgroup= option.
* systemd-nspawn gained support for the 'owneridmap' option for bind
mounts to map the target directory owner from inside the container to
the owner of the directory bound from the host filesystem.
* An sshd config drop-in to allow ssh keys acquired via userdbctl to be
used for authorization.
* New generator systemd-ssh-generator can be used to bind a
socket-activated SSH instance to a local AF_SOCK or AF_UNIX socket.
This generator will automatically bind /run/host/unix-export/ssh.
* systemd-resolved now implements RFC 8914 EDE error codes.
* systemd-resolved and resolvectl now support RFC 9460 SVCB and HTTPS
records.
* resolvectl gained a new option --relax-single-label= to allow
querying single-label hostnames via DNS.
Systemd-boot and systemd-stub and Related Tools:
* TPM 1.2 PCR measurement support has been removed from systemd-stub.
TPM 1.2 is obsolete and – due to the (by today's standards) weak
cryptographic algorithms it only supports – does not actually provide
the security benefits it's supposed to provide. Given that the rest
of systemd's codebase never supported TPM 1.2, the support has now
been removed from systemd-stub as well.
* Confexts are loaded by systemd-stub from the ESP as well.
* The pcrlock policy is saved in an unencrypted credential file
"pcrlock.<entry-token>.cred" under XBOOTLDR/ESP in the
/loader/credentials/ directory. It will be picked up at boot by
systemd-stub and passed to the initrd, where it can be used to unlock
the root file system.
* kernel-install gained support for --root= for the 'list' verb.
* systemd-pcrlock gained an --entry-token= option to configure the
entry-token.
* systemd-pcrlock now provides a Varlink interface and can be
run as a daemon via a template unit.
* bootctl now provides a Varlink interface and can be run as a daemon
via a template unit.
* ukify gained support for signing of PCR signatures via OpenSSL's
engines and providers.
* ukify now supports zboot kernels.
Command-line tools:
* systemd-run is now a multi-call binary. When invoked as 'run0', it
provides as interface similar to 'sudo', with all arguments starting
at the first non-option parameter being treated the command to
invoke as root. Unlike 'sudo' and similar tools, it does not make use
of setuid binaries or other privilege escalation methods, but instead
runs the specified command as a transient unit, which is started by
the system service manager, so privileges are dropped, rather than
gained, thus implementing a much more robust and safe security model.
* systemd-run gained a new option '--ignore-failure' to suppress
command failures.
* systemd-creds gained new options --user/--uid=.
* 'systemctl edit --stdin' allows creation of unit files and drop-ins
with contents supplied via standard input. This is useful when creating
configuration programmatically; the tool takes care of figuring out
the file name, creating any directories, and reloading the manager
afterwards.
* 'systemctl disable --now' and 'systemctl mask --now' now work
correctly with template units.
* 'systemd-analyze architectures' lists known CPU architectures.
* 'systemd-analyze --json=…' is supported for 'architectures',
'capability', 'exit-status'.
* 'systemd-tmpfiles --purge' will purge (remove) all files and
directories created via tmpfiles.d configuration.
* systemd-id128 gained new options --no-pager, --no-legend, and
-j/--json=.
* hostnamectl gained '-j' as shortcut for '--json=pretty' or
'--json=short'.
* loginctl now supports -j/--json=.
* resolvectl now supports -j/--json= for --type=.
* systemd-vmspawn gained a new --firmware= option to configure or list
firmware definitions for Qemu, a new --tpm= option to enable or
disable the use of a software TPM, a new --linux= option to specify a
kernel binary for direct kernel boot, a new --initrd= option to
specify an initrd for direct kernel boot, a new -D/--directory option
to use a plain directory as the root file system, a new
--private-users option similar to the one in systemd-nspawn, new
options --bind= and --bind-ro= to bind part of the host's file system
hierarchy into the guest, a new --extra-drive= option to attach
additional storage, and -n/--network-tap/--network-user-mode to
configure networking.
* A new systemd-vmspawn@.service can be used to launch systemd-vmspawn
as a service.
* varlinkctl gained support for the "ssh:" transport. This requires
OpenSSH 9.4 or newer.
* varlinkctl gained a new --collect switch to collect all responses of
a method call emitted in JSON_SEQ mode and turn them into normal
JSON.
* systemd-sysext gained support for mutable system extensions, where a
writeable upperdir is stored under /var/lib/extensions.mutable/, and
a new --mutable option to configure this behaviour.
* systemd-dissect gained a new --make-archive-option to generate an
archive file from a disk image.
* systemd-repart gained new options --generate-fstab= and
--generate-crypttab= to write the fstab and crypttab files.
* systemd-repart gained a new option --private-key-source= to allow
using OpenSSL's "engines" or "providers" as the signing mechanism to
use when creating verity signature partitions.
* systemd-measure gained new options --certificate=, --private-key=,
and --private-key-source= to allow using OpenSSL's "engines" or
"providers" as the signing mechanism to use when creating signed
TPM2 PCR measurement values.
* systemd-tmpfiles gained a new option --dry-run to print what would be
done without actually taking action.
* systemd-bsod gained a new option --tty= to specify the output TTY
* timedatectl and machinectl gained option '-P', an alias for
'--value --property=…'.
* Various tools that pretty-print config files will now highlight
configuration directives.
Libraries:
* libsystemd gained new call sd_bus_creds_new_from_pidfd to get a
credentials object for a pidfd and sd_bus_creds_get_pidfd_dup() to
retrieve the pidfd from a credentials object.
* RPM macro %_kernel_install_dir has been added with the path
to the directory for kernel-install plugins.
Other:
* systemd-logind now supports a new "background-light" session class
which does not pull in the user@.service unit. This is intended in
particular for cron jobs.
systemd-logind now also supports a new "user-incomplete" session
class for a user session that does not have a running user manager,
but may be upgraded to a full "user" session later on. This has
been hooked into the PAM stack to appropriately classify sessions
while they are being started.
systemd-logind gained a new org.freedesktop.login1.Session.SetClass()
method to change the session class.
systemd-logind will not allow background, background-light, manager,
and manager-early session types to take control of devices or change
the session type.
* systemd-logind gained a new
org.freedesktop.login1.Manager.ListSessionsEx() method that provides
additional metadata compared to ListSessions(). loginctl makes use of
this to list additional fields in list-sessions.
* systemd-cryptenroll can now enroll directly with a PKCS11 public key
(instead of a certificate).
* Core dumps are now retained for two weeks by default.
* systemd-cryptsetup gained support for crypttab option
link-volume-key= to enter the volume key into the kernel keyring when
the volume is opened.
* portablectl --copy= parameter gained a new 'mixed' argument, that will
result in resources owned by the OS (e.g.: portable profiles) to be linked
but resources owned by the portable image (e.g.: the unit files and the
images themselves) to be copied.
* The remaining documentation that was on
https://freedesktop.org/wiki/Software/systemd/ has been moved to
https://systemd.io.
* A small new unit generator "systemd-ssh-generator" has been added. It
checks if the sshd binary is installed. If so, it binds it via
per-connection socket activation to various sockets depending on the
execution context:
• If the system is run in a VM providing AF_VSOCK support, it
automatically binds sshd to AF_VSOCK port 22.
• If the system is invoked as a full-OS container and the container
manager pre-mounts a directory /run/host/unix-export/, it will
bind sshd to an AF_UNIX socket /run/host/unix-export/ssh. The
idea is the container manager bind mounts the directory to an
appropriate place on the host as well, so that the AF_UNIX socket
may be used to easily connect from the host to the container.
• sshd is also bound to an AF_UNIX socket
/run/ssh-unix-local/socket, which may be to use ssh/sftp in a
"sudo"-like fashion to access resources of other local users.
• Via the kernel command line option "systemd.ssh_listen=" and the
system credential "ssh.listen" sshd may be bound to additional,
explicitly configured options, including AF_INET/AF_INET6 ports.
In particular the first two mechanisms should make dealing with local
VMs and full OS containers a lot easier, as SSH connections will
*just* *work* from the host – even if no networking is available
whatsoever.
systemd-ssh-generator optionally generates a per-connection
socket activation service file wrapping sshd. This is only done if
the distribution does not provide one on its own under the name
"sshd@.service". The generated unit only works correctly if the SSH
privilege separation ("privsep") directory exists. Unfortunately
distributions vary wildly where they place this directory. An
incomprehensive list:
• /usr/share/empty.sshd/ (new fedora)
• /var/empty/
• /var/empty/sshd/
• /run/sshd/ (debian/ubuntu?)
If the SSH privsep directory is placed below /var/ or /run/ care
needs to be taken that the directory is created automatically at boot
if needed, since these directories possibly or always come up
empty. This can be done via a tmpfiles.d/ drop-in. You may use the
"sshdprivsepdir" meson option provided by systemd to configure the
directory, in case you want systemd to create the directory as needed
automatically, if your distribution does not cover this natively.
Recommendations to distributions, in order to make things just work:
• Please provide a per-connection SSH service file under the name
"sshd@.service".
• Please move the SSH privsep dir into /usr/ (so that it is truly
immutable on image-based operating systems, is strictly under
package manager control, and never requires recreation if the
system boots up with an empty /run/ or /var/).
• As an extension of this: please consider following Fedora's lead
here, and use /usr/share/empty.sshd/ to minimize needless
differences between distributions.
• If your distribution insists on placing the directory in /var/ or
/run/ then please at least provide a tmpfiles.d/ drop-in to
recreate it automatically at boot, so that the sshd binary just
works, regardless in which context it is called.
* A small tool "systemd-ssh-proxy" has been added, which is supposed to
act as counterpart to "systemd-ssh-generator". It's a small plug-in
for the SSH client (via ProxyCommand/ProxyUseFdpass) to allow it to
connect to AF_VSOCK or AF_UNIX sockets. Example: "ssh vsock/4711"
connects to a local VM with cid 4711, or "ssh
unix/run/ssh-unix-local/socket" to connect to the local host via the
AF_UNIX socket /run/ssh-unix-local/socket.
CHANGES WITH 255:
Announcements of Future Feature Removals and Incompatible Changes:
* Support for split-usr (/usr/ mounted separately during late boot,
instead of being mounted by the initrd before switching to the rootfs)
and unmerged-usr (parallel directories /bin/ and /usr/bin/, /lib/ and
/usr/lib/, …) has been removed. For more details, see:
https://lists.freedesktop.org/archives/systemd-devel/2022-September/048352.html
* We intend to remove cgroup v1 support from a systemd release after
the end of 2023. If you run services that make explicit use of
cgroup v1 features (i.e. the "legacy hierarchy" with separate
hierarchies for each controller), please implement compatibility with
cgroup v2 (i.e. the "unified hierarchy") sooner rather than later.
Most of Linux userspace has been ported over already.
* Support for System V service scripts is now deprecated and will be
removed in a future release. Please make sure to update your software
*now* to include a native systemd unit file instead of a legacy
System V script to retain compatibility with future systemd releases.
* Support for the SystemdOptions EFI variable is deprecated.
'bootctl systemd-efi-options' will emit a warning when used. It seems
that this feature is little-used and it is better to use alternative
approaches like credentials and confexts. The plan is to drop support
altogether at a later point, but this might be revisited based on
user feedback.
* systemd-run's switch --expand-environment= which currently is disabled
by default when combined with --scope, will be changed in a future
release to be enabled by default.
* "systemctl switch-root" is now restricted to initrd transitions only.
Transitions between real systems should be done with
"systemctl soft-reboot" instead.
* The "ip=off" and "ip=none" kernel command line options interpreted by
systemd-network-generator will now result in IPv6RA + link-local
addressing being disabled, too. Previously DHCP was turned off, but
IPv6RA and IPv6 link-local addressing was left enabled.
* The NAMING_BRIDGE_MULTIFUNCTION_SLOT naming scheme has been deprecated
and is now disabled.
* SuspendMode=, HibernateState= and HybridSleepState= in the [Sleep]
section of systemd-sleep.conf are now deprecated and have no effect.
They did not (and could not) take any value other than the respective
default. HybridSleepMode= is also deprecated, and will now always use
the 'suspend' disk mode.
Service Manager:
* The way services are spawned has been overhauled. Previously, a
process was forked that shared all of the manager's memory (via
copy-on-write) while doing all the required setup (e.g.: mount
namespaces, CGroup configuration, etc.) before exec'ing the target
executable. This was problematic for various reasons: several glibc
APIs were called that are not supposed to be used after a fork but
before an exec, copy-on-write meant that if either process (the
manager or the child) touched a memory page a copy was triggered, and
also the memory footprint of the child process was that of the
manager, but with the memory limits of the service. From this version
onward, the new process is spawned using CLONE_VM and CLONE_VFORK
semantics via posix_spawn(3), and it immediately execs a new internal
binary, systemd-executor, that receives the configuration to apply
via memfd, and sets up the process before exec'ing the target
executable. The systemd-executor binary is pinned by file descriptor
by each manager instance (system and users), and the reference is
updated on daemon-reexec - it is thus important to reexec all running
manager instances when the systemd-executor and/or libsystemd*
libraries are updated on the filesystem.
* Most of the internal process tracking is being changed to use PIDFDs
instead of PIDs when the kernel supports it, to improve robustness
and reliability.
* A new option SurviveFinalKillSignal= can be used to configure the
unit to be skipped in the final SIGTERM/SIGKILL spree on shutdown.
This is part of the required configuration to let a unit's processes
survive a soft-reboot operation.
* System extension images (sysext) can now set
EXTENSION_RELOAD_MANAGER=1 in their extension-release files to
automatically reload the service manager (PID 1) when
merging/refreshing/unmerging on boot. Generally, while this can be
used to ship services in system extension images it's recommended to
do that via portable services instead.
* The ExtensionImages= and ExtensionDirectories= options now support
confexts images/directories.
* A new option NFTSet= provides a method for integrating dynamic cgroup
IDs into firewall rules with NFT sets. The benefit of using this
setting is to be able to use control group as a selector in firewall
rules easily and this in turn allows more fine grained filtering.
Also, NFT rules for cgroup matching use numeric cgroup IDs, which
change every time a service is restarted, making them hard to use in
systemd environment.
* A new option CoredumpReceive= can be set for service and scope units,
together with Delegate=yes, to make systemd-coredump on the host
forward core files from processes crashing inside the delegated
CGroup subtree to systemd-coredump running in the container. This new
option is by default used by systemd-nspawn containers that use the
"--boot" switch.
* A new ConditionSecurity=measured-uki option is now available, to ensure
a unit can only run when the system has been booted from a measured UKI.
* MemoryAvailable= now considers physical memory if there are no CGroup
memory limits set anywhere in the tree.
* The $USER environment variable is now always set for services, while
previously it was only set if User= was specified. A new option
SetLoginEnvironment= is now supported to determine whether to also set
$HOME, $LOGNAME, and $SHELL.
* Socket units now support a new pair of
PollLimitBurst=/PollLimitInterval= options to configure a limit on
how often polling events on the file descriptors backing this unit
will be considered within a time window.
* Scope units can now be created using PIDFDs instead of PIDs to select
the processes they should include.
* Sending SIGRTMIN+18 with 0x500 as sigqueue() value will now cause the
manager to dump the list of currently pending jobs.
* If the kernel supports MOVE_MOUNT_BENEATH, the systemctl and
machinectl bind and mount-image verbs will now cause the new mount to
replace the old mount (if any), instead of overmounting it.
* Units now have MemoryPeak, MemorySwapPeak, MemorySwapCurrent and
MemoryZSwapCurrent properties, which respectively contain the values
of the cgroup v2's memory.peak, memory.swap.peak, memory.swap.current
and memory.zswap.current properties. This information is also shown in
"systemctl status" output, if available.
TPM2 Support + Disk Encryption & Authentication:
* systemd-cryptenroll now allows specifying a PCR bank and explicit hash
value in the --tpm2-pcrs= option.
* systemd-cryptenroll now allows specifying a TPM2 key handle (nv
index) to be used instead of the default SRK via the new
--tpm2-seal-key-handle= option.
* systemd-cryptenroll now allows TPM2 enrollment using only a TPM2
public key (in TPM2B_PUBLIC format) – without access to the TPM2
device itself – which enables offline sealing of LUKS images for a
specific TPM2 chip, as long as the SRK public key is known. Pass the
public to the tool via the new --tpm2-device-key= switch.
* systemd-cryptsetup is now installed in /usr/bin/ and is no longer an
internal-only executable.
* The TPM2 Storage Root Key will now be set up, if not already present,
by a new systemd-tpm2-setup.service early boot service. The SRK will
be stored in PEM format and TPM2_PUBLIC format (the latter is useful
for systemd-cryptenroll --tpm2-device-key=, as mentioned above) for
easier access. A new "srk" verb has been added to systemd-analyze to
allow extracting it on demand if it is already set up.
* The internal systemd-pcrphase executable has been renamed to
systemd-pcrextend.
* The systemd-pcrextend tool gained a new --pcr= switch to override
which PCR to measure into.
* systemd-pcrextend now exposes a Varlink interface at
io.systemd.PCRExtend that can be used to do measurements and event
logging on demand.
* TPM measurements are now also written to an event log at
/run/log/systemd/tpm2-measure.log, using a derivative of the TCG
Canonical Event Log format. Previously we'd only log them to the
journal, where they however were subject to rotation and similar.
* A new component "systemd-pcrlock" has been added that allows managing
local TPM2 PCR policies for PCRs 0-7 and similar, which are hard to
predict by the OS vendor because of the inherently local nature of
what measurements they contain, such as firmware versions of the
system and extension cards and suchlike. pcrlock can predict PCR
measurements ahead of time based on various inputs, such as the local
TPM2 event log, GPT partition tables, PE binaries, UKI kernels, and
various other things. It can then pre-calculate a TPM2 policy from
this, which it stores in an TPM2 NV index. TPM2 objects (such as disk
encryption keys) can be locked against this NV index, so that they
are locked against a specific combination of system firmware and
state. Alternatives for each component are supported to allowlist
multiple kernel versions or boot loader version simultaneously
without losing access to the disk encryption keys. The tool can also
be used to analyze and validate the local TPM2 event log.
systemd-cryptsetup, systemd-cryptenroll, systemd-repart have all been
updated to support such policies. There's currently no support for
locking the system's root disk against a pcrlock policy, this will be
added soon. Moreover, it is currently not possible to combine a
pcrlock policy with a signed PCR policy. This component is
experimental and its public interface is subject to change.
systemd-boot, systemd-stub, ukify, bootctl, kernel-install:
* bootctl will now show whether the system was booted from a UKI in its
status output.
* systemd-boot and systemd-stub now use different project keys in their
respective SBAT sections, so that they can be revoked individually if
needed.
* systemd-boot will no longer load unverified Devicetree blobs when UEFI
SecureBoot is enabled. For more details see:
https://github.com/systemd/systemd/security/advisories/GHSA-6m6p-rjcq-334c
* systemd-boot gained new hotkeys to reboot and power off the system
from the boot menu ("B" and "O"). If the "auto-poweroff" and
"auto-reboot" options in loader.conf are set these entries are also
shown as menu items (which is useful on devices lacking a regular
keyboard).
* systemd-boot gained a new configuration value "menu-disabled" for the
set-timeout option, to allow completely disabling the boot menu,
including the hotkey.
* systemd-boot will now measure the content of loader.conf in TPM2
PCR 5.
* systemd-stub will now concatenate the content of all kernel
command-line addons before measuring them in TPM2 PCR 12, in a single
measurement, instead of measuring them individually.
* systemd-stub will now measure and load Devicetree Blob addons, which
are searched and loaded following the same model as the existing
kernel command-line addons.
* systemd-stub will now ignore unauthenticated kernel command line options
passed from systemd-boot when running inside Confidential VMs with UEFI
SecureBoot enabled.
* systemd-stub will now load a Devicetree blob even if the firmware did
not load any beforehand (e.g.: for ACPI systems).
* ukify is no longer considered experimental, and now ships in /usr/bin/.
* ukify gained a new verb inspect to describe the sections of a UKI and
print the contents of the well-known sections.
* ukify gained a new verb genkey to generate a set of key pairs for
signing UKIs and their PCR data.
* The 90-loaderentry kernel-install hook now supports installing device
trees.
* kernel-install now supports the --json=, --root=, --image=, and
--image-policy= options for the inspect verb.
* kernel-install now supports new list and add-all verbs. The former
lists all installed kernel images (if those are available in
/usr/lib/modules/). The latter will install all the kernels it can
find to the ESP.
systemd-repart:
* A new option --copy-from= has been added that synthesizes partition
definitions from the given image, which are then applied by the
systemd-repart algorithm.
* A new option --copy-source= has been added, which can be used to specify
a directory to which CopyFiles= is considered relative to.
* New --make-ddi=confext, --make-ddi=sysext, and --make-ddi=portable
options have been added to make it easier to generate these types of
DDIs, without having to provide repart.d definitions for them.
* The dm-verity salt and UUID will now be derived from the specified
seed value.
* New VerityDataBlockSizeBytes= and VerityHashBlockSizeBytes= can now be
configured in repart.d/ configuration files.
* A new Subvolumes= setting is now supported in repart.d/ configuration
files, to indicate which directories in the target partition should be
btrfs subvolumes.
* A new --tpm2-device-key= option can be used to lock a disk against a
specific TPM2 public key. This matches the same switch the
systemd-cryptenroll tool now supports (see above).
Journal:
* The journalctl --lines= parameter now accepts +N to show the oldest N
entries instead of the newest.
* journald now ensures that sealing happens once per epoch, and sets a
new compatibility flag to distinguish old journal files that were
created before this change, for backward compatibility.
Device Management:
* udev will now create symlinks to loopback block devices in the
/dev/disk/by-loop-ref/ directory that are based on the .lo_file_name
string field selected during allocation. The systemd-dissect tool and
the util-linux losetup command now supports a complementing new switch
--loop-ref= for selecting the string. This means a loopback block
device may now be allocated under a caller-chosen reference and can
subsequently be referenced without first having to look up the block
device name the caller ended up with.
* udev also creates symlinks to loopback block devices in the
/dev/disk/by-loop-inode/ directory based on the .st_dev/st_ino fields
of the inode attached to the loopback block device. This means that
attaching a file to a loopback device will implicitly make a handle
available to be found via that file's inode information.
* udevadm info gained support for JSON output via a new --json= flag, and
for filtering output using the same mechanism that udevadm trigger
already implements.
* The predictable network interface naming logic is extended to include
the SR-IOV-R "representor" information in network interface names.
This feature was intended for v254, but even though the code was
merged, the part that actually enabled the feature was forgotten.
It is now enabled by default and is part of the new "v255" naming
scheme.
* A new hwdb/rules file has been added that sets the
ID_NET_AUTO_LINK_LOCAL_ONLY=1 udev property on all network interfaces
that should usually only be configured with link-local addressing
(IPv4LL + IPv6LL), i.e. for PC-to-PC cables ("laplink") or
Thunderbolt networking. systemd-networkd and NetworkManager (soon)
will make use of this information to apply an appropriate network
configuration by default.
* The ID_NET_DRIVER property on network interfaces is now set
relatively early in the udev rule set so that other rules may rely on
its use. This is implemented in a new "net-driver" udev built-in.
Network Management:
* The "duid-only" option for DHCPv4 client's ClientIdentifier= setting
is now dropped, as it never worked, hence it should not be used by
anyone.
* The 'prefixstable' ipv6 address generation mode now considers the SSID
when generating stable addresses, so that a different stable address
is used when roaming between wireless networks. If you already use
'prefixstable' addresses with wireless networks, the stable address
will be changed by the update.
* The DHCPv4 client gained a RapidCommit option, true by default, which
enables RFC4039 Rapid Commit behavior to obtain a lease in a
simplified 2-message exchange instead of the typical 4-message
exchange, if also supported by the DHCP server.
* The DHCPv4 client gained new InitialCongestionWindow= and
InitialAdvertisedReceiveWindow= options for route configurations.
* The DHCPv4 client gained a new RequestAddress= option that allows
to send a preferred IP address in the initial DHCPDISCOVER message.
* The DHCPv4 server and client gained support for IPv6-only mode
(RFC8925).
* The SendHostname= and Hostname= options are now available for the
DHCPv6 client, independently of the DHCPv4= option, so that these
configuration values can be set independently for each client.
* The DHCPv4 and DHCPv6 client state can now be queried via D-Bus,
including lease information.
* The DHCPv6 client can now be configured to use a custom DUID type.
* .network files gained a new IPv4ReversePathFilter= setting in the
[Network] section, to control sysctl's rp_filter setting.
* .network files gaiend a new HopLimit= setting in the [Route] section,
to configure a per-route hop limit.
* .network files gained a new TCPRetransmissionTimeoutSec= setting in
the [Route] section, to configure a per-route TCP retransmission
timeout.
* A new directive NFTSet= provides a method for integrating network
configuration into firewall rules with NFT sets. The benefit of using
this setting is that static network configuration or dynamically
obtained network addresses can be used in firewall rules with the
indirection of NFT set types.
* The [IPv6AcceptRA] section supports the following new options:
UsePREF64=, UseHopLimit=, UseICMP6RateLimit=, and NFTSet=.
* The [IPv6SendRA] section supports the following new options:
RetransmitSec=, HopLimit=, HomeAgent=, HomeAgentLifetimeSec=, and
HomeAgentPreference=.
* A new [IPv6PREF64Prefix] set of options, containing Prefix= and
LifetimeSec=, has been introduced to append pref64 options in router
advertisements (RFC8781).
* The network generator now configures the interfaces with only
link-local addressing if "ip=link-local" is specified on the kernel
command line.
* The prefix of the configuration files generated by the network
generator from the kernel command line is now prefixed with '70-',
to make them have higher precedence over the default configuration
files.
* Added a new -Ddefault-network=BOOL meson option, that causes more
.network files to be installed as enabled by default. These configuration
files will which match generic setups, e.g. 89-ethernet.network matches
all Ethernet interfaces and enables both DHCPv4 and DHCPv6 clients.
* If a ID_NET_MANAGED_BY= udev property is set on a network device and
it is any other string than "io.systemd.Network" then networkd will
not manage this device. This may be used to allow multiple network
management services to run in parallel and assign ownership of
specific devices explicitly. NetworkManager will soon implement a
similar logic.
systemctl:
* systemctl is-failed now checks the system state if no unit is
specified.
* systemctl will now automatically soft-reboot if a new root file system
is found under /run/nextroot/ when a reboot operation is invoked.
Login management:
* Wall messages now work even when utmp support is disabled, using
systemd-logind to query the necessary information.
* systemd-logind now sends a new PrepareForShutdownWithMetadata D-Bus
signal before shutdown/reboot/soft-reboot that includes additional
information compared to the PrepareForShutdown signal. Currently the
additional information is the type of operation that is about to be
executed.
Hibernation & Suspend:
* The kernel and OS versions will no longer be checked on resume from
hibernation.
* Hibernation into swap files backed by btrfs are now
supported. (Previously this was supported only for other file
systems.)