After five months of development, the release of the system manager systemd 251 has been presented.
Key Changes:
- System requirements have been increased. The minimum supported version of the Linux kernel has been raised from 3.13 to 4.15. A CLOCK_BOOTTIME timer is required for operation. A compiler supporting the C11 standard and GNU extensions is necessary for building (the C89 standard continues to be used for header files).
- An experimental utility systemd-sysupdate has been added to automatically detect, download, and install updates using an atomic mechanism for replacing partitions, files, or directories (two independent partitions/files/directories are used, where one contains the currently operating resource and the other installs the next update, after which the partitions/files/directories are swapped).
- A new internal shared library libsystemd-core-.so has been introduced, installed in the directory /usr/lib/systemd/system, and corresponding to the existing library libsystemd-shared-.so. The use of the shared library libsystemd-core-.so allows reducing the overall installation size by reusing binary code. The version number can be specified via the 'shared-lib-tag' parameter in the meson build system, allowing distributions to ship multiple versions of these libraries simultaneously.
- Transmission of the environment variables $MONITOR_SERVICE_RESULT, $MONITOR_EXIT_CODE, $MONITOR_EXIT_STATUS, $MONITOR_INVOCATION_ID, and $MONITOR_UNIT containing information about the monitored unit to the OnFailure/OnSuccess handlers has been implemented.
- For units, the ExtensionDirectories configuration has been implemented, which can be used to organize the loading of system extension components from regular directories instead of disk images. The content of the system extension directory is overlaid using OverlayFS and applied to extend the directory hierarchy of /usr/ and /opt/, adding additional files at runtime, even if the specified directories are mounted in read-only mode. The command 'portablectl attach —extension=' has also been enhanced to support specifying the directory.
- For units forcibly terminated by the systemd-oomd handler due to memory shortages in the system, the 'oom-kill' flag has been provided, reflecting in the attribute 'user.oomd_ooms' the number of forced terminations.
- New path specifiers %y/%Y have been added for units, reflecting a normalized path to the unit (with symbolic links resolved). Also added are specifiers %q for substituting the value of PRETTY_HOSTNAME and %d for substituting CREDENTIALS_DIRECTORY.
- In unprivileged services run by a regular user using the "--user" flag, changes are allowed for settings including RootDirectory, MountAPIVFS, ExtensionDirectories, *Capabilities*, ProtectHome, *Directory, TemporaryFileSystem, PrivateTmp, PrivateDevices, PrivateNetwork, NetworkNamespacePath, PrivateIPC, IPCNamespacePath, PrivateUsers, ProtectClock, ProtectKernelTunables, ProtectKernelModules, ProtectKernelLogs, and MountFlags. This capability is only available when user namespace support is enabled on the system.
- In the LoadCredential configuration, specifying the name of a directory as an argument is allowed; in this case, an attempt is made to load credentials from all files in the specified directory.
- In systemctl, the "--timestamp" parameter now supports the "unix" flag to display time in epoch format (seconds since January 1, 1970).
- In "systemctl status", the "old-kernel" flag is shown if the kernel loaded in the session has an older version number than the base kernel available in the system. The "unmerged-usr" flag has also been added to indicate that the contents of directories /bin/ and /sbin/ are not formed via symbolic links to /usr.
- For generators running as process PID 1, new environment variables $SYSTEMD_SCOPE (indicating whether running from a system or user service), $SYSTEMD_IN_INITRD (indicating running from initrd or host environment), $SYSTEMD_FIRST_BOOT (indicating first boot), $SYSTEMD_VIRTUALIZATION (indicating virtualization presence or running in a container), and $SYSTEMD_ARCHITECTURE (indicating the architecture for which the kernel is built) have been introduced.
- In handler PID 1, the ability to load system credential parameters from the QEMU fw_cfg interface or by specifying the systemd.set_credential parameter in the kernel command line is implemented. The LoadCredential directive ensures automatic searching for credentials in the directories /etc/credstore/, /run/credstore/, and /usr/lib/credstore/ when a relative path is specified as an argument. Similar behavior is applied to the LoadCredentialEncrypted directive, which additionally checks the directories /etc/credstore.encrypted/, /run/credstore.encrypted/, and /usr/lib/credstore.encrypted/.
- The ability to export in JSON format has been stabilized in systemd-journald. The commands "journalctl --list-boots" and "bootctl list" have been enhanced to support JSON output (the flag "--json").
- New files with hwdb databases have been added to udev, containing information about portable devices (PDAs, calculators, etc.) and devices used in sound and video creation (DJ mixers, keypads).
- New options have been added to udevadm, such as "--prioritized-subsystem" to specify the priority of system follow-ups (used in systemd-udev-trigger.service to prioritize block devices and TPM), as well as "--type=all", "--initialized-match", and "--initialized-nomatch" for selecting initialized or uninitialized devices. The command "udevadm info --tree" is now available to display the object tree in the /sys/ hierarchy. New commands "wait" and "lock" have also been added to udevadm to wait for the device entry in the database and to lock the block device during formatting or while writing the partition table.
- A new set of symbolic links has been added for devices /dev/disk/by-diskseq/ to identify block devices by their sequence number ("diskseq").
- Support for the "Firmware" parameter has been added in the [Match] section of .link files to match the device by a string description of the firmware.
- In systemd-networkd, the default scope value for unicast routes configured through the [Route] section has been changed to "link" to match the behavior of the "ip route" command. The [Bridge] section now includes the parameter Isolated=true|false to configure the corresponding attribute of network bridges in the kernel. The [Tunnel] section has a new External parameter for setting up external-type tunnels (metadata collection mode). In the [DHCPServer] section, parameters BootServerName, BootServerAddress, and BootFilename have been added to configure the server address, server name, and boot file name sent proxy server via DHCP when booting in PXE mode. The L2TP parameter has been removed from the [Network] section, and the new Local setting can now be used in .netdev files in conjunction with the L2TP interface.
- A new unit "systemd-networkd-wait-online@.service" has been introduced, which can be used to wait for a specific network interface to come up.
- The ability to use .netdev files for creating virtual WLAN devices has been implemented, with a dedicated [WLAN] section provided for their configuration.
- In the .link/.network files, the [Match] section has been implemented with the Kind parameter for matching by device type (‘bond’, ‘bridge’, ‘gre’, ‘tun’, ‘veth’).
- The systemd-resolved service is now launched earlier in the boot process, including from initrd if systemd-resolved is present in the initrd image.
- In systemd-cryptenroll, the option —fido2-credential-algorithm has been added to choose the credential encryption algorithm, and the option —tpm2-with-pin has been added to manage PIN input when unlocking a partition using TPM. A similar option tpm2-pin has been added to /etc/crypttab. When unlocking devices via TPM, the parameters are encrypted to protect against key interception.
- A D-Bus API has been added to systemd-timesyncd for dynamically obtaining information from the NTP server through IPC.
- To determine the need for colored output in all commands, a check for the COLORTERM environment variable has been implemented in addition to the previously checked NO_COLOR, SYSTEMD_COLORS, and TERM.
- In the Meson build system, the install_tag option has been implemented for selective building and installation of necessary components: pam, nss, devel (pkg-config), systemd-boot, libsystemd, libudev. A build option default-compression has been added to choose the compression algorithm for systemd-journald and systemd-coredump.
- In sd-boot, an experimental setting ‘reboot-for-bitlocker’ has been added in loader.conf for booting Microsoft Windows with BitLocker TPM.
Source: opennet.ru
