The release of systemd 252 includes support for UKI (Unified Kernel Image).

After five months of development, the release of the system manager systemd 252 has been presented. A key change in the new version is the integration of support for the enhanced boot process, allowing the verification of digital signatures not only for the kernel and bootloader but also for components of the base system environment.

The proposed method involves using a unified kernel image (UKI) during boot, which combines the handler for loading the kernel from UEFI (UEFI boot stub), the Linux kernel image, and the initrd memory-loaded system environment used for initial initialization before mounting the root filesystem. The UKI image is formatted as a single executable file in PE format, which can be loaded using traditional boot loaders or called directly from UEFI firmware. When invoked from UEFI, it offers the ability to verify the integrity and authenticity via digital signature not only for the kernel but also for the contents of the initrd.

To calculate the parameters of the TPM PCR (Trusted Platform Module Platform Configuration Register), which are used for integrity control and digital signature formation for the UKI image, a new utility called systemd-measure has been included. The public key used in the signature and additional information about the PCR can be embedded directly into the UKI boot image (the key and signature are stored in a PE-formatted file in the fields '.pcrsig' and '.pcrkey') and extracted by external or internal utilities.

Also, utilities such as systemd-cryptsetup, systemd-cryptenroll, and systemd-creds have been adapted to utilize this information, enabling the binding of encrypted disk partitions to a digitally signed kernel (in this case, access to the encrypted partition is granted only if the UKI image has passed digital signature verification based on parameters stored in the TPM).

Additionally, a utility named systemd-pcrphase has been included, allowing for the management of the binding of various boot stages to parameters stored in the memory of cryptographic processors that support the TPM 2.0 specification (for example, the decryption key for the LUKS2 partition can be made available only in the initrd image and access to it can be blocked at later stages of the boot process).

Other changes include:

• The locale C.UTF-8 is used by default, unless another locale is specified in the settings.
• The ability to perform a full preset operation of services (‘systemctl preset’) during the first boot has been implemented. To enable presetting during boot, a build with the ‘-Dfirst-boot-full-preset’ option is required, but it is planned to be activated by default in future releases.
• In user management units, a CPU resource controller has been employed, allowing the application of CPUWeight settings to all slice units used for partitioning the system (app.slice, background.slice, session.slice) to isolate resources among various user services competing for CPU resources. The CPUWeight now also supports the ‘idle’ value to activate the corresponding resource provision mode.
• In transient units and the systemd-repart utility, overriding settings is allowed through the creation of drop-in files in the /etc/systemd/system/name.d/ directory.
• For system images, a support-ended flag (‘support-ended’) has been set, determining this fact based on the new parameter value ‘SUPPORT_END=’ in the /etc/os-release file.
• Settings ‘ConditionCredential=’ and ‘AssertCredential=’ have been added, which can be used to ignore or abort units when certain credentials are absent from the system.
• The settings ‘DefaultSmackProcessLabel=’ and ‘DefaultDeviceTimeoutSec=’ have been added to system.conf and user.conf to define the SMACK security level and the unit activation timeout applied by default.
• In the settings ‘ConditionFirmware=’ and ‘AssertFirmware=’, it is now possible to specify individual SMBIOS fields, for example, to start the unit only if the field /sys/class/dmi/id/board_name contains the value ‘Custom Board’, it can be specified as ‘ConditionFirmware=smbios-field(board_name =
• During initialization (PID 1), the ability to import credentials from SMBIOS fields (Type 11, ‘OEM vendor strings’) has been added in addition to defining them through qemu_fwcfg, simplifying the provision of credentials. virtual machines and allowing for the avoidance of external tools such as cloud-init and ignition.
• During shutdown, the logic for unmounting virtual filesystems (proc, sys) has been changed, and information about processes blocking the unmounting of filesystems is now logged.
• The System Call Filter (SystemCallFilter) now defaults to allowing access to the system call riscv_flush_icache.
• The sd-boot loader has been enhanced to support a mixed boot mode, allowing a 64-bit Linux kernel to be launched from a 32-bit UEFI firmware. An experimental feature has been added to automatically apply SecureBoot keys from files found in the ESP (EFI system partition).
• The bootctl utility now includes new options: ‘--all-architectures’ for installing binaries for all supported EFI architectures, ‘--root=’ and ‘--image=’ for working with a directory or disk image, ‘--install-source=’ for specifying the installation source, and ‘--efi-boot-option-description=’ for managing boot entry names.
• The systemctl utility has introduced the 'list-automounts' command to display a list of automatically mounted directories and the ‘--image=’ option for executing commands in relation to a specified disk image. The ‘show’ and ‘status’ commands now include ‘--state=’ and ‘--type=’ options.
• In systemd-networkd, new options have been added: ‘TCPCongestionControlAlgorithm=’ for selecting the TCP congestion control algorithm, ‘KeepFileDescriptor=’ for preserving file descriptors for TUN/TAP interfaces, ‘NetLabel=’ for setting NetLabel tags, and ‘RapidCommit=’ for speeding up setup via DHCPv6 (RFC 3315). The ‘RouteTable=’ parameter now allows specifying routing table names.
• In systemd-nspawn, the use of relative file paths in the ‘--bind=’ and ‘--overlay=’ options is now permitted. The ‘--bind=’ option also adds support for the ‘rootidmap’ parameter, to bind the root user ID in the container to the owner of the mounted directory on the host system.
• In systemd-resolved, the OpenSSL package is now the default backend for encryption (support for gnutls remains as an option). Unsupported DNSSEC algorithms are now treated as unsafe, instead of returning an error (SERVFAIL).
• In systemd-sysusers, systemd-tmpfiles, and systemd-sysctl, the capability to pass settings via the credential storage mechanism has been implemented.
• The systemd-analyze utility has been enhanced with the ‘compare-versions’ command for comparing version number strings (similar to ‘rpmdev-vercmp’ and ‘dpkg --compare-versions’). The ‘systemd-analyze dump’ command now features the ability to filter units by mask.
• When selecting a multi-step sleep mode (suspend-then-hibernate, transitioning to sleep after standby), the duration in standby is now based on the forecast of remaining battery life. Instant transitions to sleep occur when less than 5% battery charge is left.
• A new output mode "-o short-delta" has been added to 'journalctl', displaying the time difference between different messages in the log.
• Support for creating partitions with Squashfs file system and partitions for dm-verity, including those with digital signatures, has been added to systemd-repart.
• A "StopIdleSessionSec=" setting has been added to systemd-logind to terminate inactive sessions after a specified timeout.
• An option "--unlock-key-file=" has been added to systemd-cryptenroll for extracting the decryption key from a file, rather than through a user prompt.
• The possibility of running the systemd-growfs utility in environments without udev has been ensured.
• Improved support for systems with multiple graphics cards has been made in systemd-backlight.
• The license for the code examples provided in the documentation has been changed from CC0 to MIT-0.

Incompatible changes:

• When checking the kernel version number using the ConditionKernelVersion directive, simple string comparison is now applied for ‘=’ and ‘!=’ operators. If the comparison operator is not specified, glob pattern matching can be used with symbols ‘*’, ‘?’ and ‘[‘, ‘]’. For version comparisons resembling the stverscmp() function, the operators ‘’, ‘=’ should be used.
• The SELinux label used for access checks from the unit file is now read at the stage of file loading, rather than at the time of access check.
• The condition "ConditionFirstBoot" now only triggers on the first system boot during the boot stage and returns "false" when calling units after the boot process is completed.
• In 2024, systemd plans to discontinue support for the resource limitation mechanism of cgroup v1, which was marked as deprecated in the systemd 248 release. Administrators are advised to prepare in advance for the migration to cgroup v2 for services tied to cgroup v1. A key difference between cgroups v2 and v1 is the use of a unified hierarchy of cgroups for all types of resources, instead of separate hierarchies for distributing CPU resources, managing memory consumption, and for input/output. Separate hierarchies lead to difficulties in coordinating interactions between handlers and additional kernel resource overhead when applying rules to processes mentioned in different hierarchies.
• In the second half of 2023, support for separate directory hierarchies is expected to be discontinued, when /usr is mounted separately from root or when the directories /bin and /usr/bin, /lib and /usr/lib are separated.

Source: opennet.ru