Release of system manager systemd 257

After six months of development, the release of the system manager systemd 257 has been presented. Key changes include: new utilities systemd-sbsign and systemd-keyutil, support for MPTCP when activated via socket, initial support for building with the Musl C library, a utility updatectl for managing the installation of updates via systemd-sysupdate, the ability to run services in separate PID namespaces, and protection against accidental file deletion when using 'systemd-tmpfiles --purge'.

Among the changes in the new release:

• A new utility systemd-sbsign has been added for signing executable files in PE (Portable Executable) format with a digital signature, intended for use during boot in EFI Secure Boot mode. Signature generation can use engines and providers provided by the OpenSSL library. Systemd-sbsign can serve as an alternative to the applications sbsigntool and pesign in the ukify utility when creating universal UKI (Unified Kernel Image) kernel images, which combine the bootloader for UEFI (UEFI boot stub), the Linux kernel image, and the initial RAM disk environment initrd into a single file.
• A new utility systemd-keyutil has been added, implementing various operations on private keys and X.509 certificates. For example, systemd-keyutil can be used to verify the ability to load private keys and certificates, as well as to extract their public keys in PEM format.
• In the '.socket' units used to enable the socket activation mechanism (starting processes when there is an attempt to establish a network connection), support for MPTCP (Multipath TCP) has been implemented, which is an extension of the TCP protocol that organizes the operation of TCP connections delivering packets simultaneously over multiple routes through different network interfaces bound to different IP addresses.
• Changes necessary for building using the standard Musl C library have been included.
• In various systemd components that output progress indicators for ongoing operations (for example, systemd-repart, systemd-sysupdate/updatectl, and importctl), support has been added for using ANSI sequences to animate progress display. Such sequences are currently supported only in Windows Terminal (it is expected that this feature will eventually be brought to terminal emulators for Linux as well).
• The capabilities of the systemd-sysupdate component have been expanded, which is used for automatically detecting, downloading, and installing updates using an atomic mechanism for swapping partitions, files, or directories (two independent partitions/files/directories are used, one containing the currently active resource and the other hosting the next update, after which the partitions/files/directories are swapped). In practice, systemd-sysupdate is already being used in GNOME OS.

  In addition to the systemd-sysupdate process, a service of the same name has been added, allowing the use of D-Bus for system update management by non-privileged users. A new utility called updatectl has also been included for managing the service. The systemd-sysupdate now includes an "--offline" flag to prohibit downloading metadata over the network, using only versions already downloaded to the local system. Support for JSON output format has been added to all commands.
• A new property called "PrivatePIDs" has been implemented for services, which allows processes to be launched with PID 1 (the init process) in a separate process ID namespace. In the environment created for the launched process, only processes from that specific namespace will be visible.
• The udev rules have been enhanced to support case-insensitive matching (for example, 'ATTR{foo}=="abcd"'). Through udev, access has been provided to the /dev/udmabuf device for non-privileged local users ("uaccess"), which is necessary for working with IPMI cameras via libcamera. udev now recognizes various hardware cryptocurrency wallets with a USB interface and sets the ID_HARDWARE_WALLET property for them, enabling the 'uaccess' mode for access by non-privileged users.
• New fields RELEASE_TYPE, EXPERIMENT, and EXPERIMENT_URL have been added to the /etc/os-release file. "RELEASE_TYPE" can take values of "experimental", "development", "stable", and "lts" to distinguish stable versions from those in development and experimental builds. The EXPERIMENT and EXPERIMENT_URL parameters are intended to clarify the nature of the experimental build.
• The run0 utility, developed as a replacement for the sudo program, has been updated with the option ‘—shell-prompt-prefix’, which defines the command shell prompt prefix. By default, the prefix displays the emoji ‘🦸’ for visual emphasis on a session with elevated privileges.
• In systemd-tmpfiles, to avoid accidentally deleting the wrong files, the ‘—purge’ option now applies only to settings in tmpfiles.d/ that explicitly have the flag ‘$’ set. For the ‘—purge’ operation, you must now specify at least one file from the tmpfiles.d/ directory. A flag ‘?’ has been added for lines of type ‘L’, which, if set, will create a symbolic link only if the target file exists.
• In the service manager and related utilities, the migration of process tracking code to using PIDFD instead of PID has continued. The PIDFD identifier is tied to a specific process and does not change, whereas the PID can be associated with a different process after the current process linked to that PID has finished.
• For services, the ability to set the ‘RestartMode’ parameter to ‘debug’ has been implemented, which will restart a failed service with debugging mode enabled (the environment variable DEBUG_INVOCATION=1 is set), and the maximum log level will temporarily be raised to the debug level.
• In the PID 1 handler, the ability to load rules for the LSM module IPE (Integrity Policy Enforcement) has been implemented, defining the integrity enforcement policy for the entire system (which operations are allowed and how to verify the authenticity of components).
• In the ‘.timer’ unit files, the ‘DeferReactivation’ option has been added, allowing the next activation by the timer to be skipped if the service has not yet completed since the last activation.
• In the unit file parameter PrivateUsers, the ability to specify the value ‘identity’ has been implemented for enabling user ID mapping when creating a namespace (user namespace).
• In the unit file parameter PrivateTmp, support for the value ‘disconnected’ has been added, whereby separate instances of tmpfs will be used for the directories /tmp/ and /var/tmp/.
• The ProtectControlGroups unit files parameter has been enhanced to support new modes 'private' and 'strict', under which a new cgroup namespace is created for the service, and cgroupfs is mounted. When the 'strict' option is set, cgroupfs is mounted in read-only mode.
• The StateDirectory, RuntimeDirectory, CacheDirectory, LogsDirectory, and ConfigurationDirectory parameters now allow the use of the ':ro' flag to restrict access to the corresponding directories in read-only mode.
• Support for the value 'firmware' has been added to the kernel command line parameter 'systemd.machine_id', whereby the machine ID will be computed based on the UUID from SMBIOS/DeviceTree.
• Support for the system calls mseal(), listmount(), and statmount() has been added, as introduced in recent releases of the Linux kernel.
• Interactive authorization support using Polkit has been added to the resolvectl, timedatectl, and systemd-inhibit utilities.
• The systemctl utility now allows the use of the '--now' flag in the 'reenable' command.
• The systemd-mount utility has added the '--json' option for JSON output (for example, when specified along with '--list-devices', a list of devices will be output in JSON format).
• The 'localectl' utility has been enhanced with the '-l' and '--full' options to disable truncating long lines in output.
• The sleep.conf file has introduced the HibernateOnACPower option, which allows delaying the switch to sleep mode until the device is disconnected from a stationary power source.
• Support for the '!' modifier has been added to the 'u' lines in systemd-sysusers, allowing the creation of completely locked user accounts (previously, blocking a user required setting an incorrect password, which, for example, did not prevent authentication via SSH keys).
• The 'EnterNamespace' option has been added to systemd-coredump, providing access to the mount namespace of any crashed processes to retrieve their debugging symbols. This option can be particularly useful for organizing the backtrace of core files from applications running in isolated containers.
• In systemd-logind, handling of the Ctrl-Alt-Shift-Esc key combination has been enabled to send the signal org.freedesktop.login1.SecureAttentionKey to user environment components, prompting a secure login dialog. The «DesignatedMaintenanceTime» setting has been implemented for automatic scheduling of shutdown at a specified time. Similar to the support for DRM devices and evdev, access configuration for unprivileged users to hidraw devices (game controllers and joysticks) has been added.
• Support for registration by unprivileged clients has been added in systemd-machined. of virtual machines and containers. Access to systemd-machined functionality has been provided via the Varlink API, in addition to D-Bus.
• A new section «[IPv6AddressLabel]» has been added to the networkd.conf configuration file for configuring labels and prefixes for IPv6 addresses.
• The command ‘networkctl edit’ has been enhanced with the «—stdin» option to obtain the file content from standard input. The ‘networkctl edit’ and ‘networkctl cat’ commands have gained support for editing and displaying .netdev files by specifying the network interface. An option «—no-ask-password» has been added to disable interactive authorization.
• In the utilities ukify, bootctl, systemd-keyutil, systemd-measure, systemd-repart, and systemd-sbsign, the option «—certificate-source» has been added for loading X.509 certificates via the OpenSSL provider instead of direct file loading.
• In systemd-boot, the ability to use volume control buttons for navigation up and down in the boot menu has been added, which can be useful on devices such as smartphones. Support for setting the UEFI Secure Boot database in the ESL(db/dbx/…) format for systemd-boot has been added to the bootctl utility.
• In journalctl, the option «—list-invocation» has been added to show a list of unit invocations, and the option «—invocation» («-I») has been added to display logs related only to a specific invocation.
• In systemd-nspawn, support for unprivileged use of FUSE (Filesystem in Userspace) in containers has been added. When using the «—bind-user» option, user SSH keys required for SSH access are forwarded to the container.
• In libsystemd, a new software interface «sd-json», which uses the JSON format, has been added, along with the «sd-varlink» interface, which uses IPC Varlink.
• The recommended basic kernel version has been raised to the 5.4 release, which was formed in 2019. Next year, support for older kernels is planned to be discontinued, marking the 5.4 release as the minimally supported basic version.
• Support for cgroups v1 is deemed deprecated and disabled by default (to enable it in the kernel command line, SYSTEMD_CGROUP_ENABLE_LEGACY_FORCE=1 must be specified in addition to enabling it in systemd settings). In the next release, systemd 258, the code related to cgroups v1 is planned to be completely removed. The removal of support for System V service scripts is also scheduled for systemd 258.

Source: opennet.ru