After nine months of development, the release of the system manager systemd 258 has been presented. Key changes include the discontinuation of support for cgroups v1 and System V-style system management components, the addition of new utilities systemd-factory-reset and systemd-pty-forward, the concept of home areas, and support for booting from disk images obtained via HTTP.
Among the changes in the new release:
- The systemd-factory-reset utility has been added to initiate or cancel a factory reset at the next boot. An instant reset unit, factory-reset-now.target, has been introduced. A kernel command line parameter 'systemd.factory_reset' has been added for resets during boot.
- The home area concept has been introduced, allowing the specification of subdirectories within the main home directory ($HOME), where a user can log in separately to work in different workspaces. For example, separate areas can be created for one user for testing settings and for development (~\/Areas\/foo and ~\/Areas\/bar). To log into an additional area upon login, the area name must be specified in the username, separated by '%' (e.g., 'username%foo'), or the run0 utility can be used with the '--area' option. Home area support is currently implemented only in systemd-homed and is unavailable for full graphical sessions.
- The kernel command line parameters 'systemd.pull' and 'rd.systemd.pull', used for automatic loading, of virtual machines, containers or extension images (sysext, confext), now include the 'blockdev' flag. When this flag is specified, the loaded image is attached to a loopback device, allowing direct booting from the disk image obtained via HTTP. For example: rd.systemd.pull=raw,machine,verify=no,blockdev:image:https:\/\/192.168.100.1:8081\/image.raw \\ root=\/dev\/disk\/by-loop-ref\/image.raw-part2
- The systemd-pty-forward utility has been added, allowing for the creation of a pseudoterminal ('PTY') and launching a process on it, redirecting any output back to the original terminal where the utility was started.
- The code supporting cgroups v1 has been removed.
- System V-style system management components have been removed, such as the utilities itctl, runlevel, and telinit, the device \/dev\/initctl, the concept of runlevels, unit files runlevel[0-6].target, and the ability to manage states via the init command. The removal of support for System V service scripts is planned for the next release.
- The minimum requirements for the Linux kernel version have been raised to 5.4 (version 5.7 is recommended).
- Permissions for tty/pts devices have changed from 0620 (-rw—w—-) to 0600 (-rw——-) to prevent writing to another user's terminal in the same group. To revert to old behavior during compilation, the option ‘-Dtty-mode=0620’ can be used.
- Support for GnuTLS and libgcrypt libraries has been discontinued in systemd-resolved and systemd-importd, with OpenSSL remaining as the only cryptographic backend.
- Support for the condition 'ConditionKernelModuleLoaded' has been added to unit files to check for the loading of a specific kernel module. The condition 'ConditionKernelVersion' has been replaced with a more general construct 'ConditionVersion', through which versions of systemd and glibc can also be checked.
- Support for user quotas has been enabled for the /tmp/ section located in tmpfs, and for /dev/shm/.
- For slice units used to partition the system (app.slice, background.slice, session.slice) to isolate resources among different user services, ConcurrencySoftMax and ConcurrencyHardMax settings have been implemented to manage the number of simultaneously active units. The added features can be used as a mechanism for managing job startup based on resource consumption, supporting hierarchical job pools.
- Support for the prefix ‘|’ in ExecStart has been added, allowing execution through a command interpreter.
- An API based on the Varlink protocol has been implemented, which can be used to determine the current state, list of units, and state of the units.
- An additional preset directory has been added for system services executed in initrd, allowing the separation of the enabling of system services for the host and initrd.
- The ability to bind quotas to individual services has been added using the settings StateDirectoryQuota, StateDirectoryAccounting, CacheDirectoryQuota, CacheDirectoryAccounting, LogsDirectoryQuota, and LogsDirectoryAccounting.
- Support has been added in systemd-udevd for the properties ID_NET_BRING_UP_BEFORE_JOINING_BRIDGE, ID_NET_NAME_INCLUDE_DOMAIN, ID_AV_LIGHTS. A kernel command line parameter 'udev.trace' and the option '--traceu' in the devadm utility have been added for tracing the udev logic during boot and operation. The 'cat' command has been added to the udevadm utility to display the contents of installed rule files. Automatic labeling of debug USB interfaces for Android (ADB DbC, ADB, Fastboot) has been provided for access by unprivileged users.
- New settings have been added in systemd-networkd: IPv4DuplicateAddressDetectionTimeoutSec, UseSIP in the '[DHCPv6]' section, MPLSRouting in the '[Network]' section, Preference in the '[IPv6RoutePrefix]' section, LinkLocalLearning, Locked, MACAuthenticationBypass, and VLANTunnel in the '[Bridge]' section. The DHCPv4 client now supports the BOOTP protocol.
- New session classes have been added in systemd-logind: 'none' to disable session creation; 'user-light' and 'user-early-light' for creating user sessions without activating the service manager for the user (for non-interactive sessions).
- Support for delegation zones ('delegate zone') has been added in systemd-resolved, allowing for routing DNS queries for specific domains through specified... servers DNS. Support for sending parallel DNS record requests A and AAAA for a single domain has been guaranteed. The setting RefuseRecordTypes has been added in resolved.conf to specify blocked record types, for instance, to block 'A' records on hosts with IPv6 only.
- The 'systemctl start' command has been enhanced with the option '--verbose' to display the log of unit operations being performed.
- Support for two new loader specifications has been added in systemd-boot — 'uki' and 'uki-url'. In the second case, it is now possible to load a UKI image from an external host via HTTP. The ability to embed UEFI firmware images into UKI (Unified Kernel Image) images has been added. The setting 'reboot-on-error' has been added in loader.conf to determine actions (reboot or show boot menu) in case of a failure of the selected boot entry.
- Support for unprivileged execution of container images stored in regular directories has been added in systemd-nspawn.
- Support for images compressed with the zstd algorithm (in addition to .xz, .gz, and .bz2) has been added in systemd-importd.
- Command line parameters "systemd.break" and "rd.systemd.break" have been added, allowing the insertion of interactive breakpoints that interrupt the boot process at specified moments. Four breakpoints are available: "pre-udev," "pre-basic," "pre-mount," and "pre-switch-root."
- The next release is set to discontinue support for the /run/lock/ directory and the iptables packet filter (only nftables support will remain in systemd-networkd and systemd-nspawn). Minimum version requirements are also expected to increase: Linux kernel 5.10, glibc 2.34, openssl 3.0.0, python 3.9.0.
Source: opennet.ru
