The system manager systemd 260 is now available.

After three months of development, the release of the system manager systemd 260 is now available. Key changes include the discontinuation of support for service scripts in System V format, the 'mstack' mechanism for assembling layered mount hierarchies, the systemd-report utility, support for integrating systemd-networkd with ModemManager, support for custom portable services, and the 'xaccess' concept in systemd-logind and systemd-udevd.

Among the changes in the new release:

• Support for service scripts in System V format has been discontinued along with the supply of the components rc-local.service, systemd-sysv-install, systemd-rc-local-generator, and systemd-sysv-generator.
• The 'mstack' (Mount Stack) mechanism has been implemented, allowing directories with the suffix '.mstack/' to create a composite directory hierarchy formed through sequential mounting and overlaying disk images and parts of the filesystem using OverlayFS and 'mount --bind'. The systemd-mstack command, the '--mstack' option in systemd-nspawn, and the RootMStack parameter in units have been added, which can be used for mounting and unmounting all elements defined in the '.mstack' configuration at once, for example, to quickly recreate a container image or the working environment of a service. Each file or subdirectory in '.mstack/' defines one mounting level or 'overlayfs' layer.

  For instance, the following configuration 'foobar.mstack/' defines an overlayfs with two layers set to read-only from the disk images base.raw and app.raw (specified as symbolic links), and a 'rw' directory allowing writing over them: foobar.mstack/layer@0.raw → ../base.raw foobar.mstack/layer@1.raw → ../app.raw foobar.mstack/rw/
• The 'metrics' and 'report' frameworks have been implemented, which can be used by system components to output statistics via Varlink in the /run/systemd/report/ directory. The systemd-report utility has been added, generating a summary report that consolidates statistics from all components and outputs it in JSON format. Currently, metrics are only provided by the service manager and systemd-networkd.
• In systemd-networkd, integration with ModemManager has been ensured, and the section '[MobileNetwork]' has been added with settings for APN, AllowedAuthenticationMechanisms, User, Password, IPFamily, AllowRoaming, PIN, OperatorId, RouteMetric, and UseGateway, allowing systemd-networkd to connect to cellular operators through modems.
• The ability to run systemd-portabled as a user service executed by a non-privileged user has been provided. The utility portablectl now includes the flags "--user" and "--system" for selecting the type of service. Portable Services are system services packaged as self-contained containers (delivered as a system image but treated like a regular service).
• Support for the concept of "xaccess" (Extended Access) has been added in systemd-logind and systemd-udevd, allowing graphical sessions to provide GPU access for remote users who do not physically use a monitor and input devices on the local system (similar to uaccess for users physically interacting with the computer). To configure sessions in this case, the XDG_SESSION_EXTRA_DEVICE_ACCESS environment variable is suggested through PAM.
• To automate DeviceTree configuration in UKI images (Unified Kernel Image), a canonical set of files with hardware identifiers has been proposed at /usr/lib/systemd/boot/hwids/, linking device identifiers to DeviceTree elements. With this set, the UKI image automatically finds and loads the necessary DTB (Device Tree Blob) during boot without the need to create device-specific images. Currently, hwid files are generated for ARM64 devices based on Snapdragon chips.
• A new field "FANCY_NAME" has been added to /etc/os-release, differing from "PRETTY_NAME" by allowing non-ASCII glyphs from Unicode. If the "FANCY_NAME" field is present, it will be used in the output of systemd, systemd-hostnamed, and hostnamectl instead of "PRETTY_NAME".
• Services that provide public Varlink interfaces have been consolidated in a single directory /run/varlink/registry/ using symbolic links. The command 'varlinkctl list-registry' has been implemented to view the list of such services.
• In units, it is now possible to specify the value "managed" for the PrivateUsers parameter, allowing automatic assignment of user and group ID ranges (UID/GID) through systemd-nsresourced.
• A RefreshOnReload setting has been added to units to update extensions and credentials upon the unit's restart.
• A BindNetworkInterface setting has been added to units for the automatic binding of all sockets created in the unit to a specified network interface.
• The unit has been updated with the ConditionPathIsSocket and AssertPathIsSocket settings to modify behavior or terminate the unit if the specified paths are not sockets.
• The command 'enqueue-marked' has been added to systemctl, invoking the D-Bus EnqueueMarkedJobs() method. The previously used parameter '--marked' has been deprecated.
• A MemoryTHP setting has been added to services to manage the use of large memory pages (THP - Transparent Huge Pages) in services.
• Support for the FirewallMark parameter has been added in the .delegate files of systemd-resolved to set a firewall mark in the network stack for generated DNS traffic.
• The 'acquire' command has been added to systemd-sysupdate to separate the stages of loading and installing or updating. Support for marking partitions as partially loaded has been implemented.
• An option '--image-format' has been added to systemd-vmspawn to choose the format (qcow2 or raw) of the disk image.
• Support for the 'JSON' format has been implemented for the '--list' option in systemd-inhibit, with the ability to filter output using the flags '--what', '--who', '--why' and '--mode'.
• Basic support for integrity control of encrypted partitions using dm-integrity has been added to systemd-repart.
• The command 'extract-certificate' has been added to the systemd-keyutil utility to output the contents of X.509 certificates.
• Support for interactive authentication via polkit has been implemented in systemd-sysext and varlinkctl.
• A polkit policy has been added to allow unprivileged users to invoke systemd-ask-password.
• The ability to load OCI images using the command 'importctl pull-oci' has been added to systemd-importd, which are stored as images for mounting via 'mstack'.
• Support for colors SYSTEMD_COLORS=auto-16, SYSTEMD_COLORS=auto-256, and SYSTEMD_COLORS=auto-24bit has been added.
• Fully functional standalone executables for systemd-sysusers and systemd-tmpfiles have been provided (previously only trimmed versions were built).
• A 'prekill hook' has been added to systemd-oomd, allowing the attachment of handlers that trigger before forcefully terminating a process due to memory shortage in the system.
• The ability to use non-system users and groups in udev rules (OWNER=/GROUP=) and systemd-networkd settings (User=/Group=) has been reinstated, but is marked as deprecated.
• The mkfs.xfs utility functionality introduced in xfsprogs 6.17.0 has been employed in systemd-repart for deploying initial filesystem content from the specified directory.
• The minimum version requirements have been increased: Linux kernel 5.4 → 5.10 (recommended 5.14, and for full functionality — 6.6), libidn → libidn2, Python 3.7.0 → 3.9.0, glibc 2.31 → 2.34, OpenSSL 1.1.0 → 3.0.0, cryptsetup 2.0.1/2.3.0 → 2.4.0, elfutils 158 → 177, libblkid 2.24 → 2.37, libseccomp 2.3.1 → 2.4.0.
• The rules for ensuring portability and stability have been redesigned and simplified, reinforcing commitments to prevent visible regressions in public interfaces for users.

Source: opennet.ru