After three months of development, the release of the system manager systemd 261 is now available. Key changes include preparation for API support for age verification, support for Kexec Handover and Live Update Orchestration subsystems for rebooting without losing state, the IMDS (Instance Metadata Service) subsystem, functionality for boot protection on systems without a physical TPM (Trusted Platform Module), and the systemd-sysinstall component implementing the installer.
Among the changes in the new release:
- A new component, systemd-sysinstall, has been added, providing a simple operating system installer that can be managed from the command line or through an interactive text interface. The functionality of systemd-sysinstall is formed from existing capabilities of systemd: systemd-repart is used for disk partitioning, the command 'bootctl link' is used for kernel installation and boot menu generation, the command 'bootctl install' is for installing the systemd-boot loader, and systemd-creds is used for initial configuration of the installed system (e.g., locale and keyboard layout selection).
- As part of the preparation to implement the requirements of laws for integrating an API for age verification into the OS, a birthDate field has been added to the userdb database with the user's date of birth. This added field can be used in the developing portal xdg-desktop-portal for distributions and the AccountsService to provide applications with information about the user's age category via the D-Bus interface 'org.freedesktop.AgeVerification1' or 'org.freedesktop.ParentalControls'. An option '--birth-date' has been added to the homectl utility for setting the age.
- Support for the Linux kernel subsystems LUO (Live Update Orchestration) and KHO (Kexec Handover) has been added to the PID1 handler, allowing for a complete reboot and kernel update without stopping the operation and without losing the state of the system, devices, and processes. KHO provides the ability to start a new kernel from the old one without losing the system's state, while LUO implements the preservation of the state of devices and RAM, ensuring continuity of operations related to DMA and interrupt processing.
In systemd, the ability to save file descriptors before calling kexec and restore them after the kernel is restarted via kexec has been implemented for both system and user units. Custom LUO sessions can also be created within the units, which are saved and restored during the execution of kexec. To enable the preservation of file descriptor store state, the setting 'FileDescriptorStorePreserve=yes' should be used.
- The systemd-imdsd subsystem has been implemented, providing a Varlink IPC-based API for local programs to access IMDS (Instance Metadata Service) services offered by various cloud system providers. IMDS allows for virtual machines gaining information about the cloud environment; for example, details about network configuration, geographical location of the node, CPU type, and storage size can be obtained. The systemd-imdsd provides both a low-level API for accessing individual fields and a high-level interface for querying standard keys matched to keys specific to individual cloud platforms. A utility, systemd-imds, has been added for interacting with systemd-imdsd, allowing fields from IMDS to be imported into the local account system.
To recognize cloud platforms based on information from SMBIOS and to determine the IMDS functionality available on the current node, a new database hwdb.d/40-imds.hwdb has been added. Recognition of cloud platforms such as Amazon EC2, Microsoft Azure, Google Compute Engine, Hetzner, Oracle Cloud, Scaleway, Tencent Cloud, Alibaba ECS, and Vultr has been implemented. The systemd-imds-generator handler is available for automatically substituting the service to obtain data via IMDS when identifying operation under a supported cloud platform. It is possible to create universal images that support the use of IMDS when launched in cloud environments but can also operate without IMDS.
- In systemd-stub, the 'boot secret' functionality has been implemented, allowing a key to be generated based on an EFI variable stored in an area inaccessible to the operating system and initialized with a random value. In initrd, the key is passed through the file /.extra/boot-secret. This feature may be necessary to obtain a system-specific random key for verifying the boot process or encryption on systems without a hardware TPM (Trusted Platform Module).
- A service systemd-tpm2-swtpm.service has been added to run the swtpm (Software TPM Emulator) that can be used for automatic fallback to software-based TPM for secure boot on systems without hardware TPM. The software TPM operates in user space and cannot achieve the same level of security as a hardware TPM, but its use is justified in certain situations compared to operating without TPM. For example, the software TPM can obtain the encryption key for partitions using the new 'boot secret' functionality and utilize the ESP (EFI System Partition) on the disk to store its state. A command-line parameter for automatic enabling of software TPM has been proposed: systemd.tpm2_software_fallback.
- The component systemd-sysupdate has been declared stable and placed in /usr/bin/, intended for the automatic detection, downloading, and installation of updates using an atomic replacement mechanism for partitions, files, or directories (two independent partitions/files/directories are used, one containing the currently running resource while the other installs the next update, after which the partitions/files/directories are swapped).
- In systemd-resolved, the ability to override or specify new DNS records has been implemented through the placement of JSON-formatted files in the systemd/resolve/static.d/ directories. Unlike /etc/hosts, in the new files, it is possible not only to bind an IP address to hostnames, but also to define DNS resource RR-records different from 'A' and 'AAAA'. Additionally, settings for DNS cache sizes have been added to systemd-resolved: 'DNSCacheSize', 'MulticastDNSCacheSize', and 'LLMNRCacheSize'.
- The 'storagectl' utility has been added for inspecting storage devices and managing the connection of block devices and file systems.
- As part of the initiative to reduce dependencies, dynamic loading of the libraries libgnutls, libmicrohttpd, libcurl, libcrypto, libssl, libfdisk, and libcryptsetup has been implemented in libsystemd through the use of dlopen() in situations where their functions are actually required.
. - In systemd-tmpfiles, the flag ‘—inline’ has been added, allowing directives to be set in the command line without creating configuration files in tmpfiles.d/ and without sending settings via STDIN. A new type of directive ‘k/K’ for setting capabilities has been introduced. A configuration file tmpfiles.d/root.conf has been added, setting the access rights to 0555 (-r-xr-xr-x) for the root directory (/) to protect against incorrect permissions when dynamically forming the root filesystem.
- The bootctl utility now saves a backup of the systemd-boot loader and specifies the old version in UEFI as a fallback boot option.
- In systemd-vmspawn, support for direct kernel boot without using UEFI firmware has been added. The option ‘—firmware-features’ is implemented to selectively enable or disable specific firmware capabilities. A ‘—console=headless’ mode has been introduced to run the virtual machine without a console and screen. An option ‘—image-disk-type’ has been added to choose the type of block storage used in the VM (virtio-blk, virtio-scsi, nvme, scsi-cd). The ‘—coco’ (Confidential Computing) option has been added to enable memory encryption mode. of virtual machines using AMD SEV-SNP technology.
- In systemd-hostnamed and /etc/machine-info, support for attaching arbitrary tags to the current system has been added, using the parameter ‘Tags’. The set tags can then be applied to selectively enforce settings with a check via the ConditionMachineTag expression.
- New settings EventLoopRateLimitIntervalSec and EventLoopRateLimitBurst have been added, limiting the intensity of the event processing loop in PID1 to free up CPU resources in case of looping.
- In the service manager, the MinimumUptimeSec setting has been implemented to specify the minimum uptime for the system (default 15 seconds). If a shutdown or reboot is initiated before this time elapses, a corresponding delay is added during the shutdown phase.
- For units, new settings CPUSetPartition have been implemented to set the type of cpuset partition in cgroup (‘root’, ‘isolated’, ‘member’), RestrictFileSystemAccess to allow the execution of only executable files verified by digital signature using dm-verity, and CPUPressureWatch/CPUPressureThresholdSec/IOPressureWatch/IOPressureThresholdSec for notifications about high CPU and I/O load.
- The list of metrics output by the systemd-report utility has been expanded. For example, information about physical memory size and active CPU cores, data about the contents of SMBIOS fields and /etc/machine-info, information on Confidential Computing mode support, and details about the TPM2 chip manufacturer have been added.
- In systemd-oomd, the ability to define rules for filtering processes during memory shortages in the system has been implemented. Rules can be specified in the directory /etc/systemd/oomd/rules.d/ or in service units via the OOMRule directive.
- Support for the 'PROXY' protocol, corresponding to the first version of the 'haproxy' protocol, has been added to systemd-socket-proxy.
- A new backend sd-dhcp-relay for DHCP relaying has been implemented in systemd-networkd. The settings in the '[DHCPServer]' section — BindToInterface, RelayTarget, RelayAgentCircuitId, and RelayAgentRemoteId — are deprecated, and instead, the DHCPRelay parameter in the '[Network]' section and a series of new settings in the '[DHCPRelay]' section and in the networkd.conf file should be used. A command 'networkctl dhcp-lease INTERFACE' has been added to save a dump with information about IP address bindings (DHCP lease).
- The systemd-nspawn utility has added the option '--restrict-address-families', and in .nspawn files, the RestrictAddressFamilies setting to limit the address families of sockets used in the container. In future releases, only the AF_INET, AF_INET6, and AF_UNIX families will be allowed by default.
- Support for the old udev database format (version 0.x) has been discontinued. Live upgrades from versions of systemd to release 247 are no longer supported.
- When building with the musl C library, at least musl release 1.2.6 is now required.
Additionally, the release of the liberated-systemd project 261, which develops a fork of systemd without code that can be used for user tracking, should be noted. The proposed release focuses on removing the code that adds a birthDate field with the user's date of birth to userdb, and introduces the option '--birth-date' in the homectl utility for setting age.
Source: opennet.ru
