After five months of development System Manager Release . Notable new features include integration into PID 1 for memory shortage handling, support for attaching custom BPF programs for filtering unit traffic, numerous new options for systemd-networkd, monitoring mode for the bandwidth of network interfaces, the use of 22-bit PID numbers by default on 64-bit systems instead of 16-bit, a shift to a unified cgroups hierarchy, and inclusion in systemd-network-generator.
Key Changes:
- The PID 1 handler now recognizes kernel-generated Out-Of-Memory (OOM) signals to transition units that have reached their memory consumption limit into a special state, with an optional ability to forcefully terminate or stop them;
- New parameters IPIngressFilterPath and
IPEgressFilterPath have been implemented for unit files, allowing the connection of BPF programs with arbitrary handlers to filter incoming and outgoing IP packets generated by processes associated with this unit. The proposed capabilities enable the creation of a kind of firewall for systemd services. a simple network filter based on BPF; - The systemctl utility has added the "clean" command to remove cache, runtime files, state information, and log directories;
- Support for MACsec, nlmon, IPVTAP, and Xfrm network interfaces has been added to systemd-networkd;
- In systemd-networkd, separate configuration for DHCPv4 and DHCPv6 stacks is implemented through the "[DHCPv4]" and "[DHCPv6]" sections in the configuration file. The RoutesToDNS option has been added to include a separate route to the DNS server specified in parameters received from the DHCP server (so that traffic to DNS is sent through the same link as the main route received from DHCP). New options for DHCPv4 have been added: MaxAttempts â maximum number of requests for obtaining an address, BlackList â blacklist of DHCP servers, SendRelease â enabling the sending of DHCP RELEASE messages upon session termination;
- New commands have been added to the systemd-analyze utility:
- "systemd-analyze timestamp" â parsing and converting time;
- "systemd-analyze timespan" â parsing and converting time spans;
- "systemd-analyze condition" â parsing and testing ConditionXYZ expressions;
- "systemd-analyze exit-status" â parsing and converting exit codes from numbers to names and vice versa;
- The command «systemd-analyze unit-files» outputs a list of all file paths for units and unit aliases.
- The options SuccessExitStatus, RestartPreventExitStatus, and
RestartForceExitStatus now support not only numeric exit codes but also their text identifiers (for example, «DATAERR»). You can view the list of code bindings to identifiers using the command «systemd-analyze exit-status»; - The networkctl utility has added the «delete» command for removing virtual network devices, as well as the option «âstats» to display statistics for the devices;
- New settings SpeedMeter and SpeedMeterIntervalSec have been added to networkd.conf for periodically measuring the bandwidth of network interfaces. The statistics obtained from the measurements can be viewed in the output of the command ânetworkctl statusâ;
- A new utility systemd-network-generator has been added to generate files
.network, .netdev, and .link based on the IP settings passed at boot through the Linux kernel command line in Dracut settings format; - The sysctl value «kernel.pid_max» on 64-bit systems is now set by default to 4194304 (22-bit PIDs instead of 16-bit), which decreases the likelihood of PID collisions, increases the limit on the number of simultaneously running processes, and positively impacts security. This change may potentially lead to compatibility issues, but no such reports have been made in practice so far;
- By default, during the build stage, a transition to a unified cgroups-v2 hierarchy has been made («-Ddefault-hierarchy=unified»). Previously, the default was set to a hybrid mode («-Ddefault-hierarchy=hybrid»);
- The behavior of the SystemCallFilter has been changed, which now terminates the entire process instead of individual threads when a prohibited system call is made, as terminating individual threads could lead to unpredictable issues. The changes take effect only if Linux kernel version 4.14+ and libseccomp 2.4.0+ are present;
- Unprivileged programs are now allowed to send ICMP Echo packets (ping) due to setting the sysctl «net.ipv4.ping_group_range» for the entire range of groups (for all processes);
- To speed up the build process, the generation of man pages is disabled by default (to build the complete documentation, use the option â-Dman=trueâ or â-Dhtml=trueâ for HTML format manuals). Two scripts, build/man/man and build/man/html, are included for generating and previewing the desired manuals, simplifying documentation viewing.
- For handling domain names with national alphabet characters, the libidn2 library is enabled by default (to revert to libidn, use the option â-Dlibidn=trueâ);
- Support for the executable file /usr/sbin/halt.local, which provided functionality that has not gained adequate distribution in distributions, has been discontinued. It is recommended to use scripts in /usr/lib/systemd/system-shutdown/ or define a new unit dependent on final.target to manage commands at shutdown;
- At the final stage of shutdown, systemd now automatically increases the log level in sysctl âkernel.printkâ, which resolves the issue of logging events that occur in the later stages of shutdown when the standard logging daemons have already terminated;
- In journalctl and other log displaying utilities, warnings are highlighted in yellow and audit records in blue for better visual distinction from the overall content;
- In the environment variable $PATH, the path to bin/ now precedes the path to sbin/, meaning that if there are executables with the same names in both directories, the file from bin/ will be executed;
- In systemd-logind, a call to SetBrightness() is provided for safely changing the screen brightness for each session;
- A flag â--wait-for-initializationâ has been added to the âudevadm infoâ command to await device initialization completion;
- During system boot, the PID 1 handler now displays unit names on the screen instead of a string with their description. To revert to the previous behavior, you can use the StatusUnitFormat option in /etc/systemd/system.conf or the kernel parameter systemd.status_unit_format;
- In /etc/systemd/system.conf, for the watchdog in PID 1, the option KExecWatchdogSec has been added, which defines the timeout for rebooting using kexec. The old setting, ShutdownWatchdogSec, has been renamed to RebootWatchdogSec and defines the timeout for operations during shutdown or normal reboot;
A new option has been added for services, - ExecCondition , allowing commands to be set that will be executed before ExecStartPre. Based on the error code returned by the command, a decision is made about further execution of the unit â if the code 0 is returned, the unit continues to start; if it is from 1 to 254 it silently terminates without marking a failure, and if it is 255 â it terminates with a failure indication;
- A new service, systemd-pstore.service, has been added to extract data from sys/fs/pstore/ and to save it in /var/lib/pstore for further analysis;
- New commands have been added to the timedatectl utility for configuring NTP parameters for systemd-timesyncd in relation to network interfaces;
- The command âlocalectl list-localesâ no longer displays locales other than UTF-8;
- Errors in variable assignment in sysctl.d/ files are now ignored if the variable name starts with the â-â character;
- The service now fully handles the initialization of the Linux kernelâs pseudorandom number generator entropy pool. Services that require a properly initialized /dev/urandom must start after systemd-random-seed.service;
- Support for maintaining an optional with a random sequence in the EFI System Partition (ESP) has been provided;
- New commands âbootctl random-seedâ for generating a seed file in ESP and âbootctl is-installedâ for checking the installation of the systemd-boot loader have been added to the bootctl utility. Bootctl also now outputs warnings regarding incorrect boot entry configurations (for instance, when the kernel image has been removed but the boot entry for it remains);
- Automatic selection of the swap partition has been ensured when transitioning the system to sleep mode. The partition is selected based on the priority set for it, and in the case of equal priorities â by the size of free space;
- An option keyfile-timeout has been added to /etc/crypttab to specify the timeout duration for the encryption key device before prompting for a password to access the encrypted partition;
- An IOWeight option has been added to set the input/output weight for the BFQ scheduler;
- A strict (âstrictâ) mode for DNS-over-TLS has been added to systemd-resolved, along with the capability for caching only positive DNS responses (âCache no-negativeâ in resolved.conf);
- For VXLAN in systemd-networkd, the GenericProtocolExtension option has been added to enable VXLAN protocol extensions. For VXLAN and GENEVE, the IPDoNotFragment option has been introduced to set a no-fragmentation flag for outgoing packets;
- In systemd-networkd, the FastOpenNoCookie option has been added under the [Route] section to enable the TCP Fast Open (TFO â TCP Fast Open, RFC 7413) mechanism tied to individual routes, as well as the TTLPropagate option for configuring TTL LSP (Label Switched Path). The Type option now supports routing modes local, broadcast, anycast, multicast, any, and xresolve;
- In systemd-networkd, the DefaultRouteOnDevice option has been proposed in the [Network] section to automatically set a default route for a specified network device;
- In systemd-networkd, options ProxyARP and
ProxyARPWifi have been added for configuring proxy ARP behavior, MulticastRouter to set routing parameters in multicast mode, MulticastIGMPVersion to change the IGMP (Internet Group Management Protocol) version for multicast; - In systemd-networkd, for FooOverUDP tunnels, the Local, Peer, and PeerPort options have been added to configure the IP addresses of the local and remote sides, as well as the network port number. For TUN tunnels, the VnetHeader option has been added to enable GSO (Generic Segment Offload) support;
- In systemd-networkd, the Property option has been introduced in the [Match] section of .network and .link files to identify devices based on their specific udev properties;
- In systemd-networkd, the AssignToLoopback option has been added for tunnels, managing the binding of the tunnel end to the loopback device "lo";
- In systemd-networkd, IPv6 stack activation has been automated in case it is blocked via sysctl disable_ipv6 â IPv6 will be activated if IPv6 settings (static or DHCPv6) are defined for the network interface; otherwise, the already set sysctl value remains unchanged;
- In .network files, the CriticalConnection setting has been replaced with the KeepConfiguration option, providing more means to define situations ("yes", "static", "dhcp-on-stop", "dhcp") in which systemd-networkd should not alter existing connections during startup;
- Vulnerability fixed , caused by the lack of access control to the D-Bus interface of systemd-resolved. The issue allows a non-privileged user to perform operations only available to administrators, such as changing DNS settings and directing DNS queries to a spoofed server;
- Vulnerability fixed , related to the disabling of pam_systemd for non-interactive sessions, which allows for session spoofing.
Source: opennet.ru
