After three months of development System Manager Release The new release includes new components systemd-homed and systemd-repart, adds support for portable user profiles in JSON format, enables namespace definitions in systemd-journald, and introduces support for the "pidfd" mechanism. It has been completely redesigned. , which consolidates most of the available documentation and presents a new logo.
Key :
- A service has been added , which provides management for portable home directories delivered as a mountable image file, with data encrypted. Systemd-homed allows creating self-contained user data environments that can be transferred between different systems without worrying about synchronizing identifiers and privacy. User credential parameters are tied to the home directory rather than system settings—instead of /etc/passwd, /etc/group, and /etc/shadow, a profile in JSON format is used. . For more details, see systemd-homed.
- A companion systemd-homed component "" ("systemd-userdb") has been added, which translates UNIX/glibc NSS accounts into JSON records and provides a unified Varlink API for querying and iterating through records. The JSON profile tied to the home directory specifies the parameters necessary for user operation, including name data, password hashes, encryption keys, quotas, and provided resources. The profile can be signed with a digital signature stored on an external Yubikey token. A utility called "userdbctl" is offered for managing profiles. Support for JSON profiles has been added to various systemd components, including systemd-logind and pam-systemd, enabling authentication, login, environment variable setup, session creation, limit setting, etc., for users of portable directories. In the future, it is expected that JSON profile generation will be possible through the sssd framework with user settings stored in LDAP.
- A new utility called 'systemd-repart' has been introduced, designed for repartitioning disk partition tables in GPT format. The structure of the partitions is defined declaratively through files that describe which partitions should or may exist. At each boot, the actual partition table is compared to these files, after which missing partitions are added, or if a specified relative or absolute size does not match, the size of existing partitions is increased. Only incremental changes are allowed, meaning deletion and reduction in size are not possible; partitions can only be added and increased.
The utility is primarily designed to run from initrd and automatically detects the disk where the root partition is located, requiring no additional configuration other than the files that define the changes.In practice, systemd-repart may prove useful for operating system images that may initially be delivered in a minimal form and then expanded after the first boot to the size of the existing block device or supplemented with additional partitions (for example, the root partition can expand to cover the entire disk, or a swap partition or /home can be created after the first boot). Another application might involve configurations with two swapping partitions—initially, only the first partition may be supplied, while the second is created upon the first boot.
- It is now possible to run multiple instances of systemd-journald, each keeping logs in its own namespace. In addition to the main systemd-journald.service, a template is provided in the .service directory for creating additional instances tied to their own namespaces using the 'LogNamespace' directive. Each log namespace is served by a separate background process with its own set of configurations and limits. This proposed feature may prove beneficial for load balancing in the presence of large volumes of logs or for enhancing application isolation. An option has been added to journalctl, '--namespace', which restricts queries to only the specified namespace.
- Support for the mechanism of assigning alternative names to network interfaces has been added in systemd-udevd and other systemd components, allowing multiple names to be assigned to a single interface simultaneously. The name length can reach 128 characters (previously, network interface names were limited to 16 characters). By default, systemd-udevd now assigns all name variants generated by supported naming schemes to each network interface. This behavior can be changed through the new AlternativeName and AlternativeNamesPolicy settings in .link files. In systemd-nspawn, the generation of alternative names with the full name of the container has been implemented for veth links created on the host side.
- Support for the Linux kernel subsystem 'pidfd' has been added in the API sd-event.h to handle situations involving PID reuse (pidfd is tied to a specific process and does not change, while PID can be bound to another process after the current process associated with this PID has finished). All systemd components, except for PID 1, have been transitioned to use pidfds, if this subsystem is supported by the current kernel.
- In systemd-logind, access control for virtual terminal switching operations is provided through PolicyKit. By default, the privileges to switch the active terminal are granted only to users who have initiated a session on the local virtual terminal at least once.
- To simplify the creation of initrd images with systemd, the PID 1 handler now detects when it is used in initrd and automatically loads initrd.target instead of default.target in this case. With this approach, the initrd images and the main system can differ only by the presence of the file /etc/initrd-release.
- A new kernel command line parameter has been added — 'systemd.cpu_affinity', equivalent to the CPUAffinity option in /etc/systemd/system.conf and allowing the CPU binding mask to be configured for PID 1 and other processes.
- SELinux policy reloading is provided along with the restart of PID 1 through commands such as 'systemctl daemon-reload'.
- The PID 1 handler has added a configuration 'systemd.show-status=error', which, when set, only outputs error messages and significant delays during boot to the console.
- In systemd-sysusers, support for creating users with the main group name being different from the username has been added.
- In systemd-growfs, support for expanding XFS partitions has been implemented through the mount option x-systemd.growfs in /etc/fstab, in addition to previously supported Ext4 and Btrfs partition expansions.
- A new option x-initrd.attach has been added to /etc/crypttab for identifying a decrypted partition that has already been unlocked during the initrd stage.
- Systemd-cryptsetup has been updated to support unlocking encrypted partitions using smart cards PKCS#11, for instance, to attach partition encryption to YubiKey tokens, via the pkcs11-uri option in /etc/crypttab.
- New mount options "x-systemd.required-by" and "x-systemd.wanted-by" have been added to /etc/fstab for explicitly configuring units that define mounting operations invoked instead of local-fs.target and remote-fs.target.
- A new service sandbox isolation option — ProtectClock has been introduced, restricting write access to the system clock (access is blocked at the /dev/rtc level, system calls, and permissions CAP_SYS_TIME/CAP_WAKE_ALARM).
- In the specification and systemd-gpt-auto-generator, the definition of partitions has been added.
/var и /var/tmp. - In "systemctl list-unit-files," a new column has been introduced that reflects the enablement status suggested in the manufacturer presets for that type of units.
- A new option "--with-dependencies" has been added to "systemctl"; when enabled, commands like "systemctl status" and "systemctl cat" will output not only all relevant units but also the units they depend on.
- In systemd-networkd, the configuration qdisc has been enhanced with the ability to configure TBF (Token Bucket Filter), SFQ (Stochastic Fairness Queuing), CoDel (Controlled-Delay Active Queue Management), and FQ (Fair Queue) parameters.
- Support for IFB network devices has been introduced in systemd-networkd ().
- A MultiPathRoute parameter for configuring multi-path routes has been implemented in the [Route] section of systemd-networkd.
- In systemd-networkd, for the DHCPv4 client, the SendDecline option has been added; when specified, after receiving a DHCP response with an address, a duplicate address check is performed, and if a conflict is detected, the allocated address is declined. The RouteMTUBytes option has also been added for the DHCPv4 client to specify the MTU size for routes generated from IP address bindings (leases).
- The PrefixRoute configuration in the [Address] section of the .network files has been deprecated. It has been replaced by the AddPrefixRoute configuration, which has the reverse meaning.
- In the .network files, support for the new value "_dhcp" is added in the Gateway setting of the [Route] section, where a static route is selected based on the gateway configured via DHCP.
- The .network files have introduced settings in the [RoutingPolicyRule] section.
User and SuppressPrefixLength for defining source routing based on UID ranges and prefix size. - In networkctl, the "status" command now allows log display linked to each network interface.
- The systemd-networkd-wait-online now supports setting a maximum wait time for the interface to become active and waiting for the interface to disappear.
- Processing of .link and .network files with an empty or commented-out [Match] section has been discontinued.
- In the .link and .network files, the [Match] section now includes the "PermanentMACAddress" setting for checking the permanent MAC address of devices when using a randomly generated MAC.
- The [TrafficControlQueueingDiscipline] section in .network files has been renamed to [NetworkEmulator], and the prefix "NetworkEmulator" has been removed from related setting names.
- In systemd-resolved, support for SNI verification has been added for DNS-over-TLS.
Source: opennet.ru
