After five months of development System Manager Release . The new release features support for freezing units, the ability to verify the root disk image using a digital signature, support for journal and core dump compression using the ZSTD algorithm, the ability to unlock portable home directories using FIDO2 tokens, support for unlocking Microsoft BitLocker partitions via /etc/crypttab, and the renaming of BlackList to DenyList.
Key :
- Support for the resource controller freezer based on cgroups v2 has been added, allowing processes to be stopped and temporarily freeing some resources (CPU, I/O, and potentially even memory) for other tasks. Freezing and unfreezing of units is managed with the new command 'systemctl freeze' or via D-Bus.
- Support for verifying the root disk image using a digital signature has been added. Verification is performed using new settings in service units: RootHash (the root hash for verifying the disk image specified through the RootImage option) and RootHashSignature (the digital signature in PKCS#7 format for the root hash).
- The PID 1 handler has been enhanced to automatically load precompiled AppArmor rules (/etc/apparmor/earlypolicy) during the initial boot phase.
- New settings for unit files have been added: ConditionPathIsEncrypted and AssertPathIsEncrypted to check the specified path's location on a block device using encryption (dm-crypt/LUKS), ConditionEnvironment and AssertEnvironment for checking environment variables (e.g., set by PAM or during container setup).
- For *.mount units, the ReadWriteOnly setting has been implemented, preventing a partition from being mounted read-only if it could not be mounted for read and write access. In /etc/fstab, this mode is configured using the 'x-systemd.rw-only' option.
- For *.socket units, the PassPacketInfo setting has been added, which includes the kernel's addition of extra metadata for each packet read from the socket (including IP_PKTINFO, IPV6_RECVPKTINFO, and NETLINK_PKTINFO modes for the socket).
- For services (*.service units), settings CoredumpFilter (defines memory sections to include in core dumps) and
TimeoutStartFailureMode/TimeoutStopFailureMode (defines the behavior (SIGTERM, SIGABRT, or SIGKILL) upon timeout during the start or stop of a service) have been proposed. - Most options have added support for specifying hexadecimal values defined with the prefix '0x'.
- Various command line parameters and configuration files related to key or certificate setup now allow the specification of the path to Unix sockets (AF_UNIX) for transmitting keys and certificates via IPC service calls, eliminating the need to place certificates in unencrypted disk storage.
- Support for six new specifiers has been added, which can be used in units, tmpfiles.d/, sysusers.d/, and other configuration files: %a for substituting the current architecture, %o/%w/%B/%W for substituting fields with identifiers from /etc/os-release, and %l for substituting the short hostname.
- Support for the '.include' syntax in unit files has been discontinued, having been deprecated six years ago.
- In the StandardError and StandardOutput settings, support for the values 'syslog' and 'syslog-console' has been discontinued, which will be automatically converted to 'journal' and 'journal+console'.
- Limits on size and number of inodes have been set for automatically created mount points based on tmpfs (/tmp, /run, /dev/shm, etc.), corresponding to 50% of RAM size for /tmp and /dev/shm, and 10% of RAM for all others.
- New kernel command line parameters have been added: systemd.hostname to set the hostname during the early boot stage, udev.blockdev_read_only to limit all block devices related to physical drives to read-only mode (for selective re-enabling, the command 'blockdev --setrw' can be used), systemd.swap to disable automatic activation of swap partitions, systemd.clock-usec to set system clocks in microseconds, systemd.condition-needs-update and systemd.condition-first-boot to override the ConditionNeedsUpdate and ConditionFirstBoot checks.
- By default, the sysctl fs.suid_dumpable is set to 2 ('suidsafe'), allowing core dumps to be saved for processes with the suid flag.
- The hardware database from ChromiumOS has borrowed the file /usr/lib/udev/hwdb.d/60-autosuspend.hwdb, which includes information about PCI and USB devices that support automatic sleep mode.
- A setting ManageForeignRoutes has been added in networkd.conf, which, when enabled, allows systemd-networkd to manage all routes configured by other utilities.
- A section "[SR-IOV]" has been added to the .network files for configuring network devices that support SR-IOV (Single Root I/O Virtualization).
- The configuration IPv4AcceptLocal has been added to the "[Network]" section in systemd-networkd to allow the reception of packets on the network interface that come from a local source address.
- In systemd-networkd, the ability to configure HTB traffic prioritization disciplines has been added through the [HierarchyTokenBucket] and
[HierarchyTokenBucketClass], "pfifo" through [PFIFO], "GRED" through [GenericRandomEarlyDetection], "SFB" through [StochasticFairBlue], "cake"
through [CAKE], "PIE" through [PIE], "DRR" through [DeficitRoundRobinScheduler] and
[DeficitRoundRobinSchedulerClass], "BFIFO" through [BFIFO],
"PFIFOHeadDrop" through [PFIFOHeadDrop], "PFIFOFast" through [PFIFOFast], "HHF"
through [HeavyHitterFilter], "ETS" through [EnhancedTransmissionSelection],
"QFQ" through [QuickFairQueueing] and [QuickFairQueueingClass]. - In systemd-networkd, the UseGateway setting has been added to the [DHCPv4] section to disable the application of gateway information received via DHCP.
- In systemd-networkd, the SendVendorOption setting has been added to the [DHCPv4] and [DHCPServer] sections for setting and processing additional vendor options.
- In systemd-networkd, a new set of options EmitPOP3/POP3, EmitSMTP/SMTP, and EmitLPR/LPR has been implemented in the [DHCPServer] section to add information about POP3, SMTP, and LPR servers.
- In systemd-networkd, the VLANProtocol setting has been introduced in the [Bridge] section of the .netdev files to select the VLAN protocol in use.
- In systemd-networkd, the Group setting has been implemented in the [Link] section of the .network files to manage a group of links.
- The BlackList settings have been renamed to DenyList (for backward compatibility, processing of the old name has been retained).
- In systemd-networkd, a large batch of settings related to IPv6 and DHCPv6 has been added.
- The command "forcerenew" has been added to networkctl for forcefully renewing all address bindings (leases).
- In systemd-resolved, the DNS setting now allows specifying the port number and hostname for verifying the certificate for DNS-over-TLS. Support for SNI verification has been added in the DNS-over-TLS implementation.
- In systemd-resolved, the ability to configure the redirection of single-label DNS names has been added.
- In systemd-journald, support has been implemented for using the zstd algorithm to compress large fields in logs. Efforts have been made to protect against collisions in the hash tables used in logs.
- In journalctl, clickable URLs linking to documentation have been added to the log message output.
- The Audit setting has been added to journald.conf to manage the inclusion of audit during the initialization of systemd-journald.
- The ability to compress core dumps using the zstd algorithm has been added to systemd-coredump.
- A UUID setting for assigning a UUID to the created partition has been added to systemd-repart.
- In the systemd-homed service, which manages portable home directories, the ability to unlock home directories using FIDO2 tokens has been added. The backend for LUKS partition encryption now supports automatically returning empty blocks of the filesystem upon session completion. Protection against double encryption of data has been added if it is determined that encryption is already applied to the /home partition in the system.
- The following settings have been added to /etc/crypttab: 'keyfile-erase' for deleting the key after use and 'try-empty-password' for attempting to unlock the partition with an empty password before prompting the user for a password (useful for installing encrypted images with the password assigned after the first boot rather than during installation).
- Support for unlocking Microsoft BitLocker partitions during boot using /etc/crypttab has been implemented in systemd-cryptsetup. The ability to read
keys for automatic unlocking of partitions from the files /etc/cryptsetup-keys.d/.key and /run/cryptsetup-keys.d/.key has also been added. - A systemd-xdg-autostart-generator has been added for creating unit files from .desktop autostart files.
- The 'bootctl' command has been updated with the new command 'reboot-to-firmware'.
- Options have been added to systemd-firstboot: '--image' for specifying the disk image for booting, '--kernel-command-line' for initializing the /etc/kernel/cmdline file, '--root-password-hashed' for setting the hashed root password, and '--delete-root-password' for removing the root password.
Source: opennet.ru
