After three months of development is available System Manager Release systemd 261. Key changes include preparation for supporting the API for age verification, support for the Kexec Handover and Live Update Orchestration subsystems for restart without state loss, the IMDS (Instance Metadata Service) subsystem, functionality for boot protection on systems without a physical TPM (Trusted Platform Module), and the systemd-sysinstall component implementing the installer.
Among the changes in the new release:
- A new component systemd-sysinstall has been added, featuring a simple operating system installer that can be managed from the command line or through an interactive text interface. The functionality of systemd-sysinstall has been formed from existing capabilities of systemd: disk partitioning is handled by systemd-repart, kernel installation and boot menu generation are managed by the command âbootctl linkâ, for bootloader installation, use the command systemd-boot â the command âbootctl installâ, and for the initial configuration of the installed system (like selecting locale and keyboard layout) â systemd-creds.
- In preparation for implementing the requirements of laws for integrating into the OS an API for age verification in the database userdb , a birthDate field for the user has been added. This field can be used in the developing portal for distributions, xdg-desktop-portal, and the AccountsService to provide applications with information about the user's age category via the D-Bus interface org.freedesktop.AgeVerification1 or org.freedesktop.ParentalControls. An option has been added to the homectl utility âbirth-date to set the age.
- Support for the Linux kernel subsystem PID1 has been added to LUO (Live Update Orchestration) and KHO (Kexec Handover), enabling complete kernel reboot and update without stopping ongoing operations and maintaining system, device, and process states. KHO provides capabilities for booting a new kernel from an old one without losing system state, while LUO implements the preservation of device states and memory, ensuring continuity for DMA-related operations and interrupt handling.
In systemd, for system and user units, the ability to save file descriptors before calling kexec and restore them after kernel reboot via kexec has been implemented. Custom sessions can also be created within the units. LUO, saved and restored during kexec execution. To enable the preservation of the file descriptor store state, the setting FileDescriptorStorePreserve=yes should be used. - The subsystem systemd-imdsd, provides a Varlink IPC-based API for local programs to access IMDS (Instance Metadata Service) provided by various cloud providers. IMDS allows virtual machines to obtain information about the cloud environment, such as network configuration, geographical location of the node, CPU type, and storage size. systemd-imdsd provides both a low-level API for accessing individual fields and a high-level interface for querying standard keys mapped to keys specific to individual cloud platforms. A tool, systemd-imds, has been added to interact with systemd-imdsd, allowing the import of fields from IMDS into the local account system.
To recognize cloud platforms by information from SMBIOS and determine the IMDS functionality available on the current node, a new database hwdb.d/40-imds.hwdb has been added. Recognition has been implemented for cloud platforms including Amazon EC2, Microsoft Azure, Google Compute Engine, Hetzner, Oracle Cloud, Scaleway, Tencent Cloud, Alibaba ECS, and Vultr. A systemd-imds-generator handler is available for automatically substituting the service for fetching data via IMDS when operating on a supported cloud platform. Universal images can be created that support the use of IMDS when launching in cloud environments but can also operate without IMDS. - In systemd-stub has implemented boot secret functionality, allowing the formation of a key based on an EFI variable stored in an area inaccessible to the operating system and initialized with a random value. In initrd, the key is passed via the file /.extra/boot-secret. This capability may be needed to obtain a system-specific random key for verifying the boot process or encryption on systems without a hardware TPM (Trusted Platform Module).
- A service systemd-tpm2-swtpm.service has been added to start the TPM chip emulator swtpm (Software TPM Emulator), which can be used for automatic fallback to a software implementation of TPM for secure boot on systems without hardware TPM. The software TPM operates in user space and does not provide the same level of protection as hardware TPM, but in some situations, its use is justified compared to operating without TPM. For instance, the software TPM can obtain the encryption key for partitions using the new 'boot secret' functionality and use the ESP (EFI System Partition) on the disk to store its state. To enable the software TPM automatically, the kernel command line parameter systemd.tpm2_software_fallback has been proposed.
- A stable component has been announced and placed in /usr/bin/ systemd-sysupdate, designed for automatic detection, downloading, and installation of updates using an atomic mechanism for replacing partitions, files, or directories (two independent partitions/files/directories are used, one containing the currently running resource, and the other receiving the next update, after which the partitions/files/directories are swapped).
- In systemd-resolved has implemented the ability to override or specify new DNS records by placing JSON format files in the directories systemd/resolve/static.d/. Unlike /etc/hosts, in the new files, it is possible not only to bind IP addresses to hostnames but also to define resource DNS RR records other than 'A' and 'AAAA'. Additionally, systemd-resolved has added settings for DNS cache size: DNSCacheSize, MulticastDNSCacheSize, and LLMNRCacheSize.
- A utility âstoragectlâ has been added for inspecting storage devices and managing the connection of block devices and file systems.
- In the framework of of the to reduce dependencies in libsystemd, dynamic loading of libraries libgnutls, libmicrohttpd, libcurl, libcrypto, libssl, libfdisk, and libcryptsetup has been implemented using dlopen() in situations where their functions are actually needed.
- In systemd-tmpfiles has added the flag âinline, allowing directives to be set directly in the command line without creating configuration files in tmpfiles.d/ and without sending settings via STDIN. A new directive type k/K for setting has been introduced. capabilitiesA configuration file tmpfiles.d/root.conf has been added, setting permissions to 0555 (-r-xr-xr-x) for the root directory (/) to prevent incorrect permissions when dynamically generating the root filesystem.
- In the utility bootctl a backup of the systemd-boot loader is now preserved, along with writing the old version in UEFI as a fallback boot option.
- In systemd-vmspawn added support for booting the kernel directly without using UEFI firmware. An option âfirmware-features has been implemented to selectively enable or disable individual firmware features. A âconsole=headless mode has been added for running a virtual machine without a console and screen. An option âimage-disk-type has been introduced for choosing the block storage type used in the VM (virtio-blk, virtio-scsi, nvme, scsi-cd). An option âcoco (Confidential Computing) has been added to enable memory encryption for virtual machines using AMD SEV-SNP technology.
- In systemd-hostnamed and /etc/machine-info now supports attaching arbitrary tags to the current system using the Tags parameter. The set tags can then be used to selectively apply settings with a check via the ConditionMachineTag expression.
- Added settings EventLoopRateLimitIntervalSec and EventLoopRateLimitBurst to limit the intensity of the event processing loop in PID1 to free CPU resources in case of a loop.
- In the service manager, the MinimumUptimeSec setting has been implemented to specify the minimum uptime for the system (default 15 seconds). If a shutdown or reboot is initiated before this time elapses, a corresponding delay is added during the shutdown phase.
- For units, new settings CPUSetPartition have been implemented to specify the cpuset partition type in cgroups (root, isolated, member), RestrictFileSystemAccess to allow only the execution of files verified by digital signature using dm-verity, and CPUPressureWatch/CPUPressureThresholdSec/IOPressureWatch/IOPressureThresholdSec to receive notifications about high CPU and I/O load.
- The list of metrics reported by the utility systemd-report. For example, information about physical memory size and active CPU cores, data about the contents of SMBIOS fields and /etc/machine-info, information about support for Confidential Computing mode, and details about the manufacturer of the TPM2 chips have been added.
- In systemd-oomd The ability to set rules for killing processes when the system runs low on memory has been implemented. Rules can be specified in the directory /etc/systemd/oomd/rules.d/ or in service units using the OOMRule directive.
- In systemd-socket-proxy Support for the PROXY protocol, matching the first version of the haproxy protocol, has been added.
- In systemd-networkd A new backend sd-dhcp-relay for DHCP relays has been implemented. The settings in the [DHCPServer] section â BindToInterface, RelayTarget, RelayAgentCircuitId, and RelayAgentRemoteId â are deprecated and should be replaced with the DHCPRelay parameter in the [Network] section and a series of new settings in the [DHCPRelay] section and the networkd.conf file. Added the command networkctl dhcp-lease INTERFACE to save a dump containing information about IP address bindings (DHCP lease).
- jot, systemd-nspawn The option ârestrict-address-families has been added, as well as the RestrictAddressFamilies setting in .nspawn files to limit the address families of sockets used in the container. In future releases, only the AF_INET, AF_INET6, and AF_UNIX families will be allowed by default.
- Support for the old udev (version 0.x) database format has been discontinued. On-the-fly updates from systemd versions up to release 247 (opennet.ru) are no longer supported.
- When building with the musl C library, at least musl release 1.2.6 is now required.
Additionally, it can be noted release project liberated-systemd 261, a fork of systemd that has been stripped of code that could be used for user tracking. The proposed release focuses on removing code that added a birthDate field with the user's birth date to the userdb, and a âbirth-date option to the homectl utility for setting age.
Source: linux.org.ru
