After two months of development, the release of the system manager systemd 242 has been presented. Notable new features include support for L2TP tunnels, the ability to manage the behavior of systemd-logind during a restart via environment variables, support for extended boot partitions XBOOTLDR for mounting /boot, and the possibility of booting with the root partition in overlayfs, as well as a large number of new settings for different unit types.
Key Changes:
- systemd-networkd now provides support for L2TP tunnels;
- In sd-boot and bootctl, support for XBOOTLDR (Extended Boot Loader) partitions, intended for mounting in /boot, has been implemented, in addition to ESP partitions mounted in /efi or /boot/efi. Kernels, settings, initrd images, and EFI can now be loaded from both ESP partitions and XBOOTLDR partitions. This change allows sd-boot to be used in more conservative scenarios where the bootloader itself is located in ESP, and the loaded kernels and their associated metadata are placed in a separate partition;
- The ability to boot with the kernel option "systemd.volatile=overlay" has been added, allowing the root partition to be located in overlayfs and organizing operation over a read-only image of the root directory while writing changes to a separate directory in tmpfs (changes in this configuration are lost after a reboot). Similarly, in systemd-nspawn, the option "—volatile=overlay" has been added to utilize similar functionality in containers;
- In systemd-nspawn, the option "—oci-bundle" has been added, allowing the use of runtime sets for ensuring the isolated launch of containers that comply with the Open Container Initiative (OCI) specification. Support for various options described in the OCI specification has been proposed for use in the command line and nspawn units; for example, settings "—inaccessible" and "Inaccessible" can be used to exclude parts of the file system, and options "—console" and "—pipe" have been added for configuring standard output streams;
- The ability to manage the behavior of systemd-logind via environment variables has been added: $SYSTEMD_REBOOT_TO_FIRMWARE_SETUP,
$SYSTEMD_REBOOT_TO_BOOT_LOADER_MENU and
$SYSTEMD_REBOOT_TO_BOOT_LOADER_ENTRY. These variables allow you to plug in your own reboot process handlers (/run/systemd/reboot-to-firmware-setup, /run/systemd/reboot-to-boot-loader-menu and
/run/systemd/reboot-to-boot-loader-entry) или вообще отключить их (при выставлении значения в false); - The command "systemctl reboot" has been enhanced with options "—boot-load-menu=" and
«—boot-loader-entry=», allowing the selection of a specific boot menu item or boot mode after reboot; - A new sandbox isolation command «RestrictSUIDSGID=» was added, using seccomp to prevent the creation of files with SUID/SGID flags;
- Default application of the limitations «NoNewPrivileges» and «RestrictSUIDSGID» has been ensured in services with dynamic user ID generation mode («DynamicUser») enabled;
- The default setting MACAddressPolicy=persistent in .link files has been modified to cover a greater number of devices. Bridge interfaces, tunnel (tun, tap) interfaces, and bonded links do not identify themselves other than by the network interface name, so this name is now used as the basis for binding MAC and IPv4 addresses. Additionally, a setting «MACAddressPolicy=random» has been added, which can be used to bind MAC and IPv4 addresses to devices randomly;
- Unit files «.device» generated through systemd-fstab-generator no longer include the corresponding «.mount» units as dependencies in the «Wants=» section. Simply connecting a device no longer leads to the automatic start of the mount unit, but such units can still be started for other reasons, such as part of local-fs.target or as dependencies of other units dependent on local-fs.target;
- Support for masks («*» etc.) has been added to the «networkctl list/status/lldp» commands to filter specific groups of network interfaces based on their names;
- The environment variable $PIDFILE is now set using the absolute path configured in services via the «PIDFile=» parameter;
- Public DNS servers have been added to the backup DNS servers used if a primary DNS is not explicitly defined; servers Cloudflare (1.1.1.1). The option «-Ddns-servers=» can be used to override the list of backup DNS servers;
- Upon detecting the presence of a USB device controller, the new usb-gadget.target handler is automatically started (when the system is running on a USB peripheral device);
- For unit files, the setting «CPUQuotaPeriodSec=» has been implemented to define the time period relative to which the CPU time quota set by «CPUQuota=» is measured;
- For unit files, the configuration "ProtectHostname=" has been implemented, which prohibits services from changing host name information, even if they have the necessary permissions;
- For unit files, the configuration "NetworkNamespacePath=" has been introduced, allowing the namespace to be bound to services or socket units by specifying the path to the namespace file in the pseudo-filesystem /proc;
- The ability to disable variable substitution for processes started with the "ExecStart=" configuration has been added by placing a colon ":" before the launch command;
- New flags "OnClockChange=" and
"OnTimezoneChange=" have been proposed for timers (.timer units), which allow controlling the unit call when the system time or timezone changes; - New settings "ConditionMemory=" and "ConditionCPUs=" have been added, determining unit invocation conditions based on memory size and the number of CPU cores (for instance, a resource-intensive service can only be started if the necessary RAM is available);
- A new unit time-set.target has been added, which takes the locally set system time without using synchronization with external time servers through the unit time-sync.target. This new unit can be used by services that only require the accuracy of unsynchronized local clocks;
- In "systemctl start" and similar commands, the option "--show-transaction" has been added, which, when specified, outputs a summary of all jobs queued due to the requested operation;
- In systemd-networkd, a new state 'enslaved' has been defined, used instead of 'degraded' or 'carrier' for network interfaces that are part of aggregated links or network bridges. For primary interfaces experiencing issues with one of the component links, the state 'degraded-carrier' has been added;
- In .network units, the option "IgnoreCarrierLoss=" has been added to preserve network settings in case of a link loss;
- Through the "RequiredForOnline=" setting in .network units, it is now possible to specify the minimum acceptable link state required to transition the network interface to 'online' and trigger the systemd-networkd-wait-online handler;
- In systemd-networkd-wait-online, the option "--any" has been added to wait for the readiness of any of the specified network interfaces instead of all, as well as the option "--operational-state=" to define the link state indicating readiness;
- In .network units, the settings "UseAutonomousPrefix=" and "UseOnLinkPrefix=" have been added, which can be used to ignore prefixes when receiving
announcements from the IPv6 router (RA, Router Advertisement); - In .network units, settings "MulticastFlood=", "NeighborSuppression=", and "Learning=" have been added to modify the operation parameters of the network bridge, as well as the setting "TripleSampling=" to change the TRIPLE-SAMPLING mode of CAN virtual interfaces;
- In /etc/crypttab, options same-cpu-crypt and submit-from-crypt-cpus have been added, controlling the scheduler's behavior when migrating between CPU cores for tasks related to encryption; VPN;
- In systemd-tmpfiles, the handling of the lock file has been ensured before performing operations in directories with temporary files, allowing the cleaning of obsolete files to be temporarily disabled (for example, unpacking a tar archive in /tmp may reveal very old files that cannot be deleted until the actions with them are completed);
- In the command "systemd-analyze cat-config", the ability to analyze configuration split across multiple files has been provided, such as user and system presets, the contents of tmpfiles.d and sysusers.d, udev rules, etc.
- In "journalctl", the option "--cursor-file=" has been added to specify the file for loading and saving the position pointer;
- In systemd-detect-virt, the determination of the ACRN hypervisor and the WSL (Windows Subsystem for Linux) subsystem has been added for further branching using the conditional operator "ConditionVirtualization";
- During the installation of systemd (when executing "ninja install"), the creation of symbolic links in the /etc directory to the files systemd-networkd.service, systemd-networkd.socket,
- systemd-resolved.service, remote-cryptsetup.target, remote-fs.target,
systemd-networkd-wait-online.service, and systemd-timesyncd.service has been discontinued. To create these files, the command "systemctl preset-all" must now be executed.
After two months of development, the release of the system manager systemd 242 has been presented.
Source: opennet.ru
