After three months of development System Manager Release .
Key Changes:
- Support has been added for the cpuset resource controller based on cgroups v2, providing a mechanism for binding processes to specific CPUs (the âAllowedCPUsâ setting) and memory NUMA nodes (the âAllowedMemoryNodesâ setting);
- Support has been added for loading settings from the EFI variable SystemdOptions for systemd configuration, allowing the behavior of systemd to be configured in situations where it is difficult to change kernel command line parameters, and when the configuration from disk is read too late (for example, when itâs necessary to configure options related to the cgroup hierarchy). The command âbootctl systemd-efi-optionsâ can be used to set the variable in EFI;
- Units now support loading settings from the â{unit_type}.d/â directories, linked to unit types (for example, âservice.d/â), which can be used to apply settings that cover all unit files of that type;
- A new sandbox isolation mode ProtectKernelLogs has been added for service units, allowing the program to be barred from accessing the kernel log buffer, accessible via the syslog system call (do not confuse this with the same-named API provided in libc). When this mode is active, application access to /proc/kmsg, /dev/kmsg, and CAP_SYSLOG will be blocked;
- A setting RestartKillSignal has been introduced for units, allowing the override of the signal number used to terminate the process during task restart (this can change the termination behavior of a process at the stage of preparation for restart);
- The command âsystemctl cleanâ has been adapted for use with socket, mount, and swap units;
- At an early stage of booting, restrictions on the kernel's intensity of message output through the printk call have been disabled, allowing for the accumulation of more complete logs about the boot process at a stage when the log storage has not yet been connected (the log is accumulated in the kernel's ring buffer). The configuration of limits for printk from the kernel command line takes higher priority and can override the behavior of systemd. Systemd programs that directly output logs to /dev/kmsg (this is done only at the early stage of booting) use separate internal limits to protect against filling up the buffer;
- The âstop --job-mode=triggeringâ command has been added to the systemctl utility, allowing both the specified command-line unit and all units that may trigger it to be stopped;
- Unit state information now includes details about calling and called units;
- The ability to use the 'RuntimeMaxSec' setting in scope units has been enabled (previously it was applicable only in service units). For example, 'RuntimeMaxSec' can now be used to limit the duration of PAM sessions through the creation of a scope unit
for a user account. The time limit can also be specified via the systemd.runtime_max_sec option in the PAM module parameters pam_systemd; - A new group of system calls '@pkey' has been added, simplifying the whitelisting of memory protection-related system calls when restricting containers and services;
- A 'w+' flag has been added to systemd-tmpfiles for writing in append mode;
- The output of systemd-analyze now includes information about the kernel memory configuration compliance with systemd settings (for example, if some third-party program has modified kernel parameters);
- An option '--base-time' has been added to systemd-analyze, which calculates calendar data relative to the time specified in this option rather than the current system time;
- In 'journalctl --update-catalog', the persistence of item sequence in the output has been ensured (useful for organizing repeatable builds);
- The ability to specify a default value for the 'WatchdogSec' setting used in systemd services has been added. The base value can be defined at compile time through the '-Dservice-watchdog' option (if an empty value is set, the watchdog will be disabled);
- A build option '-Duser-path' has been added to override the $PATH value;
- The systemd-id128 utility has added the '-u' ('--uuid') option for outputting 128-bit identifiers in UUID (canonical representation of UUID);
- Building now requires libcryptsetup version at least 2.0.1.
Changes related to network configuration:
- In systemd-networkd, support for on-the-fly reconfiguration of links has been added, for which the 'reload' and 'reconfigure DEVICE...' commands have been added to networkctl to reload settings and reconfigure devices;
- In systemd-networkd, the creation of default routes for local IPv4 links with intranet addresses 169.254.0.0/16 has been discontinued (). Previously, automatic creation of default routes for such links led to unexpected behavior and routing issues in some cases. To restore the old behavior, use the setting 'DefaultRouteOnDevice=yes'. Similarly, the assignment of local IPv6 addresses has been discontinued if local IPv6 routing for the link is not enabled;
- In systemd-networkd, when connecting to wireless networks in ad-hoc mode, the configuration using link-local addressing is applied by default;
- Added parameters RxBufferSize and TxBufferSize to configure the size of the receiving and transmitting buffers of the network interface;
- In systemd-networkd, the announcement of additional IPv6 routes has been implemented, controllable via the Route and LifetimeSec options in the '[IPv6RoutePrefix]' section;
- In systemd-networkd, the ability to configure 'next hop' routes has been added through the 'Gateway' and 'Id' options in the '[NextHop]' section;
- In systemd-networkd and networkctl for DHCP, updates of IP address bindings (leases) can be performed on the fly using the 'networkctl renew' command;
- systemd-networkd has implemented a reset of DHCP configuration upon restart (to preserve settings, the KeepConfiguration parameter should be used). The default value of the SendRelease setting has been changed to 'true';
- In the DHCPv4 client, the value of the OPTION_INFORMATION_REFRESH_TIME option, provided by the server, is now used. To request specific options from the server, the 'RequestOptions' parameter is offered, and for sending options to the server, 'SendOption'. An 'IPServiceType' parameter has been added to configure the type of IP service from the DHCP client;
- To substitute the list of SIP (Session Initiation Protocol) servers by the DHCPv4 server, the 'EmitSIP' and 'SIP' parameters have been added. On the client side, the reception of SIP parameters from the server can be enabled using the 'UseSIP=yes' setting;
- In the DHCPv6 client, the 'PrefixDelegationHint' parameter has been added to request an address prefix;
- In .network files, support for matching wireless networks by SSID and BSSID has been implemented, for example, to bind to the access point name and MAC address. The SSID and BSSID values are displayed in the networkctl output for wireless interfaces. Additionally, the ability to match by the type of wireless network (WLANInterfaceType parameter) has been added;
- In systemd-networkd, the ability to configure queuing disciplines for traffic management has been added through new parameters Parent,
NetworkEmulatorDelaySec, NetworkEmulatorDelayJitterSec,
NetworkEmulatorPacketLimit and NetworkEmulatorLossRate,
NetworkEmulatorDuplicateRate in the section «[TrafficControlQueueingDiscipline]»; - systemd-resolved now ensures validation of IP addresses in certificates when built with GnuTLS.
Changes related to udev:
- In systemd-udevd, the 30-second timeout for forcibly terminating stuck handlers has been removed. Systemd-udevd now waits for handlers to complete, for which 30 seconds may have been insufficient for a graceful shutdown in large deployments (for example, the timeout could interrupt driver initialization during the remounting process for the root filesystem). When using systemd, the timeout that systemd-udevd will wait for before exiting can be set via the TimeoutStopSec setting in systemd-udevd.service. When running without systemd, the timeout is controlled by the udev.event_timeout parameter;
- A fido_id program has been added to udev that identifies FIDO CTAP1 tokens ("U2F")/CTAP2 based on data from their past usage and outputs the necessary environment variables (the program allows avoiding the need for external whitelists of all previously used tokens);
This implements automatic generation of autosuspend udev rules for devices from a whitelist imported from Chromium OS (this change allows for broader application of power-saving modes for additional devices); - A new setting "CONST{key}=value" has been added to udev, allowing direct mappings of system constant values without running separate handlers for verification. Currently, only the keys "arch" and "virt" are supported;
- Non-exclusive mode access to CDROMs is ensured when performing the operation of querying supported modes (this change resolves issues of program access to CDROMs and reduces the risk of interruptions for disk writing programs that do not use exclusive access mode).
- After three months of development, the release of the system manager has been presented,
Source: opennet.ru
