After four months of development, the release of the system manager systemd 248 has been presented. This new version includes support for images to extend system directories, the configuration file /etc/veritytab, the systemd-cryptenroll utility, unlocking LUKS2 using TPM2 chips and FIDO2 tokens, starting units in an isolated IPC namespace, the B.A.T.M.A.N. protocol for mesh networks, and the nftables backend for systemd-nspawn. The systemd-oomd has been stabilized.
Key Changes:
- The concept of System Extension images has been implemented, allowing for the extension of the directory hierarchies /usr/ and /opt/, and the addition of extra files at runtime, even if the specified directories are mounted in read-only mode. When a system extension image is connected, its contents are layered onto the hierarchy of /usr/ and /opt/ using OverlayFS.
A new utility, systemd-sysext, has been proposed for connecting, disconnecting, viewing, and updating system extension images. To automatically connect already installed images during boot, the systemd-sysext.service has been added. The parameter "SYSEXT_LEVEL=" has been added to the os-release file to define the level of supported system extensions.
- For units, an ExtensionImages configuration has been implemented, which can be used to bind system extension images to the namespace hierarchy of isolated service file systems.
- A configuration file /etc/veritytab has been added for configuring block-level data verification using the dm-verity module. The file format is similar to /etc/crypttab — "volume_name data_device hash_device root_hash_options". A kernel command line parameter systemd.verity.root_options has been added to configure the behavior of dm-verity for the root device.
- In systemd-cryptsetup, the ability to extract the URI of a PKCS#11 token and the encrypted key from the LUKS2 metadata header in JSON format has been added, allowing integration of the information needed to unlock the encrypted device directly into the device without the need for external files.
- In systemd-cryptsetup, support has been provided for unlocking encrypted LUKS2 partitions using TPM2 chips and FIDO2 tokens, in addition to the previously supported PKCS#11 tokens. The loading of libfido2 is done via dlopen(), meaning its existence is checked on the fly, rather than as a hard dependency.
- New options "no-write-workqueue" and "no-read-workqueue" have been added to /etc/crypttab for systemd-cryptsetup to enable synchronous input/output processing related to encryption and decryption.
- The systemd-repart utility now has the ability to activate encrypted partitions using TPM2 chips, for example, to create an encrypted /var partition during the first boot.
- A systemd-cryptenroll utility has been added for binding TPM2, FIDO2, and PKCS#11 tokens to LUKS partitions, as well as for unbinding and viewing tokens, binding backup keys, and setting an access password.
- The PrivateIPC parameter has been added, allowing the configuration of process startup in an isolated IPC space with its own separate identifiers and message queue in the unit file. An option IPCNamespacePath has been provided to connect the unit to an already created IPC identifier space.
- The ExecPaths and NoExecPaths settings have been added, allowing the noexec flag to be applied to specific parts of the file system.
- Support for the mesh protocol B.A.T.M.A.N. ("Better Approach To Mobile Adhoc Networking") has been added to systemd-networkd, allowing the creation of decentralized networks where each node is connected through neighboring nodes. A [BatmanAdvanced] section is proposed in .netdev, the BatmanAdvanced parameter in .network files, and a new device type "batadv."
- The implementation of the early response mechanism for memory shortages in systemd-oomd has been stabilized. The DefaultMemoryPressureDurationSec option has been added to configure the waiting time for resource release before impacting the unit. Systemd-oomd uses the kernel PSI (Pressure Stall Information) subsystem and allows the detection of the onset of delays due to resource shortages, selectively terminating resource-intensive processes when the system is still not in a critical state and has not started aggressively trimming cache and swapping out data.
- A new kernel command line parameter—"root=tmpfs"—allows mounting the root partition in a temporary storage area located in RAM using Tmpfs.
- The parameter in /etc/crypttab that specifies the key file can now point to AF_UNIX and SOCK_STREAM type sockets. The key must be provided upon connection to the socket, which can be used, for instance, to create services that dynamically provide keys.
- The fallback hostname for use by the system manager and systemd-hostnamed can now be set in two ways: via the DEFAULT_HOSTNAME parameter in os-release and through the environment variable $SYSTEMD_DEFAULT_HOSTNAME. systemd-hostnamed now also handles the specification of 'localhost' in the hostname and adds the ability to export the hostname, as well as the properties 'HardwareVendor' and 'HardwareModel' via DBus.
- The block with environment variables can now be configured through the new ManagerEnvironment option in system.conf or user.conf, not only through the kernel command line and unit file settings.
- At compile time, the possibility of using the fexecve() system call to launch processes instead of execve() has been provided to reduce latency between security context verification and its application.
- New conditional operations ConditionSecurity=tpm2 and ConditionCPUFeature have been added for unit files to check for the presence of TPM2 devices and certain CPU features (for example, ConditionCPUFeature=rdrand can be used to check if the CPU supports the RDRAND operation).
- For available kernels, automatic generation of syscall tables for seccomp filters has been implemented.
- The ability to substitute new bind mounts into existing mount namespaces of services, without restarting the services, has been added. Substitution is performed with the commands 'systemctl bind ...' and 'systemctl mount-image ...'.
- Support for specifying paths in the form of 'truncate:' for clearing before use has been added to the StandardOutput and StandardError settings.
- In sd-bus, the ability to connect to the session of a specified user inside a local container has been added. For example, 'systemctl --user -M lennart@ start quux'.
- In systemd.link files in the [Link] section, the following parameters have been implemented:
- Promiscuous — allows the device to enter 'promiscuous' mode for processing all network packets, including those not addressed to the current system;
- TransmitQueues and ReceiveQueues for configuring the number of TX and RX queues;
- TransmitQueueLength for configuring the size of the TX queue; GenericSegmentOffloadMaxBytes and GenericSegmentOffloadMaxSegment to define limits for applying GRO (Generic Receive Offload) technology.
- New settings have been added to systemd.network files:
- [Network] RouteTable for selecting the routing table;
- [RoutingPolicyRule] Type for the type of routing ('blackhole', 'unreachable', 'prohibit');
- [IPv6AcceptRA] RouteDenyList and RouteAllowList for lists of allowed and denied route announcements;
- [DHCPv6] UseAddres to ignore the issued DHCP address;
- [DHCPv6PrefixDelegation] ManageTemporaryAddress;
- ActivationPolicy for defining the policy regarding interface activity (always maintain in UP or DOWN state or allow the user to change states with the command ‘ip link set dev’).
- Options [VLAN] Protocol, IngressQOSMaps, EgressQOSMaps, and [MACVLAN] BroadcastMulticastQueueLength have been added to systemd.netdev files for configuring VLAN packet handling.
- Mounting the /dev/ directory in noexec mode has been discontinued, as it causes conflicts when using the executable flag with /dev/sgx files. To revert to the old behavior, the NoExecPaths=/dev. setting can be used.
- The file permissions for /dev/vsock have been changed to 0o666, and the files /dev/vhost-vsock and /dev/vhost-net have been moved to the group. kvm.
- The hardware ID base has been expanded to include USB devices for fingerprint reading, properly supporting sleep transition.
- systemd-resolved has added support for responding to DNSSEC queries via the stub resolver. Local clients can perform DNSSEC validation themselves, while external queries are proxied unchanged to the parent DNS server.
- In resolved.conf, a CacheFromLocalhost option has been added, where if set, systemd-resolved will use caching even for queries to the DNS server at 127.0.0.1 (by default, caching for such requests is disabled to avoid double caching).
- systemd-resolved has added support for RFC-5001 NSID in the local DNS resolver, allowing clients to distinguish between interactions with the local resolver and others. proxy server DNS.
- The resolvectl utility now provides the ability to display information about the data source (local cache, network query, response from local handler) and apply encryption during data transmission. Options for controlling the name resolution process have been introduced: —cache, —synthesize, —network, —zone, —trust-anchor, and —validate.
- Support for configuring the firewall using nftables has been added to systemd-nspawn in addition to the existing support for iptables. In the IPMasquerade setting in systemd-networkd, the use of a nftables-based backend has been added.
- Support for calling locale-gen to generate missing locales has been added to systemd-localed.
- Various utilities have been updated with options —pager/—no-pager/—json= to enable/disable pagination mode and output in JSON format. The ability to set the number of colors used in the terminal via the environment variable SYSTEMD_COLORS (‘16’ or ‘256’) has been added.
- The builds with separate directory hierarchies (separation of / and /usr) and support for cgroup v1 have been declared obsolete.
- The main branch in Git has been renamed from ‘master’ to ‘main’.
Source: opennet.ru
