Release of System Manager systemd 249

After three months of development, the release of System Manager systemd 249 has been presented. This new release provides the ability to define users/groups in JSON format, stabilizes the Journal protocol, simplifies the organization of booting alternating disk partitions, adds the ability to bind BPF programs to services, implements mapping of user identifiers in mounted partitions, and offers a large set of new network settings and container launch capabilities.

Key Changes:

• The Journal protocol has been documented, which can be used in clients instead of the syslog protocol for local log delivery. The Journal protocol has been implemented quite some time ago and is already used in some client libraries; however, its official support has only been announced now.
• In userdb and nss-systemd, the reading of additional user definitions located in the directories /etc/userdb/, /run/userdb/, /run/host/userdb/, and /usr/lib/userdb/, defined in JSON format, is supported. It is noted that this feature will provide an additional mechanism for user creation in the system, ensuring full integration with NSS and /etc/shadow. Support for JSON format for user/group records will also allow attaching various resource management parameters and other settings recognized by pam_systemd and systemd-logind to users.
• In nss-systemd, the synthesis of user/group records in /etc/shadow using hashed passwords from systemd-homed has been ensured.
• A mechanism has been implemented to simplify the organization of updates using alternating disk partitions (one active partition and the other backup — the update is copied to the backup partition, after which it becomes active). If the disk image contains two root or /usr partitions, and udev has not determined the presence of the 'root=' parameter or disk images specified via the '--image' option in the systemd-nspawn and systemd-dissect utilities are being processed, the boot partition can be calculated by comparing GPT labels (it is implied that the GPT label mentions the content version number of the partition and systemd will choose the partition with the latest changes).
• The BPFProgram setting has been added to service files, which allows for loading BPF programs into the kernel and managing them with a binding to specific systemd services.
• The systemd-fstab-generator and systemd-repart now support booting from disks that contain only a /usr partition and do not have a root partition (the root partition will be generated by the systemd-repart utility during the first boot).
• In systemd-nspawn, the option "—private-user-chown" has been replaced with the more universal "—private-user-ownership" variant, which can accept values like "chown" as equivalent to "—private-user-chown", "off" to disable the old setting, "map" for mapping user IDs in mounted file systems, and "auto" to select "map" when the necessary functionality is available in the kernel (5.12+) or fallback to recursive "chown" otherwise. Mapping allows associating files of one user on a mounted foreign partition with another user on the current system, simplifying file sharing between users. In the systemd-homed mechanism for portable home directories, mapping will allow users to move their home directories to external storage and use them on different computers with differing user ID mappings.
• In systemd-nspawn, the option "—private-user" now supports the value "identity" to directly reflect user IDs when setting up the namespace (user namespace), meaning UID 0 and UID 1 in the container will reflect to UID 0 and UID 1 on the host side, reducing attack vectors (the container will gain process capabilities only within its own namespace).
• The option "—bind-user" has been added to systemd-nspawn to forward a user account from the host environment into the container (the home directory is mounted in the container, a user/group entry is added, and UID mapping between the container and host environment is performed).
• Support for requesting set passwords (passwd.hashed-password. and passwd.plaintext-password.) has been added to systemd-ask-password and systemd-sysusers, utilizing a new secure confidential data transmission mechanism introduced in systemd 247, which uses temporary files in a separate directory. By default, credentials are accepted from the process with PID1, which receives them, for example, from a container management system, facilitating user password setup on first boot.
• Support for using a secure confidential data transmission mechanism to request various system parameters has been added to systemd-firstboot, which can be used to initialize system settings on the first boot of a container image that lacks the necessary settings in the /etc directory.
• During boot, process PID 1 can now display both the name and description of a unit simultaneously. The output can be changed using the parameter 'StatusUnitFormat=combined' in system.conf or the kernel command line option 'systemd.status-unit-format=combined'.
• The systemd-machine-id-setup and systemd-repart utilities have added the '--image' option to pass a machine ID file to disk images or to increase the size of a disk image.
• A MakeDirectories parameter has been added to the partition configuration file used by the systemd-repart utility, which can be used to create arbitrary directories in the newly created filesystem at the stage before reflection in the partition table (for example, to create directories for mount points in the root partition so that the partition can be immediately mounted in read-only mode). Corresponding parameters Flags, ReadOnly, and NoAuto have been added for managing GPT flags in the created partitions. The CopyBlocks parameter now implements the value 'auto' for automatically selecting the current boot partition as the source when copying blocks (for instance, when it's necessary to transfer one's own root partition to a new medium).
• The GPT includes the flag "grow-file-system," similar to the x-systemd.growfs mount option, which provides automatic expansion of the file system size to the boundaries of the block device if the file system size is less than the partition. This flag applies to Ext3, XFS, and Btrfs file systems and can be used for automatically detected partitions. By default, the flag is enabled for writable partitions automatically created via systemd-repart. An option to configure the flag has been added to systemd-repart: GrowFileSystem.
• Support for the new variables IMAGE_VERSION and IMAGE_ID has been implemented in the /etc/os-release file to define the version and identifier of atomically updated images. Specifiers %M and %A have been suggested for substituting the specified values into various commands.
• A new parameter "—extension" has been added to the portablectl utility to activate portable system extension images (for example, they can be used to distribute images with additional services integrated into the root partition).
• The systemd-coredump utility now extracts ELF build-id information when generating a core dump for a process, which can be useful for determining to which package the failing process belongs if the name and version information of deb or rpm packages were embedded in the ELF files.
• A new hardware database for FireWire (IEEE 1394) devices has been added to udev.
• In udev, three changes have been made to the network interface naming scheme "net_id" that break backward compatibility: incorrect characters in interface names are now replaced with "_"; PCI hotplug slot names for s390 systems are processed as hexadecimal numbers; and the use of up to 65535 built-in PCI devices is now allowed (previously, numbers above 16383 were blocked).
• The domain "home.arpa" has been added to the Negative Trust Anchors (NTA) list in systemd-resolved, recommended for local home networks but not applicable in DNSSEC.
• The CPUAffinity parameter has been updated to parse specifiers "%".
• The ManageForeignRoutingPolicyRules parameter has been added to ".network" files, which can be used to exclude the processing of third-party routing policies in systemd-networkd.
• The RequiredFamilyForOnline parameter has been added to ".network" files to determine the presence of an IPv4 or IPv6 address as an indication of the network interface being "online." The networkctl utility now displays the "online" status for each link.
• The parameter OutgoingInterface has been added to the «.network» files to specify the outgoing interfaces when configuring network bridges.
• The Group parameter has been added to the «.network» files, allowing configuration of a Multipath group for entries in the «[NextHop]» section.
• The options «-4» and «-6» have been added to systemd-network-wait-online to limit connection waiting only for IPv4 or IPv6.
• The RelayTarget parameter has been added to the DHCP server settings, switching the server to DHCP Relay mode. Additional configuration for DHCP relay has been suggested with the RelayAgentCircuitId and RelayAgentRemoteId options.
• The ServerAddress parameter has been added to the DHCP server, allowing to explicitly set the server IP address (otherwise, the address is chosen automatically).
• The [DHCPServerStaticLease] section has been implemented in the DHCP server, allowing configuration of static address bindings (DHCP leases), by specifying fixed IP bindings to MAC addresses and vice versa.
• Support for the value «none» has been implemented in the RestrictAddressFamilies setting, whereby the service will not have access to sockets of any address family.
• Support for configuring RouteMetric has been implemented in the «.network» files in the [Address], [DHCPv6PrefixDelegation], and [IPv6Prefix] sections, allowing to specify the metric for the route prefix created for the specified address.
• In nss-myhostname and systemd-resolved, DNS record synthesis has been ensured with addresses for hosts with the special name «_outbound», for which a local IP is always returned, chosen according to the default routes used for outbound connections.
• An active by default setting RoutesToNTP has been added to the «[DHCPv4]» section in the .network files, which mandates the addition of a separate route through the current network interface for accessing the NTP server address obtained for this interface via DHCP (similar to DNS configuration, it ensures that traffic to the NTP server will be directed through the interface via which that address was obtained).
• SocketBindAllow and SocketBindDeny settings have been added to control access to sockets bound to the current service.
• For unit files, the conditional setting ConditionFirmware has been implemented, allowing for checks that assess firmware functions, such as operation on UEFI systems and device.tree, as well as compatibility with specific device-tree capabilities.
• The ConditionOSRelease option has been implemented to check fields in the /etc/os-release file. The operators '=', '!=', '<', '=', and '>' are valid for determining the conditions for checking field values.
• In the hostnamectl utility, the commands 'get-xyz' and 'set-xyz' have been stripped of the 'get' and 'set' prefixes. For example, instead of using 'hostnamectl get-hostname' and 'hostnamectl set-hostname', you can now use the command 'hostnamectl hostname', where the value assignment is defined by providing an additional argument ('hostnamectl hostname value'). Support for the old commands has been retained for compatibility.
• In the systemd-detect-virt utility and the ConditionVirtualization setting, proper identification of Amazon EC2 environments has been ensured.
• The LogLevelMax setting in unit files now applies not only to log messages generated by the service but also to messages from process PID 1 that mention the service.
• The ability to include SBAT (UEFI Secure Boot Advanced Targeting) data in systemd-boot EFI PE files has been provided.
• New options 'headless' and 'password-echo' have been implemented in /etc/crypttab — the former allows skipping all operations related to interactive password and PIN prompts for the user, while the latter allows configuring the method of password input display (show nothing, show character by character, or display asterisks). An option '--echo' has been added to systemd-ask-password for similar purposes.
• Support for unlocking LUKS2 encrypted partitions using FIDO2 tokens has been expanded in systemd-cryptenroll, systemd-cryptsetup, and systemd-homed. New options '--fido2-with-user-presence', '--fido2-with-user-verification', and '--fido2-with-client-pin' have been added to manage user presence verification, authentication, and the need to enter a PIN.
• In systemd-journal-gatewayd, options '--user', '--system', '--merge', and '--file' have been added, similar to those in journalctl.
• In addition to direct dependencies between units specified through the OnFailure and Slice parameters, support for implicit reverse dependencies OnFailureOf and SliceOf has been added, which can be useful, for example, for identifying all units included in a slice.
• New types of dependencies between units have been added: OnSuccess and OnSuccessOf (opposite of OnFailure, triggered upon successful completion); PropagatesStopTo and StopPropagatedFrom (allowing the stopping event of one unit to propagate to another unit); Upholds and UpheldBy (an alternative to Restart).
• The systemd-ask-password utility now has the ‘—emoji’ option to control the appearance of the lock symbol (🔐) in the password input line.
• Documentation for the structure of systemd source trees has been added.
• For units, a MemoryAvailable property has been added, indicating how much memory remains available to the unit before reaching the limit set by the MemoryMax, MemoryHigh, or MemoryAvailable parameters.

Source: opennet.ru