Release of system manager systemd 250

After five months of development, the release of system manager systemd 250 is presented. The new release includes the ability to store credentials in an encrypted form, automatic verification of automatically detected GPT partitions using digital signatures, improved notifications about reasons for service startup delays, options for restricting service access to specific file systems and network interfaces, support for integrity checking of partitions using the dm-integrity module, and support for automatic updates of sd-boot.

Key Changes:

• Support for encrypted and authenticated credentials has been added, which can be useful for securely storing confidential materials such as SSL-access keys and passwords. Credential decryption occurs only when necessary and is tied to the local installation or hardware. Data is automatically encrypted using symmetric encryption algorithms, with keys that can be stored in the file system, in a TPM2 chip, or using a combination scheme. When the service starts, credentials are automatically decrypted and made available to the service in plain form. A utility called 'systemd-creds' has been added for working with encrypted credentials, and settings LoadCredentialEncrypted and SetCredentialEncrypted are provided for services.
• Support for loading the kernel using the LINUX_EFI_INITRD_MEDIA_GUID EFI protocol has been added to sd-stub, an executable file for EFI that allows the EFI firmware to load the Linux kernel. Additionally, sd-stub now supports packaging credentials and sysext files into a cpio archive and passing this archive to the kernel along with the initrd (additional files are placed in the /.extra/ directory). This capability allows for a verifiable immutable initrd environment, supplemented by sysexts and encrypted data for authentication.
• The specification for Discoverable Partitions has been significantly expanded, providing means to identify, mount, and activate system partitions using GPT (GUID Partition Tables). Compared to previous releases, support for the root partition and the /usr partition has been implemented for most architectures, including platforms that do not use UEFI.

  Discoverable Partitions also now supports partitions whose integrity is verified by the dm-verity module using PKCS#7 digital signatures, simplifying the creation of fully authenticated disk images. Verification support is integrated into various utilities that manipulate disk images, including systemd-nspawn, systemd-sysext, systemd-dissect, RootImage services, systemd-tmpfiles, and systemd-sysusers.
• For long-running or stopped units, in addition to displaying an animated progress indicator, the option to output status information has been provided, allowing an understanding of what is happening with a service at the moment and which service's execution the system manager is currently waiting to complete.
• A DefaultOOMScoreAdjust parameter has been added to /etc/systemd/system.conf and /etc/systemd/user.conf, allowing adjustment of the OOM-killer trigger threshold during memory shortages, applicable to processes started by systemd for both the system and users. By default, system services have a higher weight than user services, meaning that under low memory conditions, the likelihood of user services being terminated is higher than that of system services.
• A RestrictFileSystems setting has been added to limit service access to certain types of file systems. You can use the command 'systemd-analyze filesystems' to view available FS types. Similarly, a RestrictNetworkInterfaces option has been implemented to restrict access to certain network interfaces. The implementation is based on a BPF LSM module that limits a group of processes' access to kernel objects.
• A new configuration file /etc/integritytab and the systemd-integritysetup utility have been added, configuring the dm-integrity module for data integrity monitoring at the individual sector level, for example, to ensure the immutability of encrypted data (Authenticated Encryption, ensuring that a block of data has not been modified in a roundabout way). The format of the /etc/integritytab file is similar to the /etc/crypttab and /etc/veritytab files, except that dm-integrity is used instead of dm-crypt and dm-verity.
• A new unit file systemd-boot-update.service has been added, which, when activated and with the sd-boot bootloader installed, will automatically update the version of the sd-boot bootloader, keeping the bootloader code always up to date. The sd-boot itself is now built with support for the SBAT mechanism (UEFI Secure Boot Advanced Targeting) by default, addressing certificate revocation issues for UEFI Secure Boot. In addition, sd-boot now supports parsing boot settings for Microsoft Windows to correctly form the names of boot partitions with Windows and displays the version of Windows.

  In sd-boot, there is now support for defining the color scheme at build time. Support for changing the screen resolution by pressing the 'r' key has been added during the boot process. A hotkey 'f' has been added to access the firmware settings interface. An automatic boot mode corresponding to the menu item selected at the last boot has been added. There is now the possibility of automatically loading EFI drivers located in the /EFI/systemd/drivers/ directory in the ESP (EFI System Partition).

• A new unit file factory-reset.target has been included, processed in systemd-logind similarly to reboot, poweroff, suspend, and hibernate operations, and used to create handlers for performing factory resets.
• The systemd-resolved process now creates an additional listening socket at address 127.0.0.54 in addition to 127.0.0.53. Incoming requests to address 127.0.0.54 are always redirected to the upstream DNS server and are not handled locally.
• Support for building systemd-importd and systemd-resolved with the OpenSSL library instead of libgcrypt has been provided.
• Initial support for the LoongArch architecture, used in Loongson processors, has been added.
• The systemd-gpt-auto-generator has implemented the ability to automatically configure the swap partitions defined by the system, encrypted by the LUKS2 subsystem.
• The code for parsing GPT images, used in systemd-nspawn, systemd-dissect, and similar utilities, now includes the ability to decode images for other architectures, allowing systemd-nspawn to run images in emulators of different architectures.
• When inspecting disk images in systemd-dissect, information about the partition's purpose is now displayed, such as its bootability via UEFI or its use in a container.
• A field called 'SYSEXT_SCOPE' has been added to the system-extension.d/ files, allowing the specification of the system image scope: 'initrd', 'system', or 'portable'.
• A field named 'PORTABLE_PREFIXES' has been added to the os-release file, which can be used in portable images to determine the supported prefixes for unit files.
• New settings for HandlePowerKeyLongPress, HandleRebootKeyLongPress, HandleSuspendKeyLongPress, and HandleHibernateKeyLongPress have been implemented in systemd-logind, which can be used to determine actions when certain keys are held for longer than 5 seconds (for example, quickly pressing the Suspend key can be configured to enter sleep mode, while holding it can trigger deep sleep).
• For units, settings StartupAllowedCPUs and StartupAllowedMemoryNodes have been implemented, which differ from similar settings without the Startup prefix in that they apply only during the boot and shutdown phases, allowing different resource constraints at startup.
• Checks for [Condition|Assert][Memory|CPU|IO]Pressure have been added, allowing the activation of a unit to be skipped or fail with an error if high memory, CPU, or I/O pressure is detected through the PSI mechanism.
• The default limit on the maximum number of inodes has been increased for the /dev partition from 64k to 1M, and for /tmp from 400k to 1M.
• A configuration option called ExecSearchPath has been proposed for services, allowing the path for searching executable files to be modified as defined in settings similar to ExecStart.
• The RuntimeRandomizedExtraSec setting has been added, allowing for random deviations to be introduced into the RuntimeMaxSec timeout that limits the execution time of a unit.
• The syntax for the RuntimeDirectory, StateDirectory, CacheDirectory, and LogsDirectory settings has been expanded, allowing for the creation of a symbolic link to a specified directory by specifying an additional colon-separated value to enable access through multiple paths.
• Configuration options TTYRows and TTYColumns are provided for setting the number of rows and columns in the TTY device.
• The ExitType setting has been added, allowing for changes to the service termination detection logic. By default, systemd tracks the termination of only the main process, but if ExitType=cgroup is set, the system manager will wait for the last process in the cgroup to terminate.
• Support for TPM2/FIDO2/PKCS11 in systemd-cryptsetup is now also built as a plugin for cryptsetup, allowing the use of the standard cryptsetup command to unlock an encrypted partition.
• The TPM2 handler in systemd-cryptsetup has added support for primary RSA keys, in addition to ECC keys, to improve compatibility with chips that do not support ECC.
• The token-timeout option has been added to /etc/crypttab, allowing the maximum wait time for connecting a PKCS#11/FIDO2 token to be defined, after which a password or recovery key prompt will be displayed.
• The SaveIntervalSec setting has been implemented in systemd-timesyncd, allowing the current system time to be periodically saved to disk, such as for implementing monotonic clocks on systems without an RTC.
• The systemd-analyze utility has added options: ‘—image’ and ‘—root’ for checking unit files within a specified image or root directory, ‘—recursive-errors’ for considering dependent units when detecting errors, ‘—offline’ for checking unit files saved on disk separately, ‘—json’ for JSON output, ‘—quiet’ to disable non-critical messages, and ‘—profile’ for binding to a portable profile. The inspect-elf command has also been added for analyzing core files in ELF format and allows for checking unit files with a specified unit name, regardless of whether this name matches the filename.
• Support for the CAN (Controller Area Network) bus has been expanded in systemd-networkd. Settings have been added to manage CAN modes: Loopback, OneShot, PresumeAck, and ClassicDataLengthCode. The [CAN] section of .network files has added options TimeQuantaNSec, PropagationSegment, PhaseBufferSegment1, PhaseBufferSegment2, SyncJumpWidth, DataTimeQuantaNSec, DataPropagationSegment, DataPhaseBufferSegment1, DataPhaseBufferSegment2, and DataSyncJumpWidth to manage bit synchronization on the CAN interface.
• In systemd-networkd, a Label option has been added for the DHCPv4 client, allowing the configuration of address labels applied when configuring IPv4 addresses.
• In systemd-udevd, support for special values 'max' has been implemented in 'ethtool' to set the buffer size to the maximum value supported by the hardware.
• In .link files for systemd-udevd, it is now possible to configure various parameters for network adapter bonding and hardware offload handlers.
• In systemd-networkd, new .network files are provided by default: 80-container-vb.network for defining network bridges created when starting systemd-nspawn with the options '--network-bridge' or '--network-zone'; 80-6rd-tunnel.network for defining tunnels automatically created upon receiving a DHCP response with the 6RD option.
• Support for IP tunneling over InfiniBand interfaces has been added in systemd-networkd and systemd-udevd, for which the 'IPoIB' section has been added to systemd.netdev files, and the handling of the 'ipoib' value has been implemented in the Kind configuration.
• Automatic route configuration for addresses specified in the AllowedIPs parameter has been implemented in systemd-networkd, which can be configured through the RouteTable and RouteMetric parameters in the [WireGuard] and [WireGuardPeer] sections.
• Automatic generation of stable MAC addresses for batadv and bridge interfaces has been ensured in systemd-networkd. To disable this behavior, one can specify the value MACAddress=none in .netdev files.
• The configuration WakeOnLanPassword has been added to the '[Link]' section in .link files to define the password for working with WoL in 'SecureOn' mode.
• In the '[CAKE]' section of .network files, new options AutoRateIngress, CompensationMode, FlowIsolationMode, NAT, MPUBytes, PriorityQueueingPreset, FirewallMark, Wash, SplitGSO, and UseRawPacketSize have been added to define the parameters for the CAKE (Common Applications Kept Enhanced) queuing management mechanism.
• The IgnoreCarrierLoss setting has been added to the '[Network]' section of .network files, which allows determining how long to wait before reacting to a loss of carrier signal.
• In systemd-nspawn, homectl, machinectl, and systemd-run, the syntax of the '--setenv' parameter has been expanded — if only the variable name is specified (without '='), the value will be taken from the corresponding environment variable (for example, specifying '--setenv=FOO' will take the value from the $FOO environment variable and use it in the corresponding environment variable within the container).
• The option "--suppress-sync" has been added to systemd-nspawn to disable the execution of the sync()/fsync()/fdatasync() system calls when creating a container (useful when speed is a priority and preserving build artifacts in case of failure is not important, as they can be recreated at any time).
• A new hwdb database has been added, which includes various types of signal analyzers (multimeters, protocol analyzers, oscilloscopes, etc.). Information about cameras in hwdb has been expanded with a field for camera type (regular or infrared) and lens position (front or rear).
• Generation of stable network interface names for netfront devices used in Xen has been ensured.
• Core file analysis by the systemd-coredump utility based on libdw/libelf libraries is now performed in a separate process isolated in a sandbox environment.
• Support for environment variables $SYSTEMD_IMPORT_BTRFS_SUBVOL, $SYSTEMD_IMPORT_BTRFS_QUOTA, and $SYSTEMD_IMPORT_SYNC has been added to systemd-importd, which can be used to disable the generation of Btrfs subvolumes and configure quotas and disk synchronization.
• In systemd-journald, on filesystems that support copy-on-write mode, re-enabling the COW mode for archived logs has been implemented, allowing them to be compressed by Btrfs.
• Deduplication of identical fields in a single message has been implemented in systemd-journald, occurring before the message is placed in the journal.
• The shutdown command has been enhanced with the "--show" option to display the scheduled shutdown.

Source: opennet.ru