mirror of
https://github.com/systemd/systemd
synced 2024-09-06 16:56:43 +00:00
Update NEWS
This commit is contained in:
parent
448a21abbd
commit
f456764cda
284
NEWS
284
NEWS
|
@ -42,6 +42,175 @@ CHANGES WITH 255 in spe:
|
||||||
addressing to be disabled, too. Previously DHCP was turned off, but
|
addressing to be disabled, too. Previously DHCP was turned off, but
|
||||||
IPv6RA and IPv6 link-local addressing was left enabled.
|
IPv6RA and IPv6 link-local addressing was left enabled.
|
||||||
|
|
||||||
|
* The NAMING_BRIDGE_MULTIFUNCTION_SLOT naming scheme has been deprecated
|
||||||
|
and is now disabled.
|
||||||
|
|
||||||
|
Service Manager:
|
||||||
|
|
||||||
|
* The way services are spawned has been overhauled. Previously, a process
|
||||||
|
was forked that shared all of the manager's memory (via copy-on-write)
|
||||||
|
while doing all the required set ups (e.g.: mount namespaces, CGroup
|
||||||
|
configuration, etc.) before exec'ing the target executable. This was
|
||||||
|
problematic for various reasons: several glibc APIs were called that
|
||||||
|
are not supposed to be used after a fork but before an exec, copy-on-write
|
||||||
|
meant that if either process (the manager or the child) touched a memory
|
||||||
|
page a copy was triggered, and also the memory footprint of the child
|
||||||
|
process was that of the manager but with the memory limits of the service.
|
||||||
|
From this version onward, the new process is spawned using CLONE_VM and
|
||||||
|
CLONE_VFORK semantics via posix_spawn, and it immediately execs a new
|
||||||
|
internal binary, systemd-executor, that receives the configuration to
|
||||||
|
apply via memfd, and sets up the process before exec'ing the target
|
||||||
|
executable.
|
||||||
|
|
||||||
|
* Internal process tracking is being changed to use PIDFDs instead of PIDs
|
||||||
|
when the kernel supports it, to improve robustness and reliability.
|
||||||
|
|
||||||
|
* A new option SurviveFinalKillSignal= is now supported to configure a
|
||||||
|
unit to skip units on the final sigterm/sigkill spree on shutdown. This
|
||||||
|
is part of the required configuration to let a unit's processes survive
|
||||||
|
a soft-reboot operation without being interrupted.
|
||||||
|
|
||||||
|
* Sysext images can now set EXTENSION_RELOAD_MANAGER=1 in their
|
||||||
|
extension-release files to automatically daemon-reload when
|
||||||
|
merging/refreshing/unmerging on boot. This should be used only in
|
||||||
|
exceptional circumstances, as it can cause very difficult to debug
|
||||||
|
race conditions and lockups.
|
||||||
|
|
||||||
|
* The ExtensionImages= and ExtensionDirectories= options now support
|
||||||
|
confexts images/directories.
|
||||||
|
|
||||||
|
* A new option NFTSet= provides a method for integrating dynamic cgroup IDs
|
||||||
|
into firewall rules with NFT sets. The benefit of using this setting is to be
|
||||||
|
able to use control group as a selector in firewall rules easily and this in
|
||||||
|
turn allows more fine grained filtering. Also, NFT rules for cgroup matching
|
||||||
|
use numeric cgroup IDs, which change every time a service is restarted, making
|
||||||
|
them hard to use in systemd environment.
|
||||||
|
|
||||||
|
* A new option CoredumpReceive= can be set, together with Delegate=yes, to
|
||||||
|
make systemd-coredump on the host forward core files from processes crashed
|
||||||
|
inside the delegated CGroup subtree to systemd-coredump running in the
|
||||||
|
container.
|
||||||
|
|
||||||
|
* A new ConditionSecurity=measured-uki option is now available, to ensure
|
||||||
|
a unit can only run when the system has been booted from a measured UKI.
|
||||||
|
|
||||||
|
* MemoryAvailable= now considers physical memory if there are no CGroup
|
||||||
|
memory limits set anywhere in the tree.
|
||||||
|
|
||||||
|
* The $USER environment variable is now always set for services, while
|
||||||
|
previously it was only set if User= was specified. A new option
|
||||||
|
SetLoginEnvironment= is now supported to determine whether to also set
|
||||||
|
$HOME, $LOGNAME and $SHELL.
|
||||||
|
|
||||||
|
* Socket units now support a new PollLimit= option to configure a limit on
|
||||||
|
how often polling events on the file descriptors backing this unit will
|
||||||
|
be considered.
|
||||||
|
|
||||||
|
* Scope units can now be created passing PIDFDs instead of PIDs to select
|
||||||
|
the processes they should include.
|
||||||
|
|
||||||
|
* Sending sigrtmin+18 with 0x500 as value will now cause the manager to
|
||||||
|
dump the list of currently pending jobs.
|
||||||
|
|
||||||
|
* If the kernel supports MOVE_MOUNT_BENEATH, the systemctl and machinectl
|
||||||
|
bind and mount-image verbs will now cause the new mount to to replace
|
||||||
|
the old mount (if any), instead of overmounting it.
|
||||||
|
|
||||||
|
TPM2 Support + Disk Encryption & Authentication:
|
||||||
|
|
||||||
|
* systemd-cryptenroll now allows specifying a PCR bank and hash digest in
|
||||||
|
the --tpm2-pcrs= option.
|
||||||
|
|
||||||
|
* systemd-cryptenroll now allows specifying a TPM2 key handle to be used
|
||||||
|
instead of the default SRK via the new --tpm2-seal-key-handle= option.
|
||||||
|
|
||||||
|
* systemd-cryptsetup is now installed in /usr/bin/ and is no longer an
|
||||||
|
internal-only executable.
|
||||||
|
|
||||||
|
* The TPM2 Storage Root Key will now be set up, if not already present,
|
||||||
|
by a new systemd-tpm2-setup.service early boot service.
|
||||||
|
|
||||||
|
* The internal systemd-pcrphase executable has been renamed to systemd-pcrextend.
|
||||||
|
|
||||||
|
* systemd-pcrextend now exposes a varlink interface at io.systemd.PCRExtend
|
||||||
|
that can be used to do measurements and event logging on demand.
|
||||||
|
|
||||||
|
* TPM measurements are now also written to an event log at
|
||||||
|
/run/log/systemd/tpm2-measure.log, using the TCG Canonical Event Log
|
||||||
|
format, together with the existing journald entries.
|
||||||
|
|
||||||
|
systemd-boot, systemd-stub, ukify, bootctl, kernel-install:
|
||||||
|
|
||||||
|
* The 90-loaderentry kernel-install hook now supports installing device
|
||||||
|
trees.
|
||||||
|
|
||||||
|
* ukify is no longer considered experimental, and now ships in /usr/bin/.
|
||||||
|
|
||||||
|
* ukify gained a new verb, inspect, that describes the sections of a UKI
|
||||||
|
and print the content of the well-known sections.
|
||||||
|
|
||||||
|
* bootctl will now show whether the system was booted from a UKI in its
|
||||||
|
status output.
|
||||||
|
|
||||||
|
* systemd-boot and systemd-stub now use different project keys in their
|
||||||
|
respective SBAT sections, so that they can be revoked individually if
|
||||||
|
needed.
|
||||||
|
|
||||||
|
* systemd-boot will no longer load unverified Devicetree blobs when UEFI
|
||||||
|
SecureBoot is enabled. For more details see:
|
||||||
|
https://github.com/systemd/systemd/security/advisories/GHSA-6m6p-rjcq-334c
|
||||||
|
|
||||||
|
* systemd-boot gained new hotkeys to reboot and power off the system from
|
||||||
|
the boot menu.
|
||||||
|
|
||||||
|
* systemd-boot will now show auto-generated reboot and poweroff entries in
|
||||||
|
the boot menu.
|
||||||
|
|
||||||
|
* systemd-boot gained a new configuration value menu-disabled for the
|
||||||
|
set-timeout option, to allow completely disabling the boot menu,
|
||||||
|
including the hotkey.
|
||||||
|
|
||||||
|
* systemd-boot will now measure the contente of loader.conf in PCR5.
|
||||||
|
|
||||||
|
* systemd-stub will now concatenate the content of all kernel command-line
|
||||||
|
addons before measuring them in PCR12, in a single measurement, instead
|
||||||
|
of measuring them individually.
|
||||||
|
|
||||||
|
* systemd-stub will now measure and load Devicetree Blob addons, which are
|
||||||
|
searched and loaded following the same model as the existing kernel
|
||||||
|
command-line addons.
|
||||||
|
|
||||||
|
* systemd-stub will now ignore unauthenticated kernel command line options
|
||||||
|
passed from systemd-boot when running inside Confidential VMs with UEFI
|
||||||
|
SecureBoot enabled.
|
||||||
|
|
||||||
|
systemd-repart:
|
||||||
|
|
||||||
|
* A new option --copy-from that synthesizes partition definitions from
|
||||||
|
the given image, wich are then applied to the systemd-repart algorithm,
|
||||||
|
has been added.
|
||||||
|
|
||||||
|
* A new option --copy-source has been added, which can be used to specify
|
||||||
|
a directory to which CopyFiles= is considered relative to.
|
||||||
|
|
||||||
|
* New --make-ddi=confext, --make-ddi=sysext and --make-ddi=portable options
|
||||||
|
have been added to make it easier to generate these types of DDIs,
|
||||||
|
without having to provide repart.d definitions for them.
|
||||||
|
|
||||||
|
* The dm-verity salt and UUID will now be derived from the specified seed.
|
||||||
|
|
||||||
|
* New VerityDataBlockSizeBytes= and VerityHashBlockSizeBytes= can now be
|
||||||
|
configured in repart.d configuration files.
|
||||||
|
|
||||||
|
* A new Subvolumes= setting is now supported in repart.d configuration
|
||||||
|
files, to indicate which directories in the target partition should be
|
||||||
|
btrfs subvolumes.
|
||||||
|
|
||||||
|
Journal:
|
||||||
|
|
||||||
|
* The journalctl --lines parameter now accepts +N to show the oldest N
|
||||||
|
entries instead of the newest.
|
||||||
|
|
||||||
Device Management:
|
Device Management:
|
||||||
|
|
||||||
* udev will now create symlinks to loopback block devices in the
|
* udev will now create symlinks to loopback block devices in the
|
||||||
|
@ -59,6 +228,10 @@ CHANGES WITH 255 in spe:
|
||||||
attaching a file to a loopback device will implicitly make a handle
|
attaching a file to a loopback device will implicitly make a handle
|
||||||
available to be found via that file's inode information.
|
available to be found via that file's inode information.
|
||||||
|
|
||||||
|
* udevadm info gained support for JSON output via a new --json flag, and
|
||||||
|
for filtering output using the same mechanism that udevadm trigger
|
||||||
|
already implements.
|
||||||
|
|
||||||
Network Management:
|
Network Management:
|
||||||
|
|
||||||
* The "duid-only" option for DHCPv4 client's ClientIdentifier= setting
|
* The "duid-only" option for DHCPv4 client's ClientIdentifier= setting
|
||||||
|
@ -83,16 +256,127 @@ CHANGES WITH 255 in spe:
|
||||||
simplified 2-message exchange instead of the typical 4-message
|
simplified 2-message exchange instead of the typical 4-message
|
||||||
exchange if also supported by the DHCP server.
|
exchange if also supported by the DHCP server.
|
||||||
|
|
||||||
|
* The DHCPv4 client gained new InitialCongestionWindow= and
|
||||||
|
InitialAdvertisedReceiveWindow= options for Route configurations.
|
||||||
|
|
||||||
|
* The DHCPv4 client gained a new RequestAddress= option that allows
|
||||||
|
to send a preferred IP address in the initial DHCPDISCOVER message.
|
||||||
|
|
||||||
* The SendHostname and Hostname options are now available for the
|
* The SendHostname and Hostname options are now available for the
|
||||||
DHCPv6 client, independent of the DHCPv4 option, so that these
|
DHCPv6 client, independent of the DHCPv4 option, so that these
|
||||||
configuration values can be set independently for each client.
|
configuration values can be set independently for each client.
|
||||||
|
|
||||||
|
* The DHCPv4 and DHCPv6 client state can now be queried via D-Bus,
|
||||||
|
including lease information.
|
||||||
|
|
||||||
|
* The DHCPv6 client can now be configured to use a custom DUIDType.
|
||||||
|
|
||||||
|
* The DHCPv6 server can now be configured to use a custom hot limit
|
||||||
|
via HopLimit=.
|
||||||
|
|
||||||
|
* HopLimit= can now be used to configure a per-route hop limit.
|
||||||
|
|
||||||
|
* TCPRetransmissionTimeOutSec= can now be used to configured a per-route
|
||||||
|
TCP retransmission timeout.
|
||||||
|
|
||||||
|
* A new directive `NFTSet=` provides a method for integrating network
|
||||||
|
configuration into firewall rules with NFT sets. The benefit of using
|
||||||
|
this setting is that static network configuration or dynamically
|
||||||
|
obtained network addresses can be used in firewall rules with the
|
||||||
|
indirection of NFT set types.
|
||||||
|
|
||||||
|
* A new [IPv6PREF64Prefix] set of options, containing Prefix= and
|
||||||
|
LifetimeSec=, has been introduced to enable support for pref64 (RFC8781).
|
||||||
|
|
||||||
|
* The [IPv6AcceptRA] section supports the following new options:
|
||||||
|
UsePREF64=, UseHopLimit=, UseICMP6RateLimit= and NFTSet=.
|
||||||
|
|
||||||
|
* The [IPv6SendRA] section supports the following new options:
|
||||||
|
RetransmitSec=, HopLimit=, HomeAgent=, HomeAgentLifetimeSec= and
|
||||||
|
HomeAgentPreference=.
|
||||||
|
|
||||||
|
* The network generator now configures the interfaces with only
|
||||||
|
link-local addressing if ip=link-local is specified on the kernel
|
||||||
|
command line.
|
||||||
|
|
||||||
Changes in systemd-analyze:
|
Changes in systemd-analyze:
|
||||||
|
|
||||||
* "systemd-analyze plot" has gained tooltips on each unit name with
|
* "systemd-analyze plot" has gained tooltips on each unit name with
|
||||||
related-unit information in its svg output, such as Before=,
|
related-unit information in its svg output, such as Before=,
|
||||||
Requires=, and similar properties.
|
Requires=, and similar properties.
|
||||||
|
|
||||||
|
Other:
|
||||||
|
|
||||||
|
* A new varlinkctl tool has been added to allow interfacing with
|
||||||
|
Varlink services, and introspection has been added to all such
|
||||||
|
services.
|
||||||
|
|
||||||
|
* systemctl is-failed now checks the system state if no unit is
|
||||||
|
specified.
|
||||||
|
|
||||||
|
* systemctl will now automatically soft-reboot if a new root file
|
||||||
|
system has been setup in /run/nextroot/ when a reboot operation
|
||||||
|
is invoked.
|
||||||
|
|
||||||
|
* systemd-sysext and systemd-confext now expose a varlink service
|
||||||
|
at io.systemd.sysext.
|
||||||
|
|
||||||
|
* wall messsages now work even when utmp support is disabled, using
|
||||||
|
systemd-logind to query the necessary information.
|
||||||
|
|
||||||
|
* systemd-logind now sends a new PrepareForShutdownWithMetadata D-Bus
|
||||||
|
signal before shutdown/reboot/soft-reboot, that includes additional
|
||||||
|
information with respect to what PrepareForShutdown has. Currently
|
||||||
|
the additional information is the type of operation that is about to
|
||||||
|
be executed.
|
||||||
|
|
||||||
|
* systemd-sysupdate now accepts directories in the MatchPattern= option.
|
||||||
|
|
||||||
|
* systemd-coredump running on the host now supports forwarding core
|
||||||
|
files to systemd-coredump running in the container where the crash
|
||||||
|
has happened, if both sides are configured to do so.
|
||||||
|
|
||||||
|
* systemd-run will now output the invocation ID of the launched
|
||||||
|
transient unit.
|
||||||
|
|
||||||
|
* systemd-analyze, systemd-tmpfiles, systemd-sysusers, systemd-sysctl,
|
||||||
|
and systemd-binfmt gained a new --tldr option that can be used in
|
||||||
|
combination with --cat-config to suppress uninteresting configuration
|
||||||
|
lines, such as comments.
|
||||||
|
|
||||||
|
* systemd-resolved gained a new DumpStatistics varlink method, and
|
||||||
|
resolvectl gained a new corresponding show-server-state verb that
|
||||||
|
calls it.
|
||||||
|
|
||||||
|
* systemd-timesyncd will now emit a D-Bus signal when the LinkNTPServers
|
||||||
|
property changes.
|
||||||
|
|
||||||
|
* vconsole now supports KEYMAP=@kernel for preserving the kernel keymap
|
||||||
|
as-is.
|
||||||
|
|
||||||
|
* The kernel and OS versions will no longer be checked on resume from
|
||||||
|
hibernation.
|
||||||
|
|
||||||
|
* seccomp now supports the LoongArch64 architecture.
|
||||||
|
|
||||||
|
* systemd-id128 now supports a new -P option to show only values, and
|
||||||
|
combining --app with the show verb.
|
||||||
|
|
||||||
|
* A new pam_systemd_loadkey.so PAM module is now available, which
|
||||||
|
allows automatically fetching the passphrase used by cryptsetup to
|
||||||
|
unlock the root file system and setting it as the PAM authtok. This
|
||||||
|
enables, among other things, configuring auto-unlock of the GNOME
|
||||||
|
Keyring / KDE Wallet when autologin is configured.
|
||||||
|
|
||||||
|
* Many meson options now use the 'feature' type, which means they
|
||||||
|
take enabled/disabled/auto as values.
|
||||||
|
|
||||||
|
* A new meson option configfiledir can be used to change where
|
||||||
|
configuration files with default values are installed to.
|
||||||
|
|
||||||
|
* Options and verbs in manpages are now tagged with the version they
|
||||||
|
were first introduced in.
|
||||||
|
|
||||||
CHANGES WITH 254:
|
CHANGES WITH 254:
|
||||||
|
|
||||||
Announcements of Future Feature Removals and Incompatible Changes:
|
Announcements of Future Feature Removals and Incompatible Changes:
|
||||||
|
|
Loading…
Reference in a new issue