systemd System and Service Manager

CHANGES WITH 251:

Backwards-incompatible changes:

* The minimum kernel version required has been bumped from 3.13 to 3.15,

and CLOCK_BOOTTIME is now assumed to always exist.

* In v250, a systemd-networkd feature that automatically configures

routes to addresses specified in AllowedIPs= was added and enabled by

default. However, this causes network connectivity issues in many

existing setups. Hence, it has been disabled by default since

systemd-stable 250.3. The feature can still be used by explicitly

configuring RouteTable= setting in .netdev files.

* Jobs started via StartUnitWithFlags() will no longer return 'skipped'

when a Condition*= check does not succeed, restoring the JobRemoved

signal to the behaviour it had before v250.

* The org.freedesktop.portable1 methods GetMetadataWithExtensions() and

GetImageMetadataWithExtensions() have been fixed to provide an extra

return parameter, containing the actual extension release metadata.

The current implementation was judged to be broken and unusable, and

thus the usual procedure of adding a new set of methods was skipped,

and backward compatibility broken instead on the assumption that

nobody can be affected given the current state of this interface.

* All kernels supported by systemd mix RDRAND (or similar) into the

entropy pool at early boot. This means that on those systems, even if

/dev/urandom is not yet initialized, it still returns bytes that that

are at least as high quality as RDRAND. For that reason, we no longer

have reason to invoke RDRAND from systemd itself, which has

historically been a source of bugs. Furthermore, kernels ≥5.6 provide

the getrandom(GRND_INSECURE) interface for returning random bytes

before the entropy pool is initialized without warning into kmsg,

which is what we attempt to use if available. systemd's direct usage

of RDRAND has been removed. x86 systems ≥Broadwell that are running

an older kernel may experience kmsg warnings that were not seen with

250. For newer kernels, non-x86 systems, or older x86 systems, there

should be no visible changes.

* sd-boot will now measure the kernel command line into TPM PCR 12

rather than PCR 8. This improves usefulness of the measurements on

systems where sd-boot is chainloaded from Grub. Grub measures all

commands its executes into PCR 8, which makes it very hard to use

reasonably, hence separate ourselves from that and use PCR 12

instead, which is what certain Ubuntu editions already do. To retain

compatibility with systems running older systemd systems a new meson

option 'efi-tpm-pcr-compat' has been added (which defaults to false).

If enabled, the measurement is done twice: into the new-style PCR 12

*and* the old-style PCR 8. It's strongly advised to migrate all users

to PCR 12 for this purpose in the long run, as we intend to remove

this compatibility feature in two year's time.

* busctl capture now writes output in the newer pcapng format instead

of pcap.

* An udev rule that imported hwdb matches for USB devices with

lowercase hexadecimal vendor/product ID digits was added in systemd

250. This has been reverted, since uppercase hexadecimal digits are

supposed to be used, and we already had a rule that with the

appropriate match.

Users might need to adjust their local hwdb entries.

* arch_prctl(2) has been moved to the @default set in the syscall filters

(as exposed via the SystemCallFilter= setting in service unit files).

It is apparently used by the linker now.

Changes in the Boot Loader Specification, kernel-install and sd-boot:

* kernel-install's and bootctl's Boot Loader Specification Type #1

entry generation logic has been reworked. The user may now pick

explicitly by which "token" string to name the installation's boot

entries, via the new /etc/kernel/entry-token file or the new

--entry-token= switch to bootctl. By default — as before — the

entries are named after the local machine ID. However, in "golden

image" environments, where the machine ID shall be initialized on

first boot (as opposed to at installation time before first boot) the

machine ID will not be available at build time. In this case the

--entry-token= switch to bootctl (or the /etc/kernel/entry-token

file) may be used to override the "token" for the entries, for

example the IMAGE_ID= or ID= fields from /etc/os-release. This will

make the OS images independent of any machine ID, and ensure that the

images will not carry any identifiable information before first boot,

but on the other hand means that multiple parallel installations of

the very same image on the same disk cannot be supported.

Summary: if you are building golden images that shall acquire

identity information exclusively on first boot, make sure to both

remove /etc/machine-id *and* to write /etc/kernel/entry-token to the

value of the IMAGE_ID= or ID= field of /etc/os-release or another

suitable identifier before deploying the image.

* The Boot Loader Specification has been extended with

/loader/entries.srel file located in the EFI System Partition (ESP)

that disambiguates the format of the entries in the /loader/entries/

directory (in order to discern them from incompatible uses of this

directory by other projects). For entries that follow the

Specification, the string "type1" is stored in this file.

bootctl will now write this file automatically when installing the

systemd-boot boot loader.

* kernel-install supports a new initrd_generator= setting in

/etc/kernel/install.conf, that is exported as

$KERNEL_INSTALL_INITRD_GENERATOR to kernel-install plugins. This

allows choosing different initrd generators.

* kernel-install will now create a "staging area" (an initially-empty

directory to gather files for a Boot Loader Specification Type #1

entry). The path to this directory is exported as

$KERNEL_INSTALL_STAGING_AREA to kernel-install plugins, which should

drop files there instead of writing them directly to the final

location. kernel-install will move them when all files have been

prepared successfully.

* New option sort-key= has been added to the Boot Loader Specification

to override the sorting order of the entries in the boot menu. It is

read by sd-boot and bootctl, and will be written by kernel-install,

with the default value of IMAGE_ID= or ID= fields from

os-release. Together, this means that on multiboot installations,

entries should be grouped and sorted in a predictable way.

* The sort order of boot entries has been updated: entries which have

the new field sort-key= are sorted by it first, and all entries

without it are ordered later. After that, entries are sorted by

version so that newest entries are towards the beginning of the list.

* The kernel-install tool gained a new 'inspect' verb which shows the

paths and other settings used.

* sd-boot can now optionally beep when the menu is shown and menu

entries are selected, which can be useful on machines without a

working display. (Controllable via a loader.conf setting.)

* The --make-machine-id-directory= switch to bootctl has been replaced

by --make-entry-directory=, given that the entry directory is not

necessarily named after the machine ID, but after some other suitable

ID as selected via --entry-token= described above. The old name of

the option is still understood to maximize compatibility.

* 'bootctl list' gained support for a new --json= switch to output boot

menu entries in JSON format.

Changes in systemd-homed:

* Starting with v250 systemd-homed uses UID/GID mapping on the mounts

of activated home directories it manages (if the kernel and selected

file systems support it). So far it mapped three UID ranges: the

range from 0…60000, the user's own UID, and the range 60514…65534,

leaving everything else unmapped (in other words, the 16bit UID range

is mapped almost fully, with the exception of the UID subrange used

for systemd-homed users, with one exception: the user's own UID).

Unmapped UIDs may not be used for file ownership in the home

directory — any chown() attempts with them will fail. With this

release a fourth range is added to these mappings:

524288…1879048191. This range is the UID range intended for container

uses, see:

https://systemd.io/UIDS-GIDS

This range may be used for container managers that place container OS

trees in the home directory (which is a questionable approach, for

quota, permission, SUID handling and network file system

compatibility reasons, but nonetheless apparently commonplace). Note

that this mapping is mapped 1:1 in a pass-through fashion, i.e. the

UID assignments from the range are not managed or mapped by

`systemd-homed`, and must be managed with other mechanisms, in the

context of the local system.

Typically, a better approach to user namespacing in relevant

container managers would be to leave container OS trees on disk at

UID offset 0, but then map them to a dynamically allocated runtime

UID range via another UID mount map at container invocation

time. That way user namespace UID ranges become strictly a runtime

concept, and do not leak into persistent file systems, persistent

user databases or persistent configuration, thus greatly simplifying

handling, and improving compatibility with home directories intended

to be portable like the ones managed by systemd-homed.

Changes in shared libraries:

* A new libsystemd-core-<version>.so private shared library is

installed under /usr/lib/systemd/system, mirroring the existing

libsystemd-shared-<version>.so library. This allows the total

installation size to be reduced by binary code reuse.

* The <version> tag used in the name of libsystemd-shared.so and

libsystemd-core.so can be configured via the meson option

'shared-lib-tag'. Distributions may build subsequent versions of the

systemd package with unique tags (e.g. the full package version),

thus allowing multiple installations of those shared libraries to be

available at the same time. This is intended to fix an issue where

programs that link to those libraries would fail to execute because

they were installed earlier or later than the appropriate version of

the library.

* The sd-id128 API gained a new call sd_id128_to_uuid_string() that is

similar to sd_id128_to_string() but formats the ID in RFC 4122 UUID

format instead of simple series of hex characters.

Changes in PID1, systemctl, and systemd-oomd:

* A new set of service monitor environment variables will be passed to

OnFailure=/OnSuccess= handlers, but only if exactly one unit lists the

handler unit as OnFailure=/OnSuccess=. The variables are:

$MONITOR_SERVICE_RESULT, $MONITOR_EXIT_CODE, $MONITOR_EXIT_STATUS,

$MONITOR_INVOCATION_ID and $MONITOR_UNIT. For cases when a single

handler needs to watch multiple units, use a templated handler.

* A new ExtensionDirectories= setting in service unit files allows

system extensions to be loaded from a directory. (It is similar to

ExtensionImages=, but takes paths to directories, instead of

disk image files.)

'portablectl attach --extension=' now also accepts directory paths.

* The user.delegate and user.invocation_id extended attributes on

cgroups are used in addition to trusted.delegate and

trusted.invocation_id. The latter pair requires privileges to set,

but the former doesn't and can be also set by the unprivileged user

manager.

(Only supported on kernels ≥5.6.)

* Units that were killed by systemd-oomd will now have a service result

of 'oom-kill'. The number of times a service was killed is tallied

in the 'user.oomd_ooms' extended attribute.

The OOMPolicy= unit file setting is now also honoured by

systemd-oomd.

* In unit files the new %y/%Y specifiers can be used to refer to

normalized unit file path, which is particularly useful for symlinked

unit files.

The new %R specifier resolves to the pretty hostname

(i.e. PRETTY_HOSTNAME= from /etc/machine-info).

The new %d specifier resolves to the credentials directory of a

service (same as $CREDENTIALS_DIRECTORY).

* The RootDirectory=, MountAPIVFS=, ExtensionDirectories=,

*Capabilities*=, ProtectHome=, *Directory=, TemporaryFileSystem=,

PrivateTmp=, PrivateDevices=, PrivateNetwork=, NetworkNamespacePath=,

PrivateIPC=, IPCNamespacePath=, PrivateUsers=, ProtectClock=,

ProtectKernelTunables=, ProtectKernelModules=, ProtectKernelLogs=,

MountFlags= service settings now also work in unprivileged user

services, i.e. those run by the user's --user service manager, as long

as user namespaces are enabled on the system.

* Services with Restart=always and a failing ExecCondition= will no

longer be restarted, to bring ExecCondition= behaviour in line with

Condition*= settings.

* LoadCredential= now accepts a directory as the argument; all files

from the directory will be loaded as credentials.

* A new D-Bus property ControlGroupId is now exposed on service units,

that encapsulates the service's numeric cgroup ID that newer kernels

assign to each cgroup.

* PID 1 gained support for configuring the "pre-timeout" of watchdog

devices and the associated governor, via the new

RuntimeWatchdogPreSec= and RuntimeWatchdogPreGovernor= configuration

options in /etc/systemd/system.conf.

* systemctl's --timestamp= option gained a new choice "unix", to show

timestamp as unix times, i.e. seconds since 1970, Jan 1st.

* 'systemctl enable' and similar commands will now create relative

symlinks in .wants/ and .requires/ and for aliases. Most of the time

systemd itself doesn't care, but absolute symlinks were causing wrong

behaviour in case of aliases to linked unit files. The change was

necessary to fix this aspect. Absolute links are interpreted as

before, and it is still possible to create them via other means.

Changes in systemd-journald:

* The journal JSON export format has been added to listed of stable

interfaces (https://systemd.io/PORTABILITY_AND_STABILITY/).

* journalctl --list-boots now supports JSON output and the --reverse option.

* Under docs/: JOURNAL_EXPORT_FORMATS was imported from the wiki and

updated, BUILDING_IMAGES is new:

https://systemd.io/JOURNAL_EXPORT_FORMATS

https://systemd.io/BUILDING_IMAGES

Changes in udev:

* Two new hwdb files have been added. One lists "handhelds" (PDAs,

calculators, etc.), the other AV production devices (DJ tables,

keypads, etc.) that should accessible to the seat owner user by

default.

* udevadm trigger gained a new --prioritized-subsystem= option to

process certain subsystems (and all their parent devices) earlier.

systemd-udev-trigger.service now uses this new option to trigger

block and TPM devices first, hopefully making the boot a bit faster.

* udevadm trigger now implements --type=all, --initialized-match,

--initialized-nomatch to trigger both subsystems and devices, only

already-initialized devices, and only devices which haven't been

initialized yet, respectively.

* .link files gained support for setting MDI/MID-X on a link.

* .link files gained support for [Match] Firmware= setting to match on

the device firmware description string. By mistake, it was previously

only supported in .network files.

* .link files gained support for [Link] SR-IOVVirtualFunctions= setting

and [SR-IOV] section to configure SR-IOV virtual functions.

Changes in systemd-networkd:

* The default scope for unicast routes configured through [Route]

section is changed to "link", to make the behavior consistent with

"ip route" command. The manual configuration of [Route] Scope= is

still honored.

* A new unit systemd-networkd-wait-online@<interface>.service has been

added that can be used to wait for a specific network interface to be

up.

* systemd-networkd gained a new [Bridge] Isolated=true|false setting

that configures the eponymous kernel attribute on the bridge.

* .netdev files now can be used to create virtual WLAN devices, and

configure various settings on them, via the [WLAN] section.

* .link/.network files gained support for [Match] Kind= setting to match

on device kind ("bond", "bridge", "gre", "tun", "veth", etc.)

This value is also shown by 'networkctl status'.

* The Local= setting in .netdev files for various virtual network

devices gained support for specifying, in addition to the network

address, the name of a local interface which must have the specified

address.

* systemd-networkd gained a new [Tunnel] External= setting in .netdev

files, to configure tunnels in external mode (a.k.a. collect metadata

mode).

* [Network] L2TP= setting was removed. Please use interface specifier in

Local= setting in .netdev files of corresponding L2TP interface.

* New [DHCPServer] BootServerName=, BootServerAddress=, and

BootFilename= settings can be used to configure the server address,

server name, and file name sent in the DHCP packet (e.g. to configure

PXE boot).

Changes in systemd-resolved:

* systemd-resolved is started earlier (in sysinit.target), so it

available earlier and will also be started in the initrd if installed

there.

Changes in disk encryption:

* systemd-cryptenroll can now control whether to require the user to

enter a PIN when using TPM-based unlocking of a volume via the new

--tpm2-with-pin= option.

Option tpm2-pin= can be used in /etc/crypttab.

* When unlocking devices via TPM, TPM2 parameter encryption is now

used, to ensure that communication between CPU and discrete TPM chips

cannot be eavesdropped to acquire disk encryption keys.

Changes in systemd-hostnamed:

* HARDWARE_VENDOR= and HARDWARE_MODEL= can be set in /etc/machine-info

to override the values gleaned from the hwdb.

* A ID_CHASSIS property can be set in the hwdb (for the DMI device

/sys/class/dmi/id) to override the chassis that is reported by

hostnamed.

* hostnamed's D-Bus interface gained a new method GetHardwareSerial()

for reading the hardware serial number, as reportd by DMI.

Changes in other components:

* /etc/locale.conf is now populated through tmpfiles.d factory /etc/

handling with the values that were configured during systemd build

(if /etc/locale.conf has not been created through some other

mechanism). This means that /etc/locale.conf should always have

reasonable contents and we avoid a potential mismatch in defaults.

* The userdbctl tool will now show UID range information as part of the

list of known users.

* A new build-time configuration setting default-user-shell= can be

used to set the default shell for user records and nspawn shell

invocations (instead of of the default /bin/bash).

Experimental features:

* sd-boot gained a new *experimental* setting "reboot-for-bitlocker" in

loader.conf that implements booting Microsoft Windows from the

sd-boot in a way that first reboots the system, to reset the TPM

PCRs. This improves compatibility with BitLocker's TPM use, as the

PCRs will only record the Windows boot process, and not sd-boot

itself, thus retaining the PCR measurements not involving sd-boot.

Note that this feature is experimental for now, and is likely going

to be generalized and renamed in a future release, without retaining

compatibility with the current implementation.

* A new systemd-sysupdate component has been added that automatically

discovers, downloads, and installs A/B-style updates for the host

installation itself, or container images, portable service images,

and other assets. See the new systemd-sysupdate man page for updates.

Contributions from: 4piu, Adam Williamson, adrian5, Albert Brox,

AlexCatze, Alfonso Sánchez-Beato, Alvin Šipraga, Andrea Pappacoda,

Andy Chi, Anita Zhang, Antonio Alvarez Feijoo,

Arfrever Frehtes Taifersar Arahesis, ash, Bastien Nocera, Be,

bearhoney, Benjamin Berg, Christian Brauner, Clyde Byrd III,

Curtis Klein, Daan De Meyer, Danilo Krummrich, David, David Bond,

Davide Cavalca, David Tardon, dependabot[bot], Donald Chan,

Dorian Clay, Eduard Tolosa, Erik Sjölund, Evgeny Vereshchagin,

Federico Ceratto, Franck Bui, Frantisek Sumsal, Gaël PORTAY,

Georges Basile Stavracas Neto, Goffredo Baroncelli, Grigori Goronzy,

Hans de Goede, Heiko Becker, Hugo Carvalho, James Hilliard,

Jan Janssen, Jason A. Donenfeld, Joan Bruguera, Joerie de Gram,

Josh Triplett, Julia Kartseva, ksa678491784, Lan Tian, Laura Barcziova,

Lennart Poettering, Leviticoh, licunlong, Lidong Zhong, lincoln auster,

Lubomir Rintel, Luca Boccassi, Luca BRUNO, Ludwig Nussel,

Marcel Hellwig, march1993, Marco Scardovi, Markus Weippert,

Martin Wilck, Matija Skala, Matthias Lisin, Matt Walton, Max Gautier,

Michael Biebl, Michael Olbrich, Michal Koutný, Mike Gilbert,

Morten Linderud, Nishal Kulkarni, Noel Kuntze, Peter Hutterer,

Peter Morrow, Pigmy-penguin, prumian, Richard Neill,

Rike-Benjamin Schuppner, Romain Naour, Ruben Kerkhof, Ryan Hendrickson,

Santa Wiryaman, Seth Falco, Stephen Hemminger, tawefogo,

Temuri Doghonadze, Thomas Batten, Thomas Haller, Tobias Stoeckmann,

Tyson Whitehead, Vishal Chillara Srinivas, Vivien Didelot, Weblate,

Xiaotian Wu, yangmingtai, YmrDtnJu, Yonathan Randolph, Yu Watanabe,

Zbigniew Jędrzejewski-Szmek, наб

— Warsaw, 2022-03---

CHANGES WITH 250:

* Support for encrypted and authenticated credentials has been added.

This extends the credential logic introduced with v247 to support

non-interactive symmetric encryption and authentication, based on a

key that is stored on the /var/ file system or in the TPM2 chip (if

available), or the combination of both (by default if a TPM2 chip

exists the combination is used, otherwise the /var/ key only). The

credentials are automatically decrypted at the moment a service is

started, and are made accessible to the service itself in unencrypted

form. A new tool 'systemd-creds' encrypts credentials for this

purpose, and two new service file settings LoadCredentialEncrypted=

and SetCredentialEncrypted= configure such credentials.

This feature is useful to store sensitive material such as SSL

certificates, passwords and similar securely at rest and only decrypt

them when needed, and in a way that is tied to the local OS

installation or hardware.

* systemd-gpt-auto-generator can now automatically set up discoverable

LUKS2 encrypted swap partitions.

* The GPT Discoverable Partitions Specification has been substantially

extended with support for root and /usr/ partitions for the majority

of architectures systemd supports. This includes platforms that do

not natively support UEFI, because even though GPT is specified under

UEFI umbrella, it is useful on other systems too. Specifically,

systemd-nspawn, systemd-sysext, systemd-gpt-auto-generator and

Portable Services use the concept without requiring UEFI.

* The GPT Discoverable Partitions Specifications has been extended with

a new set of partitions that may carry PKCS#7 signatures for Verity

partitions, encoded in a simple JSON format. This implements a simple

mechanism for building disk images that are fully authenticated and

can be tested against a set of cryptographic certificates. This is

now implemented for the various systemd tools that can operate with

disk images, such as systemd-nspawn, systemd-sysext, systemd-dissect,

Portable services/RootImage=, systemd-tmpfiles, and systemd-sysusers.

The PKCS#7 signatures are passed to the kernel (where they are

checked against certificates from the kernel keyring), or can be

verified against certificates provided in userspace (via a simple

drop-in file mechanism).

* systemd-dissect's inspection logic will now report for which uses a

disk image is intended. Specifically, it will display whether an

image is suitable for booting on UEFI or in a container (using

systemd-nspawn's --image= switch), whether it can be used as portable

service, or attached as system extension.

* The system-extension.d/ drop-in files now support a new field

SYSEXT_SCOPE= that may encode which purpose a system extension image

is for: one of "initrd", "system" or "portable". This is useful to

make images more self-descriptive, and to ensure system extensions

cannot be attached in the wrong contexts.

* The os-release file learnt a new PORTABLE_PREFIXES= field which may

be used in portable service images to indicate which unit prefixes

are supported.

* The GPT image dissection logic in systemd-nspawn/systemd-dissect/…

now is able to decode images for non-native architectures as well.

This allows systemd-nspawn to boot images of non-native architectures

if the corresponding user mode emulator is installed and

systemd-binfmtd is running.

* systemd-logind gained new settings HandlePowerKeyLongPress=,

HandleRebootKeyLongPress=, HandleSuspendKeyLongPress= and

HandleHibernateKeyLongPress= which may be used to configure actions

when the relevant keys are pressed for more than 5s. This is useful

on devices that only have hardware for a subset of these keys. By

default, if the reboot key is pressed long the poweroff operation is

now triggered, and when the suspend key is pressed long the hibernate

operation is triggered. Long pressing the other two keys currently

does not trigger any operation by default.

* When showing unit status updates on the console during boot and

shutdown, and a service is slow to start so that the cylon animation

is shown, the most recent sd_notify() STATUS= text is now shown as

well. Services may use this to make the boot/shutdown output easier

to understand, and to indicate what precisely a service that is slow

to start or stop is waiting for. In particular, the per-user service

manager instance now reports what it is doing and which service it is

waiting for this way to the system service manager.

* The service manager will now re-execute on reception of the

SIGRTMIN+25 signal. It previously already did that on SIGTERM — but

only when running as PID 1. There was no signal to request this when

running as per-user service manager, i.e. as any other PID than 1.

SIGRTMIN+25 works for both system and user managers.

* The hardware watchdog logic in PID 1 gained support for operating

with the default timeout configured in the hardware, instead of

insisting on re-configuring it. Set RuntimeWatchdogSec=default to

request this behavior.

* A new kernel command line option systemd.watchdog_sec= is now

understood which may be used to override the hardware watchdog

time-out for the boot.

* A new setting DefaultOOMScoreAdjust= is now supported in

/etc/systemd/system.conf and /etc/systemd/user.conf. It may be used

to set the default process OOM score adjustment value for processes

started by the service manager. For per-user service managers this

now defaults to 100, but for per-system service managers is left as

is. This means that by default now services forked off the user

service manager are more likely to be killed by the OOM killer than

system services or the managers themselves.

* A new per-service setting RestrictFileSystems= as been added that

restricts the file systems a service has access to by their type.

This is based on the new BPF LSM of the Linux kernel. It provides an

effective way to make certain API file systems unavailable to

services (and thus minimizing attack surface). A new command

"systemd-analyze filesystems" has been added that lists all known

file system types (and how they are grouped together under useful

group handles).

* Services now support a new setting RestrictNetworkInterfaces= for

restricting access to specific network interfaces.

* Service unit files gained new settings StartupAllowedCPUs= and

StartupAllowedMemoryNodes=. These are similar to their counterparts

without the "Startup" prefix and apply during the boot process

only. This is useful to improve boot-time behavior of the system and

assign resources differently during boot than during regular

runtime. This is similar to the preexisting StartupCPUWeight=

vs. CPUWeight.

* Related to this: the various StartupXYZ= settings

(i.e. StartupCPUWeight=, StartupAllowedCPUs=, …) are now also applied

during shutdown. The settings not prefixed with "Startup" hence apply

during regular runtime, and those that are prefixed like that apply

during boot and shutdown.

* A new per-unit set of conditions/asserts

[Condition|Assert][Memory|CPU|IO]Pressure= have been added to make a

unit skip/fail activation if the system's (or a slice's) memory/cpu/io

pressure is above the configured threshold, using the kernel PSI

feature. For more details see systemd.unit(5) and

https://www.kernel.org/doc/html/latest/accounting/psi.html

* The combination of ProcSubset=pid and ProtectKernelTunables=yes and/or

ProtectKernelLogs=yes can now be used.

* The default maximum numbers of inodes have been raised from 64k to 1M

for /dev/, and from 400k to 1M for /tmp/.

* The per-user service manager learnt support for communicating with

systemd-oomd to acquire OOM kill information.

* A new service setting ExecSearchPath= has been added that allows

changing the search path for executables for services. It affects

where we look for the binaries specified in ExecStart= and similar,

and the specified directories are also added the $PATH environment

variable passed to invoked processes.

* A new setting RuntimeRandomizedExtraSec= has been added for service

and scope units that allows extending the runtime time-out as

configured by RuntimeMaxSec= with a randomized amount.

* The syntax of the service unit settings RuntimeDirectory=,

StateDirectory=, CacheDirectory=, LogsDirectory= has been extended:

if the specified value is now suffixed with a colon, followed by

another filename, the latter will be created as symbolic link to the

specified directory. This allows creating these service directories

together with alias symlinks to make them available under multiple

names.

* Service unit files gained two new settings TTYRows=/TTYColumns= for

configuring rows/columns of the TTY device passed to

stdin/stdout/stderr of the service. This is useful to propagate TTY

dimensions to a virtual machine.

* A new service unit file setting ExitType= has been added that

specifies when to assume a service has exited. By default systemd

only watches the main process of a service. By setting

ExitType=cgroup it can be told to wait for the last process in a

cgroup instead.

* Automount unit files gained a new setting ExtraOptions= that can be

used to configure additional mount options to pass to the kernel when

mounting the autofs instance.

* "Urlification" (generation of ESC sequences that generate clickable

hyperlinks in modern terminals) may now be turned off altogether

during build-time.

* Path units gained new TriggerLimitBurst= and TriggerLimitIntervalSec=

settings that default to 200 and 2 s respectively. The ratelimit

ensures that a path unit cannot cause PID1 to busy-loop when it is

trying to trigger a service that is skipped because of a Condition*=

not being satisfied. This matches the configuration and behaviour of

socket units.

* The TPM2/FIDO2/PKCS11 support in systemd-cryptsetup is now also built

as a plug-in for cryptsetup. This means the plain cryptsetup command

may now be used to unlock volumes set up this way.

* The TPM2 logic in cryptsetup will now automatically detect systems

where the TPM2 chip advertises SHA256 PCR banks but the firmware only

updates the SHA1 banks. In such a case PCR policies will be

automatically bound to the latter, not the former. This makes the PCR

policies reliable, but of course do not provide the same level of

trust as SHA256 banks.

* The TPM2 logic in systemd-cryptsetup/systemd-cryptsetup now supports

RSA primary keys in addition to ECC, improving compatibility with

TPM2 chips that do not support ECC. RSA keys are much slower to use

than ECC, and hence are only used if ECC is not available.

* /etc/crypttab gained support for a new token-timeout= setting for

encrypted volumes that allows configuration of the maximum time to

wait for PKCS#11/FIDO2 tokens to be plugged in. If the time elapses

the logic will query the user for a regular passphrase/recovery key

instead.

* Support for activating dm-integrity volumes at boot via a new file

/etc/integritytab and the tool systemd-integritysetup have been

added. This is similar to /etc/crypttab and /etc/veritytab, but deals

with dm-integrity instead of dm-crypt/dm-verity.

* The systemd-veritysetup-generator now understands a new usrhash=

kernel command line option for specifying the Verity root hash for

the partition backing the /usr/ file system. A matching set of

systemd.verity_usr_* kernel command line options has been added as

well. These all work similar to the corresponding options for the

root partition.

* The sd-device API gained a new API call sd_device_get_diskseq() to

return the DISKSEQ property of a device structure. The "disk

sequence" concept is a new feature recently introduced to the Linux

kernel that allows detecting reuse cycles of block devices, i.e. can

be used to recognize when loopback block devices are reused for a

different purpose or CD-ROM drives get their media changed.

* A new unit systemd-boot-update.service has been added. If enabled

(the default) and the sd-boot loader is detected to be installed, it

is automatically updated to the newest version when out of date. This

is useful to ensure the boot loader remains up-to-date, and updates

automatically propagate from the OS tree in /usr/.

* sd-boot will now build with SBAT by default in order to facilitate

working with recent versions of Shim that require it to be present.

* sd-boot can now parse Microsoft Windows' Boot Configuration Data.

This is used to robustly generate boot entry titles for Windows.

* A new generic target unit factory-reset.target has been added. It is

hooked into systemd-logind similar in fashion to

reboot/poweroff/suspend/hibernate, and is supposed to be used to

initiate a factory reset operation. What precisely this operation

entails is up for the implementer to decide, the primary goal of the

new unit is provide a framework where to plug in the implementation

and how to trigger it.

* A new meson build-time option 'clock-valid-range-usec-max' has been

added which takes a time in µs and defaults to 15 years. If the RTC

time is noticed to be more than the specified time ahead of the

built-in epoch of systemd (which by default is the release timestamp

of systemd) it is assumed that the RTC is not working correctly, and

the RTC is reset to the epoch. (It already is reset to the epoch when

noticed to be before it.) This should increase the chance that time

doesn't accidentally jump too far ahead due to faulty hardware or

batteries.

* A new setting SaveIntervalSec= has been added to systemd-timesyncd,

which may be used to automatically save the current system time to

disk in regular intervals. This is useful to maintain a roughly

monotonic clock even without RTC hardware and with some robustness

against abnormal system shutdown.

* systemd-analyze verify gained support for a pair of new --image= +

--root= switches for verifying units below a specific root

directory/image instead of on the host.

* systemd-analyze verify gained support for verifying unit files under

an explicitly specified unit name, independently of what the filename

actually is.

* systemd-analyze verify gained a new switch --recursive-errors= which

controls whether to only fail on errors found in the specified units

or recursively any dependent units.

* systemd-analyze security now supports a new --offline mode for

analyzing unit files stored on disk instead of loaded units. It may

be combined with --root=/--image to analyze unit files under a root

directory or disk image. It also learnt a new --threshold= parameter

for specifying an exposure level threshold: if the exposure level

exceeds the specified value the call will fail. It also gained a new

--security-policy= switch for configuring security policies to

enforce on the units. A policy is a JSON file that lists which tests

shall be weighted how much to determine the overall exposure

level. Altogether these new features are useful for fully automatic

analysis and enforcement of security policies on unit files.

* systemd-analyze security gain a new --json= switch for JSON output.

* systemd-analyze learnt a new --quiet switch for reducing

non-essential output. It's honored by the "dot", "syscall-filter",

"filesystems" commands.

* systemd-analyze security gained a --profile= option that can be used

to take into account a portable profile when analyzing portable

services, since a lot of the security-related settings are enabled

through them.

* systemd-analyze learnt a new inspect-elf verb that parses ELF core

files, binaries and executables and prints metadata information,

including the build-id and other info described on:

https://systemd.io/COREDUMP_PACKAGE_METADATA/

* .network files gained a new UplinkInterface= in the [IPv6SendRA]

section, for automatically propagating DNS settings from other

interfaces.

* The static lease DHCP server logic in systemd-networkd may now serve

IP addresses outside of the configured IP pool range for the server.

* CAN support in systemd-networkd gained four new settings Loopback=,

OneShot=, PresumeAck=, ClassicDataLengthCode= for tweaking CAN

control modes. It gained a number of further settings for tweaking

CAN timing quanta.

* The [CAN] section in .network file gained new TimeQuantaNSec=,

PropagationSegment=, PhaseBufferSegment1=, PhaseBufferSegment2=,

SyncJumpWidth=, DataTimeQuantaNSec=, DataPropagationSegment=,

DataPhaseBufferSegment1=, DataPhaseBufferSegment2=, and

DataSyncJumpWidth= settings to control bit-timing processed by the

CAN interface.

* DHCPv4 client support in systemd-networkd learnt a new Label= option

for configuring the address label to apply to configure IPv4

addresses.

* The [IPv6AcceptRA] section of .network files gained support for a new

UseMTU= setting that may be used to control whether to apply the

announced MTU settings to the local interface.

* The [DHCPv4] section in .network file gained a new Use6RD= boolean

setting to control whether the DHCPv4 client request and process the

DHCP 6RD option.

* The [DHCPv6PrefixDelegation] section in .network file is renamed to

[DHCPPrefixDelegation], as now the prefix delegation is also supported

with DHCPv4 protocol by enabling the Use6RD= setting.

* The [DHCPPrefixDelegation] section in .network file gained a new

setting UplinkInterface= to specify the upstream interface.

* The [DHCPv6] section in .network file gained a new setting

UseDelegatedPrefix= to control whether the delegated prefixes will be

propagated to the downstream interfaces.

* The [IPv6AcceptRA] section of .network files now understands two new

settings UseGateway=/UseRoutePrefix= for explicitly configuring

whether to use the relevant fields from the IPv6 Router Advertisement

records.

* The ForceDHCPv6PDOtherInformation= setting in the [DHCPv6] section

has been removed. Please use the WithoutRA= and UseDelegatedPrefix=

settings in the [DHCPv6] section and the DHCPv6Client= setting in the

[IPv6AcceptRA] section to control when the DHCPv6 client is started

and how the delegated prefixes are handled by the DHCPv6 client.

* The IPv6Token= section in the [Network] section is deprecated, and

the [IPv6AcceptRA] section gained the Token= setting for its

replacement. The [IPv6Prefix] section also gained the Token= setting.

The Token= setting gained 'eui64' mode to explicitly configure an

address with the EUI64 algorithm based on the interface MAC address.

The 'prefixstable' mode can now optionally take a secret key. The

Token= setting in the [DHCPPrefixDelegation] section now supports all

algorithms supported by the same settings in the other sections.

* The [RoutingPolicyRule] section of .network file gained a new

SuppressInterfaceGroup= setting.

* The IgnoreCarrierLoss= setting in the [Network] section of .network

files now allows a duration to be specified, controlling how long to

wait before reacting to carrier loss.

* The [DHCPServer] section of .network file gained a new Router=

setting to specify the router address.

* The [CAKE] section of .network files gained various new settings

AutoRateIngress=, CompensationMode=, FlowIsolationMode=, NAT=,

MPUBytes=, PriorityQueueingPreset=, FirewallMark=, Wash=, SplitGSO=,

and UseRawPacketSize= for configuring CAKE.

* systemd-networkd now ships with new default .network files:

80-container-vb.network which matches host-side network bridge device

created by systemd-nspawn's --network-bridge or --network-zone

switch, and 80-6rd-tunnel.network which matches automatically created

sit tunnel with 6rd prefix when the DHCP 6RD option is received.

* systemd-networkd's handling of Endpoint= resolution for WireGuard

interfaces has been improved.

* systemd-networkd will now automatically configure routes to addresses

specified in AllowedIPs=. This feature can be controlled via

RouteTable= and RouteMetric= settings in [WireGuard] or

[WireGuardPeer] sections.

* systemd-networkd will now once again automatically generate persistent

MAC addresses for batadv and bridge interfaces. Users can disable this

by using MACAddress=none in .netdev files.

* systemd-networkd and systemd-udevd now support IP over InfiniBand

interfaces. The Kind= setting in .netdev file accepts "ipoib". And

systemd.netdev files gained the [IPoIB] section.

* systemd-networkd and systemd-udevd now support net.ifname-policy=

option on the kernel command-line. This is implemented through the

systemd-network-generator service that automatically generates

appropriate .link, .network, and .netdev files.

* The various systemd-udevd "ethtool" buffer settings now understand

the special value "max" to configure the buffers to the maximum the

hardware supports.

* systemd-udevd's .link files may now configure a large variety of

NIC coalescing settings, plus more hardware offload settings.

* .link files gained a new WakeOnLanPassword= setting in the [Link]

section that allows to specify a WoL "SecureOn" password on hardware

that supports this.

* systemd-nspawn's --setenv= switch now supports an additional syntax:

if only a variable name is specified (i.e. without being suffixed by

a '=' character and a value) the current value of the environment

variable is propagated to the container. e.g. --setenv=FOO will

lookup the current value of $FOO in the environment, and pass it down

to the container. Similar behavior has been added to homectl's,

machinectl's and systemd-run's --setenv= switch.

* systemd-nspawn gained a new switch --suppress-sync= which may be used

to optionally suppress the effect of the sync()/fsync()/fdatasync()

system calls for the container payload. This is useful for build

system environments where safety against abnormal system shutdown is

not essential as all build artifacts can be regenerated any time, but

the performance win is beneficial.

* systemd-nspawn will now raise the RLIMIT_NOFILE hard limit to the

same value that PID 1 uses for most forked off processes.

* systemd-nspawn's --bind=/--bind-ro= switches now optionally take

uidmap/nouidmap options as last parameter. If "uidmap" is used the

bind mounts are created with UID mapping taking place that ensures

the host's file ownerships are mapped 1:1 to container file

ownerships, even if user namespacing is used. This way

files/directories bound into containers will no longer show up as

owned by the nobody user as they typically did if no special care was

taken to shift them manually.

* When discovering Windows installations sd-boot will now attempt to

show the Windows version.

* The color scheme to use in sd-boot may now be configured at

build-time.

* sd-boot gained the ability to change screen resolution during

boot-time, by hitting the "r" key. This will cycle through available

resolutions and save the last selection.

* sd-boot learnt a new hotkey "f". When pressed the system will enter

firmware setup. This is useful in environments where it is difficult

to hit the right keys early enough to enter the firmware, and works

on any firmware regardless which key it natively uses.

* sd-boot gained support for automatically booting into the menu item

selected on the last boot (using the "@saved" identifier for menu

items).

* sd-boot gained support for automatically loading all EFI drivers

placed in the /EFI/systemd/drivers/ subdirectory of the EFI System

Partition (ESP). These drivers are loaded before the menu entries are

loaded. This is useful e.g. to load additional file system drivers

for the XBOOTLDR partition.

* systemd-boot will now paint the input cursor on its own instead of

relying on the firmware to do so, increasing compatibility with broken

firmware that doesn't make the cursor reasonably visible.

* sd-boot now embeds a .osrel PE section like we expect from Boot

Loader Specification Type #2 Unified Kernels. This means sd-boot

itself may be used in place of a Type #2 Unified Kernel. This is

useful for debugging purposes as it allows chain-loading one a

(development) sd-boot instance from another.

* sd-boot now supports a new "devicetree" field in Boot Loader

Specification Type #1 entries: if configured the specified device

tree file is installed before the kernel is invoked. This is useful

for installing/applying new devicetree files without updating the

kernel image.

* Similarly, sd-stub now can read devicetree data from a PE section

".dtb" and apply it before invoking the kernel.

* sd-stub (the EFI stub that can be glued in front of a Linux kernel)

gained the ability to pick up credentials and sysext files, wrap them

in a cpio archive, and pass as an additional initrd to the invoked

Linux kernel, in effect placing those files in the /.extra/ directory

of the initrd environment. This is useful to implement trusted initrd

environments which are fully authenticated but still can be extended

(via sysexts) and parameterized (via encrypted/authenticated

credentials, see above).

Credentials can be located next to the kernel image file (credentials

specific to a single boot entry), or in one of the shared directories

(credentials applicable to multiple boot entries).

* sd-stub now comes with a full man page, that explains its feature set

and how to combine a kernel image, an initrd and the stub to build a

complete EFI unified kernel image, implementing Boot Loader

Specification Type #2.

* sd-stub may now provide the initrd to the executed kernel via the

LINUX_EFI_INITRD_MEDIA_GUID EFI protocol, adding compatibility for

non-x86 architectures.

* bootctl learnt new set-timeout and set-timeout-oneshot commands that

may be used to set the boot menu time-out of the boot loader (for all

or just the subsequent boot).

* bootctl and kernel-install will now read variables

KERNEL_INSTALL_LAYOUT= from /etc/machine-info and layout= from

/etc/kernel/install.conf. When set, it specifies the layout to use

for installation directories on the boot partition, so that tools

don't need to guess it based on the already-existing directories. The

only value that is defined natively is "bls", corresponding to the

layout specified in

https://systemd.io/BOOT_LOADER_SPECIFICATION/. Plugins for

kernel-install that implement a different layout can declare other

values for this variable.

'bootctl install' will now write KERNEL_INSTALL_LAYOUT=bls, on the

assumption that if the user installed sd-boot to the ESP, they intend

to use the entry layout understood by sd-boot. It'll also write

KERNEL_INSTALL_MACHINE_ID= if it creates any directories using the ID

(and it wasn't specified in the config file yet). Similarly,

kernel-install will now write KERNEL_INSTALL_MACHINE_ID= (if it

wasn't specified in the config file yet). Effectively, those changes

mean that the machine-id used for boot loader entry installation is

"frozen" upon first use and becomes independent of the actual

machine-id.

Configuring KERNEL_INSTALL_MACHINE_ID fixes the following problem:

images created for distribution ("golden images") are built with no

machine-id, so that a unique machine-id can be created on the first

boot. But those images may contain boot loader entries with the

machine-id used during build included in paths. Using a "frozen"

value allows unambiguously identifying entries that match the