| | 2 | |
| | 3 | |
| | 4 | {{{ |
| | 5 | CHANGES WITH 231: |
| | 6 | |
| | 7 | * In service units the various ExecXYZ= settings have been extended |
| | 8 | with an additional special character as first argument of the |
| | 9 | assigned value: if the character '+' is used the specified command |
| | 10 | line it will be run with full privileges, regardless of User=, |
| | 11 | Group=, CapabilityBoundingSet= and similar options. The effect is |
| | 12 | similar to the existing PermissionsStartOnly= option, but allows |
| | 13 | configuration of this concept for each executed command line |
| | 14 | independently. |
| | 15 | |
| | 16 | * Services may now alter the service watchdog timeout at runtime by |
| | 17 | sending a WATCHDOG_USEC= message via sd_notify(). |
| | 18 | |
| | 19 | * MemoryLimit= and related unit settings now optionally take percentage |
| | 20 | specifications. The percentage is taken relative to the amount of |
| | 21 | physical memory in the system (or in case of containers, the assigned |
| | 22 | amount of memory). This allows scaling service resources neatly with |
| | 23 | the amount of RAM available on the system. Similarly, systemd-logind's |
| | 24 | RuntimeDirectorySize= option now also optionally takes percentage |
| | 25 | values. |
| | 26 | |
| | 27 | * In similar fashion TasksMax= takes percentage values now, too. The |
| | 28 | value is taken relative to the configured maximum number of processes |
| | 29 | on the system. The per-service task maximum has been changed to 15% |
| | 30 | using this functionality. (Effectively this is an increase of 512 → |
| | 31 | 4915 for service units, given the kernel's default pid_max setting.) |
| | 32 | |
| | 33 | * Calendar time specifications in .timer units now understand a ".." |
| | 34 | syntax for time ranges. Example: "4..7:10" may now be used for |
| | 35 | defining a timer that is triggered at 4:10am, 5:10am, 6:10am and |
| | 36 | 7:10am every day. |
| | 37 | |
| | 38 | * The InaccessableDirectories=, ReadOnlyDirectories= and |
| | 39 | ReadWriteDirectories= unit file settings have been renamed to |
| | 40 | InaccessablePaths=, ReadOnlyPaths= and ReadWritePaths= and may now be |
| | 41 | applied to all kinds of file nodes, and not just directories, with |
| | 42 | the exception of symlinks. Specifically these settings may now be |
| | 43 | used on block and character device nodes, UNIX sockets and FIFOS as |
| | 44 | well as regular files. The old names of these settings remain |
| | 45 | available for compatibility. |
| | 46 | |
| | 47 | * systemd will now log about all service processes it kills forcibly |
| | 48 | (using SIGKILL) because they remained after the clean shutdown phase |
| | 49 | of the service completed. This should help identifying services that |
| | 50 | shut down uncleanly. Moreover if KillUserProcesses= is enabled in |
| | 51 | systemd-logind's configuration a similar log message is generated for |
| | 52 | processes killed at the end of each session due to this setting. |
| | 53 | |
| | 54 | * systemd will now set the $JOURNAL_STREAM environment variable for all |
| | 55 | services whose stdout/stderr are connected to the Journal (which |
| | 56 | effectively means by default: all services). The variable contains |
| | 57 | the device and inode number of the file descriptor used for |
| | 58 | stdout/stderr. This may be used by invoked programs to detect whether |
| | 59 | their stdout/stderr is connected to the Journal, in which case they |
| | 60 | can switch over to direct Journal communication, thus being able to |
| | 61 | pass extended, structured metadata along with their log messages. As |
| | 62 | one example, this is now used by glib's logging primitives. |
| | 63 | |
| | 64 | * When using systemd's default tmp.mount unit for /tmp, the mount point |
| | 65 | will now be established with the "nosuid" and "nodev" options. This |
| | 66 | avoids privilege escalation attacks that put traps and exploits into |
| | 67 | /tmp. However, this might cause problems if you e. g. put container |
| | 68 | images or overlays into /tmp; if you need this, override tmp.mount's |
| | 69 | "Options=" with a drop-in, or mount /tmp from /etc/fstab with your |
| | 70 | desired options. |
| | 71 | |
| | 72 | * systemd now supports the "memory" cgroup controller also on |
| | 73 | cgroupsv2. |
| | 74 | |
| | 75 | * The systemd-cgtop tool now optionally takes a control group path as |
| | 76 | command line argument. If specified, the control group list shown is |
| | 77 | limited to subgroups of that group. |
| | 78 | |
| | 79 | * The SystemCallFilter= unit file setting gained support for |
| | 80 | pre-defined, named system call filter sets. For example |
| | 81 | SystemCallFilter=@clock is now an effective way to make all clock |
| | 82 | changing-related system calls unavailable to a service. A number of |
| | 83 | similar pre-defined groups are defined. Writing system call filters |
| | 84 | for system services is simplified substantially with this new |
| | 85 | concept. Accordingly, all of systemd's own, long-running services now |
| | 86 | enable system call filtering based on this, by default. |
| | 87 | |
| | 88 | * A new service setting MemoryDenyWriteExecute= has been added, taking |
| | 89 | a boolean value. If turned on, a service may no longer create memory |
| | 90 | mappings that are writable and executable at the same time. This |
| | 91 | enhances security for services where this is enabled as it becomes |
| | 92 | harder to dynamically write and then execute memory in exploited |
| | 93 | service processes. This option has been enabled for all of systemd's |
| | 94 | own long-running services. |
| | 95 | |
| | 96 | * A new RestrictRealtime= service setting has been added, taking a |
| | 97 | boolean argument. If set the service's processes may no longer |
| | 98 | acquire realtime scheduling. This improves security as realtime |
| | 99 | scheduling may otherwise be used to easily freeze the system. |
| | 100 | |
| | 101 | * systemd-nspawn gained a new switch --notify-ready= taking a boolean |
| | 102 | value. This may be used for requesting that the system manager inside |
| | 103 | of the container reports start-up completion to nspawn which then |
| | 104 | propagates this notification further to the service manager |
| | 105 | supervising nspawn itself. A related option NotifyReady= in .nspawn |
| | 106 | files has been added too. This functionality allows ordering of the |
| | 107 | start-up of multiple containers using the usual systemd ordering |
| | 108 | primitives. |
| | 109 | |
| | 110 | * machinectl gained a new command "stop" that is an alias for |
| | 111 | "terminate". |
| | 112 | |
| | 113 | * systemd-resolved gained support for contacting DNS servers on |
| | 114 | link-local IPv6 addresses. |
| | 115 | |
| | 116 | * If systemd-resolved receives the SIGUSR2 signal it will now flush all |
| | 117 | its caches. A method call for requesting the same operation has been |
| | 118 | added to the bus API too, and is made available via "systemd-resolve |
| | 119 | --flush-caches". |
| | 120 | |
| | 121 | * systemd-resolve gained a new --status switch. If passed a brief |
| | 122 | summary of the used DNS configuration with per-interface information |
| | 123 | is shown. |
| | 124 | |
| | 125 | * resolved.conf gained a new Cache= boolean option, defaulting to |
| | 126 | on. If turned off local DNS caching is disabled. This comes with a |
| | 127 | performance penalty in particular when DNSSEC is enabled. Note that |
| | 128 | resolved disables its internal caching implicitly anyway, when the |
| | 129 | configured DNS server is on a host-local IP address such as ::1 or |
| | 130 | 127.0.0.1, thus automatically avoiding double local caching. |
| | 131 | |
| | 132 | * systemd-resolved now listens on the local IP address 127.0.0.53:53 |
| | 133 | for DNS requests. This improves compatibility with local programs |
| | 134 | that do not use the libc NSS or systemd-resolved's bus APIs for name |
| | 135 | resolution. This minimal DNS service is only available to local |
| | 136 | programs and does not implement the full DNS protocol, but enough to |
| | 137 | cover local DNS clients. A new, static resolv.conf file, listing just |
| | 138 | this DNS server is now shipped in /usr/lib/systemd/resolv.conf. It is |
| | 139 | now recommended to make /etc/resolv.conf a symlink to this file in |
| | 140 | order to route all DNS lookups to systemd-resolved, regardless if |
| | 141 | done via NSS, the bus API or raw DNS packets. Note that this local |
| | 142 | DNS service is not as fully featured as the libc NSS or |
| | 143 | systemd-resolved's bus APIs. For example, as unicast DNS cannot be |
| | 144 | used to deliver link-local address information (as this implies |
| | 145 | sending a local interface index along), LLMNR/mDNS support via this |
| | 146 | interface is severely restricted. It is thus strongly recommended for |
| | 147 | all applications to use the libc NSS API or native systemd-resolved |
| | 148 | bus API instead. |
| | 149 | |
| | 150 | * systemd-networkd's bridge support learned a new setting |
| | 151 | VLANFiltering= for controlling VLAN filtering. Moreover a new section |
| | 152 | in .network files has been added for configuring VLAN bridging in |
| | 153 | more detail: VLAN=, EgressUntagged=, PVID= in [BridgeVLAN]. |
| | 154 | |
| | 155 | * systemd-networkd's IPv6 Router Advertisement code now makes use of |
| | 156 | the DNSSL and RDNSS options. This means IPv6 DNS configuration may |
| | 157 | now be acquired without relying on DHCPv6. Two new options |
| | 158 | UseDomains= and UseDNS= have been added to configure this behaviour. |
| | 159 | |
| | 160 | * systemd-networkd's IPv6AcceptRouterAdvertisements= option has been |
| | 161 | renamed IPv6AcceptRA=, without altering its behaviour. The old |
| | 162 | setting name remains available for compatibility reasons. |
| | 163 | |
| | 164 | * The systemd-networkd VTI/VTI6 tunneling support gained new options |
| | 165 | Key=, InputKey= and OutputKey=. |
| | 166 | |
| | 167 | * systemd-networkd gained support for VRF ("Virtual Routing Function") |
| | 168 | interface configuration. |
| | 169 | |
| | 170 | * "systemctl edit" may now be used to create new unit files by |
| | 171 | specifying the --force switch. |
| | 172 | |
| | 173 | * sd-event gained a new function sd_event_get_iteration() for |
| | 174 | requesting the current iteration counter of the event loop. It starts |
| | 175 | at zero and is increased by one with each event loop iteration. |
| | 176 | |
| | 177 | * A new rpm macro %systemd_ordering is provided by the macros.systemd |
| | 178 | file. It can be used in lieu of %systemd_requires in packages which |
| | 179 | don't use any systemd functionality and are intended to be installed |
| | 180 | in minimal containers without systemd present. This macro provides |
| | 181 | ordering dependecies to ensure that if the package is installed in |
| | 182 | the same rpm transaction as systemd, systemd will be installed before |
| | 183 | the scriptlets for the package are executed, allowing unit presets |
| | 184 | to be handled. |
| | 185 | |
| | 186 | New macros %_systemdgeneratordir and %_systemdusergeneratordir have |
| | 187 | been added to simplify packaging of generators. |
| | 188 | |
| | 189 | * The os-release file gained VERSION_CODENAME field for the |
| | 190 | distribution nickname (e.g. VERSION_CODENAME=woody). |
| | 191 | |
| | 192 | * New udev property UDEV_DISABLE_PERSISTENT_STORAGE_RULES_FLAG=1 |
| | 193 | can be set to disable parsing of metadata and the creation |
| | 194 | of persistent symlinks for that device. |
| | 195 | |
| | 196 | * The v230 change to tag framebuffer devices (/dev/fb*) with "uaccess" |
| | 197 | to make them available to logged-in users has been reverted. |
| | 198 | |
| | 199 | * Much of the common code of the various systemd components is now |
| | 200 | built into an internal shared library libsystemd-shared-231.so |
| | 201 | (incorporating the systemd version number in the name, to be updated |
| | 202 | with future releases) that the components link to. This should |
| | 203 | decrease systemd footprint both in memory during runtime and on |
| | 204 | disk. Note that the shared library is not for public use, and is |
| | 205 | neither API not ABI stable, but is likely to change with every new |
| | 206 | released update. Packagers need to make sure that binaries |
| | 207 | linking to libsystemd-shared.so are updated in step with the |
| | 208 | library. |
| | 209 | |
| | 210 | * Configuration for "mkosi" is now part of the systemd |
| | 211 | repository. mkosi is a tool to easily build legacy-free OS images, |
| | 212 | and is available on github: https://github.com/systemd/mkosi. If |
| | 213 | "mkosi" is invoked in the build tree a new raw OS image is generated |
| | 214 | incorporating the systemd sources currently being worked on and a |
| | 215 | clean, fresh distribution installation. The generated OS image may be |
| | 216 | booted up with "systemd-nspawn -b -i", qemu-kvm or on any physcial |
| | 217 | UEFI PC. This functionality is particularly useful to easily test |
| | 218 | local changes made to systemd in a pristine, defined environment. See |
| | 219 | HACKING for details. |
| | 220 | |
| | 221 | }}} |
