| 759 | | CHANGES WITH 260: |
| 760 | | |
| 761 | | Feature Removals and Incompatible Changes: |
| 762 | | |
| 763 | | * Support for System V service scripts has been removed. Please make |
| 764 | | sure to update your software *now* to include a native systemd unit |
| 765 | | file instead of a legacy System V script. |
| 766 | | |
| 767 | | The following components have been removed: |
| 768 | | |
| 769 | | • systemd-rc-local-generator and rc-local.service, |
| 770 | | • systemd-sysv-generator, |
| 771 | | • systemd-sysv-install (hook for systemctl enable/disable/is-enabled). |
| 772 | | |
| 773 | | The corresponding meson options '-Drc-local=', '-Dsysvinit-path=', |
| 774 | | and '-Dsysvrcnd-path=' are deprecated, and will be dropped in a future |
| 775 | | release. |
| 776 | | |
| 777 | | * Meson options '-Dintegration-tests=' and '-Dcryptolib=' (deprecated |
| 778 | | in v258) have been removed. |
| 779 | | |
| 780 | | * Support for libidn has been removed. IDN functionality now requires |
| 781 | | libidn2. The corresponding meson option '-Dlibidn=' is deprecated |
| 782 | | too and will be dropped in a future release. |
| 783 | | |
| 784 | | * Required versions of various dependencies have been raised: |
| 785 | | |
| 786 | | • cryptsetup 2.0.1/2.3.0 → 2.4.0, |
| 787 | | • elfutils 158 → 177, |
| 788 | | • libblkid 2.24 → 2.37, |
| 789 | | • libseccomp 2.3.1 → 2.4.0, |
| 790 | | • glibc 2.31 → 2.34, |
| 791 | | • libxcrypt or libcrypt from glibc → libxcrypt 4.4.0 only, |
| 792 | | • OpenSSL 1.1.0 → 3.0.0, |
| 793 | | • Python 3.7.0 → 3.9.0. |
| 794 | | |
| 795 | | * The Linux kernel version requirements have been updated too: |
| 796 | | baseline 5.4 → 5.10, recommended baseline 5.7 → 5.14, 6.6 for full |
| 797 | | functionality. Code for compatibility with versions older than the |
| 798 | | baseline has been removed. |
| 799 | | |
| 800 | | * The parsing of RootImageOptions= and the mount image parameters of |
| 801 | | ExtensionImages= and MountImages= has been changed so that the last |
| 802 | | definition for a given partition wins and is applied, rather than the |
| 803 | | first, to keep these options coherent with other unit settings. |
| 804 | | |
| 805 | | * Support for non-system users and groups in udev rules and |
| 806 | | systemd-networkd configuration has been restored, but is deprecated |
| 807 | | and discouraged. systemd-udevd will emits warnings if a non-system |
| 808 | | user/group is specified in OWNER=/GROUP=. Similarly, systemd-networkd |
| 809 | | will warn about User=/Group= settings with a non-system user/group |
| 810 | | specified in .netdev files for Tun/Tap interfaces. This support will |
| 811 | | be removed in a future release. |
| 812 | | |
| 813 | | Device nodes should not be owned by a non-system user/group. It is |
| 814 | | recommended to check udev rules files with 'udevadm verify' and/or |
| 815 | | 'udevadm test' commands. |
| 816 | | |
| 817 | | * systemd-repart will now make use of mkfs.xfs's support for |
| 818 | | populating XFS filesystems from a directory. This support was |
| 819 | | added in xfsprogs 6.17.0 released 20 October 2025. As there is no |
| 820 | | proper way to detect whether mkfs.xfs supports populating from a |
| 821 | | directory or not, we make use of it unconditionally and have dropped |
| 822 | | support for the old way using protofiles. |
| 823 | | |
| 824 | | * The org.systemd.login1.Manager D-Bus interface has a minor API break. |
| 825 | | The CanPowerOff(), CanReboot(), CanSuspend(), etc. family of methods |
| 826 | | have introduced new return values which may break downstream |
| 827 | | consumers such as desktop environments. The new return values more |
| 828 | | precisely communicate the status of inhibitors: 'inhibited', |
| 829 | | 'inhibitor-blocked', and 'challenge-inhibitor-blocked'. This allows |
| 830 | | desktops to differentiate between system administrator policy and |
| 831 | | temporary restrictions imposed by inhibitors. |
| 832 | | |
| 833 | | * In systemd-260-rc1, the sd_varlink_field_type_t enum was extended in |
| 834 | | a way that changed the numerical values of existing fields. This was |
| 835 | | reverted for -rc2. Programs using sd-varlink and compiled with the |
| 836 | | headers from -rc1 must be recompiled. |
| 837 | | New system interfaces and components: |
| 838 | | |
| 839 | | * The os-release(5) gained a new field FANCY_NAME= that is similar to |
| 840 | | PRETTY_NAME= but may contain ANSI sequences, and non-ASCII Unicode |
| 841 | | glyphs. The new field is also defined to NOT contain any version |
| 842 | | specification, providing better separation between the OS name and |
| 843 | | version. |
| 844 | | |
| 845 | | The systemd manager, systemd-hostnamed, and hostnamectl will now |
| 846 | | show FANCY_NAME= in preference to PRETTY_NAME=. |
| 847 | | |
| 848 | | * The "Portability and Stability" policy has been simplified and |
| 849 | | updated to strengthen the promises of avoiding user-visible |
| 850 | | regressions in public interfaces. See |
| 851 | | https://systemd.io/PORTABILITY_AND_STABILITY/ for details. |
| 852 | | |
| 853 | | * Services providing a public Varlink interface can be symlinked under |
| 854 | | /run/varlink/registry/, allowing well-known services to be |
| 855 | | enumerated. 'varlinkctl list-registry' can be used to list available |
| 856 | | services. This is particularly useful in context of the Varlink HTTP |
| 857 | | bridge (https://github.com/mvo5/varlink-http-bridge), which may |
| 858 | | expose all services whose sockets are linked in this directory. |
| 859 | | |
| 860 | | * A new "metrics" or "report" framework has been defined. Any system |
| 861 | | component can hook into the reporting framework by providing a |
| 862 | | Varlink endpoint under /run/systemd/report/. |
| 863 | | |
| 864 | | systemd-report is a new command line tool which collects the reports |
| 865 | | from all endpoints and combines them in JSON format. |
| 866 | | |
| 867 | | The details of the structure of the reports should be considered |
| 868 | | EXPERIMENTAL at this point. We reserve the right to make incompatible |
| 869 | | changes to the JSON structure and/or place additional requirements. |
| 870 | | |
| 871 | | Currently, two components provide metrics this way: systemd-networkd |
| 872 | | and the system service manager. |
| 873 | | |
| 874 | | * A new "mstack" feature has been introduced, to allowing defining an |
| 875 | | overlayfs and bind mount arrangement by structuring the content of an |
| 876 | | ".mstack/" directory that follows this specification. MStacks are |
| 877 | | useful to invoke services and containers from a directory that fully |
| 878 | | self describes its intended way of use. |
| 879 | | |
| 880 | | * A new 'verity' TPM NvPCR has been added. Various components measure |
| 881 | | dm-verity images to it upon loading. This includes |
| 882 | | systemd-veritysetup (controllable via the new 'tpm2-measure-nvpcr=' |
| 883 | | /etc/veritytab setting), and the DDI dissection logic. |
| 884 | | * A canonical set of hwid files for automated DeviceTree mapping in |
| 885 | | UKIs is now shipped under /usr/lib/systemd/boot/hwids/<efi-arch>/. |
| 886 | | Users and developers are welcome to contribute definitions for |
| 887 | | their specific devices, so that UKIs can automatically find and load |
| 888 | | the appropriate DTB on boot, without requiring per-devices and |
| 889 | | per-kernel images. ukify now uses these definition automatically if |
| 890 | | present on the system at build time. A first set of hwid files for |
| 891 | | arm64 Snapdragon devices has been imported. |
| 892 | | |
| 893 | | Changes in the system and service manager: |
| 894 | | |
| 895 | | * A new unit setting RootMStack= has been introduced, to support the |
| 896 | | new "mstack" feature for services (see above). |
| 897 | | |
| 898 | | * The unit setting PrivateUsers= gained a new possible value "managed", |
| 899 | | which automatically assigns a dynamic and transient range of 65536 |
| 900 | | UIDs/GIDs to the unit, acquired via systemd-nsresourced. |
| 901 | | |
| 902 | | * The implementation for PrivateUsers=full has been updated to map the |
| 903 | | full range of IDs. The workaround to allow nested systemd older than |
| 904 | | 257 to correctly detect that it is under such a mapping has been |
| 905 | | dropped. |
| 906 | | |
| 907 | | * systemd now uses the CSI 18 terminal sequence to query terminal |
| 908 | | size. This allows the query to be made without changing the position |
| 909 | | of the cursor. Terminal emulators which do not yet support the |
| 910 | | sequence are encouraged to do so. |
| 911 | | |
| 912 | | * Service units gained a RefreshOnReload= setting that configures |
| 913 | | whether extensions and credentials are to be refreshed when the unit |
| 914 | | is reloaded. |
| 915 | | |
| 916 | | * A new unit setting BindNetworkInterface= has been introduced that |
| 917 | | automatically binds all sockets created by the unit to a specific |
| 918 | | network interface. This is generally useful, but in particular for |
| 919 | | VRF setups. |
| 920 | | |
| 921 | | * Two new unit settings ConditionPathIsSocket= and AssertPathIsSocket= |
| 922 | | can be used to skip or fail the unit if the given path is not a |
| 923 | | socket. |
| 924 | | |
| 925 | | * For units which specify PrivateTmp=yes and DefaultDependencies=no |
| 926 | | without an explicit requirement for /tmp/, a disconnected /tmp/ will |
| 927 | | be used, as if PrivateTmp=disconnected was specified. Also, if there |
| 928 | | is no explicit ordering for /var/, the private mount for /var/tmp/ |
| 929 | | will not be created. Those changes avoid race conditions with |
| 930 | | creation of those private directories during early boot and may |
| 931 | | result in changes to unit ordering. |
| 932 | | |
| 933 | | * EnqueueMarkedJobs() D-Bus method now has a Varlink counterpart. |
| 934 | | |
| 935 | | * systemctl gained a new 'enqueue-marked' verb, which calls the |
| 936 | | EnqueueMarkedJobs() D-Bus method. The '--marked' parameter, which was |
| 937 | | previously used for the same purpose, is now deprecated. |
| 938 | | |
| 939 | | * SetProperties() D-Bus method now has a Varlink counterpart. For now, |
| 940 | | it only supports setting the Markers= property. |
| 941 | | |
| 942 | | * New 'needs-start' and 'needs-stop' settings are now supported for the |
| 943 | | Markers= property. |
| 944 | | |
| 945 | | * The CPUSchedulingPolicy= service setting now supports the new value |
| 946 | | "ext" for enabling the SCHED_EXT scheduler recently added to the |
| 947 | | Linux kernel. |
| 948 | | |
| 949 | | * A new MemoryTHP= service setting has been added that controls |
| 950 | | per-service Transparent Huge Pages (THP) support. |
| 951 | | |
| 952 | | Changes in systemd-udevd: |
| 953 | | |
| 954 | | * Permissions for /dev/ptp* are now set to 0664 (previously 0660), |
| 955 | | allowing unprivileged read-only access. This relies on the kernel fix |
| 956 | | "ptp: Add PHC file mode checks. Allow RO adjtime() without |
| 957 | | FMODE_WRITE." (commit b4e53b15c04e3852949003752f48f7a14ae39e86 in |
| 958 | | v6.15, backported to LTS releases in v6.12.68, v6.6.122, v6.1.162, |
| 959 | | v5.15.199, and v5.10.249), which adds missing PTP ioctl permission |
| 960 | | checks and keeps clock-modifying operations write-restricted. Systems |
| 961 | | running stable kernel branches should ensure they are updated to patch |
| 962 | | levels that include the fix. |
| 963 | | |
| 964 | | * Persistent network interface naming has bee extended to MCTP devices |
| 965 | | with the "mc" prefix. |
| 966 | | |
| 967 | | * The minimum backlight brightness value used when restoring backlight |
| 968 | | levels at boot has been lowered from 5% to 1%. This lower value |
| 969 | | should be sufficient to avoid blacked-out displays, but allows user |
| 970 | | environments to use a wider range of values (without lower values |
| 971 | | being reset during reboot). Note that environments may still set very |
| 972 | | low brightness values at runtime independently of the systemd clamp |
| 973 | | which only applies during boot. |
| 974 | | |
| 975 | | * A new udev property ID_INTEGRATION= is now exposed on devices that |
| 976 | | have ID_BUS= defined. This variable can be set to 'internal' when the |
| 977 | | device is integral part of the system or 'external' otherwise. |
| 978 | | Internal buses like PCI, I2C, SPI... imply 'internal' and external |
| 979 | | buses like bluetooth imply 'external'. For USB the 'removable' |
| 980 | | attribute of the port the device is connected to determines the |
| 981 | | result: 'fixed' implies 'internal' and 'removable' or 'unknown' |
| 982 | | implies 'external'. |
| 983 | | |
| 984 | | * ID_INPUT_JOYSTICK_INTEGRATION= property has been dropped in favour of |
| 985 | | ID_INTEGRATION= because it was never used and the new variable covers |
| 986 | | the idea that variable was intended for better. |
| 987 | | |
| 988 | | * A new udev builtin "tpm2_id" is now available which will extract |
| 989 | | vendor/model identification from connected TPM2 devices as they are |
| 990 | | probed. This is then used to import data from the udev database, |
| 991 | | possibly containing quirk and other information about specific TPMs. |
| 992 | | |
| 993 | | Changes in systemd-networkd: |
| 994 | | |
| 995 | | * MultiPathRoute= option now supports interface-bound ECMP routes. |
| 996 | | |
| 997 | | * systemd-networkd gained integration with ModemManager via the "simple |
| 998 | | connect" protocol. A new [MobileNetwork] section has been added with |
| 999 | | APN=, AllowedAuthenticationMechanisms=, User=, Password=, IPFamily=, |
| 1000 | | AllowRoaming=, PIN=, OperatorId=, RouteMetric=, and UseGateway= |
| 1001 | | settings. This allows systemd-networkd to establish a cellular modem |
| 1002 | | connection to a broadband network. |
| 1003 | | |
| 1004 | | * systemd-networkd gained a pair of varlink methods |
| 1005 | | io.systemd.Network.Link.Up()/Down(). 'networkctl up/down' now |
| 1006 | | utilizes those varlink interfaces in place of direct RTNL messages |
| 1007 | | for better interaction with networkd. |
| 1008 | | |
| 1009 | | * .link files gained new ScatterGather=, ScatterGatherFragmentList=, |
| 1010 | | TCPECNSegmentationOffload=, TCPMangleIdSegmentationOffload=, |
| 1011 | | GenericReceiveOffloadList=, GenericReceiveOffloadUDPForwarding= |
| 1012 | | options for configuring various details of Ethernet devices. |
| 1013 | | |
| 1014 | | * systemd-networkd's Varlink and JSON interfaces will now report IP |
| 1015 | | addresses both as integer array (as before) and as human readable |
| 1016 | | string (new addition). |
| 1017 | | |
| 1018 | | Changes in systemd-boot and the stub: |
| 1019 | | |
| 1020 | | * The timeout in the boot menu can be configured with the |
| 1021 | | io.systemd.boot.timeout= SMBIOS type 11 string. |
| 1022 | | |
| 1023 | | * A new LoaderEntryPreferred setting has been added to systemd-boot that |
| 1024 | | is similar to LoaderEntryDefault, but that takes into the account boot |
| 1025 | | assessment logic, and will skip entries that have the tries-left counter |
| 1026 | | set to zero. |
| 1027 | | |
| 1028 | | * bootctl's Varlink interface gained a new Install() method for performing |
| 1029 | | systemd-boot installation/upgrade via IPC calls. |
| 1030 | | |
| 1031 | | * bootctl gained a new --efi-boot-option-description-with-device=yes |
| 1032 | | switch which augments the EFI boot option description registered with |
| 1033 | | the firmware to include information about the disk used for |
| 1034 | | booting. This is useful when installing multiple OSes on the same |
| 1035 | | system, but on different disks. (Example: install a main OS on the |
| 1036 | | SSD of a laptop, plus another one on an USB stick.) |
| 1037 | | |
| 1038 | | Changes in sd-varlink: |
| 1039 | | |
| 1040 | | * The Varlink implementation now supports SD_VARLINK_ANY as a wildcard |
| 1041 | | type. This is useful to declare generic interfaces which need to |
| 1042 | | support multiple types. |
| 1043 | | |
| 1044 | | * When sd_varlink_connect_url() is invoked with an unrecognized URL |
| 1045 | | scheme, but an executable named after the scheme exists under |
| 1046 | | /usr/lib/systemd/varlink-bridges/, it is invoked and receives an |
| 1047 | | AF_UNIX socktpair() via the usual $LISTEN_FDS socket activation |
| 1048 | | protocol. The aforementioned Varlink HTTP bridge project makes use of |
| 1049 | | this to allow any local Varlink client (including varlinkctl) to |
| 1050 | | contact remote Varlink services via HTTP. The concept is entirely |
| 1051 | | generic however, and can be used to plug in arbitrary other transport |
| 1052 | | protocols, proxies, or connection setup mechanisms. |
| 1053 | | |
| 1054 | | Changes in systemd-resolved: |
| 1055 | | |
| 1056 | | * systemd-resolved's .delegate files learnt a new setting FirewallMark= |
| 1057 | | to set the Linux network stack's "firewall mark" value for all DNS |
| 1058 | | traffic generated by the delegation. |
| 1059 | | |
| 1060 | | * resolvectl now uses Varlink to connect to systemd-resolved. |
| 1061 | | |
| 1062 | | * Queries done through nss-resolve can be limited to a specific |
| 1063 | | interface with the $SYSTEMD_NSS_RESOLVE_INTERFACE environment |
| 1064 | | variable. |
| 1065 | | |
| 1066 | | * systemd-resolved now supports ifindex=0 in the BrowseServices IPC API, |
| 1067 | | to allow browsing all mDNS interfaces in one call. |
| 1068 | | |
| 1069 | | Changes in systemd-sysupdate/systemd-sysupdated: |
| 1070 | | |
| 1071 | | * systemd-sysupdate gained a new 'acquire' verb, allowing the download |
| 1072 | | and installation or update steps to be done separately. |
| 1073 | | |
| 1074 | | * systemd-sysupdate will now refuse processing SHA256SUMS manifests if |
| 1075 | | they list a file BEST-BEFORE- suffixed by a date that is already in |
| 1076 | | the past, as a simple mechanism to detect freshness. |
| 1077 | | |
| 1078 | | * systemd-sysupdate now can mark partitions as partially downloaded. |
| 1079 | | |
| 1080 | | Changes in systemd-vmspawn: |
| 1081 | | |
| 1082 | | * systemd-vmspawn gained support for registering with systemd-machined |
| 1083 | | in the user session. New options --user/--system control which |
| 1084 | | instance is used. |
| 1085 | | |
| 1086 | | * systemd-vmspawn gained support for ephemeral machines via a new |
| 1087 | | --ephemeral option. This is similar to the functionality provided via |
| 1088 | | the same switch in systemd-nspawn. |
| 1089 | | |
| 1090 | | * systemd-vmspawn gained a new switch --image-format= for selecting the |
| 1091 | | image format (i.e. support qcow2 in additin to raw) to boot from. |
| 1092 | | Also --extra-drive= now takes the image format as a colon separated |
| 1093 | | parameter. |
| 1094 | | |
| 1095 | | Changes in systemd-nsresourced/systemd-mountfsd: |
| 1096 | | |
| 1097 | | * The MakeDirectory() Varlink IPC call provided by systemd-mountfsd now |
| 1098 | | accepts a "mode" parameter for configuring the access mode of the |
| 1099 | | newly created directory. The MountImage() call gained a new |
| 1100 | | "mountOptions" parameter for configuring mount options for the |
| 1101 | | various partitions of a DDI explicitly. The call will now also report |
| 1102 | | via a new "singleFileSystem" field in the response whether it is |
| 1103 | | processing a DDI lacking a GPT envelope, and consisting of a raw file |
| 1104 | | system only. A new input parameter "relaxExtensionReleaseChecks" |
| 1105 | | controls whether to enforce extension release checks. |
| 1106 | | |
| 1107 | | * systemd-nsresourced's BPF-LSM based security policy on user |
| 1108 | | namespaces it delegates UID ranges too is relaxed: processes in such |
| 1109 | | namespaces may now freely access to inodes owned by UIDs/GIDs outside |
| 1110 | | of the transient UID range. This reflects the fact that the security |
| 1111 | | policy exists to ensure ownership of inodes by transient UIDs is |
| 1112 | | never persisted on disk. |
| 1113 | | |
| 1114 | | * systemd-nsresourced can now delegate multiples of additional 64K |
| 1115 | | ranges of UIDs/GIDs to user namespaces, on request. This permits |
| 1116 | | nesting of user namespace enabled containers with transient UID |
| 1117 | | ranges. |
| 1118 | | |
| 1119 | | * systemd-nsresourced now supports a new type user namespace UID |
| 1120 | | delegation: only the client's UID is mapped. This is very similar to |
| 1121 | | what the kernel allows anyway as unprivileged delegation without |
| 1122 | | systemd-nsresourced involvement, however, can be combined with |
| 1123 | | multiple additional 64K ranges (see above). |
| 1124 | | |
| 1125 | | * systemd-nsresourced may now optionally map the "foreign" UID/GID |
| 1126 | | range to itself for user namespaces it delegates transient UIDs/GIDs |
| 1127 | | to. This opens up the concept for nested containers. |
| 1128 | | |
| 1129 | | * systemd-nsresourced's and systemd-mountfsd's Varlink sockets may now |
| 1130 | | be mounted into container trees, to permit nested use of their |
| 1131 | | functionality. This can be used automatically in systemd-nspawn's |
| 1132 | | --private-users-delegate= option. |
| 1133 | | |
| 1134 | | Changes in systemd-logind: |
| 1135 | | |
| 1136 | | * systemd-logind/systemd-udevd gained support for a new "xaccess" |
| 1137 | | concept for delegating access to specific devices to users with |
| 1138 | | specially marked sessions. The augments the "uaccess" logic that |
| 1139 | | provides device access to users with foreground sessions. The primary |
| 1140 | | usecase for this is to give access to GPU render devices to local |
| 1141 | | graphical sessions for remote users, i.e. which are not attached to |
| 1142 | | any local seat. Sessions are configured via the PAM environment |
| 1143 | | variable XDG_SESSION_EXTRA_DEVICE_ACCESS= for this logic. |
| 1144 | | |
| 1145 | | * systemd-inhibit --list option gained support for JSON output |
| 1146 | | and filtering with --what= , --who=, --why=, and --mode=. |
| 1147 | | |
| 1148 | | Changes in systemd-portabled: |
| 1149 | | |
| 1150 | | * systemd-portabled now also runs as a user service. Unprivileged users |
| 1151 | | can run portable services (on sufficiently fresh |
| 1152 | | kernels). portablectl gained a pair of switches --user/--system to |
| 1153 | | explicitly select which service instance to talk to. |
| 1154 | | |
| 1155 | | * systemd-portabled will now generate a policy and pin the image for a |
| 1156 | | portable service, so that the image cannot be changed later without a |
| 1157 | | reattach. |
| 1158 | | |
| 1159 | | Changes in other components: |
| 1160 | | |
| 1161 | | * systemd-repart gained basic support for dm-integrity protection of |
| 1162 | | encrypted volumes. Two new options Integrity= and IntegrityAlgorithm= |
| 1163 | | can be used to configure integrity checks for LUKS volumes. |
| 1164 | | |
| 1165 | | * Image dissection policies have been extended to allow restricting |
| 1166 | | file system types and requiring integrity checks for encrypted |
| 1167 | | volumes with a new 'encryptedwithintegrity' policy. |
| 1168 | | |
| 1169 | | * systemd-dissect gained a --copy-ownership= switch to configure |
| 1170 | | ownership of copied files. |
| 1171 | | |
| 1172 | | * systemd-keyutil gained an 'extract-certificate' verb to print the |
| 1173 | | X.509 certificate. The existing 'public' verb has been renamed to |
| 1174 | | 'extract-public' as it works analogously. (The old name remains |
| 1175 | | available for compatibility.) |
| 1176 | | |
| 1177 | | * Support for interactive polkit authorization has been added to |
| 1178 | | systemd-sysext and varlinkctl. |
| 1179 | | |
| 1180 | | * A polkit policy was added for systemd-ask-password, allowing it to be |
| 1181 | | used by unprivileged callers. |
| 1182 | | |
| 1183 | | * journalctl now implements a Varlink interface that exposes a |
| 1184 | | GetEntries() method, which allows retrieving journal entries. |
| 1185 | | |
| 1186 | | * systemd-importd gained support for downloading OCI images ("importctl |
| 1187 | | pull-oci"). They will be stored locally as "mstack" images, which |
| 1188 | | then can be used by various components, for example be run as system |
| 1189 | | services via RootMStack= in unit files, or as systemd-nspawn |
| 1190 | | containers via --mstack= (see below). |
| 1191 | | |
| 1192 | | * systemd-nspawn gained a new --mstack= parameter to support the new |
| 1193 | | "mstack" feature for containers. |
| 1194 | | |
| 1195 | | * A new systemd-mstack command line tool has been introduced to support |
| 1196 | | the new "mstack" feature interactively. |
| 1197 | | |
| 1198 | | * New options SYSTEMD_COLORS=auto-16, SYSTEMD_COLORS=auto-256, and |
| 1199 | | SYSTEMD_COLORS=auto-24bit have been added. They are like |
| 1200 | | SYSTEMD_COLORS=16, SYSTEMD_COLORS=256, and SYSTEMD_COLORS=24bit |
| 1201 | | respectively when output is to a non-dumb TTY, and degrade to |
| 1202 | | SYSTEMD_COLORS=no otherwise. |
| 1203 | | |
| 1204 | | * Standalone versions of the systemd-sysusers and systemd-tmpfiles |
| 1205 | | binaries now support full functionality. (Previously, those tools |
| 1206 | | were compiled without features which would require libmount and pull |
| 1207 | | in a lot of dependencies. After the conversion to dlopen the option |
| 1208 | | whether to support features requiring libmount is made by providing |
| 1209 | | libmount or not, at install time.) |
| 1210 | | |
| 1211 | | * Internal code dealing with processes has been updated to use pidfds |
| 1212 | | in many places. |
| 1213 | | |
| 1214 | | * busctl's 'wait' verb now honours --limit-messages= too. |
| 1215 | | |
| 1216 | | * systemd-cryptsetup gained support for a new fixate-volume-key= |
| 1217 | | option, that can be used to pin a specific encrypted volume to an |
| 1218 | | /etc/crypttab entry via its volume key (more precisely a hash derived |
| 1219 | | from it). systemd-repart will assist generating this information. |
| 1220 | | |
| 1221 | | * systemd-sysext/systemd-confext's "refresh" will now by default try to |
| 1222 | | suppress any operation in case no images where added, removed or |
| 1223 | | changed. To force a umount/mount operation in this case (i.e. get |
| 1224 | | back to the status quo ante) a new --always-refresh= option has been |
| 1225 | | added. Note that the change detection identifies extensions by |
| 1226 | | identity (verity hash, or else by file handle/inode, mount ID, |
| 1227 | | creation time and modification time), and does not look at their |
| 1228 | | contents. In particular, for directory-based extensions, adding, |
| 1229 | | removing or modifying files inside the directory (or touching the |
| 1230 | | directory itself) is not detected, and such a refresh is suppressed |
| 1231 | | by default. Use --always-refresh=yes to force a refresh in these |
| 1232 | | cases. |
| 1233 | | |
| 1234 | | * systemd-oomd acquired "prekill hook" functionality, permitting other |
| 1235 | | system components to synchronously hook into the OOM killing logic, |
| 1236 | | by registering a Varlink socket in a special directory. |
| 1237 | | |
| 1238 | | * systemd-analyze learnt a new verb "identify-tpm2" which shows |
| 1239 | | vendor/model information extracted from the system's TPM. |
| 1240 | | |
| 1241 | | Changes in units: |
| 1242 | | |
| 1243 | | * runlevel[0-6].target units that were removed in v258 have been |
| 1244 | | restored and can be enabled with the new -Dcompat-sysv-interfaces=yes |
| 1245 | | meson option. The installation of legacy.conf for tmpfiles is now |
| 1246 | | also conditionalized under the same option. |
| 1247 | | |
| 1248 | | * getty@.service gained an [Install] and must now be explicitly enabled |
| 1249 | | to be active. |
| 1250 | | |
| 1251 | | |
| 1252 | | |
| 1253 | | |
