]> git.ipfire.org Git - thirdparty/systemd.git/blob - man/machine-id.xml
license: LGPL-2.1+ -> LGPL-2.1-or-later
[thirdparty/systemd.git] / man / machine-id.xml
1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
4 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
5
6 <refentry id="machine-id">
7 <refentryinfo>
8 <title>machine-id</title>
9 <productname>systemd</productname>
10 </refentryinfo>
11
12 <refmeta>
13 <refentrytitle>machine-id</refentrytitle>
14 <manvolnum>5</manvolnum>
15 </refmeta>
16
17 <refnamediv>
18 <refname>machine-id</refname>
19 <refpurpose>Local machine ID configuration file</refpurpose>
20 </refnamediv>
21
22 <refsynopsisdiv>
23 <para><filename>/etc/machine-id</filename></para>
24 </refsynopsisdiv>
25
26 <refsect1>
27 <title>Description</title>
28
29 <para>The <filename>/etc/machine-id</filename> file contains the unique machine ID of
30 the local system that is set during installation or boot. The machine ID is a single
31 newline-terminated, hexadecimal, 32-character, lowercase ID. When decoded from
32 hexadecimal, this corresponds to a 16-byte/128-bit value. This ID may not be all
33 zeros.</para>
34
35 <para>The machine ID is usually generated from a random source during system
36 installation or first boot and stays constant for all subsequent boots. Optionally,
37 for stateless systems, it is generated during runtime during early boot if necessary.
38 </para>
39
40 <para>The machine ID may be set, for example when network booting, with the
41 <varname>systemd.machine_id=</varname> kernel command line parameter or by passing the
42 option <option>--machine-id=</option> to systemd. An ID specified in this manner
43 has higher priority and will be used instead of the ID stored in
44 <filename>/etc/machine-id</filename>.</para>
45
46 <para>The machine ID does not change based on local or network configuration or when
47 hardware is replaced. Due to this and its greater length, it is a more useful
48 replacement for the
49 <citerefentry project='man-pages'><refentrytitle>gethostid</refentrytitle><manvolnum>3</manvolnum></citerefentry>
50 call that POSIX specifies.</para>
51
52 <para>This machine ID adheres to the same format and logic as the
53 D-Bus machine ID.</para>
54
55 <para>This ID uniquely identifies the host. It should be considered "confidential", and must not be exposed in
56 untrusted environments, in particular on the network. If a stable unique identifier that is tied to the machine is
57 needed for some application, the machine ID or any part of it must not be used directly. Instead the machine ID
58 should be hashed with a cryptographic, keyed hash function, using a fixed, application-specific key. That way the
59 ID will be properly unique, and derived in a constant way from the machine ID but there will be no way to retrieve
60 the original machine ID from the application-specific one. The
61 <citerefentry><refentrytitle>sd_id128_get_machine_app_specific</refentrytitle><manvolnum>3</manvolnum></citerefentry>
62 API provides an implementation of such an algorithm.</para>
63 </refsect1>
64
65 <refsect1>
66 <title>Initialization</title>
67
68 <para>Each machine should have a non-empty ID in normal operation. The ID of each
69 machine should be unique. To achieve those objectives,
70 <filename>/etc/machine-id</filename> can be initialized in a few different ways.
71 </para>
72
73 <para>For normal operating system installations, where a custom image is created for a
74 specific machine, <filename>/etc/machine-id</filename> should be populated during
75 installation.</para>
76
77 <para>
78 <citerefentry><refentrytitle>systemd-machine-id-setup</refentrytitle><manvolnum>1</manvolnum></citerefentry>
79 may be used by installer tools to initialize the machine ID at install time, but
80 <filename>/etc/machine-id</filename> may also be written using any other means.
81 </para>
82
83 <para>For operating system images which are created once and used on multiple
84 machines, for example for containers or in the cloud,
85 <filename>/etc/machine-id</filename> should be either missing or an empty file in the generic file
86 system image (the difference between the two options is described under "First Boot Semantics" below). An
87 ID will be generated during boot and saved to this file if possible. Having an empty file in place is
88 useful because it allows a temporary file to be bind-mounted over the real file, in case the image is
89 used read-only.</para>
90
91 <para><citerefentry><refentrytitle>systemd-firstboot</refentrytitle><manvolnum>1</manvolnum></citerefentry>
92 may be used to initialize <filename>/etc/machine-id</filename> on mounted (but not
93 booted) system images.</para>
94
95 <para>When a machine is booted with
96 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
97 the ID of the machine will be established. If <varname>systemd.machine_id=</varname>
98 or <option>--machine-id=</option> options (see first section) are specified, this
99 value will be used. Otherwise, the value in <filename>/etc/machine-id</filename> will
100 be used. If this file is empty or missing, <filename>systemd</filename> will attempt
101 to use the D-Bus machine ID from <filename>/var/lib/dbus/machine-id</filename>, the
102 value of the kernel command line option <varname>container_uuid</varname>, the KVM DMI
103 <filename>product_uuid</filename> or the devicetree <filename>vm,uuid</filename>
104 (on KVM systems), and finally a randomly generated UUID.</para>
105
106 <para>After the machine ID is established,
107 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
108 will attempt to save it to <filename>/etc/machine-id</filename>. If this fails, it
109 will attempt to bind-mount a temporary file over <filename>/etc/machine-id</filename>.
110 It is an error if the file system is read-only and does not contain a (possibly empty)
111 <filename>/etc/machine-id</filename> file.</para>
112
113 <para><citerefentry><refentrytitle>systemd-machine-id-commit.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
114 will attempt to write the machine ID to the file system if
115 <filename>/etc/machine-id</filename> or <filename>/etc/</filename> are read-only during
116 early boot but become writable later on.</para>
117 </refsect1>
118
119 <refsect1>
120 <title>First Boot Semantics</title>
121
122 <para><filename>/etc/machine-id</filename> is used to decide whether a boot is the first one. The rules
123 are as follows:</para>
124
125 <orderedlist>
126 <listitem><para>If <filename>/etc/machine-id</filename> does not exist, this is a first boot. During
127 early boot, <command>systemd</command> will write <literal>uninitialized\n</literal> to this file and overmount
128 a temporary file which contains the actual machine ID. Later (after <filename>first-boot-complete.target</filename>
129 has been reached), the real machine ID will be written to disk.</para></listitem>
130
131 <listitem><para>If <filename>/etc/machine-id</filename> contains the string <literal>uninitialized</literal>,
132 a boot is also considered the first boot. The same mechanism as above applies.</para></listitem>
133
134 <listitem><para>If <filename>/etc/machine-id</filename> exists and is empty, a boot is
135 <emphasis>not</emphasis> considered the first boot. <command>systemd</command> will still bind-mount a file
136 containing the actual machine-id over it and later try to commit it to disk (if <filename>/etc/</filename> is
137 writable).</para></listitem>
138
139 <listitem><para>If <filename>/etc/machine-id</filename> already contains a valid machine-id, this is
140 not a first boot.</para></listitem>
141 </orderedlist>
142
143 <para>If by any of the above rules, a first boot is detected, units with <varname>ConditionFirstBoot=yes</varname>
144 will be run.</para>
145 </refsect1>
146
147 <refsect1>
148 <title>Relation to OSF UUIDs</title>
149
150 <para>Note that the machine ID historically is not an OSF UUID as
151 defined by <ulink url="https://tools.ietf.org/html/rfc4122">RFC
152 4122</ulink>, nor a Microsoft GUID; however, starting with systemd
153 v30, newly generated machine IDs do qualify as v4 UUIDs.</para>
154
155 <para>In order to maintain compatibility with existing
156 installations, an application requiring a UUID should decode the
157 machine ID, and then apply the following operations to turn it
158 into a valid OSF v4 UUID. With <literal>id</literal> being an
159 unsigned character array:</para>
160
161 <programlisting>/* Set UUID version to 4 --- truly random generation */
162 id[6] = (id[6] &amp; 0x0F) | 0x40;
163 /* Set the UUID variant to DCE */
164 id[8] = (id[8] &amp; 0x3F) | 0x80;</programlisting>
165
166 <para>(This code is inspired by
167 <literal>generate_random_uuid()</literal> of
168 <filename>drivers/char/random.c</filename> from the Linux kernel
169 sources.)</para>
170
171 </refsect1>
172
173 <refsect1>
174 <title>History</title>
175
176 <para>The simple configuration file format of
177 <filename>/etc/machine-id</filename> originates in the
178 <filename>/var/lib/dbus/machine-id</filename> file introduced by
179 D-Bus. In fact, this latter file might be a symlink to
180 <filename>/etc/machine-id</filename>.</para>
181 </refsect1>
182
183 <refsect1>
184 <title>See Also</title>
185 <para>
186 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
187 <citerefentry><refentrytitle>systemd-machine-id-setup</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
188 <citerefentry project='man-pages'><refentrytitle>gethostid</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
189 <citerefentry><refentrytitle>hostname</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
190 <citerefentry><refentrytitle>machine-info</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
191 <citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
192 <citerefentry><refentrytitle>sd-id128</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
193 <citerefentry><refentrytitle>sd_id128_get_machine</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
194 <citerefentry><refentrytitle>systemd-firstboot</refentrytitle><manvolnum>1</manvolnum></citerefentry>
195 </para>
196 </refsect1>
197
198 </refentry>