man/machine-id.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
   4 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
   5
   6 <refentry id="machine-id">
   7   <refentryinfo>
   8     <title>machine-id</title>
   9     <productname>systemd</productname>
  10   </refentryinfo>
  11
  12   <refmeta>
  13     <refentrytitle>machine-id</refentrytitle>
  14     <manvolnum>5</manvolnum>
  15   </refmeta>
  16
  17   <refnamediv>
  18     <refname>machine-id</refname>
  19     <refpurpose>Local machine ID configuration file</refpurpose>
  20   </refnamediv>
  21
  22   <refsynopsisdiv>
  23     <para><filename>/etc/machine-id</filename></para>
  24   </refsynopsisdiv>
  25
  26   <refsect1>
  27     <title>Description</title>
  28
  29     <para>The <filename>/etc/machine-id</filename> file contains the unique machine ID of
  30     the local system that is set during installation or boot. The machine ID is a single
  31     newline-terminated, hexadecimal, 32-character, lowercase ID. When decoded from
  32     hexadecimal, this corresponds to a 16-byte/128-bit value. This ID may not be all
  33     zeros.</para>
  34
  35     <para>The machine ID is usually generated from a random source during system
  36     installation or first boot and stays constant for all subsequent boots. Optionally,
  37     for stateless systems, it is generated during runtime during early boot if necessary.
  38     </para>
  39
  40     <para>The machine ID may be set, for example when network booting, with the
  41     <varname>systemd.machine_id=</varname> kernel command line parameter or by passing the
  42     option <option>--machine-id=</option> to systemd. An ID specified in this manner
  43     has higher priority and will be used instead of the ID stored in
  44     <filename>/etc/machine-id</filename>.</para>
  45
  46     <para>The machine ID does not change based on local or network configuration or when
  47     hardware is replaced. Due to this and its greater length, it is a more useful
  48     replacement for the
  49     <citerefentry project='man-pages'><refentrytitle>gethostid</refentrytitle><manvolnum>3</manvolnum></citerefentry>
  50     call that POSIX specifies.</para>
  51
  52     <para>This machine ID adheres to the same format and logic as the
  53     D-Bus machine ID.</para>
  54
  55     <para>This ID uniquely identifies the host. It should be considered "confidential", and must not be exposed in
  56     untrusted environments, in particular on the network. If a stable unique identifier that is tied to the machine is
  57     needed for some application, the machine ID or any part of it must not be used directly. Instead the machine ID
  58     should be hashed with a cryptographic, keyed hash function, using a fixed, application-specific key. That way the
  59     ID will be properly unique, and derived in a constant way from the machine ID but there will be no way to retrieve
  60     the original machine ID from the application-specific one. The
  61     <citerefentry><refentrytitle>sd_id128_get_machine_app_specific</refentrytitle><manvolnum>3</manvolnum></citerefentry>
  62     API provides an implementation of such an algorithm.</para>
  63   </refsect1>
  64
  65   <refsect1>
  66     <title>Initialization</title>
  67
  68     <para>Each machine should have a non-empty ID in normal operation. The ID of each
  69     machine should be unique. To achieve those objectives,
  70     <filename>/etc/machine-id</filename> can be initialized in a few different ways.
  71     </para>
  72
  73     <para>For normal operating system installations, where a custom image is created for a
  74     specific machine, <filename>/etc/machine-id</filename> should be populated during
  75     installation.</para>
  76
  77     <para>
  78     <citerefentry><refentrytitle>systemd-machine-id-setup</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  79     may be used by installer tools to initialize the machine ID at install time, but
  80     <filename>/etc/machine-id</filename> may also be written using any other means.
  81     </para>
  82
  83     <para>For operating system images which are created once and used on multiple machines, for example for
  84     containers or in the cloud, <filename>/etc/machine-id</filename> should be either missing or an empty
  85     file in the generic file system image (the difference between the two options is described under "First
  86     Boot Semantics" below). An ID will be generated during boot and saved to this file if possible. Having an
  87     empty file in place is useful because it allows a temporary file to be bind-mounted over the real file,
  88     in case the image is used read-only. Also see <ulink url="https://systemd.io/BUILDING_IMAGES">Safely
  89     Building Images</ulink>.</para>
  90
  91     <para><citerefentry><refentrytitle>systemd-firstboot</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  92     may be used to initialize <filename>/etc/machine-id</filename> on mounted (but not
  93     booted) system images.</para>
  94
  95     <para>When a machine is booted with
  96     <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  97     the ID of the machine will be established. If <varname>systemd.machine_id=</varname>
  98     or <option>--machine-id=</option> options (see first section) are specified, this
  99     value will be used. Otherwise, the value in <filename>/etc/machine-id</filename> will
 100     be used. If this file is empty or missing, <filename>systemd</filename> will attempt
 101     to use the D-Bus machine ID from <filename>/var/lib/dbus/machine-id</filename>, the
 102     value of the kernel command line option <varname>container_uuid</varname>, the KVM DMI
 103     <filename>product_uuid</filename> or the devicetree <filename>vm,uuid</filename>
 104     (on KVM systems), the Xen hypervisor <filename>uuid</filename>, and finally a randomly
 105     generated UUID.</para>
 106
 107     <para>After the machine ID is established,
 108     <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 109     will attempt to save it to <filename>/etc/machine-id</filename>. If this fails, it
 110     will attempt to bind-mount a temporary file over <filename>/etc/machine-id</filename>.
 111     It is an error if the file system is read-only and does not contain a (possibly empty)
 112     <filename>/etc/machine-id</filename> file.</para>
 113
 114     <para><citerefentry><refentrytitle>systemd-machine-id-commit.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 115     will attempt to write the machine ID to the file system if
 116     <filename>/etc/machine-id</filename> or <filename>/etc/</filename> are read-only during
 117     early boot but become writable later on.</para>
 118   </refsect1>
 119
 120   <refsect1>
 121     <title>First Boot Semantics</title>
 122
 123     <para><filename>/etc/machine-id</filename> is used to decide whether a boot is the first one. The rules
 124     are as follows:</para>
 125
 126     <orderedlist>
 127       <listitem><para>The kernel command argument <varname>systemd.condition-first-boot=</varname> may be
 128       used to override the autodetection logic, see
 129       <citerefentry><refentrytitle>kernel-command-line</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
 130       </para></listitem>
 131
 132       <listitem><para>Otherwise, if <filename>/etc/machine-id</filename> does not exist, this is a first
 133       boot. During early boot, <command>systemd</command> will write <literal>uninitialized\n</literal> to
 134       this file and overmount a temporary file which contains the actual machine ID. Later (after
 135       <filename>first-boot-complete.target</filename> has been reached), the real machine ID will be written
 136       to disk.</para></listitem>
 137
 138       <listitem><para>If <filename>/etc/machine-id</filename> contains the string <literal>uninitialized</literal>,
 139       a boot is also considered the first boot. The same mechanism as above applies.</para></listitem>
 140
 141       <listitem><para>If <filename>/etc/machine-id</filename> exists and is empty, a boot is
 142       <emphasis>not</emphasis> considered the first boot. <command>systemd</command> will still bind-mount a file
 143       containing the actual machine-id over it and later try to commit it to disk (if <filename>/etc/</filename> is
 144       writable).</para></listitem>
 145
 146       <listitem><para>If <filename>/etc/machine-id</filename> already contains a valid machine-id, this is
 147       not a first boot.</para></listitem>
 148     </orderedlist>
 149
 150     <para>If according to the above rules a first boot is detected, units with
 151     <varname>ConditionFirstBoot=yes</varname> will be run and <command>systemd</command> will perform
 152     additional initialization steps, in particular presetting units.</para>
 153   </refsect1>
 154
 155   <refsect1>
 156     <title>Relation to OSF UUIDs</title>
 157
 158     <para>Note that the machine ID historically is not an OSF UUID as defined by <ulink
 159     url="https://tools.ietf.org/html/rfc4122">RFC 4122</ulink>, nor a Microsoft GUID; however, starting with
 160     systemd v30, newly generated machine IDs do qualify as Variant 1 Version 4 UUIDs, as per RFC 4122.</para>
 161
 162     <para>In order to maintain compatibility with existing installations, an application requiring a strictly
 163     RFC 4122 compliant UUID should decode the machine ID, and then (non-reversibly) apply the following
 164     operations to turn it into a valid RFC 4122 Variant 1 Version 4 UUID. With <literal>id</literal> being an
 165     unsigned character array:</para>
 166
 167     <programlisting>/* Set UUID version to 4 --- truly random generation */
 168 id[6] = (id[6] &amp; 0x0F) | 0x40;
 169 /* Set the UUID variant to DCE */
 170 id[8] = (id[8] &amp; 0x3F) | 0x80;</programlisting>
 171
 172     <para>(This code is inspired by
 173     <literal>generate_random_uuid()</literal> of
 174     <filename>drivers/char/random.c</filename> from the Linux kernel
 175     sources.)</para>
 176
 177   </refsect1>
 178
 179   <refsect1>
 180     <title>History</title>
 181
 182     <para>The simple configuration file format of
 183     <filename>/etc/machine-id</filename> originates in the
 184     <filename>/var/lib/dbus/machine-id</filename> file introduced by
 185     D-Bus. In fact, this latter file might be a symlink to
 186     <filename>/etc/machine-id</filename>.</para>
 187   </refsect1>
 188
 189   <refsect1>
 190       <title>See Also</title>
 191       <para><simplelist type="inline">
 192         <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
 193         <member><citerefentry><refentrytitle>systemd-machine-id-setup</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
 194         <member><citerefentry project='man-pages'><refentrytitle>gethostid</refentrytitle><manvolnum>3</manvolnum></citerefentry></member>
 195         <member><citerefentry><refentrytitle>hostname</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
 196         <member><citerefentry><refentrytitle>machine-info</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
 197         <member><citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
 198         <member><citerefentry><refentrytitle>sd-id128</refentrytitle><manvolnum>3</manvolnum></citerefentry></member>
 199         <member><citerefentry><refentrytitle>sd_id128_get_machine</refentrytitle><manvolnum>3</manvolnum></citerefentry></member>
 200         <member><citerefentry><refentrytitle>systemd-firstboot</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
 201       </simplelist></para>
 202   </refsect1>
 203
 204 </refentry>