systemd System and Service Manager
+CHANGES WITH 243 in spe:
+
+ * Previously, filters defined with SystemCallFilter= would have the
+ effect that an calling an offending system call would terminate the
+ calling thread. This behaviour never made much sense, since killing
+ individual threads of unexpecting processes is likely to create more
+ problems than it solves. With this release the default action changed
+ from killing the thread to killing the whole process. For this to
+ work correctly both a kernel version (>= 4.14) and a libseccomp
+ version (>= 2.4.0) supporting this new seccomp action is required. If
+ an older kernel or libseccomp is used the old behaviour continues to
+ be used. This change does not affect any services that have no system
+ call filters defined, or that use SystemCallErrorNumber= (and thus
+ see EPERM or another error instead of being killed when calling an
+ offending system call). Note that systemd documentation always
+ claimed that the whole process is killed. With this change behaviour
+ is thus adjusted to match the documentation.
+
+ * The "kernel.pid_max" sysctl is now bumped to 4194304 by default,
+ i.e. the full 22bit range the kernel allows, up from the old 16bit
+ range. This should improve security and robustness a bit, as PID
+ collisions are made less likely (though certainly still
+ possible). There are rumours this might create compatibility
+ problems, though at this moment no practical ones are known to
+ us. Downstream distributions are hence advised to undo this change in
+ their builds if they are concerned about maximum compatibility, but
+ for everybody else we recommend leaving the value bumped. Besides
+ improving security and robustness this should also simplify things as
+ the maximum number of allowed concurrent tasks was previously bounded
+ by both "kernel.pid_max" and "kernel.threads-max" and now only a
+ single knob is left ("kernel.threads-max"). There have been concerns
+ that usability is affected by this change because larger PID numbers
+ are harder to type, but we believe the change from 5 digit PIDs to 7
+ digit PIDs is not too hampering for usability.
+
+ * MemoryLow= and MemoryMin= gained hierarchy-aware counterparts,
+ DefaultMemoryLow= and DefaultMemoryMin=, which can be used to
+ hierarchically set default memory protection values for a particular
+ subtree of the unit hierarchy.
+
+ * Memory protection directives can now take a value of zero, allowing
+ explicit opting out of a default value propagated by an ancestor.
+
+ * A new setting DisableControllers= has been added that may be used to
+ explicitly disable one or more cgroups controllers for a unit and all
+ its children.
+
+ * systemd now defaults to the "unified" cgroup hierarchy setup during
+ build-time, i.e. -Ddefault-hierarchy=unified is now the build-time
+ default. Previously, -Ddefault-hierarchy=hybrid was the default. This
+ change reflects the fact that cgroupsv2 support has matured
+ substantially in both systemd and in the kernel, and is clearly the
+ way forward. Downstream production distributions might want to
+ continue to use -Ddefault-hierarchy=hybrid (or even =legacy) for
+ their builds as unfortunately the popular container managers have not
+ caught up with the kernel API changes.
+
+ * Man pages are not built by default anymore (html pages were already
+ disabled by default), to make development builds quicker. When
+ building systemd for a full installation with documentation, meson
+ should be called -Dman=true and/or -Dhtml=true as appropriate. The
+ default was changed based on the assumption that quick one-off or
+ repeated development builds are much more common than full optimized
+ builds for installation, and people need to pass various other
+ options to when doing "proper" builds anyway, so the gain from making
+ development builds quicker is bigger than the one time disruption for
+ packagers.
+
+ Two scripts are created in the *build* directory to generate and
+ preview man and html pages on demand, e.g.:
+
+ build/man/man systemctl
+ build/man/html systemd.index
+
+ * libidn2 is used by default if both libidn2 and libidn are installed.
+ Please use -Dlibidn=true when libidn is favorable.
+
+ * The D-Bus "wire format" of the CPUAffinity= attribute is changed on
+ big-endian machines. Before, bytes were written and read in native
+ machine order as exposed by the native libc __cpu_mask interface.
+ Now, little-endian order is always used (CPUs 0–7 are described by
+ bits 0–7 in byte 0, CPUs 8–15 are described by byte 1, and so on).
+ This change fixes D-Bus calls that cross endianness boundary.
+
+ The presentation format used for CPUAffinity= by "systemctl show" and
+ "systemd-analyze dump" is changed to present CPU indices instead of
+ the raw __cpu_mask bitmask. For example, CPUAffinity=0-1 would be
+ shown as CPUAffinity=03000000000000000000000000000… (on
+ little-endian) or CPUAffinity=00000000000000300000000000000… (on
+ 64-bit big-endian), and is now shown as CPUAffinity=0-1, matching the
+ input format. The maximum integer that will be printed in the new
+ format is 8191 (four digits), while the old format always used a very
+ long number (with the length varying by architecture), so they can be
+ unambiguously distinguished.
+
+ * /usr/sbin/halt.local is no longer supported. Implementation in
+ distributions was inconsistent and it seems this functionality was
+ very rarely used.
+
+ To replace this functionality, users should:
+ - either define a new unit and make it a dependency of final.target
+ (systemctl add-wants final.target my-halt-local.service)
+ - or move the shutdown script to /usr/lib/systemd/system-shutdown/
+ and ensure that it accepts "halt", "poweroff", "reboot", and
+ "kexec" as an argument, see the description in systemd-shutdown(8).
+
+ * When a [Match] section in .link or .network file is empty (contains
+ no match patterns), a warning will be emitted. Please add any "match
+ all" pattern instead, e.g. OriginalName=* or Name=* in case all
+ interfaces should really be matched.
+
+ * A new setting NUMAPolicy= may be used to set process memory
+ allocation policy. Setting can be specified in system.conf and
+ hence will set the default policy for PID1. Default policy can be
+ overridden on per-service basis. Related setting NUMAMask= is used to
+ specify NUMA node mask that should be associated with the selected
+ policy.
+
+ * PID 1 will now listen to Out-Of-Memory (OOM) events the kernel
+ generates when processes it manages are reaching their memory limits,
+ and will place their units in a special state, and optionally kill or
+ stop the whole unit.
+
+ * The service manager will now expose bus properties for the IO
+ resources used by units. This information is also shown in "systemctl
+ status" now (for services that have IOAccounting=yes set). Moreover,
+ the IO accounting data is included in the resource log message
+ generated whenever a unit stops.
+
+ * units may now configure an explicit time-out to apply to when killed
+ with SIGABRT, for example when a service watchdog is hit. Previously,
+ the regular TimeoutStopSec= time-out was applied in this case too —
+ now a separate time-out may be set using TimeoutAbortSec=.
+
+ * Services may now send a special WATCHDOG=trigger message with
+ sd_notify() to trigger an immediate "watchdog missed" event, and thus
+ request service take down. This is useful both for testing watchdog
+ handling, but also for defining error paths in services, that shall
+ be handled the same way as watchdog events.
+
+ * There are two new per-unit settings IPIngressFilterPath= and
+ IPEgressFilterPath= which allow configuration of a BPF program
+ (usually by specifying a path to a program uploaded to /sys/fs/bpf/)
+ to apply to the IP packet ingress/egress path of all processes of a
+ unit. This is useful to allow running systemd services with BPF
+ programs set up externally.
+
+ * systemctl gained a new "clean" verb for removing the state, cache,
+ runtime or logs directories of a service while it is terminated. The
+ new verb may also be used to remove the state maintained on disk for
+ timer units that have Persistent= configured.
+
+ * During the last phase of shutdown systemd will now automatically
+ increase the log level configured in the "kernel.printk" sysctl so
+ that any relevant loggable events happening during late shutdown are
+ made visible. Previously, loggable events happening so late during
+ shutdown were generally lost if the "kernel.printk" sysctl was set to
+ high thresholds, as regular logging daemons are terminated at that
+ time and thus nothing is written to disk.
+
+ * If processes terminated during the last phase of shutdown do not exit
+ quickly systemd will now show their names after a short time, to make
+ debugging easier. After a longer time-out they are forcibly killed,
+ as before.
+
+ * journalctl (and the other tools that display logs) will now highlight
+ warnings in yellow (previously, both LOG_NOTICE and LOG_WARNING where
+ shown in bright bold, now only LOG_NOTICE is). Moreover, audit logs
+ are now shown in blue color, to separate them visually from regular
+ logs. References to configuration files are now turned into clickable
+ links on terminals that support that.
+
+ * systemd-journald will now stop logging to /var/log/journal during
+ shutdown when /var/ is on a separate mount, so that it can be
+ unmounted safely during shutdown.
+
+ * systemd-resolved gained support for a new 'strict' DNS-over-TLS mode.
+
+ * The predictable naming scheme for network devices now supports
+ generating predictable names for "netdevsim" devices.
+
+ * systemd-networkd now supports MACsec, nlmon, IPVTAP and Xfrm
+ interfaces natively.
+
+ * systemd-networkd's bridge FDB support now allows configuration of a
+ destination address for each entry (Destination=), as well as the
+ VXLAN VNI (VNI=), as well as an option to declare what an entry is
+ associated with (AssociatedWith=).
+
+ * systemd-networkd's DHCPv4 support now understands a new MaxAttempts=
+ option for configuring the maximum number of attempts to request a
+ DHCP lease. It also learnt a new BlackList= option for blacklisting
+ DHCP servers (a similar setting has also been added to the IPv6 RA
+ client), as well as a SendRelease= option for configuring whether to
+ send a DHCP RELEASE message when terminating.
+
+ * systemd-networkd's DHCPv4 and DHCPv6 stacks can now be configured
+ seperately in the [DHCPv4] and [DHCPv6] sections.
+
+ * systemd-networkd's VXLAN support gained a new option
+ GenericProtocolExtension= for enabling VXLAN Generic Protocol
+ Extension support, as well as IPDoNotFragment= for setting the IP
+ "Don't fragment" bit on outgoing packets. A similar option has been
+ added to the GENEVE support.
+
+ * In systemd-networkd's [Route] section you may now configure
+ FastOpenNoCookie= for configuring per-route TCP fast-open support, as
+ well as TTLPropagate= for configuring Label Switched Path (LSP) TTL
+ propagation. The Type= setting now supports local, broadcast,
+ anycast, multicast, any, xresolve routes, too.
+
+ * systemd-networkd's [Network] section learnt a new option
+ DefaultRouteOnDevice= for automatically configuring a default route
+ onto the network device.
+
+ * systemd-networkd's bridging support gained two new options ProxyARP=
+ and ProxyARPWifi= for configuring proxy ARP behaviour as well as
+ MulticastRouter= for configureing multicast routing behaviour.
+
+ * systemd-networkd's FooOverUDP support gained the ability to configure
+ local and peer IP addresses via Local= and Peer=. A new option
+ PeerPort= may be used to configure the peer's IP port.
+
+ * systemd-networkd's TUN support gained a new setting VnetHeader= for
+ tweaking Generic Segment Offload support.
+
+ * networkctl gained a new "delete" command for removing virtual network
+ devices, as well as a new "--stats" switch for showing device
+ statistics.
+
+ * systemd-networkd's .network and .link files gained a new Property=
+ setting in the [Match] section, to match against devices with
+ specific udev properties.
+
+ * systemd-networkd's tunnel support gained a new option
+ AssignToLoopback= for selecting whether to use the loopback device
+ "lo" as underlying device.
+
+ * systemd-networkd's MACAddress= setting in the [Neighbor] section has
+ been renamed to LinkLayerAddress=, and it now allows configuration of
+ IP addresses, too.
+
+ * The CriticalConnection= setting in .network files is now deprecated,
+ and replaced by a new KeepConfiguration= setting which allows more
+ detailed configuration of the IP configuration to keep in place.
+
+ * systemd-analyze gained a new "timestamp" verb for parsing and
+ converting timestamps. It's similar to the existing "systemd-analyze
+ calendar" command which does the same for recurring calendar
+ events. It also gained a new "condition" verb for parsing and testing
+ ConditionXYZ= expressions.
+
+ * systemd-logind now exposes a per-session SetBrightness() bus call,
+ which may be used to securely change the brightness of a kernel
+ brightness device, if it belongs to the session's seat. By using this
+ call unprivileged clients can make changes to "backlight" and "leds"
+ devices securely with strict requirements on session
+ membership. Desktop environments may use this to generically make
+ brightness changes to such devices without shipping private SUID
+ binaries or specific udev rules for that purpose.
+
+ * "udevadm info" gained a --wait-for-initialization switch to wait for
+ a device to be initialized.
+
+ * systemd-hibernate-resume-generator will now look for resumeflags= on
+ the kernel command line, which is similar to rootflags= and may be
+ used to configure device timeouts for waiting for the hibernation
+ device to show up.
+
+ * sd-event learnt a new API call sd_event_source_disable_unref() for
+ disabling and unref'ing an event source in a single function. A
+ related call sd_event_source_disable_unrefp() has been added for use
+ with GCC's cleanup extension.
+
+ * The sd-id128.h public API gained a new definition
+ SD_ID128_UUID_FORMAT_STR for formatting a 128bit ID in UUID format
+ with printf().
+
+ * "busctl introspect" gained a new switch --xml-interface for dumping
+ XML introspection data unmodified.
+
+ * PID 1 may now show the unit name instead of the unit description
+ string in its status output during boot. This may be configured in
+ the StatusUnitFormat= setting in /etc/systemd/system.conf or the
+ kernel command line option systemd.status_unit_format=.
+
+ * The systemd.debug_shell kernel command line option now optionally
+ takes a tty name to spawn the debug shell on, which allows selecting
+ a different tty than the built-in default.
+
+ …
+
CHANGES WITH 242:
* In .link files, MACAddressPolicy=persistent (the default) is changed
`SYSTEMD_LOG_LEVEL=debug udevadm test-builtin net_setup_link /sys/class/net/<name>`
may be used to view this.
+ Hint: if a bridge interface is created without any slaves, and gains
+ a slave later, then now the bridge does not inherit slave's MAC.
+ To inherit slave's MAC, for example, create the following file:
+ ```
+ # /etc/systemd/network/98-bridge-inherit-mac.link
+ [Match]
+ Type=bridge
+
+ [Link]
+ MACAddressPolicy=none
+ ```
+
* The .device units generated by systemd-fstab-generator and other
generators do not automatically pull in the corresponding .mount unit
as a Wants= dependency. This means that simply plugging in the device
* Two new conditions for units have been added: ConditionMemory= may be
used to conditionalize a unit based on installed system
RAM. ConditionCPUs= may be used to conditionalize a unit based on
- install CPU cores.
+ installed CPU cores.
* The @default system call filter group understood by SystemCallFilter=
has been updated to include the new rseq() system call introduced in
kernel 4.15.
+ * A new time-set.target has been added that indicates that the system
+ time has been set from a local source (possibly imprecise). The
+ existing time-sync.target is stronger and indicates that the time has
+ been synchronized with a precise external source. Services where
+ approximate time is sufficient should use the new target.
+
* "systemctl start" (and related commands) learnt a new
--show-transaction option. If specified brief information about all
jobs queued because of the requested operation is shown.
* The new TripleSampling= option in .network files may be used to
configure CAN triple sampling.
- * A new .netdev setting PrivateKeyFile= may be used to point to private
- key for a WireGuard interface.
+ * A new .netdev settings PrivateKeyFile= and PresharedKeyFile= may be
+ used to point to private or preshared key for a WireGuard interface.
* /etc/crypttab now supports the same-cpu-crypt and
submit-from-crypt-cpus options to tweak encryption work scheduling
a different layout of the bootloader partitions (for example grub2).
* During package installation (with `ninja install`), we would create
- symlinks for systemd-networkd.service, systemd-networkd.socket,
- systemd-resolved.service, remote-cryptsetup.target, remote-fs.target,
+ symlinks for getty@tty1.service, systemd-networkd.service,
+ systemd-networkd.socket, systemd-resolved.service,
+ remote-cryptsetup.target, remote-fs.target,
systemd-networkd-wait-online.service, and systemd-timesyncd.service
in /etc, as if `systemctl enable` was called for those units, to make
the system usable immediately after installation. Now this is not
Jörg Sommer, Jörg Thalheim, Jussi Pakkanen, Kai-Heng Feng, Lennart
Poettering, Lubomir Rintel, Luís Ferreira, Martin Pitt, Matthias
Klumpp, Michael Biebl, Michael Niewöhner, Michael Olbrich, Michal
- Sekletar, Mike Lothian, Piotr Drąg, Riccardo Schirone, Robin Elvedi,
- Roman Kulikov, Ronald Tschalär, Ross Burton, Ryan Gonzalez, Stephane
- Chazelas, StKob, Susant Sahani, Sylvain Plantefève, Szabolcs Fruhwald,
- Taro Yamada, Theo Ouzhinski, Thomas Haller, Tobias Jungel, Tom Yan,
- Tony Asleson, Topi Miettinen, unixsysadmin, Van Laser, Vesa
- Jääskeläinen, Yu, Li-Yu, Yu Watanabe, Zbigniew Jędrzejewski-Szmek
+ Sekletar, Mike Lothian, Paul Menzel, Piotr Drąg, Riccardo Schirone,
+ Robin Elvedi, Roman Kulikov, Ronald Tschalär, Ross Burton, Ryan
+ Gonzalez, Sebastian Krzyszkowiak, Stephane Chazelas, StKob, Susant
+ Sahani, Sylvain Plantefève, Szabolcs Fruhwald, Taro Yamada, Theo
+ Ouzhinski, Thomas Haller, Tobias Jungel, Tom Yan, Tony Asleson, Topi
+ Miettinen, unixsysadmin, Van Laser, Vesa Jääskeläinen, Yu, Li-Yu,
+ Yu Watanabe, Zbigniew Jędrzejewski-Szmek
- — Warsaw, 2019-04-08
+ — Warsaw, 2019-04-11
CHANGES WITH 241:
* Journal messages that are generated whenever a unit enters the failed
state are now tagged with a unique MESSAGE_ID. Similarly, messages
generated whenever a service process exits are now made recognizable,
- too. A taged message is also emitted whenever a unit enters the
+ too. A tagged message is also emitted whenever a unit enters the
"dead" state on success.
* systemd-run gained a new switch --working-directory= for configuring
up a private /dev/ file system containing devices nodes — but when
these are opened they don't work.
- At this point is is recommended that container managers utilizing
+ At this point it is recommended that container managers utilizing
user namespaces that intend to run systemd in the payload explicitly
block mknod() with seccomp or similar, so that the graceful fallback
logic works again.
not created by systemd-sysusers anymore.
NOTE: This has a chance of breaking nss-ldap and similar NSS modules
- that embedd a network facing module into any process using getpwuid()
+ that embed a network facing module into any process using getpwuid()
or related call: the dynamic allocation of the user ID for
systemd-resolved.service means the service manager has to check NSS
if the user name is already taken when forking off the service. Since
PrivateDevices=, ProtectSystem=, …) are used. This option is hence
primarily useful for services that do not use any of the other file
system namespacing options. One such service is systemd-udevd.service
- wher this is now used by default.
+ where this is now used by default.
* ConditionSecurity= gained a new value "uefi-secureboot" that is true
when the system is booted in UEFI "secure mode".
/etc/machine-id. If the machine ID could not be determined,
$KERNEL_INSTALL_MACHINE_ID will be empty. Plugins should not put
anything in the entry directory (passed as the second argument) if
- $KERNEL_INSTALL_MACHINE_ID is empty. For backwards compatiblity, a
+ $KERNEL_INSTALL_MACHINE_ID is empty. For backwards compatibility, a
temporary directory is passed as the entry directory and removed
after all the plugins exit.
* We temporarily dropped the "-l" switch for fsck invocations,
since they collide with the flock() logic above. util-linux
upstream has been changed already to avoid this conflict,
- and we will readd "-l" as soon as util-linux with this
+ and we will re-add "-l" as soon as util-linux with this
change has been released.
* The dependency on libattr has been removed. Since a long
where the local administrator's configuration in /etc always
overrides any other settings.
- Contributions fron: Ali H. Caliskan, Alison Chaiken, Bas van
+ Contributions from: Ali H. Caliskan, Alison Chaiken, Bas van
den Berg, Brandon Philips, Cristian Rodríguez, Daniel Buch,
Dan Kilman, Dave Reisner, David Härdeman, David Herrmann,
David Strauss, Dimitris Spingos, Djalal Harouni, Eelco
projects / thirdparty / systemd.git / blobdiff