Merge pull request #12289 from poettering/news-pid-max

NEWS: explain the kernel.pid_max sysctl change

diff --git a/NEWS b/NEWS
index 98d5a1607107770a1fdd9072f894b4ed25e8bb0e..4df29b90e980e696647d886d05795b2c8a580ac2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,26 @@
 systemd System and Service Manager
 
+CHANGES WITH 243 in spe:
+
+        * The "kernel.pid_max" sysctl is now bumped to 4194304 by default,
+          i.e. the full 22bit range the kernel allows, up from the old 16bit
+          range. This should improve security and robustness a bit, as PID
+          collisions are made less likely (though certainly still
+          possible). There are rumours this might create compatibility
+          problems, though at this moment no practical ones are known to
+          us. Downstream distributions are hence advised to undo this change in
+          their builds if they are concerned about maximum compatibility, but
+          for everybody else we recommend leaving the value bumped. Besides
+          improving security and robustness this should also simplify things as
+          the maximum number of allowed concurrent tasks was previously bounded
+          by both "kernel.pid_max" and "kernel.threads-max" and now only a
+          single knob is left ("kernel.threads-max"). There have been concerns
+          that usability is affected by this change because larger PID numbers
+          are harder to type, but we believe the change from 5 digit PIDs to 7
+          digit PIDs is not too hampering for usability.
+
+          …
+
 CHANGES WITH 242:
 
         * In .link files, MACAddressPolicy=persistent (the default) is changed
@@ -69,7 +90,7 @@ CHANGES WITH 242:
         * Two new conditions for units have been added: ConditionMemory= may be
           used to conditionalize a unit based on installed system
           RAM. ConditionCPUs= may be used to conditionalize a unit based on
-          install CPU cores.
+          installed CPU cores.
 
         * The @default system call filter group understood by SystemCallFilter=
           has been updated to include the new rseq() system call introduced in