mirror of
https://github.com/systemd/systemd-stable.git
synced 2025-03-08 20:58:20 +03:00
NEWS: start putting together NEWS for v249
This commit is contained in:
Lennart Poettering
parent
51df483846
commit
f973aea740
255
NEWS
255
NEWS
@ -1,5 +1,260 @@
|
||||
systemd System and Service Manager
|
||||
|
||||
CHANGES WITH 249 in spe:
|
||||
|
||||
* When operating on disk images via the --image= switch of various
|
||||
tools (such as systemd-nspawn or systemd-dissect), and multiple
|
||||
suitable root or /usr/ partitions exist in the image, then a simple
|
||||
strverscmp() inspired comparison is done on the GPT partition label,
|
||||
and the newest partition picked. This permits a simple and generic
|
||||
whole-file-system A/B update logic where new operating system
|
||||
versions are dropped into partitions whose label is then updated with
|
||||
a matching version identifier.
|
||||
|
||||
* systemd-sysusers now supports querying the passwords to set for the
|
||||
users it creates via the "credentials" logic introduced in v247: the
|
||||
passwd.hashed-password.<user> and passwd.plaintext-password.<user>
|
||||
credentials are consulted for the password to use (either in UNIX
|
||||
hashed form, or literally). By default these credentials are inherited
|
||||
down from PID1 (which in turn imports it from a container manager if
|
||||
there is one). This permits easy configuration of user passwords
|
||||
during first boot. Example:
|
||||
|
||||
# systemd-nspawn -i foo.raw --volatile=yes --set-credential=passwd.plaintext-password.root:foo
|
||||
|
||||
Note that systemd-sysusers operates in purely additive mode: it
|
||||
executes no operation if the declared users already exist, and hence
|
||||
doesn't set any passwords as effect of the command line above if the
|
||||
specified root user exists already in the image. (Note that
|
||||
--volatile=yes ensures it doesn't, though.)
|
||||
|
||||
* systemd-firstboot now also supports querying various system
|
||||
parameters via the credential subsystems. Thus, as above this may be
|
||||
used to initialize important system parameters on first boot of
|
||||
previously unprovisioned images (i.e. images with a mostly empty
|
||||
/etc/).
|
||||
|
||||
* The systemd-ask-password now also supports reading passwords from the
|
||||
credentials subsystem, via the new --credential= switch.
|
||||
|
||||
* Services gained a new ExitType= setting which can configure how to
|
||||
determine when a service exited: the default is "main" which defines
|
||||
the runtime by the service's main process lifetime (this matches the
|
||||
only behaviour implemented in v248 and before), but with "cgroup" the
|
||||
runtime is defined by the existence of any process in the service's
|
||||
cgroup.
|
||||
|
||||
* The systemd-machine-id-setup tool now supports a --image= switch for
|
||||
provisioning a machine ID file into an OS disk image, similar to how
|
||||
--root= operates on an OS file tree. This matches the existing switch
|
||||
of the same name to the systemd-tmpfiles, systemd-firstboot or
|
||||
systemd-sysusers tools.
|
||||
|
||||
* Similar, systemd-repart gained support for a --image= switch, too. In
|
||||
combination with the existing --size= makes the tool particularly
|
||||
useful for easily growing disk images in a single command invocation,
|
||||
following the declarative rules included in the image itself.
|
||||
|
||||
* systemd-repart's partition configuration files gained support for a
|
||||
new switch MakeDirectories= which may be used to create arbitrary
|
||||
directories inside file systems that are created, before registering
|
||||
them in the partition table. This is useful in particular if root
|
||||
partitions are created that way to create mount point directories for
|
||||
other partitions included in the image. For example, a disk image
|
||||
that is created to contain a /home/ and a /var/ partition in addition
|
||||
to a root partition may MakeDirectories= to create /home/ and /var/
|
||||
as empty directories in the root file system on creation so that the
|
||||
resulting image can mounted immediately, even in read-only mode.
|
||||
|
||||
* systemd-repart's CopyBlocks= setting gained support for a special
|
||||
value "auto". If used a suitable, matching partition on the booted OS
|
||||
is found as source to copy blocks from. This is useful for
|
||||
implementing replicating installers, that are booted from one medium
|
||||
and then stream their own root partition on the target medium.
|
||||
|
||||
* systemd-repart's partition configuration files gained support for a
|
||||
Flags= and a ReadOnly= setting, allowing control of the GPT partition
|
||||
flags for the created partitions: this is useful for marking newly
|
||||
created partitions as read-only from the start.
|
||||
|
||||
* The /etc/os-release file has been extended with two new (optional)
|
||||
variables IMAGE_VERSION= and IMAGE_ID=, for carrying identification
|
||||
and versioning information for OS images that are updated
|
||||
consistently, comprehensively and atomically as one image. The two
|
||||
new specifiers %M, %A now resolve to these two fields in the various
|
||||
configuration options that resolve specifiers.
|
||||
|
||||
* portablectl gained a new switch --extension= for enabling portable
|
||||
service images with extensions that follow the extension image
|
||||
concept introduced with v248.
|
||||
|
||||
* systemd-coredump will now extract ELF build-id information from
|
||||
processes dumping core and include it in the coredump
|
||||
report. Moreover, if will look for ELF .note.package sections that
|
||||
may carry distribution packaging meta-information about the crashing
|
||||
process. This is useful to directly embed the RPM or Debian (or any
|
||||
other) package name and version in the ELF files where they originate
|
||||
from, making it easy to match up coredump reports with the software
|
||||
versions they were found it. This is particular useful on
|
||||
environments with ELF files form multiple vendors, different
|
||||
distributions and versions, as it is common today, in particular in a
|
||||
containerized and sand-boxed world. For further information, see:
|
||||
|
||||
https://systemd.io/COREDUMP_PACKAGE_METADATA
|
||||
|
||||
* A new udev hwdb has been added for Firewire audio devices
|
||||
|
||||
* sd-bus' sd_bus_is_ready() and sd_bus_is_open() calls now accept a
|
||||
NULL bus object, for which they will return false. Or in other words,
|
||||
an unallocated bus connection is neither ready nor open.
|
||||
|
||||
* The native Journal protocol has been documented. Clients may talk
|
||||
this as alternative to the classic BSD syslog protocol for locally
|
||||
delivering log records to the Journal. The protocol has been stable
|
||||
since a long time and in fact been implemented already in a variety
|
||||
of alternative client libraries. This documentation makes the support
|
||||
for that official:
|
||||
|
||||
https://systemd.io/JOURNAL_NATIVE_PROTOCOL
|
||||
|
||||
* A new BPFProgram= setting has been added to service files. It may be
|
||||
set to a path to a loaded kernel BPF program, i.e. a path to a bpffs
|
||||
file, or a bind mount or symlink to one. This may be used to upload
|
||||
and manage BPF programs externally and then hook arbitrary systemd
|
||||
services into them.
|
||||
|
||||
* The "home.arpa" domain that has been officially declared as the
|
||||
choice for domain for local home networks per RFC 8375 has been added
|
||||
to the default NTA list of resolved, since DNSSEC is generally not
|
||||
available on private domains.
|
||||
|
||||
* The CPUAffinity= setting of unit files now resolves "%" specifiers.
|
||||
|
||||
* A new ManageForeignRoutingPolicyRules= setting has been added to
|
||||
.network files which may be used to exclude foreign-created routing
|
||||
policy rules from systemd-networkd management.
|
||||
|
||||
* systemd-network-wait-online gained two new switches -4 and -6 that
|
||||
may be used to tweak whether to wait for only IPv4 or only IPv6
|
||||
connectivity.
|
||||
|
||||
* .network files gained a new RequiredFamilyForOnline= setting to
|
||||
fine-tune whether to require an IPv4 or IPv6 address in order to
|
||||
consider an interface "online".
|
||||
|
||||
* The RestrictAddressFamilies= setting in service files now supports a
|
||||
new special value "none". If specified sockets of all address
|
||||
families will be made unavailable to services configured that way.
|
||||
|
||||
* The DHCP server logic configured in .network files gained a new
|
||||
setting RelayTarget= that turns the server into a DHCP server relay.
|
||||
|
||||
|
||||
* The sd-device API acquired a new API function
|
||||
sd_device_get_usec_initialized() that returns the monotonic timestamp
|
||||
when a udev device appeared in the database first.
|
||||
|
||||
* systemd-fstab-generator and systemd-repart have been updated to
|
||||
support booting from disks that carry only a /usr/ partition but no
|
||||
root partition yet, but where systemd-repart can add them in on first
|
||||
boot. This is useful for implementing systems that ship with a single
|
||||
/usr/ file system and whose root file system shall be set up on a
|
||||
LUKS encrypted volume whose key is generated locally (and possibly
|
||||
enrolled in TPM), and which is set up and formatted during first
|
||||
boot.
|
||||
|
||||
* The [Address] section of .network files now accepts a new
|
||||
RouteMetric= setting that configures the routing metric to use for
|
||||
the prefix route created as effect of the address
|
||||
configuration. Similar, the [DHCPv6PrefixDelegation] and [IPv6Prefix]
|
||||
sections gained matching settings for their prefix routes. (The
|
||||
option of the same name of the [DHCPv6] section is moved to
|
||||
[IPv6AcceptRA], since it conceptually belongs there; the old option
|
||||
is still understood for compatibility.)
|
||||
|
||||
|
||||
* The DHCPv6 IAID and DUID are now explicitly configurable in .network
|
||||
files.
|
||||
|
||||
* A new udev property ID_NET_DHCP_BROADCAST on network interface
|
||||
devices is not honoured by systemd-networkd, that controls whether to
|
||||
issue DHCP offers via broadcasting. This is used to ensure that s390
|
||||
layer 3 network interfaces work out-of-the-box with systemd-networkd.
|
||||
|
||||
* nss-myhostname and systemd-resolved will now synthesize address
|
||||
records for a new special hostname "_outbound". The name will always
|
||||
resolve to the local IP addresses most likely used for outbound
|
||||
connections towards the default route. On multi-homed hosts this is
|
||||
useful to have a stable handle referring to "the" local IP address
|
||||
that matters most, to the point where this is defined.
|
||||
|
||||
* The Discoverable Partition Specification has been updated with a new
|
||||
GPT partition flag defined its partition types: a "growfs"
|
||||
flag. Whenever partitions with this flag set are automatically
|
||||
mounted (i.e. via systemd-gpt-auto-generator or the --image= switch
|
||||
of systemd-nspawn or other tools; and as opposed to explicit mounting
|
||||
via /etc/fstab), the file system within the partition is
|
||||
automatically grown to the full size of the partition should it be
|
||||
smaller. If the file system size already matches the partition size
|
||||
this flag has no effect. Previously, this functionality has been
|
||||
available via the explicit x-systemd.growfs mount option, and this
|
||||
new flag extends this to automatically discovered mounts. A new
|
||||
GrowFileSystem= setting has been added to systemd-repart drop-in
|
||||
files that allows configuring this partition flag. This new flag
|
||||
defaults to on for partitions automatically created by
|
||||
systemd-repart, except if they are marked read-only. See the
|
||||
specification for further details:
|
||||
|
||||
https://systemd.io/DISCOVERABLE_PARTITIONS
|
||||
|
||||
* .network files gained a new setting RoutToNTP= in the [DHCPv4]
|
||||
section. If enabled (which is the default), and an NTP server address
|
||||
is acquired through a DHCP lease on this interface an explicit route
|
||||
to this address is created on this interface to ensure that NTP
|
||||
traffic to the NTP server acquired on an interface is also routed
|
||||
trough that interface. The pre-existing RoutesToDNS= setting that
|
||||
implements the same for DNS servers is now enabled by default.
|
||||
|
||||
* A pair of service settings SocketBindAllow= + SocketBindDeny= have
|
||||
been added that may be used to restrict the network interfaces
|
||||
sockets created by the service may be bound to. This is implemented
|
||||
via BPF.
|
||||
|
||||
* A new ConditionFirmware= condition type has been added to unit
|
||||
files. It may be used to detect certain firmware features. At the
|
||||
moment it may check whether running on an UEFI system, a device.tree
|
||||
system or if the system is compatible with some specified device-tree
|
||||
feature.
|
||||
|
||||
* hostnamed gained a new Describe() D-Bus method that returns a JSON
|
||||
serialization of the host data it exposes. This is exposed via
|
||||
"hostnamectl --json=" to acquire a host identity description in
|
||||
JSON. It's our intention to add a similar concept to most services
|
||||
and objects systemd manages, in order to simplify integration with
|
||||
program code the consumes JSON.
|
||||
|
||||
* hostnamectl's various set-xyz verbs (e.g. "hostnamectl set-hostname")
|
||||
have been renamed to just xyz (e.g. "hostnamectl hostname") and may
|
||||
now be used to acquire the indicated data in terse form, instead of
|
||||
only setting it. The old names continue to be supported for
|
||||
compatibility.
|
||||
|
||||
* systemd-detect-virt and ConditionVirtualization= are now able to
|
||||
correctly identify Amazon EC2 environments.
|
||||
|
||||
* The LogLevelMax= setting of unit files now applies not only to log
|
||||
messages generated *by* the service, but also to log messages
|
||||
generated *about* the service by PID 1. To suppress logs concerning a
|
||||
specific service comprehensively, set this option to a high log
|
||||
level.
|
||||
|
||||
* bootctl gained support for a new --make-machine-id-directory= switch
|
||||
that allows precise control on whether to create the top-level
|
||||
per-machine directory in the boot partition that typically contain
|
||||
Type #1 boot loader entries.
|
||||
|
||||
…
|
||||
|
||||
CHANGES WITH 248:
|
||||
|
||||
* A concept of system extension images is introduced. Such images may
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user