@ -103,37 +103,37 @@ CHANGES WITH 257 in spe:
libsystemd:
libsystemd:
* systemd's JSON API is now available as public interface of
* systemd's JSON API is now available as public interface of libsystemd
libsystemd, under the name "sd-json". The purpose of the library is
under the name "sd-json". The purpose of the library is to allow
to allow structures to be conveniently created in C code and
structures to be conveniently created in C code and serialized to
serialized to JSON, and for JSON to be conveniently deserialized into
JSON, and for JSON to be conveniently deserialized into in-memory
in-memory structures, using callbacks to handle specific
structures, using callbacks to handle specific keys. Various data
keys. Various data types like integers, floats, booleans, strings,
types like integers, floats, booleans, strings, UUIDs, base64-encoded
UUIDs, base64-encoded and hex-encoded binary data, and arrays are
and hex-encoded binary data, and arrays are supported natively. The
supported natively. The library has been part of systemd for a while
library has been part of systemd for a while as internal component,
as internal component, a nd is now made publicly available. One major
and now being made publicly available, too . On major user of sd-json
user of sd-json is sd-varlink (see below). Note that the
is the JSON interface sd-varlink (see below). Note that documentation
documentati on of sd-json is very much incomplete for now, but the
on sd-json is very much incomplete for now, but the systemd codebase
systemd codebase provides plenty real-life code examples.
should provide plenty code real-life code examples.
* systemd's Varlink IPC API is now available as part of libsystemd,
* lib systemd's Varlink IPC API is now available as part of libsystemd
under the name "sd-varlink". This library is a C implementation of
under the name "sd-varlink". This library is a C implementation of
the Varlink IPC system (https://varlink.org/) that has been adopted
the Varlink IPC system (https://varlink.org/) that has been adopted
by systemd for various interfaces. It relies on the sd-json JSON
by systemd for various interfaces. It relies on the sd-json JSON
component, see above. Note that the documentation of sd-varlink is
component, see above. Note that documentation on sd-varlink is very
very much incomplete for now, but the systemd codebase provides
much incomplete for now, but the systemd codebase should provide
plenty real-life code examples.
plenty code real-life code examples.
* sd-bus gained a new call sd_bus_pending_method_calls() which returns
* sd-bus gained a new call sd_bus_pending_method_calls() which returns
the number of currently open asynchronous method calls initiated on
the number of currently open asynchronous method calls initiated on
this connection towards peers.
this connection towards peers.
* sd-device gained a new call sd_device_monitor_is_running() that
* sd-device gained a new call sd_device_monitor_is_running() that
returns wheth er the specified monitor object is already running. It
returns when er the specified monitor object is already running. It
also gained sd_device_monitor_get_fd(),
also gained sd_device_monitor_get_fd(),
sd_device_monitor_get_events(), sd_device_monitor_get_timeout() and
sd_device_monitor_get_events(), sd_device_monitor_get_timeout() and
sd_device_monitor_receive() to permit sd-device to run on top of a
sd_device_monitor_receive() to permit sd-device to run on a foreign
foreign event loop implementation. It also gained
event loop implementation. It also gained
sd_device_get_driver_subsystem() which returns the subsystem of
sd_device_get_driver_subsystem() which returns the subsystem of
driver objects. The new sd_device_get_device_id() call returns a
driver objects. The new sd_device_get_device_id() call returns a
short string identifying the device record.
short string identifying the device record.
@ -148,9 +148,8 @@ CHANGES WITH 257 in spe:
* Multipath TCP (MPTCP) is now supported as a socket protocol for
* Multipath TCP (MPTCP) is now supported as a socket protocol for
.socket units.
.socket units.
* A new /etc/fstab option x-systemd.wants= creates "Wants="
* New /etc/fstab option x-systemd.wants= creates "Wants" dependencies.
dependencies. (This is similar to the previously available
(This is similar to the previously available x-systemd.requires=.)
x-systemd.requires=.)
* The initialization of the system clock during boot and updates has
* The initialization of the system clock during boot and updates has
been simplified: both PID 1 or systemd-timesyncd will pick the latest
been simplified: both PID 1 or systemd-timesyncd will pick the latest
@ -162,17 +161,17 @@ CHANGES WITH 257 in spe:
shutdown, so that the user may use it to initiate a reboot if the
shutdown, so that the user may use it to initiate a reboot if the
system freezes otherwise.
system freezes otherwise.
* The new value "identity" for the unit setting PrivateUsers= may be
* The new unit option PrivateUsers=identity can be used to request a
used to request a use r namespace with an identity mapping for the
user namespace with an identity mapping for the first 65536
first 65536 UIDs/GIDs. This is analogous to the systemd-nspawn's
UIDs/GIDs. This is analogous to the systemd-nspawn's
--private-users=identity.
--private-users=identity.
* The new value "disconnected" for the unit setting PrivateTmp= may be
* The new unit option PrivateTmp=disconnected can be used to specify
used to specify that a separate tmpfs instance should be used for
that a separate tmpfs instance should be used for /tmp/ and /var/tmp/
/tmp/ and /var/tmp/ for the unit.
for the unit.
* The server manager (and various other tools too) use pidfds in more
* The manager (and various other tools too) use pidfds in more places
places to refer to processes.
to refer to processes.
* A build option -D link-executor-shared=false can be used to build
* A build option -D link-executor-shared=false can be used to build
the systemd-executor binary (added in a previous release) in a way
the systemd-executor binary (added in a previous release) in a way
@ -186,41 +185,41 @@ CHANGES WITH 257 in spe:
execute.
execute.
* The systemd.machine_id= kernel command line parameter interpreted by
* The systemd.machine_id= kernel command line parameter interpreted by
PID 1 now supports an additional special value: if set to "firmware"
PID 1 now supports an additional special value: if "firmware" is
the machine ID is initialized from the SMBIOS/DeviceTree system
specified the machine ID is initialized from the SMBIOS/DeviceTree
UUID. (Previously this was already done automatically in VM
system UUID. (Previously this was already done in VM environments,
environments, this extends the concept to any system, but only on
this extends the concept to any system, but only on explicit request
explicit request via this option.)
via this option.)
* The ImportCredential= setting in service unit files now permits
* The ImportCredential= setting in service unit files now permits
renaming of credentials as they are imported.
renaming credentials imported.
* The RestartMode= setting gained a new "debug" value. If specified and
* The RestartMode= gained a new "debug" setting. If specified and the
the service fails so that it shall be restarted it is invoked in
service fails so that it shall be restarted it is invoked in
"debugging mode". Debugging mode means that the $DEBUG_INVOCATION
"debugging mode". Debugging mode means that the $DEBUG_INVOCATION
environment variable will be set to "1" for the new
environment variable will be set to "1" for the new
invocation. Moreover, any setting LogLevelMax= will be temporarily
invocation. Moreover, any setting LogLevelMax= will be temporarily
changed to "debug" for the next invocation. This mode is useful to
changed to "debug" for the next invocation. This mode is useful to
automatically repeat invocation of tools in case they fail –
repeat invocation of tools if they fail but with additional logging
additional logging or testing routines enabled .
or testing routines turned on .
* A new service setting BindLogSockets= has been added that
* A new service setting BindLogSockets= has been added that
controls whether the AF_UNIX sockets required for logging shall be
controls whether the AF_UNIX sockets required for logging shall be
bind mounted to the mount sandbox allocated for the service.
bind mounted to the mount sandbox allocated for the service.
* At early boot, PID 1 will now optionally load a policy for the new
* PID 1 will now optionally load a policy for the new Linux IPE LSM at
Linux IPE LSM .
boot .
* Transient services (as invoked by the StartTransientUnit() D-Bus
* Transient services (StartTransientUnit() D-Bus method) may now
method) may now receive additional, arbitrary file descriptors to
receive additional, arbitrary file descriptors to pass to executed
pass to executed service processes during activation using the new
service processes on activation using the new ExtraFileDescriptor=
ExtraFileDescriptor= unit property.
unit property.
* Calendar .timer units gained a new boolean DeferReactivation=
* Calendar .timer units gained a new boolean DeferReactivation=
option. If enabled and the repetitive calendar timer elapses again
option. If enabled and the repetitive calendar timer elapses again
while the service the timer activates is still running, immediate
while the service the timer activates is still running, immediate
reactivation of the service o nce it finishes is skipped, and the
reactivation once it finishes is skipped, and the timer has to elapse
timer has to elapse again before the service is reactivated.
again before the service is reactivated.
* Generator processes invoked by the service manager will now receive a
* Generator processes invoked by the service manager will now receive a
new environment variable $SYSTEMD_SOFT_REBOOTS_COUNT that indicates
new environment variable $SYSTEMD_SOFT_REBOOTS_COUNT that indicates
@ -246,10 +245,10 @@ CHANGES WITH 257 in spe:
"strict" a new cgroup namespace is allocated for the service, and
"strict" a new cgroup namespace is allocated for the service, and
cgroupfs is mounted read-only for the service.
cgroupfs is mounted read-only for the service.
* The StateDirectory=, RuntimeDirectory=, CacheDirectory=,
* The StateDirectory=, RuntimeDirectory=, CacheDirectory=, LogsDirectory=,
LogsDirectory=, and ConfigurationDirectory= settings gained support
and ConfigurationDirectory= settings gained support for configuring the
for configuring the respective directories as read-only, via a ':ro'
respective directories as read-only, via a ':ro' flag that can be
flag that can be appended to each setting's value .
appended to each setting.
* When DynamicUser= is combined with
* When DynamicUser= is combined with
StateDirectory=/RuntimeDirectory=/CacheDirectory=/LogsDirectory= and
StateDirectory=/RuntimeDirectory=/CacheDirectory=/LogsDirectory= and
@ -259,15 +258,15 @@ CHANGES WITH 257 in spe:
chown()ing.
chown()ing.
* A new service property PrivatePIDs= has been added that runs executed
* A new service property PrivatePIDs= has been added that runs executed
processes as PID 1 - the init process - within their own PID
processes as PID 1 - the init process - within their own PID namespace.
namespace. PrivatePIDs= also mounts /proc/ so only processes within
PrivatePIDs= also mounts /proc/ so only processes within the new PID
the new PID namespace are visible.
namespace are visible.
systemd-udevd:
systemd-udevd:
* udev rules now set 'uaccess' for /dev/udmabuf, giving locally
* udev rules now set 'uaccess' for /dev/udmabuf, giving locally
logged-in users access to the hardware. This is useful i n ord er to
logged-in users access to the hardware. This is necessa ry to support
support IPMI cameras with libcamera.
IPMI cameras with libcamera.
* Serial port devices will no longer show up as systemd units, unless
* Serial port devices will no longer show up as systemd units, unless
they have an IO port or memory assigned to them. This means that only
they have an IO port or memory assigned to them. This means that only
@ -282,9 +281,9 @@ CHANGES WITH 257 in spe:
searched for both on the interface's parent device (as before) and
searched for both on the interface's parent device (as before) and
the device itself (new).
the device itself (new).
* Various USB hardware wallets are now recognized by udev via a .hwdb
* Various USB hardware wallets have are now recognized by udev via a
file, and get the ID_HARDWARE_WALLET= property set, which enables
.hwdb file, and get the ID_HARDWARE_WALLET= property set, which
"uaccess" for them, i.e. direct unprivileged access.
enables "uaccess" for them, i.e. direct unprivileged access.
* udevadm info will now output the device ID string in lines prefixed
* udevadm info will now output the device ID string in lines prefixed
with "J:", and the driver subsystem in lines prefixed with "B:".
with "J:", and the driver subsystem in lines prefixed with "B:".
@ -294,8 +293,8 @@ CHANGES WITH 257 in spe:
systemd-logind:
systemd-logind:
* New DesignatedMaintenanceTime= configuration option allows shutdowns
* New DesignatedMaintenanceTime= configuration option allows
to be automatically scheduled at the specified time.
shutdowns to be automatically scheduled at the specified time.
* logind now reacts to Ctrl-Alt-Shift-Esc being pressed. It will send
* logind now reacts to Ctrl-Alt-Shift-Esc being pressed. It will send
out a org.freedesktop.login1.SecureAttentionKey signal, indicating a
out a org.freedesktop.login1.SecureAttentionKey signal, indicating a
@ -309,8 +308,8 @@ CHANGES WITH 257 in spe:
session switches away.
session switches away.
* systemd-logind now exposes two D-Bus properties CanLock and CanIdle
* systemd-logind now exposes two D-Bus properties CanLock and CanIdle
for all sessions. These properties indicate whether the session' s
for all sessions that indicate whether the session's class support s
class supports screen locking and idleness detection.
screen locking and idle detection.
* systemd-inhibit now allows interactive polkit authorization. It
* systemd-inhibit now allows interactive polkit authorization. It
gained a --no-ask-password option to suppress it.
gained a --no-ask-password option to suppress it.
@ -321,13 +320,12 @@ CHANGES WITH 257 in spe:
Machines started via the systemd-vmspawn@.service unit will now be
Machines started via the systemd-vmspawn@.service unit will now be
registered with systemd-machined.
registered with systemd-machined.
* systemd-machined gained a pretty complete set of Varlink APIs
* systemd-machined gained a pretty complete set of Varlink interfaces
exposing its functionality. This is an alternative to the
to its functionality as alternative to the existing D-Bus interface.
pre-existing D-Bus interface.
systemd-resolved:
systemd-resolved:
* The resolvconf command now supports '-p' switch. If specified, the
* resolvconf command now supports '-p' switch. If specified, the
interface will not be used as the default route for domain name
interface will not be used as the default route for domain name
lookups.
lookups.
@ -339,11 +337,11 @@ CHANGES WITH 257 in spe:
* IPv6 address labels can be configured in a new [IPv6AddressLabel]
* IPv6 address labels can be configured in a new [IPv6AddressLabel]
section with Prefix= and Label= settings.
section with Prefix= and Label= settings.
* 'networkctl edit' can now read the new file contents from standard
* 'networkctl edit' can now read the new contents from standard input
input with the new --stdin option.
with the new --stdin option.
* 'networkctl edit' and 'cat' now support editing/show ing .netdev files
* 'networkctl edit' and 'cat' now supports editing .netdev files by
by link. 'networkctl cat' can also list all configuration files
link. 'networkctl cat' can also list all configuration files
associated with an interface at once with ':all'.
associated with an interface at once with ':all'.
* networkctl gained a --no-ask-password option to suppress interactive
* networkctl gained a --no-ask-password option to suppress interactive
@ -352,7 +350,7 @@ CHANGES WITH 257 in spe:
* "mac" has been added to the default AlternativeNamesPolicy= setting
* "mac" has been added to the default AlternativeNamesPolicy= setting
for network links (via 99-default.link). This means "enx*" interface
for network links (via 99-default.link). This means "enx*" interface
names will now be added to the list of alternative interface names by
names will now be added to the list of alternative interface names by
default, for all interfaces that have a MAC address assigned
default for all interfaces that have a MAC address assigned to them
by hardware.
by hardware.
* networkd .netdev bridge devices gained a new setting FDBMaxLearned=
* networkd .netdev bridge devices gained a new setting FDBMaxLearned=
@ -367,18 +365,18 @@ CHANGES WITH 257 in spe:
thus highlighting conflict of ownership/management of these knobs.
thus highlighting conflict of ownership/management of these knobs.
* systemd-networkd will now make RFC9463 DNR fields available to
* systemd-networkd will now make RFC9463 DNR fields available to
systemd-resolved, for automatic DNS D oT configuration, and similar.
systemd-resolved, for automatic DoT configuration, and similar.
systemd-boot, systemd-stub, and related tools:
systemd-boot, systemd-stub, and related tools:
* The EFI stub now supports loading of .ucode sections with microcode
* The EFI stub now supports loading of .ucode sections with microcode
from PE add-on files. It also now supports loading .initrd sections
from PE add-on files. It now also supports loading .initrd sections
from PE add-on files.
from PE add-on files.
* A new .profile PE section type is now documented and supported in
* A new .profile PE section type is now documented and supported in
systemd-measure, ukify, systemd-stub and systemd-boot. The se new
systemd-measure, ukify, systemd-stub and systemd-boot. Tho se new
sections allow multiple "profiles" to be stored together in the UKI,
sections allow multiple "profiles" to be stored together in the UKI,
where each .profile section creates groupings of sections in the UKI,
with .profile sections creating groupings of sections in the UKI,
allowing some sections to be shared and other sections like .cmdline
allowing some sections to be shared and other sections like .cmdline
or .initrd unique to the profile. This may be used to provide a
or .initrd unique to the profile. This may be used to provide a
single UKI that synthesizes multiple menu items in the boot menu (for
single UKI that synthesizes multiple menu items in the boot menu (for
@ -391,10 +389,10 @@ CHANGES WITH 257 in spe:
can contain multiple .dtbauto sections, and the 'compatible' string
can contain multiple .dtbauto sections, and the 'compatible' string
therein will be compared with the equivalent field in the DTB
therein will be compared with the equivalent field in the DTB
provided by the firmware, if present. If absent, SMBIOS will be used
provided by the firmware, if present. If absent, SMBIOS will be used
to calculate hardware IDs (CHIDs) and look them up in the content of
to calculate hardware IDs and compare them with the content of
.hwids, hopefully revealing an fallback 'compatible' string. This
.hwids. This allows including multiple DTBs in a single UKI, with
allows including multiple DTBs in a single UKI, with systemd-stub
the bootloader automatically selecting the correct one for the
automatically loading the correct one for the current hardware.
current hardware.
* ukify gained an --extend switch to import an existing UKI to
* ukify gained an --extend switch to import an existing UKI to
be extended, and a --measure-base= switch to support measurement
be extended, and a --measure-base= switch to support measurement
@ -407,26 +405,25 @@ CHANGES WITH 257 in spe:
* systemd-stub will report the partition UUID and image identifier its
* systemd-stub will report the partition UUID and image identifier its
UKI executable is placed on separately from the data systemd-boot
UKI executable is placed on separately from the data systemd-boot
provides about where to find its own executable, via EFI
provides about where to find its own executable. This is useful when
variables. This is useful when systemd-boot and UKIs are placed on
systemd-boot and UKIs are placed on distinct partitions (i.e. ESP and
distinct partitions (i.e. ESP and XBOOTLDR).
XBOOTLDR).
* bootctl gained new switches --print-loader-path and --print-stub-path
* bootctl --print-loader-path and --print-stub-path that output the
that output the path to the boot loader or UKI used for the current
path to the boot loader or UKI used for the current boot.
boot.
* bootctl kernel-identify now recognizes EFI add-ons.
* bootctl kernel-identify now supports identifying EFI add-ons.
* bootctl gained a --random-seed=yes|no option to control provisioning
* bootctl gained a --random-seed=yes|no option to control provisioning
of the random seed file in the ESP. (This is useful when producing an
of the random seed file in ESP. (This is useful when producing an
image that will be used in multiple instanc es.)
image that will be used multiple tim es.)
* bootctl now optionally supports installing UEFI Secure Boot databases
* bootctl now optionally supports installing UEFI Secure Boot databases
(i.e. db/dbx/… databases in ESL format) for systemd-boot to pick up
(ESLs) for systemd-boot to pick up and automatically enroll if the
and automatically enroll if the system is booted in Setup Mode. This
system is booted in Setup Mode. This is controlled via bootctl's new
is controlled via bootctl's new --secure-boot-auto-enroll=yes switch
--secure-boot-auto-enroll=yes switch (and some auxiliary ones). A
(and some auxiliary ones). A certificate can be provided in DER
certificate can be provided in DER format, and it is automatically
format, and is automatically converted into an ESL, as needed.
converted into an ESL, as needed.
* bootctl, systemd-measure, systemd-repart when referencing signing
* bootctl, systemd-measure, systemd-repart when referencing signing
keys on OpenSSL engines may now query for PINs and similar via
keys on OpenSSL engines may now query for PINs and similar via
@ -434,9 +431,9 @@ CHANGES WITH 257 in spe:
caching and UI).
caching and UI).
* A new systemd-sbsign tool has been added, that can be used to sign
* A new systemd-sbsign tool has been added, that can be used to sign
EFI binaries (PE) for Secure Boot . This tool supports OpenSSL engines
EFI binaries (PE). This tool supports OpenSSL engines and providers,
and providers, with pin caching support for PKCS11. ukify supports it
with pin caching support for PKCS11. ukify supports it as an
as an a lternative to sbsigntool and pesign.
alternative to sbsigntool and pesign.
The journal:
The journal:
@ -471,22 +468,22 @@ CHANGES WITH 257 in spe:
and AppStream metadata.
and AppStream metadata.
* Transfer definitions for systemd-sysupdate are supposed to carry the
* Transfer definitions for systemd-sysupdate are supposed to carry the
".transfer" suffix now, changing from ".conf". The latter rema in s
".transfer" suffix now, changing from ".conf". The latter is
supported for compatibility, but it's recommended to rename all files
supported for compatibility too , but it's recommended to rename all
reflecting this suffix change.
files reflecting this suffix change.
* systemd-sysupdate now supports new ".feature" files that may be
* systemd-sysupdate now supports a new ".feature" files that may be
used in conjunction with ".transfer" files to group them together, and
used in conjunction with ".transfer" files to group them together, and
allow them to be turned off or on, individually per group.
allow them to be turned off or on, individually per group.
TPM & systemd-cryptsetup:
TPM & systemd-cryptsetup:
* The 'has-tpm2' verb which reports whether TPM2 functionality is
* The 'tpm2' verb which lists usable TPM2 devices has been moved from
available has been moved from systemd-creds to systemd-analyze.
systemd-creds to systemd-analyze.
* systemd-tpm2-setup will gracefully handle TPMs that have a PIN set on
* systemd-tpm2-setup will gracefully handle TPMs that have a PIN set on
the TPM, and not attempt to a utomatically set up a Storage Root Key
the TPM, and not automatically set up a Storage Root Key (SRK) in
(SRK) in that case.
that case.
* New crypttab option password-cache=yes|no|read-only can be used to
* New crypttab option password-cache=yes|no|read-only can be used to
customize password caching.
customize password caching.
@ -528,7 +525,7 @@ CHANGES WITH 257 in spe:
start the specified executable on the remote side, and communicate
start the specified executable on the remote side, and communicate
with the remote process using the Varlink protocol.
with the remote process using the Varlink protocol.
The "ssh:" address specification has been renamed to "ssh-unix:"
"ssh:" address specification has been renamed to "ssh-unix:"
(reflecting the fact it is used to connect to a remote AF_UNIX socket
(reflecting the fact it is used to connect to a remote AF_UNIX socket
via SSH). The old syntax is still supported for backwards
via SSH). The old syntax is still supported for backwards
compatibility.
compatibility.
@ -549,8 +546,7 @@ CHANGES WITH 257 in spe:
to enable internal compression in filesystems created offline.
to enable internal compression in filesystems created offline.
* systemd-repart understands a new MakeSymlinks= option to create one
* systemd-repart understands a new MakeSymlinks= option to create one
or more symlinks (each specified as a symlink name and target) within
or more symlinks (each specified as a symlink name and target).
a newly formatted file system.
* systemd-repart gained a new SupplementFor= setting that allows
* systemd-repart gained a new SupplementFor= setting that allows
allocating a partition only if some other existing partition cannot
allocating a partition only if some other existing partition cannot
@ -563,15 +559,15 @@ CHANGES WITH 257 in spe:
systemd-ssh-proxy:
systemd-ssh-proxy:
* systemd-ssh-proxy now also supports the AF_UNIX-based "VSOCK MUX"
* systemd-ssh-proxy now also supports the "VSOCK MUX" protocol used by
protocol used by CloudHypervisor/Firecracker to expose AF_VSOCK
CloudHypervisor/Firecracker to expose AF_VSOCK sockets of the VM on
sockets of the VM on the host. Or in other words: it's now possible
the host. Or in other words: it's now possible to directly connect to
to directly connect to ssh via AF_VSOCK from hosts to VMs of these
ssh via AF_VSOCK from hosts to VMs of these two hypervisors
two hypervisors (previously this was only supported for hypervisors
(previously this was only supported for hypervisors which expose
which expose AF_VSOCK on the host as AF_VSOCK, such as qemu).
AF_VSOCK on the host as AF_VSOCK, such as qemu).
* systemd-ssh-proxy can now reference local VMs by their name: connect
* systemd-ssh-proxy can now reference local VMs by their name: connect
to any local VM "foobar" registered with systemd- machined via "ssh
to any local VM "foobar" registered with machined via "ssh
machine/foobar" using the AF_VSOCK protocol.
machine/foobar" using the AF_VSOCK protocol.
systemd-analyze:
systemd-analyze:
@ -595,6 +591,7 @@ CHANGES WITH 257 in spe:
* 'busctl monitor' gained new options --limit-messages= and --timeout=
* 'busctl monitor' gained new options --limit-messages= and --timeout=
to set the number of matches or limit the runtime of the command.
to set the number of matches or limit the runtime of the command.
This is intended to be used in scripts.
* busctl now supports doing method calls with embedded unix file
* busctl now supports doing method calls with embedded unix file
descriptors.
descriptors.
@ -612,9 +609,9 @@ CHANGES WITH 257 in spe:
systemd-importd:
systemd-importd:
* A new generator sytemd-import-generator has been added to synthesize
* A new generator sytemd-import-generator has been added to
image download jobs. This provides functionality similar to
synthetisize image download jobs. This provides functionality similar
importctl, but is configured via the kernel command line and system
to importctl, but configured via the kernel command line and system
credentials. It may be used to automatically download sysext,
credentials. It may be used to automatically download sysext,
confext, portable service, nspawn container or vmspawn VM images at
confext, portable service, nspawn container or vmspawn VM images at
boot.
boot.
@ -643,32 +640,6 @@ CHANGES WITH 257 in spe:
systemd-homed to allow users to change selected properties of their
systemd-homed to allow users to change selected properties of their
own user records.
own user records.
systemd-run & run0:
* run0 gained a new pair of settings --pty and --pipe that control
whether to invoke the specified binary on a freshly allocated pseudo
TTY, or whether to pass the client's STDIN/STDOUT/STDERR through
directly.
* run0 gained a new switch --shell-prompt-prefix= that permits passing
in a string to display on each shell prompt as prefix. If not
specified otherwise this will show a superhero emoji (🦸), in order
to visually communicate the temporarily elevated privileges a run0
session provides. This makes use of the $SHELL_PROMPT_PREFIX
environment variables mentioned below.
* systemd-run can output some of its runtime data in JSON format via
the new --json= option.
systemd-tmpfiles:
* systemd-tmpfiles --purge switch now requires specification of at
least one tmpfiles.d/ drop-in file.
* tmpfiles.d/ files gained a new '?' specifier for the 'L' line type to
create a symlink only if the source exists, and gracefully skip the
line otherwise.
Miscellaneous:
Miscellaneous:
* systemctl now supports the --now option with the 'reenable' verb.
* systemctl now supports the --now option with the 'reenable' verb.
@ -683,13 +654,21 @@ CHANGES WITH 257 in spe:
* localectl gained a -l/--full option to show output without
* localectl gained a -l/--full option to show output without
ellipsization.
ellipsization.
* systemd-run can output some data as JSON via the new --json= option.
* timedatectl now supports interactive polkit authorization.
* timedatectl now supports interactive polkit authorization.
* systemd-tmpfiles --purge switch now requires specification of at
least one tmpfiles.d/ drop-in file.
* tmpfiles.d gained a new '?' specifier for the 'L' type to create a
symlink only if the source exists, and gracefully skip otherwise.
* The new Linux mseal(), listmount(), statmount() syscalls have been
* The new Linux mseal(), listmount(), statmount() syscalls have been
added to relevant system call groups.
added to relevant system call groups.
* The systemd-ask-password logic has been extended with a per-user
* The systemd-ask-password concept has been extended with a per-user
scope, i.e. user programs may now ask for passwords via the same
concept , i.e. user programs may now ask for passwords via the same
mechanism and the previously system-wide only mechanism.
mechanism and the previously system-wide only mechanism.
* A new set of system/service credentials are added:
* A new set of system/service credentials are added:
@ -702,8 +681,17 @@ CHANGES WITH 257 in spe:
useful to visually highlight the fact a specific shell prompt
useful to visually highlight the fact a specific shell prompt
originates from a specific system, execution context or tool. These
originates from a specific system, execution context or tool. These
credentials and environment variables are supposed to be generically
credentials and environment variables are supposed to be generically
useful within and outside of the immediate systemd context. It is
useful within and outside of the immediate systemd context.
also used by 'run0', see above.
* run0 gained a new pair of settings --pty and --pipe that control
whether to invoke the specified binary on a freshly allocated pseudo
TTY, or whether to pass the client's STDIN/STDOUT/STDERR through
directly. run0 also gained a new switch --shell-prompt-prefix= that
permits passing in a string to display on each shell prompt as
prefix. If not specified otherwise this will show a superman emoji
(🦸), in order to visually communicate the temporarily elevated
privileges a run0 session provides. This makes use of the
$SHELL_PROMPT_PREFIX environment variables mentioned above.
* New RELEASE_TYPE=, EXPERIMENT=, EXPERIMENT_URL= fields have been
* New RELEASE_TYPE=, EXPERIMENT=, EXPERIMENT_URL= fields have been
defined for the /etc/os-release file. For example,
defined for the /etc/os-release file. For example,
@ -730,28 +718,28 @@ CHANGES WITH 257 in spe:
https://github.com/microsoft/terminal/pull/8055
https://github.com/microsoft/terminal/pull/8055
https://conemu.github.io/en/AnsiEscapeCodes.html#ConEmu_specific_OSC
https://conemu.github.io/en/AnsiEscapeCodes.html#ConEmu_specific_OSC
* systemd-sysusers is now able to create fully locked use r
* systemd-sysusers is now able to create fully locked accounts. Fo r
accounts. For compatibility it so far created accounts with a locked
compatibility it so far created accounts with a locked (i.e. invalid)
(i.e. invalid) password, but not marked locked as a whole. With the
password, but not marked locked as a whole. With the new "!" modifier
new "!" modifier for "u" lines, it is now possible to create fully
for "u" lines, it is now possible to create fully locked
locked accounts. The distinction between accounts with a locked
accounts. The distinction between accounts with a locked password and
password and fully locked accounts is relevant when considering
fully locked accounts is relevant when considering non-password forms
non-password forms of authentication, i.e. SSH and such. It is
of authentication, i.e. SSH and such. It is strongly recommended to
strongly recommended to make use of this new feature for almost all
make use of this new feature for almost all system accounts, since
system accounts, since they usually do not require (and should not
they usually do not require (and should not permit) interactive
permit) interactive logins. All of systemd's own system users have
logins. All of systemd's own system users have been changed to be
been changed to be marked as fully locked.
marked as fully locked.
* systemd-coredump now supports a new EnterNamespace= option, which
* systemd-coredump now supports a new EnterNamespace= option, which
defaults to off. If enabled systemd-coredump will access the mount
defaults to off. If enabled systemd-coredump will access the mount
namespace of any crashed process to acquire debug symbol information,
namespace of any crashed process to acquire debug symbol information,
in order to be able to symbolize backtraces. This option is useful to
in order to be able to symbolized backtraces. This option is useful
improve backtraces of processes of containerized applications. (Note
to improve backtraces of processes of containerized
that the host systemd-coredump preferably dispatches coredump
applications. (Note that the host systemd-coredump preferably
processing to the container itself, if it supports that. Only full-OS
dispatches coredump processing to the container itself, if it
containers which run systemd inside will support this however, in
supports that. Only full-OS containers which run systemd inside will
other cases EnterNamespace= might be an suitable approach to acquire
supp ort this howev er, in which case EnterNamespace= might be an
symbolized backtraces.)
alternative approach to acquire symbolized backtraces.)
Contributions from: A.
Contributions from: A.
Alain
Alain
Lennart Poettering