Re: [LFS Trac] #5959: systemd-261.1

LFS Trac ([email protected] via lfs-book Mailing List) <[email protected]> Sun, 28 Jun 2026 22:53:34 -0000
Newsgroups gmane.linux.lfs.book
Message-ID <[email protected]>
#5959: systemd-261.1
-------------------------+-----------------------
 Reporter:  Bruce Dubbs  |       Owner:  lfs-book
     Type:  enhancement  |      Status:  new
 Priority:  normal       |   Milestone:  13.1
Component:  Book         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+-----------------------
Comment (by Bruce Dubbs):

 CHANGES WITH 261:

         Announcements of Future Feature Removals and Incompatible Changes:

         * systemd-logind's integration with the UAPI.1 Boot Loader
           Specification (which allows the systemctl reboot --boot-loader-
 entry=
           switch to work) so far has supported a special directory
           /run/boot-loader-entries/ which allowed defining boot loader
 entries
           outside of the ESP/XBOOTLDR partition for compatibility with
 legacy
           systems that do not natively implement UAPI.1. However, it
 appears
           that (to our knowledge) it is not actually being used by any
 project
           (quite unlike UAPI.1 itself, which found adoption far beyond
           systemd), and its implementation is incomplete. With the future
 262
           release we intend to remove support for /run/boot-loader-
 entries/ and
           related interfaces, in order to simplify our codebase. Support
 for
           UAPI.1 is – of course – kept in place.

         * The experimental "systemd-sysupdated" D-Bus API is going to be
           removed in the next release. The plan is that in its place
           clients should directly talk to systemd-sysupdate (i.e. the
 backend
           of "systemd-sysupdated") via Varlink IPC. The "updatectl" tool
 will
           be reworked along these lines.

         Feature Removals and Incompatible Changes:

         * systemd-nspawn's --user= option has been renamed to --uid=. The
 -u
           short option continues to work. The old --user NAME and
 --user=NAME
           forms (with and without "=") are still accepted but deprecated;
 a
           warning is emitted suggesting --uid=NAME. The --user option
 (without
           an argument) has been repurposed as a standalone switch to
 select
           the user service manager scope, matching --system.

         * Several configuration fields in the io.systemd.Unit varlink
 interface
           that were previously exposed as plain strings have been
 converted to
           proper enum types. This adds type safety and IDL-level
 validation.
           The output wire format now uses underscores instead of dashes
 and
           plus signs in enum values (e.g. "tty-force" becomes "tty_force",
           "kmsg+console" becomes "kmsg_console"). The previous use of
 plain
           strings for these well-defined enumerations is considered a bug.
           Affected enum types: ExecInputType, ExecOutputType, ProtectHome,
           CGroupController, CollectMode, EmergencyAction, JobMode.

         * It was discovered that some of the events systemd-stub measures
 to
           the TPM were not also measured to the hardware CC registers
 (e.g.
           Intel TDX RTMRs) via EFI_CC_MEASUREMENT_PROTOCOL. In particular,
           devicetree, initrd, ucode addons and the UKI profile were only
           measured to the TPM. The missing measurements for CC have now
 been
           added; however, this changes the expected register values. This
           may need to be reflected in the attestation environments which
 use
           hardware CC registers (in place of TPM quotes).

         * systemd-nspawn gained a new --restrict-address-families= option
 (and
           corresponding RestrictAddressFamilies= setting in .nspawn files)
 to
           restrict which socket address families may be used in the
 container.
           This is currently opt-in. In a future version, the default will
 be
           changed to restrict socket address families to AF_INET, AF_INET6
 and
           AF_UNIX.

         * A new service unit "systemd-pcrosseparator.service" will now
 measure
           a new separator measurement during early userspace into PCRs
 0-7, 9,
           12-14, in order to isolate firmware/pre-boot measurements from
 host
           measurements. This is a safety concept to protect firmware
           measurements on systems where the regular firmware separator
           measurement is missing. It's also useful in environments where a
           software TPM is used, i.e. where TPM functionality is only
 available
           starting with the OS, but not before. Note that this new
 measurement
           has an effect on all indicated PCRs, hence might affect relevant
 TPM
           policies.

         * Support for udev's old database version 0 has been removed. This
           effectively means live upgrades from versions older than v247
 are not
           supported anymore.

         * systemd-networkd gained a new sd-dhcp-relay backend for DHCP
 relay
           agent support. As part of this change, the following
 [DHCPServer]
           settings are deprecated:
           - BindToInterface=
           - RelayTarget=
           - RelayAgentCircuitId=
           - RelayAgentRemoteId=
           They are replaced by DHCPRelay= in [Network], along with new
           [DHCPRelay] section settings in .network files:
           - AgentAddress=
           - GatewayAddress=
           - CircuitId=
           - VirtualSubnetSelection=
           - ExtraOption=
           - InterfacePriority=
           and in networkd.conf:
           - ServerAddress=
           - OverrideServerIdentifier=
           - RemoteId=
           - ExtraOption=

         * Required version of musl (when built with -Dlibc=musl) has been
 raised
           from 1.2.5 to 1.2.6.

         * libsystemd is no longer guaranteed to be linked against libm.
 Whether
           the dependency is recorded depends on whether the compiler
 chooses to
           emit builtins for all calls to libm symbols. Consumers that rely
 on
           libsystemd transitively pulling in libm should link against it
           themselves. There is at least one known case that is still
 unsolved:
           rsyslog crashes on launch due to libfastjson using libm without
 linking
           to it, which was previously masked because libsystemd linked to
 it. If
           forcing a link against libm is required as a workaround,
           '-Wl,--push-state,--no-as-needed,-lm,--pop-state' can be added
 to the
           link flags, or passed to systemd's meson build options via
           '-Dc_link_args=-Wl,--push-state,--no-as-needed,-lm,--pop-state'.

         Changes in the system and service manager:

         * PID1 now supports the kernel's Live Update Orchestration (LUO) /
           Kexec Handover (KHO) systems when present and enabled. System
 units'
           FD Stores are now preserved through kexec, and units will get
 back
           stashed (named) file descriptors after kexec, if the kernel
 supports
           the FD type (at the time of writing only memfds are supported).
           Units can also create their own LUO Sessions by talking to the
 kernel
           directly, and store them in their FD Stores, and those will also
 be
           preserved and passed down to the unit after kexec. Units must
 set
           'FileDescriptorStorePreserve=yes' in order to enable this
 feature.

         * User session managers now support persisting user units' FD
 Stores
           by receiving FDs via the notify socket, and passing them down
 via
           $LISTEN_FDS when the user session is restarted, if the
           'FileDescriptorStorePreserve=yes' and 'FileDescriptorStoreMax='
           options are set in the [email protected] unit. Combined with the LUO
           support, this lets user units persist state (e.g.: memfds)
 across
           not only user session restarts, but also kexec reboots.

         * The manager exposes a new ReloadCount property on its D-Bus and
           Varlink interfaces (org.freedesktop.systemd1.Manager and
           io.systemd.Manager respectively). The counter increments after
           each successfully completed daemon-reload, and it is reset on
           daemon-reexec.

         * A new unit setting CPUSetPartition= has been added that allows
           configuring the cpuset cgroup partition type (e.g. "root",
           "isolated", "member") for a service.

         * A new RestrictFileSystemAccess= setting has been added that uses
 a
           BPF LSM program to restrict execution to only binaries that are
           stored on a signed and verified dm-verity-protected filesystem.

         * The io.systemd.Unit.StartTransient() Varlink method has been
 added
           for invoking service units transiently.

         * A new set of Varlink methods has been added to the
           io.systemd.Manager interface to request system shutdown:
           PowerOff(), Reboot(), SoftReboot(), Halt() and Kexec(). These
           complement the existing D-Bus interfaces.

         * The io.systemd.Manager.ListUnitsByNames() Varlink method allows
           querying multiple units in one call and supports a result limit.

         * A new DefaultMemoryZSwapWriteback= manager setting has been
 added
           that provides a system-wide default for the existing
           MemoryZSwapWriteback= per-unit setting.

         * A new io.systemd.Job Varlink interface exposes information about
           pending and running manager jobs.

         * The service manager knows two new global knobs
           EventLoopRateLimitIntervalSec=/EventLoopRateLimitBurst= to
 configure
           PID1's event loop ratelimit logic. This permits fine-tuning the
           safety logic in PID 1 that slows down operation in case PID 1
 starts
           to busy loop.

         * The service manager gained new per-unit settings
 CPUPressureWatch=/CPUPressureThresholdSec=/IOPressureWatch=/IOPressureThresholdSec=
           which enable services to get generic notifications on CPU or IO
           pressure events.

         * A new global service manager knob MinimumUptimeSec= has been
 added
           that defines a minimum uptime for the system. It defaults to
 15s. If
           the system is shut down more quickly than the specified time a
 delay
           is inserted in the last part of shutdown, in order to avoid
 tight
           boot loops.

         * The FileDescriptorStorePreserve= unit setting can now take a new
 option
           'on-success', which preserves the FD Store when the unit is
 stopped,
           but only if it exited successfully, and discards it otherwise.

         * The service manager now implements a new Varlink interface
           io.systemd.Job for listing/cancelling any queued jobs.

         * A new knob ConditionFraction= enables scheduling of units on a
           specified fraction of the fleet of systems only. It takes a
 "tag"
           string and a percentage. The system's machine ID is hashed
 together
           with the tag into a 32bit integer, and the result is compared
 with
           the percentage of 2^32. If below, the condition is true,
 otherwise
           false. This allows staged rollout of services: if multiple
 systems
           are provisioned with the same units only roughly the specified
           percentage of systems will run the service, the rest will not.

         * A new knob ConditionMachineTag= allows conditioning a unit based
 on
           per-mach "tag" strings, as configured in /etc/machine-info, see
 below.

         New IMDS (Cloud "Instance Metadata Service") Subsystem:

         * The hardware database now contains a new database
 hwdb.d/40-imds.hwdb
           that recognizes various established public clouds by their
 SMBIOS
           information, and provides information on how to reach local IMDS
           functionality on the node. Currently, Amazon EC2, Microsoft
 Azure,
           Google Compute Engine, Hetzner, Oracle Cloud, Scaleway, Tencent
           Cloud, Alibaba ECS and Vultr are recognized.

         * An IMDS subsystem has been added. Specifically, there's now
           systemd-imdsd which provides a local Varlink IPC API that makes
 IMDS
           services accessible to local programs. It provides both a
 relatively
           low-level interface for querying arbitrary fields, and a higher-
 level
           interface for querying certain well-known keys in a generic way
           (which maps to various cloud-specific keys via the hwdb). The
 service
           can be pulled into the boot transaction automatically if a
 supported
           cloud is recognized via the systemd-imds-generator
           functionality. This permits implementation of truly generic
 images
           that can interact with IMDS if available, but operate without if
           not. A tool systemd-imds acts as a client to systemd-imdsd and
           imports various IMDS-provided fields into local system
 credentials,
           which can then be consumed by later services. The acquired IMDS
 data
           is measured before being imported.

         * Networking to cloud IMDS services may be locked down for
 recognized
           clouds. This is recommended for secure installations, but
 typically
           conflicts with traditional IMDS clients such as cloud-init,
 which
           require direct IMDS access. The new meson option "-Dimds-
 network="
           can be used to change the default mode to "locked" at build
 time.

         Changes in the TPM Subsystem:

         * A new ConditionSecurity=measured-os unit condition has been
 added
           that checks whether the system was booted with measured-boot
           semantics (i.e. via systemd-stub or an equivalent verified-boot
           mechanism that measured the OS to the TPM). This is very similar
 to
           the pre-existing ConditionSecurity=measured-uki, but is more
           generic, as it can also cover environments where the
 firmware/UKI does
           not have a TPM but the OS has (which is for example the case if
 the
           TPM is implemented purely in software).

         * A new service systemd-tpm2-swtpm.service has been added that can
 run
           the IBM "swtpm" as a software TPM, for use as an (optional)
 automatic
           fallback for systems that lack a physical TPM but where TPM
           functionality should be made available nonetheless. (This
           functionality must be enabled via
 systemd.tpm2_software_fallback= on
           the kernel command line.) Of course a software TPM running as
 part of
           a system's userspace does not provide a security posture in any
 way
           equivalent to that of a discrete hardware TPM, but in various
           use cases it might still be preferable to having no TPM
 functionality
           at all. The software TPM uses a key derived from the new "boot
           secret" functionality for encryption, and stores its state in
 the
           disk's ESP. This provides at least some protection, and
 reasonable
           persistency from initrd on.

         * systemd-boot and systemd-stub will now measure SMBIOS Type 1,
 Type 2
           and Type 11 in PCR 1, since some firmwares do not measure them,
 even
           though they are supposed to.

         * systemd-tpm2-setup.service will now allocate NvPCRs in an orer
           configurable via the "priority" field of their defining JSON
 object.
           As NV index space is very constrained, it's essential to
 allocate them
           in the order of relevance, so that the least relevant NvPCRs are
           dropped, and the most relevant NvPCRs kept.

         Changes in systemd-tmpfiles and systemd-sysusers:

         * A new tmpfiles.d/root.conf has been added that sets permissions
 on
           the root directory (/) to 0555. This is particularly useful in
           environments where the root file system is created fresh and
 empty
           with only /usr/ mounted in – but it is also useful as a general
           safety net.

         * systemd-tmpfiles gained a new --inline switch which permits
 passing
           tmpfiles.d/ directives directly on the command line rather than
 via a
           configuration file or STDIN. This is similar to the switch of
 the
           same name to systemd-sysusers.

         * New directive types 'k/K' have been added to systemd-tmpfiles
 for
           setting file capabilities.

         Changes in systemd-sysext/systemd-confext:

         * New initrd services systemd-sysext-sysroot.service and
           systemd-confext-sysroot.service are provided. These services are
           used to merge system and configuration extensions for the main
           system from the initrd. This overcomes the limitation that
 system
           and configuration extensions merged from the main system itself
           cannot be used to modify the resources which are used in the
           early boot.

         * A kernel command line kill switch that entirely disables
           systemd-sysext and systemd-confext merging is now honoured.

         Changes in systemd-networkd and networkctl:

         * A new 'networkctl dhcp-lease INTERFACE' command has been added
 to
           dump acquired DHCP leases. This may be useful for inspecting the
           DHCP options provided by the server.

         * systemd-networkd implements the io.systemd.service.Reload()
 Varlink
           method, and exposes new io.systemd.Network.Link.Describe(),
           Reconfigure(), Renew() and ForceRenew() methods. 'networkctl'
 now
           uses these Varlink methods in preference to the legacy D-Bus API
           where possible.

         * A new IPv4SrcValidMark= setting has been added to .network
 files.

         * The VRF.Table= setting now accepts symbolic route table names
 (as
           configured via RouteTable= in networkd.conf) in addition to
           numeric table IDs.

         * New DHCPServerPoolSize= and DHCPServerPoolOffset= properties
 have
           been added to the D-Bus interface, mirroring the existing
           configuration file options.

         * The DHCPv4 server gained support for serving the SIP server
 option
           (RFC 3361) to clients.

         * The Varlink Describe() output now reports interface bit rates.

         * .link files gained knobs to control IRQ affinity.

         Changes in systemd-resolved:

         * systemd-resolved will now read additional DNS resource record
           definitions to resolve locally from JSON drop-in files in
           {/etc,/run,/usr/local/lib,/usr/lib}/systemd/resolve/static.d/.
 This
           is a generalization of /etc/hosts, but is intended to be
           more flexible (i.e. other RR types than just A/AAAA + PTR can be
           configured, even if right now not too many are hooked up yet)
 and
           follow the usual drop-in pattern that avoids ownership
 conflicts.

         * New 'DNSCacheSize=', 'MulticastDNSCacheSize=' and
 'LLMNRCacheSize='
           settings are now supported to allow overriding the default
           per-interface cache sizes for the respective protocols.

         * Insecure DNSSEC answers using unsupported signature or digest
           algorithms are now correctly accepted as insecure, rather than
           being rejected outright.

         * When StaleRetentionSec= is set, the resolver no longer flushes
 its
           cache on server switch or re-probe, keeping potentially useful
           stale entries available.

         * /etc/hosts entries are now re-read on reload (SIGHUP / D-Bus
           Reload() / Varlink Reload()).

         Changes in systemd-udevd, hwdb and udev rules:

         * The DMI ID device (/sys/class/dmi/id) is now tagged so that
           early-boot consumers can reliably order against it.

         * udev's "blkid" builtin will now set a new udev property
           ID_PART_GPT_AUTO_ROOT_DISK_NEEDS_LOOP=1 on boot block devices
 where a
           GPT partition table is detected for a sector size different from
 the
           native sector size of the device. (This typically happens if a
 Hybrid
           ISO9660/GPT disk image is booted as CDROM, where the native
 sector
           size is 2048 but the GPT header uses a 512-byte sector size). If
 this
           happens then a [email protected] instance is automatically
 pulled
           in via a udev rule that generates a loopback block device from
 the
           discovered block device, exposing the device with the corrected
           sector size. Or in other words: booting a fully valid GPT disk
 image
           on a block device with a non-matching sector size will now just
 work,
           and automatically result in a matching loopback device popping
           up. The new property is also set if the boot block device
 carries a
           GPT header (i.e. is partitioned) but the block device has
 partition
           table processing turned off.
         * Persistent network interface naming has been extended to
 auxiliary
           sub-function (SF) network devices (such as mlx5_core SFs), using
 an
           "S<sfnum>" suffix appended to the parent PCI function's name
 (e.g.
           "enp193s0f0S88").

         Changes in systemd-boot, systemd-stub, bootctl, ukify:

         * systemd-stub will now maintain a "boot secret" and pass it to
 the OS
           in the /.extra/boot-secret file in the initrd. This boot secret
 is
           derived from a persistent EFI variable that is not accessible by
 the
           OS (i.e. only accessible in the UEFI environment). The EFI
 variable
           is automatically initialized to a randomly generated value if
 not set
           yet. It is intended to be used for certain fallback codepaths in
 case
           a local TPM is not available, but a UEFI environment is. If a
 TPM is
           available, it's highly recommended to use it as a better source
 of
           per-system key material, but in the absence of a TPM it often
 might be an
           acceptable fallback for local, persistent key material.
 Applications
           should never use the key as-is, but derive their own key from
 it,
           through hashing.

         * systemd-stub now auto-detects the active EFI serial console
 device
           and appends an appropriate "console=" parameter to the kernel
 command
           line, simplifying serial-console UKI deployments: the serial
 console
           output configuration of UEFI is now automatically propagated to
           Linux.

         * systemd-stub will now query the firmware's keyboard mapping and
 pass
           it to the OS via the LoaderKeyboardLayout EFI variable. This
 variable
           is then used by systemd-vconsole-setup as a fallback keyboard
 mapping
           if no mapping is explicitly configured otherwise. On modern
 laptops
           this means there's a good chance that the keyboard mapping of
 the
           built-in keyboard will be automatically detected and set up
 without
           requiring user intervention.

         * A new "extra" Type #1 Boot Loader Specification stanza is parsed
 and
           used to deliver additional resources to a UKI without modifying
 its
           contents. This may be used to pass confext DDIs, sysext DDIs or
           encrypted credentials to a UKI kernel. The generic "addon"
 handling
           has been generalized so that all UKI sidecar artifacts (initrds,
           command-line overlays, devicetree blobs, etc.) follow the same
 lookup
           rules.

         * systemd-boot will never auto-boot a non-default UKI profile,
           preventing accidental boots into alternative profiles after a
           single timeout expiry.

         * systemd-stub: El Torito CDROM boot catalog partition UUIDs are
 now
           discovered and exposed via the same mechanism as GPT/MBR
 partitions,
           enabling unified ISO image dissection.

         * systemd-stub will now incorporate any initrd already configured
 via
           the LINUX_INITRD_MEDIA_GUID UEFI device into the set of initrds
 it
           passes to the kernel (previously it would fail if one was
 already
           set). This means systemd-stub now operates in a purely
 incremental
           mode regarding initrds passed in from earlier boot steps.

         * bootctl gained a new '--print-efi-architecture' option that
 prints
           the EFI architecture identifier of the running system, which is
           useful from scripts.

         * bootctl gained a new 'link' verb (with a matching Varlink API)
 that
           installs a Type #1 boot loader entry based on a UKI in
 combination
           with confext DDIs, sysext DDIs or system credentials.

         * bootctl's 'unlink' verb is now also accessible via a Varlink
 API.

         * bootctl now stores the existing systemd-boot binary as a
 fallback when
           installing a new version, and installs a fallback UEFI boot
 entry, to
           allow a system to recover from a non-working version being
 installed.

         Changes in systemd-repart:

         * A new EncryptKDF= setting controls the KDF used for LUKS2
           partitions (e.g. argon2id, argon2i, pbkdf2).

         * A new VolumeName= setting allows specifying the LUKS2 volume
           name independently of the on-disk partition label.

         * A new BlockDeviceReplace= setting allows partitions to
 atomically
           migrate the contents of an existing block device to a different
           partition. This may be used for OS installers that migrate the
           running OS as a whole from an in-memory block device onto a
 disk,
           requiring no reboot as part of the installation cycle.

         * systemd-repart now supports a new --grain-size= switch to
 explicitly
           select the desired "grain" size (i.e. alignment granularity)
 when
           placing partitions. It defaults to 4K (as before), but can now
 be set
           to any other power of 2 larger than the sector size.

         * A new --el-torito= command line option causes a minimal El
           Torito boot catalog to be written for EFI boot on hybrid ISO
           images.

         * --shrink now uses mkfs.btrfs's native minimal-filesystem support
           when available.

         * A new per-partition Discard= setting may be used to control
           the persistent "allow-discards" flag of LUKS encrypted
 partitions.

         Changes in systemd-sysupdate:

         * systemd-sysupdate now emits READY=1 via sd_notify() after the
           install step completes, allowing for tighter integration with
           orchestration tooling.

         * systemd-sysupdate is now installed in /usr/bin/ alongside the
           other user-facing tools, as it is no longer considered
 experimental.

         Changes in systemd-nspawn, systemd-vmspawn, systemd-machined:

         * systemd-nspawn now supports persisting the payload's system
 manager
           FD Store by receiving FDs via the notify socket, and passing
 them
           down via $LISTEN_FDS when the container is restarted, if the
           'FileDescriptorStorePreserve=yes' and 'FileDescriptorStoreMax='
           options are set in the unit inside which systemd-nspawn is
 running.
           Combined with the LUO support in PID1, this lets containers
 persist
           state (e.g.: memfds) across not only container restarts, but
 also
           kexec reboots.

         * systemd-nspawn gained new --forward-journal= and
           --forward-journal-NAME= options to forward journal entries from
           the payload to specified journal sockets.

         * systemd-vmspawn gained a new --bind-volume= option that binds
 volumes
           provided by the storage provider Varlink logic (see below) into
 a VM.

         * systemd-vmspawn gained a new --console-transport= option that
           controls how the VM console is presented (PTY, native, headless,
           etc.); a PTY is now provided for the native console mode, and
           headless console operation is supported.

         * systemd-vmspawn's --console= switch gained a new value
 "headless" to
           spawn a VM in truly headless mode, i.e. without a console or
 display.

         * systemd-vmspawn gained a new switch --efi-nvram-state= for
           controlling whether and where to persist the EFI variable NVRAM
           between VM invocations. It's modelled after --tpm-state= in
           behaviour. There's also a new --efi-nvram-template= knob for
           selecting a template file to initialize the EFI NVRAM state from
 on
           first boot.

         * systemd-vmspawn's TPM logic will now ensure an endorsement
           certificate is installed.

         * systemd-vmspawn gained a new --firmware-features= option that
           enables or disables individual firmware features (with a
           "~feature" prefix for negation).

         * systemd-vmspawn now searches XDG_DATA_DIRS for QEMU firmware
           descriptors.

         * systemd-vmspawn now supports direct kernel boot without UEFI
           firmware.

         * systemd-vmspawn gained support for a new --image-disk-type=
 switch
           for selecting the block storage type (virtio-blk, virtio-scsi,
 nvme,
           scsi-cd) for block devices exposed to the VM. The --extra-drive=
           switch can now optionally configure this too.

         * The io.systemd.MachineInstance Varlink interface gained
           AddStorage(), RemoveStorage() and ReplaceStorage() methods for
           runtime storage manipulation, implemented by systemd-vmspawn.

         * systemd-vmspawn now pre-allocates PCIe root ports to allow PCIe
           device hotplug, with multifunction packing where supported.

         * systemd-vmspawn now uses the QEMU built-in vdagent (clipboard,
           resolution sync) instead of spicevmc.

         * systemd-vmspawn's --grow-image now detects and rejects qcow2
           images, where the operation is not supported.

         * systemd-vmspawn now propagates the host TERM environment
 variable
           into the VM.

         * systemd-vmspawn gained support for a new --coco= switch for
 enabling
           Confidential Computing. Currently, it only supports AMD SEV-SNP.

         * A new 'storagectl' command line tool and an accompanying
           io.systemd.StorageProvider Varlink interface have been added,
           alongside the new generic providers [email protected]
 and
           [email protected]. These allow exposing storage
           resources (filesystems, block devices) in a unified manner for
 use
           as managed user storage.

         * systemd-machined Machine.List/Register output now includes a
           'controlAddress' field describing the manager's bus address,
           where known.

         * Querying metadata of registered machines is now gated behind
           dedicated polkit actions
           (org.freedesktop.machine1.inspect-machines and inspect-images).

         * machinectl gained 'bind-volume' / 'unbind-volume' verbs to
           manage runtime bind mounts of host paths into running machines,
           and new verbs to control the lifecycle of VMs (pause, resume,
           power-off, etc.) via the io.systemd.MachineInstance Varlink
           interface.

         Changes in systemd-coredump and coredumpctl:

         * 'coredumpctl info' has gained JSON output (--json=).

         * The crashing thread's TID and name are now captured and
           recorded alongside the existing PID/comm metadata.

         * systemd-coredump will now pick up a new field COREDUMP_CODE= for
 all
           coredumps that happen. This is a field provided by kernel 7.1
 that
           contains details about the reason for the coredump, with various
           details depending on the architecture. "coredumpctl info" has
 been
           updated in order to be able to decode this new field.

         Changes in systemd-creds, systemd-cryptsetup and
         systemd-cryptenroll:

         * systemd-creds only locks against the public-key TPM2 PCR when
           booting on UEFI firmware that supports TPMs, avoiding spurious
           errors on systems without a TPM.

         * libcryptsetup is now loaded via dlopen() in the cryptsetup
           binaries, eliminating the hard runtime dependency for systems
 that do
           not actually use it.

         * systemd-cryptenroll now defaults to sealing the LUKS2 key using
           RSA-OAEP with SHA-256 (or SHA-1 if the hardware doesn't support
 it),
           in order to make the setup more robust against theoretical
 future
           brute force attacks. Existing PKCS#1 v1.5 enrollment remain
 supported
           by systemd-cryptsetup for backward compatibility.

         Changes in Dynamic Linking:

         * libgnutls, libmicrohttpd, libcurl, libcrypto, libssl, libfdisk
           and libcryptsetup are now consistently loaded via dlopen()
           throughout the codebase, further reducing the set of mandatory
           dependencies from all binaries.
         * Individual binaries now also embed the dlopen ELF metadata note
           (https://uapi-
 group.org/specifications/specs/elf_dlopen_metadata/) for
           their dlopen() dependencies, which allows packaging tools to
 reliably
           discover the set of optional dependencies of a binary, as
 opposed to
           having the note only on the libsystemd-shared.so ELF object as
 before.

         * The unused dependency on libgpg-error has been dropped.

         │ This means all direct shared library linking against external
 │
         │ libraries has now been replaced by dlopen()-based linking, with
 the │
         │ sole exception of libc.
 │

         Changes related to Varlink:

         * sd-varlink gained a new call sd_varlink_set_sentinel() that
           simplifies generating responses to method calls that have "more"
 set.

         * sd-varlink gained a new call sd_varlink_call_and_upgrade() that
           permits calling a method call with the Varlink "upgrade" feature
           enabled, i.e. that allows switching from Varlink to a different
           protocol. varlinkctl acquired a new --upgrade switch to expose
 this
           functionality. A new call sd_varlink_reply_and_upgrade()
 supports
           "upgrade" mode on the server side.

         * The 'ret' argument of sd_varlink_idl_parse() is now optional.

         * sd-varlink's per-UID connection limit has been reduced to 128.

         * varlinkctl gained a new 'serve' verb that wraps an arbitrary
           command as a Varlink server, and a new '--upgrade' option
           (along with '--exec') to consume the protocol upgrade API.

         Changes in libsystemd:

         * A new public 'sd-dlopen' header-only API has been added that
           provides macros (SD_ELF_NOTE_DLOPEN()) for annotating dlopen'd
           dependencies via the UAPI.12 ELF metadata specification
           (https://uapi-
 group.org/specifications/specs/elf_dlopen_metadata/).
           This header is licensed under MIT-0 to facilitate embedding it
           directly in other projects.

         * sd_json_parse() (and related calls) now supports a pair of new
 flags
           SD_JSON_PARSE_MUST_BE_OBJECT and SD_JSON_PARSE_MUST_BE_ARRAY. If
           specified, these flags cause the parser to fail if the top-level
           parsed JSON variant is not an object/array.

         * sd-json gained a new helper sd_json_parse_fd() that parses JSON
 data
           from a file referenced by a file descriptor. It works similar to
           sd_json_parse_file(), which operates on a FILE*. Moreover, a new
           flag SD_JSON_PARSE_SEEK0 has been added which explicitly resets
 the
           file offset to 0 when parsing via sd_json_parse_file() or
           sd_json_parse_fd().

         * sd-event gained native support for CPU and IO pressure events,
 in
           addition to the pre-existing support for memory pressure events.
 This
           is useful for slowing down or pausing worker threads or so if
 CPU or
           IO is under pressure.

         * sd-path now exposes the XDG 'projects' user directory.

         Changes in systemd-hostnamed:

         * systemd-hostnamed now provides a D-Bus API to acquire arbitrary
           fields from /etc/machine-info.

         * systemd-hostnamed is now available in early boot too (i.e.
 before
           basic.target). Note that D-Bus only becomes available later, and
 it
           can hence only be contacted via Varlink that early.

         * systemd-hostnamed and /etc/machine-info now support a new Tags=
 key,
           which can be used to tag a machine with an arbitrary set of
 strings.
           Units can match on these tags via the new ConditionMachineTag=
 setting,
           and systemd-firstboot can set the tags via command line
 parameters or
           credentials.

         Changes in systemd-logind:

         * A new [email protected] service will now measure a
 minimized
           user record into the new 'login' NvPCR upon first login.

         * A new io.systemd.Shutdown Varlink interface has been introduced
           to request system shutdown. The peer connection identifier of
           the requester is logged.

         * systemd-logind gained new Varlink APIs for listing sessions,
 users,
           seats and inhibitors

         Changes related to kexec:

         * 'systemctl kexec' gained a new --kernel-cmdline= argument that
           overrides the kernel command line for kexec invocations.

         * 'systemctl kexec' now prefers invoking the 'kexec_file_load()'
 system
           call directly, and uses the 'kexec' binary only as a fallback if
 that
           is not available, so that on most systems the dependency on
           'kexec-tools' is no longer necessary.

         Changes in systemd-firstboot:

         * systemd-firstboot will now pre-fill the input prompts for
 keyboard
           and local with the corresponding settings from the firmware if
           supported. There's a good chance, this means on recent hardware
 you
           can just keep hitting Enter in the prompts and will nonetheless
 get
           the right keyboard mapping set up. bootctl will show this data
 too,
           if available.

         * systemd-firstboot will now honour a new "firstboot.hostname"
 system
           credential for persistently setting the system hostname on first
           boot. This is different from the pre-existing "system.hostname",
           which sets the hostname only for the boot the credential is
 passed
           on, and which is not made persistent.

         Other changes:

         * The systemd-report framework introduced in v260 has been
           substantially extended. Basic system metrics
           (PhysicalMemoryBytes, CPUsOnline, SMBIOS fields, /etc/machine-
 info
           fields, Confidential Computing vendor info, TPM2 vendor info)
 are
           now provided by a new [email protected] that is
 enabled
           by default via its report-basic.socket activation unit. Per-
 cgroup
           metrics (CPU time, etc.) and per-service metrics are exposed
 through
           dedicated Varlink services. systemd-report gained the ability to
           upload collected reports via a Varlink socket directory or HTTP
           destinations, and to inject custom HTTP headers when doing so.

         * JSON user database records may now optionally carry a birth date
           field to close the gap with LDAP/OpenID/FreeIPA/etc. homectl
 gained
           a new switch --birth-date= to set it.

         * systemd-vconsole-setup will now gracefully handle the case where
 the
           setfont/loadkeys tools are not installed, and skip operation
 cleanly
           in that case.

         * The _netdev pseudo mount option is now also supported for swap
           devices, i.e. enabling correct boot time ordering to allow
 swapping
           on network block devices.

         * systemd-run gained a new --output= switch for controlling log
 output
           formatting when using "-v" mode.

         * A new component systemd-sysinstall has been added that
 implements a
           simple, modern textual installer for an OS. It's a wrapper
 around
           Varlink calls to systemd-repart (to set up a partition table and
           stream in the OS partitions), bootctl link (to install kernel
 and
           boot menu items for the OS), bootctl install (to install the
           systemd-boot boot loader), systemd-creds (to configure the
 minimal
           amount of system settings, such as keyboard mappings, locale for
 the
           newly installed system), followed by a request to reboot. It
 operates
           either interactively or command-line driven.

         * systemd-oomd gained support for OOM rulesets. These allow fine-
 tuning
           OOM policy handling, and may be defined in
 /etc/systemd/oomd/rules.d/
           and then enabled on a service unit via the new OOMRule= option.

         * systemd-socket-proxy now optionally implements the "PROXY
 protocol
           v1", as defined by "haproxy". See the new --proxy-protocol=
 switch
           for details.

 CHANGES WITH 260:

         Feature Removals and Incompatible Changes:

         * Support for System V service scripts has been removed. Please
 make
           sure to update your software *now* to include a native systemd
 unit
           file instead of a legacy System V script.

           The following components have been removed:

           • systemd-rc-local-generator and rc-local.service,
           • systemd-sysv-generator,
           • systemd-sysv-install (hook for systemctl enable/disable/is-
 enabled).

           The corresponding meson options '-Drc-local=', '-Dsysvinit-
 path=',
           and '-Dsysvrcnd-path=' are deprecated, and will be dropped in a
 future
           release.

         * Meson options '-Dintegration-tests=' and '-Dcryptolib='
 (deprecated
           in v258) have been removed.

         * Support for libidn has been removed. IDN functionality now
 requires
           libidn2. The corresponding meson option '-Dlibidn=' is
 deprecated
           too and will be dropped in a future release.

         * Required versions of various dependencies have been raised:

           • cryptsetup 2.0.1/2.3.0 → 2.4.0,
           • elfutils 158 → 177,
           • libblkid 2.24 → 2.37,
           • libseccomp 2.3.1 → 2.4.0,
           • glibc 2.31 → 2.34,
           • libxcrypt or libcrypt from glibc → libxcrypt 4.4.0 only,
           • OpenSSL 1.1.0 → 3.0.0,
           • Python 3.7.0 → 3.9.0.

         * The Linux kernel version requirements have been updated too:
           baseline 5.4 → 5.10, recommended baseline 5.7 → 5.14, 6.6 for
 full
           functionality. Code for compatibility with versions older than
 the
           baseline has been removed.

         * The parsing of RootImageOptions= and the mount image parameters
 of
           ExtensionImages= and MountImages= has been changed so that the
 last
           definition for a given partition wins and is applied, rather
 than the
           first, to keep these options coherent with other unit settings.

         * Support for non-system users and groups in udev rules and
           systemd-networkd configuration has been restored, but is
 deprecated
           and discouraged. systemd-udevd will emits warnings if a non-
 system
           user/group is specified in OWNER=/GROUP=. Similarly, systemd-
 networkd
           will warn about User=/Group= settings with a non-system
 user/group
           specified in .netdev files for Tun/Tap interfaces. This support
 will
           be removed in a future release.

           Device nodes should not be owned by a non-system user/group. It
 is
           recommended to check udev rules files with 'udevadm verify'
 and/or
           'udevadm test' commands.

         * systemd-repart will now make use of mkfs.xfs's support for
           populating XFS filesystems from a directory. This support was
           added in xfsprogs 6.17.0 released 20 October 2025. As there is
 no
           proper way to detect whether mkfs.xfs supports populating from a
           directory or not, we make use of it unconditionally and have
 dropped
           support for the old way using protofiles.

         * The org.systemd.login1.Manager D-Bus interface has a minor API
 break.
           The CanPowerOff(), CanReboot(), CanSuspend(), etc. family of
 methods
           have introduced new return values which may break downstream
           consumers such as desktop environments. The new return values
 more
           precisely communicate the status of inhibitors: 'inhibited',
           'inhibitor-blocked', and 'challenge-inhibitor-blocked'. This
 allows
           desktops to differentiate between system administrator policy
 and
           temporary restrictions imposed by inhibitors.

         * In systemd-260-rc1, the sd_varlink_field_type_t enum was
 extended in
           a way that changed the numerical values of existing fields. This
 was
           reverted for -rc2. Programs using sd-varlink and compiled with
 the
           headers from -rc1 must be recompiled.
         New system interfaces and components:

         * The os-release(5) gained a new field FANCY_NAME= that is similar
 to
           PRETTY_NAME= but may contain ANSI sequences, and non-ASCII
 Unicode
           glyphs. The new field is also defined to NOT contain any version
           specification, providing better separation between the OS name
 and
           version.

           The systemd manager, systemd-hostnamed, and hostnamectl will now
           show FANCY_NAME= in preference to PRETTY_NAME=.

         * The "Portability and Stability" policy has been simplified and
           updated to strengthen the promises of avoiding user-visible
           regressions in public interfaces. See
           https://systemd.io/PORTABILITY_AND_STABILITY/ for details.

         * Services providing a public Varlink interface can be symlinked
 under
           /run/varlink/registry/, allowing well-known services to be
           enumerated. 'varlinkctl list-registry' can be used to list
 available
           services. This is particularly useful in context of the Varlink
 HTTP
           bridge (https://github.com/mvo5/varlink-http-bridge), which may
           expose all services whose sockets are linked in this directory.

         * A new "metrics" or "report" framework has been defined. Any
 system
           component can hook into the reporting framework by providing a
           Varlink endpoint under /run/systemd/report/.

           systemd-report is a new command line tool which collects the
 reports
           from all endpoints and combines them in JSON format.

           The details of the structure of the reports should be considered
           EXPERIMENTAL at this point. We reserve the right to make
 incompatible
           changes to the JSON structure and/or place additional
 requirements.

           Currently, two components provide metrics this way: systemd-
 networkd
           and the system service manager.

         * A new "mstack" feature has been introduced, to allowing defining
 an
           overlayfs and bind mount arrangement by structuring the content
 of an
           ".mstack/" directory that follows this specification. MStacks
 are
           useful to invoke services and containers from a directory that
 fully
           self describes its intended way of use.

         * A new 'verity' TPM NvPCR has been added. Various components
 measure
           dm-verity images to it upon loading. This includes
           systemd-veritysetup (controllable via the new 'tpm2-measure-
 nvpcr='
           /etc/veritytab setting), and the DDI dissection logic.
         * A canonical set of hwid files for automated DeviceTree mapping
 in
           UKIs is now shipped under /usr/lib/systemd/boot/hwids/<efi-
 arch>/.
           Users and developers are welcome to contribute definitions for
           their specific devices, so that UKIs can automatically find and
 load
           the appropriate DTB on boot, without requiring per-devices and
           per-kernel images. ukify now uses these definition automatically
 if
           present on the system at build time. A first set of hwid files
 for
           arm64 Snapdragon devices has been imported.

         Changes in the system and service manager:

         * A new unit setting RootMStack= has been introduced, to support
 the
           new "mstack" feature for services (see above).

         * The unit setting PrivateUsers= gained a new possible value
 "managed",
           which automatically assigns a dynamic and transient range of
 65536
           UIDs/GIDs to the unit, acquired via systemd-nsresourced.

         * The implementation for PrivateUsers=full has been updated to map
 the
           full range of IDs. The workaround to allow nested systemd older
 than
           257 to correctly detect that it is under such a mapping has been
           dropped.

         * systemd now uses the CSI 18 terminal sequence to query terminal
           size. This allows the query to be made without changing the
 position
           of the cursor. Terminal emulators which do not yet support the
           sequence are encouraged to do so.

         * Service units gained a RefreshOnReload= setting that configures
           whether extensions and credentials are to be refreshed when the
 unit
           is reloaded.

         * A new unit setting BindNetworkInterface= has been introduced
 that
           automatically binds all sockets created by the unit to a
 specific
           network interface. This is generally useful, but in particular
 for
           VRF setups.

         * Two new unit settings ConditionPathIsSocket= and
 AssertPathIsSocket=
           can be used to skip or fail the unit if the given path is not a
           socket.

         * For units which specify PrivateTmp=yes and
 DefaultDependencies=no
           without an explicit requirement for /tmp/, a disconnected /tmp/
 will
           be used, as if PrivateTmp=disconnected was specified. Also, if
 there
           is no explicit ordering for /var/, the private mount for
 /var/tmp/
           will not be created. Those changes avoid race conditions with
           creation of those private directories during early boot and may
           result in changes to unit ordering.

         * EnqueueMarkedJobs() D-Bus method now has a Varlink counterpart.

         * systemctl gained a new 'enqueue-marked' verb, which calls the
           EnqueueMarkedJobs() D-Bus method. The '--marked' parameter,
 which was
           previously used for the same purpose, is now deprecated.

         * SetProperties() D-Bus method now has a Varlink counterpart. For
 now,
           it only supports setting the Markers= property.

         * New 'needs-start' and 'needs-stop' settings are now supported
 for the
           Markers= property.

         * The CPUSchedulingPolicy= service setting now supports the new
 value
           "ext" for enabling the SCHED_EXT scheduler recently added to the
           Linux kernel.

         * A new MemoryTHP= service setting has been added that controls
           per-service Transparent Huge Pages (THP) support.

         Changes in systemd-udevd:

         * Permissions for /dev/ptp* are now set to 0664 (previously 0660),
           allowing unprivileged read-only access. This relies on the
 kernel fix
           "ptp: Add PHC file mode checks. Allow RO adjtime() without
           FMODE_WRITE." (commit b4e53b15c04e3852949003752f48f7a14ae39e86
 in
           v6.15, backported to LTS releases in v6.12.68, v6.6.122,
 v6.1.162,
           v5.15.199, and v5.10.249), which adds missing PTP ioctl
 permission
           checks and keeps clock-modifying operations write-restricted.
 Systems
           running stable kernel branches should ensure they are updated to
 patch
           levels that include the fix.

         * Persistent network interface naming has bee extended to MCTP
 devices
           with the "mc" prefix.

         * The minimum backlight brightness value used when restoring
 backlight
           levels at boot has been lowered from 5% to 1%. This lower value
           should be sufficient to avoid blacked-out displays, but allows
 user
           environments to use a wider range of values (without lower
 values
           being reset during reboot). Note that environments may still set
 very
           low brightness values at runtime independently of the systemd
 clamp
           which only applies during boot.

         * A new udev property ID_INTEGRATION= is now exposed on devices
 that
           have ID_BUS= defined. This variable can be set to 'internal'
 when the
           device is integral part of the system or 'external' otherwise.
           Internal buses like PCI, I2C, SPI... imply 'internal' and
 external
           buses like bluetooth imply 'external'. For USB the 'removable'
           attribute of the port the device is connected to determines the
           result: 'fixed' implies 'internal' and 'removable' or 'unknown'
           implies 'external'.

         * ID_INPUT_JOYSTICK_INTEGRATION= property has been dropped in
 favour of
           ID_INTEGRATION= because it was never used and the new variable
 covers
           the idea that variable was intended for better.

         * A new udev builtin "tpm2_id" is now available which will extract
           vendor/model identification from connected TPM2 devices as they
 are
           probed. This is then used to import data from the udev database,
           possibly containing quirk and other information about specific
 TPMs.

         Changes in systemd-networkd:

         * MultiPathRoute= option now supports interface-bound ECMP routes.

         * systemd-networkd gained integration with ModemManager via the
 "simple
           connect" protocol. A new [MobileNetwork] section has been added
 with
           APN=, AllowedAuthenticationMechanisms=, User=, Password=,
 IPFamily=,
           AllowRoaming=, PIN=, OperatorId=, RouteMetric=, and UseGateway=
           settings. This allows systemd-networkd to establish a cellular
 modem
           connection to a broadband network.

         * systemd-networkd gained a pair of varlink methods
           io.systemd.Network.Link.Up()/Down(). 'networkctl up/down' now
           utilizes those varlink interfaces in place of direct RTNL
 messages
           for better interaction with networkd.

         * .link files gained new ScatterGather=,
 ScatterGatherFragmentList=,
           TCPECNSegmentationOffload=, TCPMangleIdSegmentationOffload=,
           GenericReceiveOffloadList=, GenericReceiveOffloadUDPForwarding=
           options for configuring various details of Ethernet devices.

         * systemd-networkd's Varlink and JSON interfaces will now report
 IP
           addresses both as integer array (as before) and as human
 readable
           string (new addition).

         Changes in systemd-boot and the stub:

         * The timeout in the boot menu can be configured with the
           io.systemd.boot.timeout= SMBIOS type 11 string.

         * A new LoaderEntryPreferred setting has been added to systemd-
 boot that
           is similar to LoaderEntryDefault, but that takes into the
 account boot
           assessment logic, and will skip entries that have the tries-left
 counter
           set to zero.

         * bootctl's Varlink interface gained a new Install() method for
 performing
           systemd-boot installation/upgrade via IPC calls.

         * bootctl gained a new --efi-boot-option-description-with-
 device=yes
           switch which augments the EFI boot option description registered
 with
           the firmware to include information about the disk used for
           booting. This is useful when installing multiple OSes on the
 same
           system, but on different disks. (Example: install a main OS on
 the
           SSD of a laptop, plus another one on an USB stick.)

         Changes in sd-varlink:

         * The Varlink implementation now supports SD_VARLINK_ANY as a
 wildcard
           type. This is useful to declare generic interfaces which need to
           support multiple types.

         * When sd_varlink_connect_url() is invoked with an unrecognized
 URL
           scheme, but an executable named after the scheme exists under
           /usr/lib/systemd/varlink-bridges/, it is invoked and receives an
           AF_UNIX socktpair() via the usual $LISTEN_FDS socket activation
           protocol. The aforementioned Varlink HTTP bridge project makes
 use of
           this to allow any local Varlink client (including varlinkctl) to
           contact remote Varlink services via HTTP. The concept is
 entirely
           generic however, and can be used to plug in arbitrary other
 transport
           protocols, proxies, or connection setup mechanisms.

         Changes in systemd-resolved:

         * systemd-resolved's .delegate files learnt a new setting
 FirewallMark=
           to set the Linux network stack's "firewall mark" value for all
 DNS
           traffic generated by the delegation.

         * resolvectl now uses Varlink to connect to systemd-resolved.

         * Queries done through nss-resolve can be limited to a specific
           interface with the $SYSTEMD_NSS_RESOLVE_INTERFACE environment
           variable.

         * systemd-resolved now supports ifindex=0 in the BrowseServices
 IPC API,
           to allow browsing all mDNS interfaces in one call.

         Changes in systemd-sysupdate/systemd-sysupdated:

         * systemd-sysupdate gained a new 'acquire' verb, allowing the
 download
           and installation or update steps to be done separately.

         * systemd-sysupdate will now refuse processing SHA256SUMS
 manifests if
           they list a file BEST-BEFORE- suffixed by a date that is already
 in
           the past, as a simple mechanism to detect freshness.

         * systemd-sysupdate now can mark partitions as partially
 downloaded.

         Changes in systemd-vmspawn:

         * systemd-vmspawn gained support for registering with systemd-
 machined
           in the user session. New options --user/--system control which
           instance is used.

         * systemd-vmspawn gained support for ephemeral machines via a new
           --ephemeral option. This is similar to the functionality
 provided via
           the same switch in systemd-nspawn.

         * systemd-vmspawn gained a new switch --image-format= for
 selecting the
           image format (i.e. support qcow2 in additin to raw) to boot
 from.
           Also --extra-drive= now takes the image format as a colon
 separated
           parameter.

         Changes in systemd-nsresourced/systemd-mountfsd:

         * The MakeDirectory() Varlink IPC call provided by systemd-
 mountfsd now
           accepts a "mode" parameter for configuring the access mode of
 the
           newly created directory. The MountImage() call gained a new
           "mountOptions" parameter for configuring mount options for the
           various partitions of a DDI explicitly. The call will now also
 report
           via a new "singleFileSystem" field in the response whether it is
           processing a DDI lacking a GPT envelope, and consisting of a raw
 file
           system only. A new input parameter "relaxExtensionReleaseChecks"
           controls whether to enforce extension release checks.

         * systemd-nsresourced's BPF-LSM based security policy on user
           namespaces it delegates UID ranges too is relaxed: processes in
 such
           namespaces may now freely access to inodes owned by UIDs/GIDs
 outside
           of the transient UID range. This reflects the fact that the
 security
           policy exists to ensure ownership of inodes by transient UIDs is
           never persisted on disk.

         * systemd-nsresourced can now delegate multiples of additional 64K
           ranges of UIDs/GIDs to user namespaces, on request. This permits
           nesting of user namespace enabled containers with transient UID
           ranges.

         * systemd-nsresourced now supports a new type user namespace UID
           delegation: only the client's UID is mapped. This is very
 similar to
           what the kernel allows anyway as unprivileged delegation without
           systemd-nsresourced involvement, however, can be combined with
           multiple additional 64K ranges (see above).

         * systemd-nsresourced may now optionally map the "foreign" UID/GID
           range to itself for user namespaces it delegates transient
 UIDs/GIDs
           to. This opens up the concept for nested containers.

         * systemd-nsresourced's and systemd-mountfsd's Varlink sockets may
 now
           be mounted into container trees, to permit nested use of their
           functionality. This can be used automatically in systemd-
 nspawn's
           --private-users-delegate= option.

         Changes in systemd-logind:

         * systemd-logind/systemd-udevd gained support for a new "xaccess"
           concept for delegating access to specific devices to users with
           specially marked sessions. The augments the "uaccess" logic that
           provides device access to users with foreground sessions. The
 primary
           usecase for this is to give access to GPU render devices to
 local
           graphical sessions for remote users, i.e. which are not attached
 to
           any local seat. Sessions are configured via the PAM environment
           variable XDG_SESSION_EXTRA_DEVICE_ACCESS= for this logic.

         * systemd-inhibit --list option gained support for JSON output
           and filtering with --what= , --who=, --why=, and --mode=.

         Changes in systemd-portabled:

         * systemd-portabled now also runs as a user service. Unprivileged
 users
           can run portable services (on sufficiently fresh
           kernels). portablectl gained a pair of switches --user/--system
 to
           explicitly select which service instance to talk to.

         * systemd-portabled will now generate a policy and pin the image
 for a
           portable service, so that the image cannot be changed later
 without a
           reattach.

         Changes in other components:

         * systemd-repart gained basic support for dm-integrity protection
 of
           encrypted volumes. Two new options Integrity= and
 IntegrityAlgorithm=
           can be used to configure integrity checks for LUKS volumes.

         * Image dissection policies have been extended to allow
 restricting
           file system types and requiring integrity checks for encrypted
           volumes with a new 'encryptedwithintegrity' policy.

         * systemd-dissect gained a --copy-ownership= switch to configure
           ownership of copied files.

         * systemd-keyutil gained an 'extract-certificate' verb to print
 the
           X.509 certificate. The existing 'public' verb has been renamed
 to
           'extract-public' as it works analogously. (The old name remains
           available for compatibility.)

         * Support for interactive polkit authorization has been added to
           systemd-sysext and varlinkctl.

         * A polkit policy was added for systemd-ask-password, allowing it
 to be
           used by unprivileged callers.

         * journalctl now implements a Varlink interface that exposes a
           GetEntries() method, which allows retrieving journal entries.

         * systemd-importd gained support for downloading OCI images
 ("importctl
           pull-oci"). They will be stored locally as "mstack" images,
 which
           then can be used by various components, for example be run as
 system
           services via RootMStack= in unit files, or as systemd-nspawn
           containers via --mstack= (see below).

         * systemd-nspawn gained a new --mstack= parameter to support the
 new
           "mstack" feature for containers.

         * A new systemd-mstack command line tool has been introduced to
 support
           the new "mstack" feature interactively.

         * New options SYSTEMD_COLORS=auto-16, SYSTEMD_COLORS=auto-256, and
           SYSTEMD_COLORS=auto-24bit have been added. They are like
           SYSTEMD_COLORS=16, SYSTEMD_COLORS=256, and SYSTEMD_COLORS=24bit
           respectively when output is to a non-dumb TTY, and degrade to
           SYSTEMD_COLORS=no otherwise.

        * Standalone versions of the systemd-sysusers and systemd-tmpfiles
           binaries now support full functionality. (Previously, those
 tools
           were compiled without features which would require libmount and
 pull
           in a lot of dependencies. After the conversion to dlopen the
 option
           whether to support features requiring libmount is made by
 providing
           libmount or not, at install time.)

         * Internal code dealing with processes has been updated to use
 pidfds
           in many places.

         * busctl's 'wait' verb now honours --limit-messages= too.

         * systemd-cryptsetup gained support for a new fixate-volume-key=
           option, that can be used to pin a specific encrypted volume to
 an
           /etc/crypttab entry via its volume key (more precisely a hash
 derived
           from it). systemd-repart will assist generating this
 information.

         * systemd-sysext/systemd-confext's "refresh" will now by default
 try to
           suppress any operation in case no images where added, removed or
           changed. To force a umount/mount operation in this case (i.e.
 get
           back to the status quo ante) a new --always-refresh= option has
 been
           added. Note that the change detection identifies extensions by
           identity (verity hash, or else by file handle/inode, mount ID,
           creation time and modification time), and does not look at their
           contents. In particular, for directory-based extensions, adding,
           removing or modifying files inside the directory (or touching
 the
           directory itself) is not detected, and such a refresh is
 suppressed
           by default. Use --always-refresh=yes to force a refresh in these
           cases.

         * systemd-oomd acquired "prekill hook" functionality, permitting
 other
           system components to synchronously hook into the OOM killing
 logic,
           by registering a Varlink socket in a special directory.

         * systemd-analyze learnt a new verb "identify-tpm2" which shows
           vendor/model information extracted from the system's TPM.

        Changes in units:

         * runlevel[0-6].target units that were removed in v258 have been
           restored and can be enabled with the new -Dcompat-sysv-
 interfaces=yes
           meson option. The installation of legacy.conf for tmpfiles is
 now
           also conditionalized under the same option.

         * [email protected] gained an [Install] and must now be explicitly
 enabled
           to be active.
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/lfs/ticket/5959#comment:4>
LFS Trac <https://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-book
Unsubscribe: See the above information page