SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: fix typos and grammar in NEWS, README and TODO

Browse Source
This commit is contained in:
Yu Watanabe
2026-09-17 11:49:45 +09:00
parent 496712eddc
commit 24de80f596
3 changed files with 83 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files
NEWS
+64 -65
View File
@@ -277,7 +277,7 @@ CHANGES WITH 262 in spe:
read-only, systemd-boot skips updating the seed and does not credit
it to the kernel entropy pool, since a seed that cannot be rotated
would be reused on later boots. This may be used to turn off
random-seed handling in replicated images. (Similar, the boot
random-seed handling in replicated images. (Similarly, the boot
counting logic is disabled if boot entry files or the file system
backing them are marked as read-only.)
@@ -419,8 +419,8 @@ CHANGES WITH 262 in spe:
before removing the old ones. If adding a new slot fails, the old
slots are left intact, avoiding lockout on enrollment failure.
* homectl gained a new --recovery-key-file= option which may used to
write the recover key into a file in an atomic and reasonable safe
* homectl gained a new --recovery-key-file= option which may be used to
write the recovery key into a file in an atomic and reasonably safe
fashion, when enrolling one.
Changes in systemd-tmpfiles:
@@ -502,7 +502,7 @@ CHANGES WITH 262 in spe:
--tpm2-argon2id-memory=, --tpm2-argon2id-iterations=,
--tpm2-argon2id-parallelism= and --tpm2-argon2id-iter-time=.
* systemd-cryptenroll now support an optional "first-boot" wizard for
* systemd-cryptenroll now supports an optional "first-boot" wizard for
enrolling additional unlock mechanisms. This is intended to be used
in TPM enabled scenarios which default to unattended TPM-based disk
encryption, but where enrollment of additional mechanisms to decrypt
@@ -517,7 +517,7 @@ CHANGES WITH 262 in spe:
to unlock the disk via an empty password, instead of prompting the
user for one. There's also a new --unlock-headless switch, which is
equivalent to --unlock-tpm2 if a TPM is available, and otherwise
equivalent to --unlock-empty. This is supposed to to be useful in
equivalent to --unlock-empty. This is supposed to be useful in
scenarios where the system defaults to unattended encryption with a
TPM if one is available, and an empty password otherwise.
@@ -645,7 +645,7 @@ CHANGES WITH 262 in spe:
* userdb services may now advertise via xattrs on their Varlink AF_UNIX
entrypoint socket inodes for which subset of UID/GID ranges or
user/group names (via glob expression) they shell be queried. This is
user/group names (via glob expression) they shall be queried. This is
a very efficient way to suppress unnecessary userdb backend IPC
requests with very basic filtering. All of systemd's own userdb
providers set the appropriate xattrs.
@@ -716,7 +716,7 @@ CHANGES WITH 262 in spe:
* systemd-sysext will now honour new fields EXTENSION_RESTART_UNITS=
and EXTENSION_RELOAD_OR_RESTART_UNITS= in the extension-release file.
If may list units to restart or reload when a sysext is applied.
It may list units to restart or reload when a sysext is applied.
* systemd-sysext can now automatically refresh if a systemd-sysupdate
run completed, by enabling the systemd-sysupdate-notify-sysext.socket
@@ -1135,7 +1135,7 @@ CHANGES WITH 261:
and Type 11 in PCR 1, since some firmwares do not measure them, even
though they are supposed to.
* systemd-tpm2-setup.service will now allocate NvPCRs in an orer
* systemd-tpm2-setup.service will now allocate NvPCRs in an order
configurable via the "priority" field of their defining JSON object.
As NV index space is very constrained, it's essential to allocate them
in the order of relevance, so that the least relevant NvPCRs are
@@ -1758,7 +1758,7 @@ CHANGES WITH 260:
* Support for non-system users and groups in udev rules and
systemd-networkd configuration has been restored, but is deprecated
and discouraged. systemd-udevd will emits warnings if a non-system
and discouraged. systemd-udevd will emit warnings if a non-system
user/group is specified in OWNER=/GROUP=. Similarly, systemd-networkd
will warn about User=/Group= settings with a non-system user/group
specified in .netdev files for Tun/Tap interfaces. This support will
@@ -1917,7 +1917,7 @@ CHANGES WITH 260:
running stable kernel branches should ensure they are updated to patch
levels that include the fix.
* Persistent network interface naming has bee extended to MCTP devices
* Persistent network interface naming has been extended to MCTP devices
with the "mc" prefix.
* The minimum backlight brightness value used when restoring backlight
@@ -2044,7 +2044,7 @@ CHANGES WITH 260:
the same switch in systemd-nspawn.
* systemd-vmspawn gained a new switch --image-format= for selecting the
image format (i.e. support qcow2 in additin to raw) to boot from.
image format (i.e. support qcow2 in addition to raw) to boot from.
Also --extra-drive= now takes the image format as a colon separated
parameter.
@@ -2306,7 +2306,7 @@ CHANGES WITH 259:
* The image dissection logic will now enforce the VFAT file system type
for XBOOTLDR partitions, similar to how it already does this for the
ESP. This is done for security, since both the ESP and XBOOTLDR must
be directly firmware-accessible and thus cannot by protected by
be directly firmware-accessible and thus cannot be protected by
cryptographic means. Thus it is essential to not mount arbitrarily
complex file systems on them. This restriction only applies if
automatic dissection is used. If other file system types shall be
@@ -2487,7 +2487,7 @@ CHANGES WITH 259:
* systemd-homed's fscrypt backend gained a new key sealing format that
aims to be more future-proof and robust against advances in brute
forcing techniques. Compatibiilty with the existing format is maintained,
forcing techniques. Compatibility with the existing format is maintained,
but new enrollments will happen with the new format. Users enrolling
new systems must thus take care in not downgrading to an older version.
@@ -2691,7 +2691,7 @@ CHANGES WITH 259:
* A new service systemd-pcrproduct.service is added which is similar to
systemd-pcrmachine.service but instead of the machine ID
(i.e. /etc/machined-id) measures the product ID (as reported by SMBIOS
(i.e. /etc/machine-id) measures the product ID (as reported by SMBIOS
or Devicetree). It uses a new NvPCR called "hardware" for this.
* systemd-pcrlock has been updated to generate CEL event log data
@@ -3630,7 +3630,7 @@ CHANGES WITH 258:
* bootctl's --no-variables switch has been replaced by
--variables=yes/no. By setting --variables=yes modification of EFI
variables can be forced now in environments where we'd previously
automatically turn this off (e.g. in choot() contexts).
automatically turn this off (e.g. in chroot() contexts).
* bootctl's --graceful is now implicitly enabled when running in a
chroot, to ease integration in packaging scriptlets.
@@ -4001,7 +4001,7 @@ CHANGES WITH 258:
filename.
* systemd-dissect's --attach command now supports a new --quiet switch
that suppressed output of the loopback device node path that is
that suppresses output of the loopback device node path that is
usually shown.
* A generic service template systemd-loop@.service has been added that
@@ -4046,7 +4046,7 @@ CHANGES WITH 258:
* The DDI dissection logic now understands a concept of partition
"filtering". A partition filter is simply a per-designator globbing
pattern to match the partition labels against. This may be used
support parallel installations of multiple operating systems on the
to support parallel installations of multiple operating systems on the
same disk, where each OS names its partitions with a specific prefix
or similar. systemd-dissect gained a new --image-filter= switch to
configure this filter. The new "dissect_image" udev plugin and
@@ -5053,11 +5053,11 @@ CHANGES WITH 257:
with the same instance name.
* systemd-analyze's "capability" verb now gained a new --mask
parameter. If specified a numeric capbality mask can be specified
which is decoded for its contained capabilities.
parameter. A numeric capability mask can be specified which is decoded
for its contained capabilities.
* systemd-analyze's "plot" verb gained two new settings: --scale-svg=
allows the X axis of the split to be stritched by a factor. If
allows the X axis of the plot to be stretched by a factor. If
--detailed is specified activation timestamps are shown in the plot.
busctl:
@@ -5219,7 +5219,7 @@ CHANGES WITH 257:
that the host systemd-coredump preferably dispatches coredump
processing to the container itself, if it supports that. Only full-OS
containers which run systemd inside will support this however, in
other cases EnterNamespace= might be an suitable approach to acquire
other cases EnterNamespace= might be a suitable approach to acquire
symbolized backtraces.)
Special thanks to Nick Owens for bringing attention to and testing
@@ -6260,7 +6260,7 @@ CHANGES WITH 256:
* systemd-sysext gained support for enabling system extensions in
mutable fashion, where a writable upperdir is stored under
/var/lib/extensions.mutable/, and a new --mutable= option to
configure this behaviour. An "ephemeral" mode is not also supported
configure this behaviour. An "ephemeral" mode is now also supported
where the mutable layer is configured to be a tmpfs that is
automatically released when the system extensions are reattached.
@@ -6298,7 +6298,7 @@ CHANGES WITH 256:
* "systemd-analyze dot" will now also show BindsTo= dependencies.
* systemd-debug-generator gained the ability add in arbitrary units
* systemd-debug-generator gained the ability to add arbitrary units
based on them being passed in via system credentials.
* A new kernel command-line option systemd.default_debug_tty= can be
@@ -6740,7 +6740,7 @@ CHANGES WITH 255:
* .network files gained a new IPv4ReversePathFilter= setting in the
[Network] section, to control sysctl's rp_filter setting.
* .network files gaiend a new HopLimit= setting in the [Route] section,
* .network files gained a new HopLimit= setting in the [Route] section,
to configure a per-route hop limit.
* .network files gained a new TCPRetransmissionTimeoutSec= setting in
@@ -7055,7 +7055,7 @@ CHANGES WITH 254:
process capability to invoked session processes of regular users on
local seats (as well as to systemd --user), unless configured
otherwise via data from JSON user records, or via the PAM module's
parameter list. This is useful in order allow desktop tools such as
parameter list. This is useful in order to allow desktop tools such as
GNOME's Alarm Clock application to set a timer for
CLOCK_REALTIME_ALARM that wakes up the system when it elapses. A
per-user service unit file may thus use AmbientCapability= to pass
@@ -7802,7 +7802,7 @@ CHANGES WITH 253:
privileges, so impact should be small. This will remove a great source
of confusion that has been reported by users over the years, due to
how these options require an extra setting to be manually enabled when
used in the per-user service manager, as opposed as to the system
used in the per-user service manager, as opposed to the system
service manager. We plan to enable this change in the next release
later this year. For more details, see:
https://lists.freedesktop.org/archives/systemd-devel/2022-December/048682.html
@@ -8038,7 +8038,7 @@ CHANGES WITH 253:
* systemd-stub now processes random seeds in the same way as
systemd-boot already does, in case a unified kernel image is being
used from a different bootloader than systemd-boot, or without any
boot load at all.
boot loader at all.
* bootctl will now generate a system token on all EFI systems, even
virtualized ones, and is activated in the case that the system token
@@ -8102,7 +8102,7 @@ CHANGES WITH 253:
* The [DHCPv4] section in .network file gained new SocketPriority=
setting that assigns the Linux socket priority used by the DHCPv4 raw
socket. This may be used in conjunction with the
EgressQOSMaps=setting in [VLAN] section of .netdev file to send the
EgressQOSMaps= setting in [VLAN] section of .netdev file to send the
desired ethernet 802.1Q frame priority for DHCPv4 initial
packets. This cannot be achieved with netfilter mangle tables because
of the raw socket bypass.
@@ -8250,8 +8250,8 @@ CHANGES WITH 253:
systemd-pcrfs@.service have been added that invoke the tool with
these switches during early boot.
* systemd-pcrphase gained a --graceful switch will make it exit cleanly
with a success exit code even if no TPM device is detected.
* systemd-pcrphase gained a --graceful switch that will make it exit
cleanly with a success exit code even if no TPM device is detected.
* systemd-cryptenroll now stores the user-supplied PIN with a salt,
making it harder to brute-force.
@@ -8272,7 +8272,7 @@ CHANGES WITH 253:
unprivileged code to access those values.
systemd-hostnamed also exports the SUPPORT_END= field from
os-release(5) as OperatingSystemSupportEnd. hostnamectl make uses of
os-release(5) as OperatingSystemSupportEnd. hostnamectl makes use of
this to show the status of the installed system.
* systemd-measure gained an --append= option to sign multiple phase
@@ -8765,11 +8765,10 @@ CHANGES WITH 252 🎃:
* A new function sd_hwdb_new_from_path() has been added to open a hwdb
database given an explicit path to the file.
* The signal number argument to sd_event_add_signal() now can now be
ORed with the SD_EVENT_SIGNAL_PROCMASK flag, causing sigprocmask() to
be automatically invoked to block the specified signal. This is
useful to simplify invocations as the caller doesn't have to do this
manually.
* The signal number argument to sd_event_add_signal() can now be ORed
with the SD_EVENT_SIGNAL_PROCMASK flag, causing sigprocmask() to be
automatically invoked to block the specified signal. This is useful to
simplify invocations as the caller doesn't have to do this manually.
* A new convenience call sd_event_set_signal_exit() has been added to
sd-event to set up signal handling so that the event loop
@@ -9527,8 +9526,8 @@ CHANGES WITH 251:
* hostnamed's D-Bus interface gained a new method GetHardwareSerial()
for reading the hardware serial number, as reported by DMI. It also
exposes a new method D-Bus property FirmwareVersion that encode the
firmware version of the system.
exposes a new D-Bus property FirmwareVersion that encodes the firmware
version of the system.
Changes in other components:
@@ -10120,7 +10119,7 @@ CHANGES WITH 250:
* sd-boot now embeds a .osrel PE section like we expect from Boot
Loader Specification Type #2 Unified Kernels. This means sd-boot
itself may be used in place of a Type #2 Unified Kernel. This is
useful for debugging purposes as it allows chain-loading one a
useful for debugging purposes as it allows chain-loading one
(development) sd-boot instance from another.
* sd-boot now supports a new "devicetree" field in Boot Loader
@@ -11355,7 +11354,7 @@ CHANGES WITH 248:
"IPMasquerade=yes", which was the same as "IPMasquerade=ipv4" before,
retains its meaning, but has been deprecated. Please switch to either
"ivp4" or "both" (if covering IPv6 is desired).
"ipv4" or "both" (if covering IPv6 is desired).
* systemd-importd will now download .verity and .roothash.p7s files
along with the machine image (as exposed via machinectl pull-raw).
@@ -11437,7 +11436,7 @@ CHANGES WITH 248:
* systemd-localed will now refuse to configure a keymap which is not
installed in the file system. This is intended as a bug fix, but
could break cases where systemd-localed was used to configure the
keymap in advanced of it being installed. It is necessary to install
keymap in advance of it being installed. It is necessary to install
the keymap file first.
* The main git development branch has been renamed to 'main'.
@@ -11998,14 +11997,14 @@ CHANGES WITH 247:
was originally defined in the Multimedia context (to restart playback
of a song or film), but is now primarily used in various embedded
devices for "Reboot" buttons. Accordingly, systemd-logind will now
honour it as such. This may configured in more detail via the new
honour it as such. This may be configured in more detail via the new
HandleRebootKey= and RebootKeyIgnoreInhibited=.
* systemd-nspawn/systemd-machined will now reconstruct hardlinks when
copying OS trees, for example in "systemd-nspawn --ephemeral",
"systemd-nspawn --template=", "machinectl clone" and similar. This is
useful when operating with OSTree images, which use hardlinks heavily
throughout, and where such copies previously resulting in "exploding"
throughout, and where such copies previously resulted in "exploding"
hardlinks.
* systemd-nspawn's --console= setting gained support for a new
@@ -13672,7 +13671,7 @@ CHANGES WITH 243:
IPv6 configuration (static or DHCPv6) was found for a given
interface. It will not touch the sysctl otherwise.
* The order of entries is $PATH used by the user manager instance was
* The order of entries in $PATH used by the user manager instance was
changed to put bin/ entries before the corresponding sbin/ entries.
It is recommended to not rely on this order, and only ever have one
binary with a given name in the system paths under /usr.
@@ -13831,7 +13830,7 @@ CHANGES WITH 243:
BFQ scheduler officially found in kernels 5.0+.
* A new mailing list has been created for reporting of security issues:
systemd-security@redhat.com. For mode details, see
systemd-security@redhat.com. For more details, see
https://systemd.io/CONTRIBUTING#security-vulnerability-reports.
Contributions from: Aaron Barany, Adrian Bunk, Alan Jenkins, Albrecht
@@ -14002,8 +14001,8 @@ CHANGES WITH 242:
submit-from-crypt-cpus options to tweak encryption work scheduling
details.
* systemd-tmpfiles will now take a BSD file lock before operating on a
contents of directory. This may be used to temporarily exclude
* systemd-tmpfiles will now take a BSD file lock before operating on the
contents of a directory. This may be used to temporarily exclude
directories from aging by taking the same lock (useful for example
when extracting a tarball into /tmp or /var/tmp as a privileged user,
which might create files with really old timestamps, which
@@ -14028,7 +14027,7 @@ CHANGES WITH 242:
partition.
* A system may now be booted with systemd.volatile=overlay on the
kernel command line, which causes the root file system to be set up
kernel command line, which causes the root file system to be set up as
an overlayfs mount combining the root-only root directory with a
writable tmpfs. In this setup, the underlying root device is not
modified, and any changes are lost at reboot.
@@ -14038,7 +14037,7 @@ CHANGES WITH 242:
* systemd-nspawn can now consume OCI runtime bundles using a new
--oci-bundle= option. This implementation is fully usable, with most
features in the specification implemented, but since this a lot of
features in the specification implemented, but since this is a lot of
new code and functionality, this feature should most likely not
be used in production yet.
@@ -14624,7 +14623,7 @@ CHANGES WITH 240:
(or just -S) option has been added for invoking the $SHELL of the
caller as a service, and implies --pty --same-dir --wait --collect
--service-type=exec. Or in other words, "systemd-run -S" is now the
quickest way to quickly get an interactive in a fully clean and
quickest way to get an interactive shell in a fully clean and
well-defined system service context.
* machinectl gained a new verb "import-fs" for importing an OS tree
@@ -15248,7 +15247,7 @@ CHANGES WITH 238:
machine is connected to external power can now be configured using
HandleLidSwitchExternalPower= in logind.conf. Previously, this action
was determined by HandleLidSwitch=, and, for backwards compatibility,
is still is, if HandleLidSwitchExternalPower= is not explicitly set.
still is, if HandleLidSwitchExternalPower= is not explicitly set.
* journalctl will periodically call sd_journal_process() to make it
resilient against inotify queue overruns when journal files are
@@ -16873,7 +16872,7 @@ CHANGES WITH 232:
CAP_SYS_MKNOD as before).
* In service unit files it is now possible to connect a specific named
file descriptor with stdin/stdout/stdout of an executed service. The
file descriptor with stdin/stdout/stderr of an executed service. The
name may be specified in matching .socket units using the
FileDescriptorName= setting.
@@ -17289,7 +17288,7 @@ CHANGES WITH 230:
* The DeviceAllow= unit setting now supports specifiers (with "%").
* "systemctl show" gained a new --value switch, which allows print a
* "systemctl show" gained a new --value switch, which allows printing
only the contents of a specific unit property, without also printing
the property's name. Similar support was added to "show*" verbs
of loginctl and machinectl that output "key=value" lists.
@@ -17847,7 +17846,7 @@ CHANGES WITH 227:
* Support for the "pids" cgroup controller has been added. It
allows accounting the number of tasks in a cgroup and
enforcing limits on it. This adds two new setting
enforcing limits on it. This adds two new settings
TasksAccounting= and TasksMax= to each unit, as well as a
global option DefaultTasksAccounting=.
@@ -17869,7 +17868,7 @@ CHANGES WITH 227:
* Watchdog timeouts have been increased to 3 minutes for all
in-tree service files. Apparently, disk IO issues are more
frequent than we hoped, and user reported >1 minute waiting
frequent than we hoped, and users reported >1 minute waiting
for disk IO.
* 'machine-id-commit' functionality has been merged into
@@ -17931,7 +17930,7 @@ CHANGES WITH 227:
show the control groups within a certain container only.
* "systemctl kill" gained support for an optional --fail
switch. If specified the requested operation will fail of no
switch. If specified the requested operation will fail if no
processes have been killed, because the unit had no
processes attached, or similar.
@@ -17995,7 +17994,7 @@ CHANGES WITH 227:
service that is activated through /dev/rfkill on each rfkill
state change and saves the settings to disk. This way,
systemd-rfkill is now compatible with devices that exist
only intermittendly, and even restores state if the previous
only intermittently, and even restores state if the previous
system shutdown was abrupt rather than clean.
* The journal daemon gained support for vacuuming old journal
@@ -19437,7 +19436,7 @@ CHANGES WITH 216:
systemd-resolved. Hostnames, addresses and arbitrary RRs may
be resolved via systemd-resolved D-Bus APIs. In contrast to
the glibc internal resolver systemd-resolved is aware of
multi-homed system, and keeps DNS server and caches separate
multi-homed systems, and keeps DNS server and caches separate
and per-interface. Queries are sent simultaneously on all
interfaces that have DNS servers configured, in order to
properly handle VPNs and local LANs which might resolve
@@ -19688,7 +19687,7 @@ CHANGES WITH 215:
* For tmpfiles' "L", "L+", "C" and "C+" directives the final
'argument' field (which so far specified the source to
symlink/copy the files from) is now optional. If omitted the
same file os copied from /usr/share/factory/ suffixed by the
same file is copied from /usr/share/factory/ suffixed by the
full destination path. This is useful for populating /etc
with essential files, by copying them from vendor defaults
shipped in /usr/share/factory/etc.
@@ -21571,7 +21570,7 @@ CHANGES WITH 202:
Contributions from: Anatol Pomozov, Auke Kok, Harald Hoyer,
Henrik Grindal Bakken, Josh Triplett, Kay Sievers, Lennart
Poettering, Lukas Nykryn, Mantas Mikulėnas Marius Vollmer,
Poettering, Lukas Nykryn, Mantas Mikulėnas, Marius Vollmer,
Martin Jansa, Martin Pitt, Michael Biebl, Michal Schmidt,
Mirco Tischler, Pali Rohar, Simon Peeters, Steven Hiscocks,
Tom Gundersen, Zbigniew Jędrzejewski-Szmek
@@ -21596,7 +21595,7 @@ CHANGES WITH 201:
* 'systemctl status' will now show information about the
network sockets a socket unit is listening on.
* 'systemctl status' will also shown information about any
* 'systemctl status' will also show information about any
drop-in configuration file for units. (Drop-In configuration
files in this context are files such as
/etc/systemd/system/foobar.service.d/*.conf)
@@ -21929,7 +21928,7 @@ CHANGES WITH 198:
journal output in reverse order (i.e. newest line first).
* journalctl gained a new "--pager-end" (or -e) option to jump
to immediately jump to the end of the journal in the
immediately to the end of the journal in the
pager. This is only supported in conjunction with "less".
* journalctl gained a new "--user-unit=" option, that works
@@ -22069,7 +22068,7 @@ CHANGES WITH 197:
* Unit files learnt a new condition ConditionACPower= which
may be used to conditionalize a unit depending on whether an
AC power source is connected or not, of whether the system
AC power source is connected or not, or whether the system
is running on battery power.
* systemctl gained a new "is-failed" verb that may be used in
@@ -22391,7 +22390,7 @@ CHANGES WITH 192:
and line break accordingly.
Contributions from: Dave Reisner, Kay Sievers, Lennart
Poettering, Lukas Nykrynm, Mirco Tischler, Václav Pavlín
Poettering, Lukas Nykryn, Mirco Tischler, Václav Pavlín
CHANGES WITH 191:
@@ -22500,7 +22499,7 @@ CHANGES WITH 190:
* There's now a new RPM macro definition for the system preset
dir: %_presetdir.
* journald will now warn if it ca not forward a message to the
* journald will now warn if it cannot forward a message to the
syslog daemon because its socket is full.
* timedated will no longer write or process /etc/timezone,
README
+5 -5
View File
@@ -148,7 +148,7 @@ REQUIREMENTS:
CONFIG_CFS_BANDWIDTH
Required for IPAddressDeny=, IPAddressAllow=, IPIngressFilterPath=,
IPEgressFilterPath= in resource control unit settings unit settings:
IPEgressFilterPath= in resource control unit settings:
CONFIG_BPF
CONFIG_BPF_SYSCALL
CONFIG_BPF_JIT
@@ -263,8 +263,8 @@ REQUIREMENTS:
>= 13.1.0 is required to build BPF program by using GCC
binutils >= 2.35
awk, sed, grep, and similar tools
clang,llvm >= 10 (optional, required to build BPF programs)
>= 13 (optional, required to build the entire project)
clang, llvm >= 10 (optional, required to build BPF programs)
>= 13 (optional, required to build the entire project)
During runtime, you need the following additional
dependencies:
@@ -276,8 +276,8 @@ REQUIREMENTS:
NOTE: If using dbus < 1.9.18, you should override the default
policy directory (--with-dbuspolicydir=/etc/dbus-1/system.d).
polkit (optional)
gnupg >= 2.4 optional (for signature verification in: importctl,
systemd-sysupdate)
gnupg >= 2.4 (optional, for signature verification in: importctl,
systemd-sysupdate)
To build in directory build/:
meson setup build/ && ninja -C build/
TODO.md
+14 -14
View File
@@ -137,7 +137,7 @@ SPDX-License-Identifier: LGPL-2.1-or-later
- sysupdate: add flag field for features and components, to require a restart
of the update loop once they have been updated.
- confext/sysext: add policy file concept: json files that encode for rleevant
- confext/sysext: add policy file concept: json files that encode for relevant
confext/sysext ddis rules when to enable them, i.e. version checks. also use
it for the garbage collector
@@ -191,7 +191,7 @@ SPDX-License-Identifier: LGPL-2.1-or-later
- store workload identity OIDC server contact info in cloud imds hwdb.
- systemd-analyze unit-shell-me-harder that has both host and unit trees around
but mostly lives in unit namespces
but mostly lives in unit namespaces
- os-release consumption at boot: version validation, and maybe in os-release
@@ -217,7 +217,7 @@ SPDX-License-Identifier: LGPL-2.1-or-later
- nspawn/vmspawn: add a concept how we can hand into the payload some proof
that it is running on a certain host, which it can then include in the report,
and which allows us to put together a map about which node runs as payload of
which other note. in particular useful for transient nodes, as it gives them
which other node. in particular useful for transient nodes, as it gives them
a better location
- add a small varlink service that wraps the raw sftp logic (without ssh) after a
@@ -284,7 +284,7 @@ SPDX-License-Identifier: LGPL-2.1-or-later
- firstboot: optionally accept credentials at firstboot without authentication
- firstboot/sysinstall: add simple interface for prompting users to enable
"features" exposed by of sysupdate.
"features" exposed by sysupdate.
- a tool that can prep credentials, put them in the ESP, for provisioning
systems for SBC or UEFI/HTTP boot. Should be doing what sysinstall does with
@@ -535,7 +535,7 @@ SPDX-License-Identifier: LGPL-2.1-or-later
when it is otherwise off
- add growvol and makevol options for /etc/crypttab, similar to
x-systemd.growfs and x-systemd-makefs.
x-systemd.growfs and x-systemd.makefs.
- Add knob to cryptsetup, to trigger automatic reboot on failure to unlock
disk. Enable this by default for rootfs, also in gpt-auto-generator
@@ -1198,7 +1198,7 @@ SPDX-License-Identifier: LGPL-2.1-or-later
inspiration from IMA log)
- Hook up journald's FSS logic with TPM2: seal the verification disk by
time-based policy, so that the verification key can remain on host and ve
time-based policy, so that the verification key can remain on host and be
validated via TPM.
- Hook up systemd-journal-upload with RESTART_RESET=1 logic (should probably
@@ -1726,10 +1726,10 @@ SPDX-License-Identifier: LGPL-2.1-or-later
- Maybe introduce an InodeRef structure inspired by PidRef, which references a
specific inode, and combines: a path, an O_PATH fd, and possibly a FID into
one. Why? We often pass around path and fd separately in chaseat() and similar
calls. Because passing around both separately is cumbersome we sometimes only
one pass one, once the other and sometimes both. It would make the code a lot
simpler if we could path both around at the same time in a simple way, via an
InodeRef which *both* pins the inode via an fd, *and* gives us a friendly
calls. Because passing around both separately is cumbersome we sometimes pass
only one, sometimes the other, and sometimes both. It would make the code a
lot simpler if we could pass both around at the same time in a simple way, via
an InodeRef which *both* pins the inode via an fd, *and* gives us a friendly
name for it.
- maybe introduce an OSC sequence that signals when we ask for a password, so
@@ -1960,9 +1960,9 @@ SPDX-License-Identifier: LGPL-2.1-or-later
- pam_systemd: on interactive logins, maybe show SUPPORT_END information at
login time, à la motd
- pam_systemd_home: add module parameter to control whether to only accept
only password or only pcks11/fido2 auth, and then use this to hook nicely
into two of the three PAM stacks gdm provides.
- pam_systemd_home: add module parameter to control whether to accept only
password or only pkcs11/fido2 auth, and then use this to hook nicely into two
of the three PAM stacks gdm provides.
See discussion at https://github.com/authselect/authselect/pull/311
- paranoia: whenever we process passwords, call mlock() on the memory
@@ -2119,7 +2119,7 @@ SPDX-License-Identifier: LGPL-2.1-or-later
- ptyfwd: use osc context information in vmspawn/nspawn/… to optionally only
listen to ^]]] key when no further vmspawn/nspawn context is allocated
- ptyfwd: usec osc context information to propagate status messages from
- ptyfwd: use osc context information to propagate status messages from
vmspawn/nspawn to service manager's "status" string, reporting what is
currently in the fg