systemd262

2️⃣9️⃣ Here's the 29th post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd

In v261 systemd-vmspawn gained support for invoking AMD style confidential computing (CoCo) VMs via --coco=sev-snp. What it didn't support then was passing systemd system credentials into them. As on AMD-sytel CoCo there's only one initial measurement done, and that measurement only covers kernel and initrd, the usual way we pass credentials into VMs (SMBIOS#11) simply…

2️⃣8️⃣ Here's the 28th post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd

The purpose of confext images is to carry configuration files to apply to the system. Typically, these configuration files belong to some system service, and it hence would be useful to restart or reload that service when the confext is applied.

With v262 there's now support for that. The extension-release file that is included in the confext and describes it, …

I just finished my #systemd261 series of posts. And I now also prepped a blog story linking to every single one of them here:

https://0pointer.net/blog/mastodon-stories-for-systemd-v261.html

Make sure to stay tuned for the #systemd262 series, most likely starting already in a few weeks!

It's that time again! The systemd v262 release is coming closer. Let's restart the "what's new" series of posts for this iteration! Hence:

1️⃣ Here's the 1st post highlighting key new features of the upcoming v262 release of systemd. #systemd262 #systemd

Back in systemd v258 we added support for a special "?" character in /etc/hostname.

7️⃣ Here's the 7th post highlighting key new features of the upcoming v262 release of systemd. #systemd262 #systemd

In systemd we have a lot of CLI tools that users may invoke. We try to provide relatively uniform interfaces for them, i.e. there's always a man page, and always a --help switch, which are structured roughly the same way.

In previous systemd versions the command line interfaces and their --help texts were maintained with only little shared code in the various tools…

4️⃣ Here's the 4th post highlighting key new features of the upcoming v262 release of systemd. #systemd262 #systemd

In systemd v261 we introduced the concept of "machine tags", i.e. a set of free-form, user chosen strings you can attach to a host. They are stored in /etc/machine-info along with some other metadata fields about the host.

In v262 the concept is further extended. First of all, the strings may now also have the form "key=value" in addition to simple strings without "=", as…

5️⃣ Here's the 5th post highlighting key new features of the upcoming v262 release of systemd. #systemd262 #systemd

systemd-sysupdate is a tool for updating files and partitions from a source typically on the Internet, to implement OS updates or updates of container, VM, extension or service images. It's mostly built around the concept of a "transfer" file, that does primarily one thing: it declares where to find new resources on the internet and where to place them locally. The tool then…

6️⃣ Here's the 6th post highlighting key new features of the upcoming v262 release of systemd. #systemd262 #systemd

In systemd v260 we added the "systemd-report" subsystem that provides a unified way to gather metrics from running services, that would like to offer them. Many of systemd's own subsystems implement providers for this now, and the systemd-report tool can compile them into a single report JSON document.

With v262 this functionality is upgraded in one fundamental way:

2️⃣0️⃣ Here's the 20th post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd

In systemd v261 we added the new "bootctl link" command, which allows managing boot menu in a commit/rollback style fashion by combining, UKIs, credentials, sysext, confext into an UAPI.1 type #1 boot loader entry, and managing space on the ESP at the same time.

"bootctl link" requires specifying the resources to combine in the boot loader entry on the command line.

1️⃣3️⃣ Here's the 13th post highlighting key new features of the upcoming v262 release of systemd. #systemd262 #systemd

The Linux kernel's console doesn't particularly receive much development these days, and neither in the previous decade or so. Because of that it hasn't really caught up with modern technical developments, such as HiDPI screens. In many scenarios it makes the console barely usable: output in a teeny-tiny font somewhere in the top-left of your screen, requiring a microscope to…

1️⃣1️⃣ Here's the 11th post highlighting key new features of the upcoming v262 release of systemd. #systemd262 #systemd

In the previous post in this series we already discussed systemd-cryptenroll/systemd-cryptsetup's TPM support a bit. There's another addition in this area with v262.

If you use LUKS for disk encryption, then the actual data is protected by a symmetric "volume" key. Encrypted versions of this volume key are placed in one or more "slots" in the LUKS header.

1️⃣4️⃣ Here's the 14th post highlighting key new features of the upcoming v262 release of systemd. #systemd262 #systemd

systemd is large collection of modular tools and services, that work nicely together. Currently if you install them all you get something like ~175 binaries. Downstream distributions tend to split these into a number of software package, which you can install separately, but I guess compared to certain other init systems, yes, we cover a lot with a lot of separate binaries.

1️⃣2️⃣ Here's the 12th post highlighting key new features of the upcoming v262 release of systemd. #systemd262 #systemd

For a while now systemd has provided the "systemd-confext" subsystem. It enables a form of atomic, reversible, secure configuration management: you wrap up configuration files in a UAPI.3 DDI, drop it on a node, run systemd-confext --refresh and it will merge the files from the DDI into your /etc/ through overlayfs. Later, drop in a different version, delete the old one, …

2️⃣ Here's the 2nd post highlighting key new features of the upcoming v262 release of systemd. #systemd262 #systemd

The Linux kernel 7.1 added support for setting extended attributes on socket inodes: both for AF_UNIX entrypoint socket inodes in the file system hierarchy, and for listener/connected sockets in the "sockfs" pseudo file system.

This is truly useful, because it allows attaching descriptive metadata on sockets that can be very cheaply read without connecting to them.

2️⃣2️⃣ Here's the 22nd post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd

Initially, there was /etc/crypttab. And then there was /etc/veritytab, and soon followed /etc/integritytab. With v262 there's also /etc/clonetab.

All of these manage a type of device mapper target that is important when building an OS: dm-crypt (encryption, i.e. LUKS), dm-verity (immutable integrity), dm-integrity (writable integrity) and dm-clone (live…

3️⃣3️⃣ Here's the 33rd post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd

For a longer time now systemd has supported the "credentials" concept, that allows passing parameters to systems and services in a secure way, with optional locking to the local TPM. One of the key goals of the design was to make the TPM binding logic "just work". Specifically, not all systems have TPMs, and thus it was key to gracefully degrade: the encryption…

3️⃣5️⃣ Here's the 35th post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd

A key concept in systemd's TPM support is that UKIs can carry information about expected PCR measurements (specifically PCR 11), which are signed by a cryptographic key of the vendor. The idea is to use this as one of the protections on disk encryption keys protected by the TPM: only on systems where PCR 11 is in a state for which the OS vendor provided such a…

I just finished my #systemd262 series of posts. And I now also prepped a blog story linking to every single one of them here:

https://0pointer.net/blog/mastodon-stories-for-systemd-v262.html

Make sure to stay tuned for the #systemd263 series, most likely starting already in a few weeks!

2️⃣1️⃣ Here's the 21st post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd

When a systemd-sysupdate update cycle completes, new resources have been dropped into the system: either as files, directories or as partitions. In some cases it's then useful to trigger further actions that then make use of the new resources made available, for example refresh the sysext or confext stack, or rebuild TPM policies or similar.

2️⃣3️⃣ Here's the 23rd post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd

The service manager in the systemd suite manages a dependency network of units, where state changes are applied to via a job queue. The job queue provides a certain kind of atomicity: when a job –and all the depending jobs it might induce – is enqueued this is either done fully or not at all, but we'll never leave some jobs around and drop others.

This is a…

3️⃣0️⃣ Here's the 30th post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd

Whenever a TPM chip is manufactured by the vendor it's supposed to be provisioned with a signed certificate ("EKcert") that is supposed to prove it's an authentic TPM.

Interestingly the key pair that this certificate is about is typically *not* persisted on the TPM chip. How can that be?

3️⃣1️⃣ Here's the 31st post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd

For a long time systemd has known a concept of "first boot" conditioning: units and certain code paths are only run on the first boot of a system, but not the others. The first boot is determined by looking at /etc/machine-id: if that file has a fully populated UUID at boot, then it's not a first boot, otherwise it is.

Various components hook into this concept:

2️⃣6️⃣ Here's the 26th post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd

When a new system is automatically deployed, a key part of it is to adapt the installation to the system it is deployed on. That can mean many things, but let's focus on one: there's a good chance some hardware-specific software needs to be installed, for example in form of a sysext, e.g. an extension image with additional drivers, or subsystems.

2️⃣7️⃣ Here's the 27th post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd

Back in v258 we added ConcurrencyMax= to slice units, which allows pacing activation of units assigned to the slice. The knob puts a limit on how many units may be in "active" state at the same time. It turns systemd into a powerful run queue system: just queue services into a slice that uses the setting, and they'll be processed as the concurrency limit allows.

3️⃣4️⃣ Here's the 34th post highlighting key new features of the recently published v262 release of systemd. #systemd262 #systemd

For a long time systemd has supported rebooting via "kexec" as a mechanism very similar like regular reboots. In v261 the concept became a lot more powerful via support for "LUO", i.e. the ability to pass resources from the current OS cycle to the next, across a kexec reboot.

With v262 we are improving kexec support in more ways: "systemctl kexec"'s kernel…