+CHANGES WITH 211:
+
+ * A new unit file setting RestrictAddressFamilies= has been
+ added to restrict which socket address families unit
+ processes gain access to. This takes address family names
+ like "AF_INET" or "AF_UNIX", and is useful to minimize the
+ attack surface of services via exotic protocol stacks. This
+ is built on seccomp system call filters.
+
+ * Two new unit file settings RuntimeDirectory= and
+ RuntimeDirectoryMode= have been added that may be used to
+ manage a per-daemon runtime directories below /run. This is
+ an alternative for setting up directory permissions with
+ tmpfiles snippets, and has the advantage that the runtime
+ directory's lifetime is bound to the daemon runtime and that
+ the daemon starts up with an empty directory each time. This
+ is particularly useful when writing services that drop
+ priviliges using the User= or Group= setting.
+
+ * The DeviceAllow= unit setting now supports globbing for
+ matching against device group names.
+
+ * The systemd configuration file system.conf gained new
+ settings DefaultCPUAccounting=, DefaultBlockIOAccounting=,
+ DefaultMemoryAccounting= to globally turn on/off accounting
+ for specific resources (cgroups) for all units. These
+ settings may still be overridden individually in each unit
+ though.
+
+ * systemd-gpt-auto-generator is now able to discover /srv and
+ root partitions in addition to /home and swap partitions. It
+ also supports LUKS-encrypted partitions now. With this in
+ place automatic discovery of partitions to mount following
+ the Discoverable Partitions Specification
+ (http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec)
+ is now a lot more complete. This allows booting without
+ /etc/fstab and without root= on the kernel command line on
+ appropriately prepared systems.
+
+ * systemd-nspawn gained a new --image= switch which allows
+ booting up disk images and Linux installations on any block
+ device that follow the Discoverable Partitions Specification
+ (see above). This means that installations made with
+ appropriately updated installers may now be started and
+ deployed using container managers, completely
+ unmodified. (We hope that libvirt-lxc will add support for
+ this feature soon, too.)
+
+ * systemd-nspawn gained a new --network-macvlan= setting to
+ set up a private macvlan interface for the
+ container. Similar, systemd-networkd gained a new
+ Kind=macvlan setting in .netdev files.
+
+ * systemd-networkd now supports configuring local addresses
+ using IPv4LL.
+
+ * A new tool systemd-network-wait-online has been added to
+ synchronously wait for network connectivity using
+ systemd-networkd.
+
+ * The sd-bus.h bus API gained a new sd_bus_track object for
+ tracking the life-cycle of bus peers. Note that sd-bus.h is
+ still not a public API though (unless you specify
+ --enable-kdbus on the configure command line, which however
+ voids your warranty and you get no API stability guarantee).
+
+ * The $XDG_RUNTIME_DIR runtime directories for each user are
+ now individual tmpfs instances, which has the benefit of
+ introducing separate pools for each user, with individual
+ size limits, and thus making sure that unprivileged clients
+ can no longer negatively impact the system or other users by
+ filling up their $XDG_RUNTIME_DIR. A new logind.conf setting
+ RuntimeDirectorySize= has been introduced that allows
+ controlling the default size limit for all users. It
+ defaults to 10% of the available physical memory. This is no
+ replacement for quotas on tmpfs though (which the kernel
+ still does not support), as /dev/shm and /tmp are still
+ shared resources used by both the system and unprivileged
+ users.
+
+ * logind will now automatically turn off automatic suspending
+ on laptop lid close when more than one display is
+ connected. This was previously expected to be implemented
+ individually in desktop environments (such as GNOME),
+ however has been added to logind now, in order to fix a
+ boot-time race where a desktop environment might not have
+ been started yet and thus not been able to take an inhibitor
+ lock at the time where logind already suspends the system
+ due to a closed lid.
+
+ * logind will now wait at least 30s after each system
+ suspend/resume cycle, and 3min after system boot before
+ suspending the system due to a closed laptop lid. This
+ should give USB docking stations and similar enough time to
+ be probed and configured after system resume and boot in
+ order to then act as suspend blocker.
+
+ * systemd-run gained a new --property= setting which allows
+ initialization of resource control properties (and others)
+ for the created scope or service unit. Example: "systemd-run
+ --property=BlockIOWeight=10 updatedb" may be used to run
+ updatedb at a low block IO scheduling weight.
+
+ * systemd-run's --uid=, --gid=, --setenv=, --setenv= switches
+ now also work in --scope mode.
+
+ * When systemd is compiled with kdbus support, basic support
+ for enforced policies is now in place. (Note that enabling
+ kdbus still voids your warranty and no API compatibility
+ promises are made.)
+
+ Contributions from: Andrey Borzenkov, Ansgar Burchardt, Armin
+ K., Daniel Mack, Dave Reisner, David Herrmann, Djalal Harouni,
+ Harald Hoyer, Henrik Grindal Bakken, Jasper St. Pierre, Kay
+ Sievers, Kieran Clancy, Lennart Poettering, Lukas Nykryn,
+ Mantas Mikulėnas, Marcel Holtmann, Mark Oteiza, Martin Pitt,
+ Mike Gilbert, Peter Rajnoha, poma, Samuli Suominen, Stef
+ Walter, Susant Sahani, Tero Roponen, Thomas Andersen, Thomas
+ Bächler, Thomas Hindoe Paaboel Andersen, Tomasz Torcz, Tom
+ Gundersen, Umut Tezduyar Lindskog, Uoti Urpala, Zachary Cook,
+ Zbigniew Jędrzejewski-Szmek
+
+ -- Berlin, 2014-03-12
+
+CHANGES WITH 210:
+
+ * systemd will now relabel /dev after loading the SMACK policy
+ according to SMACK rules.
+
+ * A new unit file option AppArmorProfile= has been added to
+ set the AppArmor profile for the processes of a unit.
+
+ * A new condition check ConditionArchitecture= has been added
+ to conditionalize units based on the system architecture, as
+ reported by uname()'s "machine" field.
+
+ * systemd-networkd now supports matching on the system
+ virtualization, architecture, kernel command line, host name
+ and machine ID.
+
+ * logind is now a lot more aggressive when suspending the
+ machine due to a closed laptop lid. Instead of acting only
+ on the lid close action it will continuously watch the lid
+ status and act on it. This is useful for laptops where the
+ power button is on the outside of the chassis so that it can
+ be reached without opening the lid (such as the Lenovo
+ Yoga). On those machines logind will now immediately
+ re-suspend the machine if the power button has been
+ accidentally pressed while the laptop was suspended and in a
+ backpack or similar.
+
+ * logind will now watch SW_DOCK switches and inhibit reaction
+ to the lid switch if it is pressed. This means that logind
+ will not suspend the machine anymore if the lid is closed
+ and the system is docked, if the laptop supports SW_DOCK
+ notifications via the input layer. Note that ACPI docking
+ stations do not generate this currently. Also note that this
+ logic is usually not fully sufficient and Desktop
+ Environments should take a lid switch inhibitor lock when an
+ external display is connected, as systemd will not watch
+ this on its own.
+
+ * nspawn will now make use of the devices cgroup controller by
+ default, and only permit creation of and access to the usual
+ API device nodes like /dev/null or /dev/random, as well as
+ access to (but not creation of) the pty devices.
+
+ * We will now ship a default .network file for
+ systemd-networkd that automatically configures DHCP for
+ network interfaces created by nspawn's --network-veth or
+ --network-bridge= switches.
+
+ * systemd will now understand the usual M, K, G, T suffixes
+ according to SI conventions (i.e. to the base 1000) when
+ referring to throughput and hardware metrics. It will stay
+ with IEC conventions (i.e. to the base 1024) for software
+ metrics, according to what is customary according to
+ Wikipedia. We explicitly document which base applies for
+ each configuration option.
+
+ * The DeviceAllow= setting in unit files now supports a syntax
+ to whitelist an entire group of devices node majors at once,
+ based on the /proc/devices listing. For example, with the
+ string "char-pts" it is now possible to whitelist all
+ current and future pseudo-TTYs at once.
+
+ * sd-event learned a new "post" event source. Event sources of
+ this type are triggered by the dispatching of any event
+ source of a type that is not "post". This is useful for
+ implementing clean-up and check event sources that are
+ triggered by other work being done in the program.
+
+ * systemd-networkd is no longer statically enabled, but uses
+ the usual [Install] sections so that it can be
+ enabled/disabled using systemctl. It still is enabled by
+ default however.
+
+ * When creating a veth interface pair with systemd-nspawn the
+ host side will now be prefixed with "vb-" if
+ --network-bridge= is used, and with "ve-" if --network-veth
+ is used. This way it is easy to distinguish these cases on
+ the host, for example to apply different configuration to
+ them with systemd-networkd.
+
+ * The compatibility libraries for libsystemd-journal.so,
+ libsystem-id128.so, libsystemd-login.so and
+ libsystemd-daemon.so do not make use of IFUNC
+ anymore. Instead we now build libsystemd.so multiple times
+ under these alternative names. This means that the footprint
+ is drastically increased, but given that these are
+ transitional compatibility libraries this shouldn't matter
+ much. This change has been made necessary to support the ARM
+ platform for these compatibility libraries, as the ARM
+ toolchain isn't really at the same level as the toolchain
+ for other architectures like x86 and does not support
+ IFUNC. Please make sure to use --enable-compat-libs only
+ during a transitional period!
+
+ Contributions from: Andreas Fuchs, Armin K., Colin Walters,
+ Daniel Mack, Dave Reisner, David Herrmann, Djalal Harouni,
+ Holger Schurig, Jason A. Donenfeld, Jason St. John, Jasper
+ St. Pierre, Kay Sievers, Lennart Poettering, Łukasz Stelmach,
+ Marcel Holtmann, Michael Scherer, Michal Sekletar, Mike
+ Gilbert, Samuli Suominen, Thomas Bächler, Thomas Hindoe
+ Paaboel Andersen, Tom Gundersen, Umut Tezduyar Lindskog,
+ Zbigniew Jędrzejewski-Szmek
+
+ -- Berlin, 2014-02-24
+
~ianmdlvl / elogind.git / blobdiff