units: make system-update-pre.target a passive unit (#9349)

[elogind.git] / NEWS

diff --git a/NEWS b/NEWS
index 0d641d62c73f4e769bf3b13996d1c9c21cd2d5e3..e120a654fd9abd6e31bc3219cee5e74ac4f4df98 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,11 +3,24 @@ systemd System and Service Manager
 CHANGES WITH 239 in spe:
 
         * NETWORK INTERFACE DEVICE NAMING CHANGES: elogind-udevd's "net_id"
-          builtin may name network interfaces differently than in previous
-          versions. SR-IOV virtual functions and NPAR partitions with PCI
-          function numbers of 8 and above will be named more predictably, and
-          udev may generate names based on the PCI slot number in some cases
-          where it previously did not.
+          builtin will name network interfaces differently than in previous
+          versions for virtual network interfaces created with SR-IOV and NPAR
+          and for devices where the PCI network controller device does not have
+          a slot number associated.
+
+          SR-IOV virtual devices are now named based on the name of the parent
+          interface, with a suffix of "v<N>", where <N> is the virtual device
+          number. Previously those virtual devices were named as if completely
+          independent.
+
+          The ninth and later NPAR virtual devices will be named following the
+          scheme used for the first eight NPAR partitions. Previously those
+          devices were not renamed and the kernel default (eth<n>) was used.
+
+          "net_id" will also generate names for PCI devices where the PCI
+          network controller device does not have an associated slot number
+          itself, but one of its parents does. Previously those devices were
+          not renamed and the kernel default (eth<n>) was used.
 
         * AF_INET and AF_INET6 are dropped from RestrictAddressFamilies= in
           elogind.service. Since v235, IPAddressDeny=any has been set to
@@ -46,6 +59,15 @@ CHANGES WITH 239 in spe:
           both runtime and persistent enablement/masking, i.e. it will remove
           any relevant symlinks both in /run and /etc.
 
+        * Note that all long-running system services shipped with elogind will
+          now default to a system call whitelist (rather than a blacklist, as
+          before). In particular, elogind-udevd will now enforce one too. For
+          most cases this should be safe, however downstream distributions
+          which disabled sandboxing of elogind-udevd (specifically the
+          MountFlags= setting), might want to disable this security feature
+          too, as the default whitelisting will prohibit all mount, swap,
+          reboot and clock changing operations from udev rules.
+
         * sd-boot acquired new loader configuration settings to optionally turn
           off Windows and MacOS boot partition discovery as well as
           reboot-into-firmware menu items. It is also able to pick a better
@@ -304,6 +326,12 @@ CHANGES WITH 239 in spe:
           system namespacing options. One such service is elogind-udevd.service
           wher this is now used by default.
 
+        * A new unit "system-update-pre.target" is added, which defines an
+          optional synchronization point for offline system updates, as
+          implemented by the pre-existing "system-update.target" unit. It
+          allows ordering services before the service that executes the actual
+          update process in a generic way.
+
         Contributions from: Adam Duskett, Alan Jenkins, Alessandro Casale,
         Alexander Kurtz, Alex Gartrell, Anssi Hannula, Arnaud Rebillout, Brian
         J. Murrell, Bruno Vernay, Chris Lesiak, Christian Brauner, Christian