* A new component "systemd-networkd" has been added that can
be used to configure local network interfaces statically or
* A new component "systemd-networkd" has been added that can
be used to configure local network interfaces statically or
- via DHCP. It is capable of bringing up bridges, VLANs and
- bonding. Currently no hookups for interactive network
- configuration are privided. Use this for your initrd,
- container, embedded or server setup, if you need a simple,
- yet powerful network configuration solution. This
- configuration subsystem is quite nifty as it allows wildcard
+ via DHCP. It is capable of bringing up bridges, VLANs, and
+ bonding. Currently, no hook-ups for interactive network
+ configuration are provided. Use this for your initrd,
+ container, embedded, or server setup if you need a simple,
+ yet powerful, network configuration solution. This
+ configuration subsystem is quite nifty, as it allows wildcard
interfaces showing up are automatically added to a bridge,
or similar. It supports link-sensing and more.
interfaces showing up are automatically added to a bridge,
or similar. It supports link-sensing and more.
* udev learned a new SECLABEL{} construct to label device
nodes with a specific security label when they appear. For
* udev learned a new SECLABEL{} construct to label device
nodes with a specific security label when they appear. For
* udev gained a new scheme to configure link-level attributes
from files in /etc/systemd/network/*.link. These files can
* udev gained a new scheme to configure link-level attributes
from files in /etc/systemd/network/*.link. These files can
- match against MAC address, device path, driver name and type
+ match against MAC address, device path, driver name and type,
- MTU, duplex settings, WakeOnLan settings, MAC address, MAC
+ MTU, duplex settings, Wake-on-LAN settings, MAC address, MAC
address assignment policy (randomized, ...).
* When the User= switch is used in a unit file, also
address assignment policy (randomized, ...).
* When the User= switch is used in a unit file, also
defining objects on the bus with a simple static const
vtable array of its methods, signals and properties.
defining objects on the bus with a simple static const
vtable array of its methods, signals and properties.
introspection data anymore to /usr/share/dbus-1/interfaces,
as the precise format of these files is unclear, and
nothing makes use of it.
introspection data anymore to /usr/share/dbus-1/interfaces,
as the precise format of these files is unclear, and
nothing makes use of it.
- * A new API "sd-dhcp.h" has been added that provides a small
- DHCPv4 client-side implementation. This is used by
+ * A new API "sd-dhcp-client.h" has been added that provides a
+ small DHCPv4 client-side implementation. This is used by
- "systemd.restore_state=0|1". When set to "0", none of the systemd tools
- will restore saved runtime state to hardware devices. More
- specifically, the rfkill and backlight states are not
- restored.
+ "systemd.restore_state=0|1". When set to "0", none of the
+ systemd tools will restore saved runtime state to hardware
+ devices. More specifically, the rfkill and backlight states
+ are not restored.
* The FsckPassNo= compatibility option in mount/service units
has been removed. The fstab generator will now add the
necessary dependencies automatically, and does not require
PID1's support for that anymore.
* The FsckPassNo= compatibility option in mount/service units
has been removed. The fstab generator will now add the
necessary dependencies automatically, and does not require
PID1's support for that anymore.
recent boots with their times and boot IDs.
* The various tools like systemctl, loginctl, timedatectl,
recent boots with their times and boot IDs.
* The various tools like systemctl, loginctl, timedatectl,
* systemd-run and systemd-analyze also gained support for "-H"
to connect to remote hosts via SSH. This is particularly
* systemd-run and systemd-analyze also gained support for "-H"
to connect to remote hosts via SSH. This is particularly
* machinectl gained a new command "login" to open a getty
login in any local container. This works with any container
that is registered with machined (such as those created by
* machinectl gained a new command "login" to open a getty
login in any local container. This works with any container
that is registered with machined (such as those created by
* machinectl gained a new "reboot" command that may be used to
trigger a reboot on a specific container that is registered
* machinectl gained a new "reboot" command that may be used to
trigger a reboot on a specific container that is registered
* systemctl gained a new --job-mode= switch to configure the
mode to queue a job with. This is a more generic version of
* systemctl gained a new --job-mode= switch to configure the
mode to queue a job with. This is a more generic version of
- --fail, --irreversible, --ignore-dependencies which are
+ --fail, --irreversible, and --ignore-dependencies, which are
still available but not advertised anymore.
* /etc/systemd/system.conf gained new settings to configure
still available but not advertised anymore.
* /etc/systemd/system.conf gained new settings to configure
* PID1 will now export on the bus profile data of the security
policy upload process (such as the SELinux policy upload to
* PID1 will now export on the bus profile data of the security
policy upload process (such as the SELinux policy upload to
* The "sd-daemon.h" API gained a new sd_watchdog_enabled() to
determine whether watchdog notifications are requested by
* The "sd-daemon.h" API gained a new sd_watchdog_enabled() to
determine whether watchdog notifications are requested by
* tmpfiles gained a new "--boot" option. When this is not used,
only lines where the command character is not suffixed with
* tmpfiles gained a new "--boot" option. When this is not used,
only lines where the command character is not suffixed with
options are executed too. This partitions tmpfiles
directives into those that can be safely executed at any
time, and those which should be run only at boot (for
example, a line that creates /run/nologin).
options are executed too. This partitions tmpfiles
directives into those that can be safely executed at any
time, and those which should be run only at boot (for
example, a line that creates /run/nologin).
asynchronous wrapper around glibc NSS host name resolution
calls, such as getaddrinfo(). In contrast to glibc's
getaddrinfo_a(), it does not use signals. In contrast to most
other asynchronous name resolution libraries, this one does
not reimplement DNS, but reuses NSS, so that alternate
host name resolution systems continue to work, such as mDNS,
asynchronous wrapper around glibc NSS host name resolution
calls, such as getaddrinfo(). In contrast to glibc's
getaddrinfo_a(), it does not use signals. In contrast to most
other asynchronous name resolution libraries, this one does
not reimplement DNS, but reuses NSS, so that alternate
host name resolution systems continue to work, such as mDNS,
cleaned up for inclusion in systemd.
* The APIs "sd-journal.h", "sd-login.h", "sd-id128.h" are no
longer found in individual libraries libsystemd-journal.so,
libsystemd-login.so, libsystemd-id128.so. Instead, we have
cleaned up for inclusion in systemd.
* The APIs "sd-journal.h", "sd-login.h", "sd-id128.h" are no
longer found in individual libraries libsystemd-journal.so,
libsystemd-login.so, libsystemd-id128.so. Instead, we have
- merged them into a single library libsystemd.so which
- provides all symbols. The reason for this are cyclic
+ merged them into a single library, libsystemd.so, which
+ provides all symbols. The reason for this is cyclic
do, like sharing static variables. Also, it substantially
increases footprint. With this change, there is only one
library for the basic APIs systemd provides. Also,
"sd-bus.h", "sd-memfd.h", "sd-event.h", "sd-rtnl.h",
"sd-resolve.h", "sd-utf8.h" are found in this library as
well, however are subject to the --enable-kdbus switch (see
do, like sharing static variables. Also, it substantially
increases footprint. With this change, there is only one
library for the basic APIs systemd provides. Also,
"sd-bus.h", "sd-memfd.h", "sd-event.h", "sd-rtnl.h",
"sd-resolve.h", "sd-utf8.h" are found in this library as
well, however are subject to the --enable-kdbus switch (see
- below). Note that "sd-dhcp.h" and "sd-daemon.h" are not part
- of this libraries (the former because it only consumes,
- never provides services of/to other APIs, and the latter
+ below). Note that "sd-dhcp-client.h" and "sd-daemon.h" are not
+ part of this library (the former because it only consumes,
+ never provides, services of/to other APIs, and the latter
provide the --enable-compat-libs compile-time switch which
will generate stub libraries that are compatible with the
old ones but redirect all calls to the new one.
provide the --enable-compat-libs compile-time switch which
will generate stub libraries that are compatible with the
old ones but redirect all calls to the new one.
"sd-memfd.h", "sd-event.h", "sd-rtnl.h", "sd-resolve.h",
"sd-memfd.h", "sd-event.h", "sd-rtnl.h", "sd-resolve.h",
- "sd-utf8.h" is compile-time optional via the
- "--enable-kdbus" switch, and is not compiled in by
- default. To make use of it, you have to explicitly enable
+ and "sd-utf8.h" are compile-time optional via the
+ "--enable-kdbus" switch, and they are not compiled in by
+ default. To make use of kdbus, you have to explicitly enable
the switch. Note however, that neither the kernel nor the
userspace API for all of this is considered stable yet. We
want to maintain the freedom to still change the APIs for
the switch. Note however, that neither the kernel nor the
userspace API for all of this is considered stable yet. We
want to maintain the freedom to still change the APIs for
* Also, note that while kdbus is pretty much complete,
it lacks one thing: proper policy support. This means you
* Also, note that while kdbus is pretty much complete,
it lacks one thing: proper policy support. This means you
it will be highly insecure. Policy support will be added in
one of the next releases, at the same time that we will
declare the APIs stable.
it will be highly insecure. Policy support will be added in
one of the next releases, at the same time that we will
declare the APIs stable.
"kdbus" is added to the kernel command line, the entire system
runs with kdbus instead of dbus-daemon, with the above mentioned
problem of missing the system policy enforcement. Also a future
"kdbus" is added to the kernel command line, the entire system
runs with kdbus instead of dbus-daemon, with the above mentioned
problem of missing the system policy enforcement. Also a future
which allows running a service with a namespaced /dev
directory that does not contain any device nodes for
physical devices. More specifically, it only includes devices
which allows running a service with a namespaced /dev
directory that does not contain any device nodes for
physical devices. More specifically, it only includes devices
entry points.
* logind has been extended to support behaviour like VT
switching on seats that do not support a VT. This makes
multi-session available on seats that are not the first seat
(seat0), and on systems where kernel support for VTs has
entry points.
* logind has been extended to support behaviour like VT
switching on seats that do not support a VT. This makes
multi-session available on seats that are not the first seat
(seat0), and on systems where kernel support for VTs has
* If a process holds a delay lock for system sleep or shutdown
and fails to release it in time, we will now log its
* If a process holds a delay lock for system sleep or shutdown
and fails to release it in time, we will now log its
* Boot-time status output is now enabled automatically after a
short timeout if boot does not progress, in order to give
* Boot-time status output is now enabled automatically after a
short timeout if boot does not progress, in order to give
* The boot-time output has been improved to show how much time
remains until jobs expire.
* The KillMode= switch in service units gained a new possible
* The boot-time output has been improved to show how much time
remains until jobs expire.
* The KillMode= switch in service units gained a new possible
all remaining processes of the service.
* When a scope unit is registered, a new property "Controller"
all remaining processes of the service.
* When a scope unit is registered, a new property "Controller"
RequestStop() signal to this name when it would like to shut
down the scope. This may be used to hook manager logic into
the shutdown logic of scope units. Also, scope units may now
RequestStop() signal to this name when it would like to shut
down the scope. This may be used to hook manager logic into
the shutdown logic of scope units. Also, scope units may now
systemd-activate was renamed from "--environment=" to
"--setenv=" for consistency.
* systemd-nspawn has been updated to create a new kdbus domain
for each container that is invoked, thus allowing each
container to have its own set of system and user buses,
systemd-activate was renamed from "--environment=" to
"--setenv=" for consistency.
* systemd-nspawn has been updated to create a new kdbus domain
for each container that is invoked, thus allowing each
container to have its own set of system and user buses,
* systemd-nspawn gained a new --drop-capability= switch to run
the container with less capabilities than the default. Both
* systemd-nspawn gained a new --drop-capability= switch to run
the container with less capabilities than the default. Both
* systemd-nspawn gained a new --register= switch to control
whether the container is registered with systemd-machined or
* systemd-nspawn gained a new --register= switch to control
whether the container is registered with systemd-machined or
OS images, but only specific apps.
* systemd-nspawn gained a new --keep-unit which may be used
OS images, but only specific apps.
* systemd-nspawn gained a new --keep-unit which may be used
results in registration of the unit service itself in
systemd-machined, instead of a newly opened scope unit.
* systemd-nspawn gained a new --network-interface= switch for
moving arbitrary interfaces to the container. The new
--network-veth switch creates a virtual Ethernet connection
results in registration of the unit service itself in
systemd-machined, instead of a newly opened scope unit.
* systemd-nspawn gained a new --network-interface= switch for
moving arbitrary interfaces to the container. The new
--network-veth switch creates a virtual Ethernet connection
- between host and container. Thew new --network-bridge=
- switch then additionally allows assigning the host side of
- this virtual Ethernet connection to a bridge device.
+ between host and container. The new --network-bridge=
+ switch then allows assigning the host side of this virtual
+ Ethernet connection to a bridge device.
+
+ * systemd-nspawn gained a new --personality= switch for
+ setting the kernel personality for the container. This is
+ useful when running a 32bit container on a 64bit host.
* logind will now also track a "Desktop" identifier for each
session which encodes the desktop environment of it. This is
* logind will now also track a "Desktop" identifier for each
session which encodes the desktop environment of it. This is
* Most systemd client tools will now honour $SYSTEMD_LESS for
settings of the "less" pager. By default, these tools will
* Most systemd client tools will now honour $SYSTEMD_LESS for
settings of the "less" pager. By default, these tools will
- override $LESS to allow certain operations like
- jump-to-the-end work. With $SYSTEMD_LESS, it is possible to
+ override $LESS to allow certain operations to work, such as
+ jump-to-the-end. With $SYSTEMD_LESS, it is possible to
- SystemCallErrorNumber= setting has been introduce that
- allows configuration if a system error number to return on
- filtered syscalls, instead of immediately killing the
+ SystemCallErrorNumber= setting has been introduced that
+ allows configuration of a system error number to return on
+ filtered system calls, instead of immediately killing the
process. Also, SystemCallArchitectures= has been added to
limit access to system calls of a particular architecture
(in order to turn off support for unused secondary
architectures). There is also a global
process. Also, SystemCallArchitectures= has been added to
limit access to system calls of a particular architecture
(in order to turn off support for unused secondary
architectures). There is also a global
off support for non-native system calls system-wide.
Contributions from: Adam Williamson, Alex Jia, Anatol Pomozov,
off support for non-native system calls system-wide.
Contributions from: Adam Williamson, Alex Jia, Anatol Pomozov,