mirror of
https://github.com/systemd/systemd.git
synced 2026-11-06 05:17:24 +00:00
man,doc: fix typos (#43766)
This commit is contained in:
Zbigniew Jędrzejewski-Szmek authored and GitHub committed
commit
4fb9fbd68a
45 files changed
+181
-181
No files matched your search
@@ -277,7 +277,7 @@ CHANGES WITH 262 in spe:
|
||||
read-only, systemd-boot skips updating the seed and does not credit
|
||||
it to the kernel entropy pool, since a seed that cannot be rotated
|
||||
would be reused on later boots. This may be used to turn off
|
||||
random-seed handling in replicated images. (Similar, the boot
|
||||
random-seed handling in replicated images. (Similarly, the boot
|
||||
counting logic is disabled if boot entry files or the file system
|
||||
backing them are marked as read-only.)
|
||||
|
||||
@@ -419,8 +419,8 @@ CHANGES WITH 262 in spe:
|
||||
before removing the old ones. If adding a new slot fails, the old
|
||||
slots are left intact, avoiding lockout on enrollment failure.
|
||||
|
||||
* homectl gained a new --recovery-key-file= option which may used to
|
||||
write the recover key into a file in an atomic and reasonable safe
|
||||
* homectl gained a new --recovery-key-file= option which may be used to
|
||||
write the recovery key into a file in an atomic and reasonably safe
|
||||
fashion, when enrolling one.
|
||||
|
||||
Changes in systemd-tmpfiles:
|
||||
@@ -502,7 +502,7 @@ CHANGES WITH 262 in spe:
|
||||
--tpm2-argon2id-memory=, --tpm2-argon2id-iterations=,
|
||||
--tpm2-argon2id-parallelism= and --tpm2-argon2id-iter-time=.
|
||||
|
||||
* systemd-cryptenroll now support an optional "first-boot" wizard for
|
||||
* systemd-cryptenroll now supports an optional "first-boot" wizard for
|
||||
enrolling additional unlock mechanisms. This is intended to be used
|
||||
in TPM enabled scenarios which default to unattended TPM-based disk
|
||||
encryption, but where enrollment of additional mechanisms to decrypt
|
||||
@@ -517,7 +517,7 @@ CHANGES WITH 262 in spe:
|
||||
to unlock the disk via an empty password, instead of prompting the
|
||||
user for one. There's also a new --unlock-headless switch, which is
|
||||
equivalent to --unlock-tpm2 if a TPM is available, and otherwise
|
||||
equivalent to --unlock-empty. This is supposed to to be useful in
|
||||
equivalent to --unlock-empty. This is supposed to be useful in
|
||||
scenarios where the system defaults to unattended encryption with a
|
||||
TPM if one is available, and an empty password otherwise.
|
||||
|
||||
@@ -645,7 +645,7 @@ CHANGES WITH 262 in spe:
|
||||
|
||||
* userdb services may now advertise via xattrs on their Varlink AF_UNIX
|
||||
entrypoint socket inodes for which subset of UID/GID ranges or
|
||||
user/group names (via glob expression) they shell be queried. This is
|
||||
user/group names (via glob expression) they shall be queried. This is
|
||||
a very efficient way to suppress unnecessary userdb backend IPC
|
||||
requests with very basic filtering. All of systemd's own userdb
|
||||
providers set the appropriate xattrs.
|
||||
@@ -716,7 +716,7 @@ CHANGES WITH 262 in spe:
|
||||
|
||||
* systemd-sysext will now honour new fields EXTENSION_RESTART_UNITS=
|
||||
and EXTENSION_RELOAD_OR_RESTART_UNITS= in the extension-release file.
|
||||
If may list units to restart or reload when a sysext is applied.
|
||||
It may list units to restart or reload when a sysext is applied.
|
||||
|
||||
* systemd-sysext can now automatically refresh if a systemd-sysupdate
|
||||
run completed, by enabling the systemd-sysupdate-notify-sysext.socket
|
||||
@@ -1135,7 +1135,7 @@ CHANGES WITH 261:
|
||||
and Type 11 in PCR 1, since some firmwares do not measure them, even
|
||||
though they are supposed to.
|
||||
|
||||
* systemd-tpm2-setup.service will now allocate NvPCRs in an orer
|
||||
* systemd-tpm2-setup.service will now allocate NvPCRs in an order
|
||||
configurable via the "priority" field of their defining JSON object.
|
||||
As NV index space is very constrained, it's essential to allocate them
|
||||
in the order of relevance, so that the least relevant NvPCRs are
|
||||
@@ -1758,7 +1758,7 @@ CHANGES WITH 260:
|
||||
|
||||
* Support for non-system users and groups in udev rules and
|
||||
systemd-networkd configuration has been restored, but is deprecated
|
||||
and discouraged. systemd-udevd will emits warnings if a non-system
|
||||
and discouraged. systemd-udevd will emit warnings if a non-system
|
||||
user/group is specified in OWNER=/GROUP=. Similarly, systemd-networkd
|
||||
will warn about User=/Group= settings with a non-system user/group
|
||||
specified in .netdev files for Tun/Tap interfaces. This support will
|
||||
@@ -1917,7 +1917,7 @@ CHANGES WITH 260:
|
||||
running stable kernel branches should ensure they are updated to patch
|
||||
levels that include the fix.
|
||||
|
||||
* Persistent network interface naming has bee extended to MCTP devices
|
||||
* Persistent network interface naming has been extended to MCTP devices
|
||||
with the "mc" prefix.
|
||||
|
||||
* The minimum backlight brightness value used when restoring backlight
|
||||
@@ -2044,7 +2044,7 @@ CHANGES WITH 260:
|
||||
the same switch in systemd-nspawn.
|
||||
|
||||
* systemd-vmspawn gained a new switch --image-format= for selecting the
|
||||
image format (i.e. support qcow2 in additin to raw) to boot from.
|
||||
image format (i.e. support qcow2 in addition to raw) to boot from.
|
||||
Also --extra-drive= now takes the image format as a colon separated
|
||||
parameter.
|
||||
|
||||
@@ -2306,7 +2306,7 @@ CHANGES WITH 259:
|
||||
* The image dissection logic will now enforce the VFAT file system type
|
||||
for XBOOTLDR partitions, similar to how it already does this for the
|
||||
ESP. This is done for security, since both the ESP and XBOOTLDR must
|
||||
be directly firmware-accessible and thus cannot by protected by
|
||||
be directly firmware-accessible and thus cannot be protected by
|
||||
cryptographic means. Thus it is essential to not mount arbitrarily
|
||||
complex file systems on them. This restriction only applies if
|
||||
automatic dissection is used. If other file system types shall be
|
||||
@@ -2487,7 +2487,7 @@ CHANGES WITH 259:
|
||||
|
||||
* systemd-homed's fscrypt backend gained a new key sealing format that
|
||||
aims to be more future-proof and robust against advances in brute
|
||||
forcing techniques. Compatibiilty with the existing format is maintained,
|
||||
forcing techniques. Compatibility with the existing format is maintained,
|
||||
but new enrollments will happen with the new format. Users enrolling
|
||||
new systems must thus take care in not downgrading to an older version.
|
||||
|
||||
@@ -2691,7 +2691,7 @@ CHANGES WITH 259:
|
||||
|
||||
* A new service systemd-pcrproduct.service is added which is similar to
|
||||
systemd-pcrmachine.service but instead of the machine ID
|
||||
(i.e. /etc/machined-id) measures the product ID (as reported by SMBIOS
|
||||
(i.e. /etc/machine-id) measures the product ID (as reported by SMBIOS
|
||||
or Devicetree). It uses a new NvPCR called "hardware" for this.
|
||||
|
||||
* systemd-pcrlock has been updated to generate CEL event log data
|
||||
@@ -3630,7 +3630,7 @@ CHANGES WITH 258:
|
||||
* bootctl's --no-variables switch has been replaced by
|
||||
--variables=yes/no. By setting --variables=yes modification of EFI
|
||||
variables can be forced now in environments where we'd previously
|
||||
automatically turn this off (e.g. in choot() contexts).
|
||||
automatically turn this off (e.g. in chroot() contexts).
|
||||
|
||||
* bootctl's --graceful is now implicitly enabled when running in a
|
||||
chroot, to ease integration in packaging scriptlets.
|
||||
@@ -4001,7 +4001,7 @@ CHANGES WITH 258:
|
||||
filename.
|
||||
|
||||
* systemd-dissect's --attach command now supports a new --quiet switch
|
||||
that suppressed output of the loopback device node path that is
|
||||
that suppresses output of the loopback device node path that is
|
||||
usually shown.
|
||||
|
||||
* A generic service template systemd-loop@.service has been added that
|
||||
@@ -4046,7 +4046,7 @@ CHANGES WITH 258:
|
||||
* The DDI dissection logic now understands a concept of partition
|
||||
"filtering". A partition filter is simply a per-designator globbing
|
||||
pattern to match the partition labels against. This may be used
|
||||
support parallel installations of multiple operating systems on the
|
||||
to support parallel installations of multiple operating systems on the
|
||||
same disk, where each OS names its partitions with a specific prefix
|
||||
or similar. systemd-dissect gained a new --image-filter= switch to
|
||||
configure this filter. The new "dissect_image" udev plugin and
|
||||
@@ -5053,11 +5053,11 @@ CHANGES WITH 257:
|
||||
with the same instance name.
|
||||
|
||||
* systemd-analyze's "capability" verb now gained a new --mask
|
||||
parameter. If specified a numeric capbality mask can be specified
|
||||
which is decoded for its contained capabilities.
|
||||
parameter. A numeric capability mask can be specified which is decoded
|
||||
for its contained capabilities.
|
||||
|
||||
* systemd-analyze's "plot" verb gained two new settings: --scale-svg=
|
||||
allows the X axis of the split to be stritched by a factor. If
|
||||
allows the X axis of the plot to be stretched by a factor. If
|
||||
--detailed is specified activation timestamps are shown in the plot.
|
||||
|
||||
busctl:
|
||||
@@ -5219,7 +5219,7 @@ CHANGES WITH 257:
|
||||
that the host systemd-coredump preferably dispatches coredump
|
||||
processing to the container itself, if it supports that. Only full-OS
|
||||
containers which run systemd inside will support this however, in
|
||||
other cases EnterNamespace= might be an suitable approach to acquire
|
||||
other cases EnterNamespace= might be a suitable approach to acquire
|
||||
symbolized backtraces.)
|
||||
|
||||
Special thanks to Nick Owens for bringing attention to and testing
|
||||
@@ -6260,7 +6260,7 @@ CHANGES WITH 256:
|
||||
* systemd-sysext gained support for enabling system extensions in
|
||||
mutable fashion, where a writable upperdir is stored under
|
||||
/var/lib/extensions.mutable/, and a new --mutable= option to
|
||||
configure this behaviour. An "ephemeral" mode is not also supported
|
||||
configure this behaviour. An "ephemeral" mode is now also supported
|
||||
where the mutable layer is configured to be a tmpfs that is
|
||||
automatically released when the system extensions are reattached.
|
||||
|
||||
@@ -6298,7 +6298,7 @@ CHANGES WITH 256:
|
||||
|
||||
* "systemd-analyze dot" will now also show BindsTo= dependencies.
|
||||
|
||||
* systemd-debug-generator gained the ability add in arbitrary units
|
||||
* systemd-debug-generator gained the ability to add arbitrary units
|
||||
based on them being passed in via system credentials.
|
||||
|
||||
* A new kernel command-line option systemd.default_debug_tty= can be
|
||||
@@ -6740,7 +6740,7 @@ CHANGES WITH 255:
|
||||
* .network files gained a new IPv4ReversePathFilter= setting in the
|
||||
[Network] section, to control sysctl's rp_filter setting.
|
||||
|
||||
* .network files gaiend a new HopLimit= setting in the [Route] section,
|
||||
* .network files gained a new HopLimit= setting in the [Route] section,
|
||||
to configure a per-route hop limit.
|
||||
|
||||
* .network files gained a new TCPRetransmissionTimeoutSec= setting in
|
||||
@@ -7055,7 +7055,7 @@ CHANGES WITH 254:
|
||||
process capability to invoked session processes of regular users on
|
||||
local seats (as well as to systemd --user), unless configured
|
||||
otherwise via data from JSON user records, or via the PAM module's
|
||||
parameter list. This is useful in order allow desktop tools such as
|
||||
parameter list. This is useful in order to allow desktop tools such as
|
||||
GNOME's Alarm Clock application to set a timer for
|
||||
CLOCK_REALTIME_ALARM that wakes up the system when it elapses. A
|
||||
per-user service unit file may thus use AmbientCapability= to pass
|
||||
@@ -7802,7 +7802,7 @@ CHANGES WITH 253:
|
||||
privileges, so impact should be small. This will remove a great source
|
||||
of confusion that has been reported by users over the years, due to
|
||||
how these options require an extra setting to be manually enabled when
|
||||
used in the per-user service manager, as opposed as to the system
|
||||
used in the per-user service manager, as opposed to the system
|
||||
service manager. We plan to enable this change in the next release
|
||||
later this year. For more details, see:
|
||||
https://lists.freedesktop.org/archives/systemd-devel/2022-December/048682.html
|
||||
@@ -8038,7 +8038,7 @@ CHANGES WITH 253:
|
||||
* systemd-stub now processes random seeds in the same way as
|
||||
systemd-boot already does, in case a unified kernel image is being
|
||||
used from a different bootloader than systemd-boot, or without any
|
||||
boot load at all.
|
||||
boot loader at all.
|
||||
|
||||
* bootctl will now generate a system token on all EFI systems, even
|
||||
virtualized ones, and is activated in the case that the system token
|
||||
@@ -8102,7 +8102,7 @@ CHANGES WITH 253:
|
||||
* The [DHCPv4] section in .network file gained new SocketPriority=
|
||||
setting that assigns the Linux socket priority used by the DHCPv4 raw
|
||||
socket. This may be used in conjunction with the
|
||||
EgressQOSMaps=setting in [VLAN] section of .netdev file to send the
|
||||
EgressQOSMaps= setting in [VLAN] section of .netdev file to send the
|
||||
desired ethernet 802.1Q frame priority for DHCPv4 initial
|
||||
packets. This cannot be achieved with netfilter mangle tables because
|
||||
of the raw socket bypass.
|
||||
@@ -8250,8 +8250,8 @@ CHANGES WITH 253:
|
||||
systemd-pcrfs@.service have been added that invoke the tool with
|
||||
these switches during early boot.
|
||||
|
||||
* systemd-pcrphase gained a --graceful switch will make it exit cleanly
|
||||
with a success exit code even if no TPM device is detected.
|
||||
* systemd-pcrphase gained a --graceful switch that will make it exit
|
||||
cleanly with a success exit code even if no TPM device is detected.
|
||||
|
||||
* systemd-cryptenroll now stores the user-supplied PIN with a salt,
|
||||
making it harder to brute-force.
|
||||
@@ -8272,7 +8272,7 @@ CHANGES WITH 253:
|
||||
unprivileged code to access those values.
|
||||
|
||||
systemd-hostnamed also exports the SUPPORT_END= field from
|
||||
os-release(5) as OperatingSystemSupportEnd. hostnamectl make uses of
|
||||
os-release(5) as OperatingSystemSupportEnd. hostnamectl makes use of
|
||||
this to show the status of the installed system.
|
||||
|
||||
* systemd-measure gained an --append= option to sign multiple phase
|
||||
@@ -8765,11 +8765,10 @@ CHANGES WITH 252 🎃:
|
||||
* A new function sd_hwdb_new_from_path() has been added to open a hwdb
|
||||
database given an explicit path to the file.
|
||||
|
||||
* The signal number argument to sd_event_add_signal() now can now be
|
||||
ORed with the SD_EVENT_SIGNAL_PROCMASK flag, causing sigprocmask() to
|
||||
be automatically invoked to block the specified signal. This is
|
||||
useful to simplify invocations as the caller doesn't have to do this
|
||||
manually.
|
||||
* The signal number argument to sd_event_add_signal() can now be ORed
|
||||
with the SD_EVENT_SIGNAL_PROCMASK flag, causing sigprocmask() to be
|
||||
automatically invoked to block the specified signal. This is useful to
|
||||
simplify invocations as the caller doesn't have to do this manually.
|
||||
|
||||
* A new convenience call sd_event_set_signal_exit() has been added to
|
||||
sd-event to set up signal handling so that the event loop
|
||||
@@ -9527,8 +9526,8 @@ CHANGES WITH 251:
|
||||
|
||||
* hostnamed's D-Bus interface gained a new method GetHardwareSerial()
|
||||
for reading the hardware serial number, as reported by DMI. It also
|
||||
exposes a new method D-Bus property FirmwareVersion that encode the
|
||||
firmware version of the system.
|
||||
exposes a new D-Bus property FirmwareVersion that encodes the firmware
|
||||
version of the system.
|
||||
|
||||
Changes in other components:
|
||||
|
||||
@@ -10120,7 +10119,7 @@ CHANGES WITH 250:
|
||||
* sd-boot now embeds a .osrel PE section like we expect from Boot
|
||||
Loader Specification Type #2 Unified Kernels. This means sd-boot
|
||||
itself may be used in place of a Type #2 Unified Kernel. This is
|
||||
useful for debugging purposes as it allows chain-loading one a
|
||||
useful for debugging purposes as it allows chain-loading one
|
||||
(development) sd-boot instance from another.
|
||||
|
||||
* sd-boot now supports a new "devicetree" field in Boot Loader
|
||||
@@ -11355,7 +11354,7 @@ CHANGES WITH 248:
|
||||
|
||||
"IPMasquerade=yes", which was the same as "IPMasquerade=ipv4" before,
|
||||
retains its meaning, but has been deprecated. Please switch to either
|
||||
"ivp4" or "both" (if covering IPv6 is desired).
|
||||
"ipv4" or "both" (if covering IPv6 is desired).
|
||||
|
||||
* systemd-importd will now download .verity and .roothash.p7s files
|
||||
along with the machine image (as exposed via machinectl pull-raw).
|
||||
@@ -11437,7 +11436,7 @@ CHANGES WITH 248:
|
||||
* systemd-localed will now refuse to configure a keymap which is not
|
||||
installed in the file system. This is intended as a bug fix, but
|
||||
could break cases where systemd-localed was used to configure the
|
||||
keymap in advanced of it being installed. It is necessary to install
|
||||
keymap in advance of it being installed. It is necessary to install
|
||||
the keymap file first.
|
||||
|
||||
* The main git development branch has been renamed to 'main'.
|
||||
@@ -11998,14 +11997,14 @@ CHANGES WITH 247:
|
||||
was originally defined in the Multimedia context (to restart playback
|
||||
of a song or film), but is now primarily used in various embedded
|
||||
devices for "Reboot" buttons. Accordingly, systemd-logind will now
|
||||
honour it as such. This may configured in more detail via the new
|
||||
honour it as such. This may be configured in more detail via the new
|
||||
HandleRebootKey= and RebootKeyIgnoreInhibited=.
|
||||
|
||||
* systemd-nspawn/systemd-machined will now reconstruct hardlinks when
|
||||
copying OS trees, for example in "systemd-nspawn --ephemeral",
|
||||
"systemd-nspawn --template=", "machinectl clone" and similar. This is
|
||||
useful when operating with OSTree images, which use hardlinks heavily
|
||||
throughout, and where such copies previously resulting in "exploding"
|
||||
throughout, and where such copies previously resulted in "exploding"
|
||||
hardlinks.
|
||||
|
||||
* systemd-nspawn's --console= setting gained support for a new
|
||||
@@ -13672,7 +13671,7 @@ CHANGES WITH 243:
|
||||
IPv6 configuration (static or DHCPv6) was found for a given
|
||||
interface. It will not touch the sysctl otherwise.
|
||||
|
||||
* The order of entries is $PATH used by the user manager instance was
|
||||
* The order of entries in $PATH used by the user manager instance was
|
||||
changed to put bin/ entries before the corresponding sbin/ entries.
|
||||
It is recommended to not rely on this order, and only ever have one
|
||||
binary with a given name in the system paths under /usr.
|
||||
@@ -13831,7 +13830,7 @@ CHANGES WITH 243:
|
||||
BFQ scheduler officially found in kernels 5.0+.
|
||||
|
||||
* A new mailing list has been created for reporting of security issues:
|
||||
systemd-security@redhat.com. For mode details, see
|
||||
systemd-security@redhat.com. For more details, see
|
||||
https://systemd.io/CONTRIBUTING#security-vulnerability-reports.
|
||||
|
||||
Contributions from: Aaron Barany, Adrian Bunk, Alan Jenkins, Albrecht
|
||||
@@ -14002,8 +14001,8 @@ CHANGES WITH 242:
|
||||
submit-from-crypt-cpus options to tweak encryption work scheduling
|
||||
details.
|
||||
|
||||
* systemd-tmpfiles will now take a BSD file lock before operating on a
|
||||
contents of directory. This may be used to temporarily exclude
|
||||
* systemd-tmpfiles will now take a BSD file lock before operating on the
|
||||
contents of a directory. This may be used to temporarily exclude
|
||||
directories from aging by taking the same lock (useful for example
|
||||
when extracting a tarball into /tmp or /var/tmp as a privileged user,
|
||||
which might create files with really old timestamps, which
|
||||
@@ -14028,7 +14027,7 @@ CHANGES WITH 242:
|
||||
partition.
|
||||
|
||||
* A system may now be booted with systemd.volatile=overlay on the
|
||||
kernel command line, which causes the root file system to be set up
|
||||
kernel command line, which causes the root file system to be set up as
|
||||
an overlayfs mount combining the root-only root directory with a
|
||||
writable tmpfs. In this setup, the underlying root device is not
|
||||
modified, and any changes are lost at reboot.
|
||||
@@ -14038,7 +14037,7 @@ CHANGES WITH 242:
|
||||
|
||||
* systemd-nspawn can now consume OCI runtime bundles using a new
|
||||
--oci-bundle= option. This implementation is fully usable, with most
|
||||
features in the specification implemented, but since this a lot of
|
||||
features in the specification implemented, but since this is a lot of
|
||||
new code and functionality, this feature should most likely not
|
||||
be used in production yet.
|
||||
|
||||
@@ -14624,7 +14623,7 @@ CHANGES WITH 240:
|
||||
(or just -S) option has been added for invoking the $SHELL of the
|
||||
caller as a service, and implies --pty --same-dir --wait --collect
|
||||
--service-type=exec. Or in other words, "systemd-run -S" is now the
|
||||
quickest way to quickly get an interactive in a fully clean and
|
||||
quickest way to get an interactive shell in a fully clean and
|
||||
well-defined system service context.
|
||||
|
||||
* machinectl gained a new verb "import-fs" for importing an OS tree
|
||||
@@ -15248,7 +15247,7 @@ CHANGES WITH 238:
|
||||
machine is connected to external power can now be configured using
|
||||
HandleLidSwitchExternalPower= in logind.conf. Previously, this action
|
||||
was determined by HandleLidSwitch=, and, for backwards compatibility,
|
||||
is still is, if HandleLidSwitchExternalPower= is not explicitly set.
|
||||
still is, if HandleLidSwitchExternalPower= is not explicitly set.
|
||||
|
||||
* journalctl will periodically call sd_journal_process() to make it
|
||||
resilient against inotify queue overruns when journal files are
|
||||
@@ -16873,7 +16872,7 @@ CHANGES WITH 232:
|
||||
CAP_SYS_MKNOD as before).
|
||||
|
||||
* In service unit files it is now possible to connect a specific named
|
||||
file descriptor with stdin/stdout/stdout of an executed service. The
|
||||
file descriptor with stdin/stdout/stderr of an executed service. The
|
||||
name may be specified in matching .socket units using the
|
||||
FileDescriptorName= setting.
|
||||
|
||||
@@ -17289,7 +17288,7 @@ CHANGES WITH 230:
|
||||
|
||||
* The DeviceAllow= unit setting now supports specifiers (with "%").
|
||||
|
||||
* "systemctl show" gained a new --value switch, which allows print a
|
||||
* "systemctl show" gained a new --value switch, which allows printing
|
||||
only the contents of a specific unit property, without also printing
|
||||
the property's name. Similar support was added to "show*" verbs
|
||||
of loginctl and machinectl that output "key=value" lists.
|
||||
@@ -17847,7 +17846,7 @@ CHANGES WITH 227:
|
||||
|
||||
* Support for the "pids" cgroup controller has been added. It
|
||||
allows accounting the number of tasks in a cgroup and
|
||||
enforcing limits on it. This adds two new setting
|
||||
enforcing limits on it. This adds two new settings
|
||||
TasksAccounting= and TasksMax= to each unit, as well as a
|
||||
global option DefaultTasksAccounting=.
|
||||
|
||||
@@ -17869,7 +17868,7 @@ CHANGES WITH 227:
|
||||
|
||||
* Watchdog timeouts have been increased to 3 minutes for all
|
||||
in-tree service files. Apparently, disk IO issues are more
|
||||
frequent than we hoped, and user reported >1 minute waiting
|
||||
frequent than we hoped, and users reported >1 minute waiting
|
||||
for disk IO.
|
||||
|
||||
* 'machine-id-commit' functionality has been merged into
|
||||
@@ -17931,7 +17930,7 @@ CHANGES WITH 227:
|
||||
show the control groups within a certain container only.
|
||||
|
||||
* "systemctl kill" gained support for an optional --fail
|
||||
switch. If specified the requested operation will fail of no
|
||||
switch. If specified the requested operation will fail if no
|
||||
processes have been killed, because the unit had no
|
||||
processes attached, or similar.
|
||||
|
||||
@@ -17995,7 +17994,7 @@ CHANGES WITH 227:
|
||||
service that is activated through /dev/rfkill on each rfkill
|
||||
state change and saves the settings to disk. This way,
|
||||
systemd-rfkill is now compatible with devices that exist
|
||||
only intermittendly, and even restores state if the previous
|
||||
only intermittently, and even restores state if the previous
|
||||
system shutdown was abrupt rather than clean.
|
||||
|
||||
* The journal daemon gained support for vacuuming old journal
|
||||
@@ -19437,7 +19436,7 @@ CHANGES WITH 216:
|
||||
systemd-resolved. Hostnames, addresses and arbitrary RRs may
|
||||
be resolved via systemd-resolved D-Bus APIs. In contrast to
|
||||
the glibc internal resolver systemd-resolved is aware of
|
||||
multi-homed system, and keeps DNS server and caches separate
|
||||
multi-homed systems, and keeps DNS server and caches separate
|
||||
and per-interface. Queries are sent simultaneously on all
|
||||
interfaces that have DNS servers configured, in order to
|
||||
properly handle VPNs and local LANs which might resolve
|
||||
@@ -19688,7 +19687,7 @@ CHANGES WITH 215:
|
||||
* For tmpfiles' "L", "L+", "C" and "C+" directives the final
|
||||
'argument' field (which so far specified the source to
|
||||
symlink/copy the files from) is now optional. If omitted the
|
||||
same file os copied from /usr/share/factory/ suffixed by the
|
||||
same file is copied from /usr/share/factory/ suffixed by the
|
||||
full destination path. This is useful for populating /etc
|
||||
with essential files, by copying them from vendor defaults
|
||||
shipped in /usr/share/factory/etc.
|
||||
@@ -21571,7 +21570,7 @@ CHANGES WITH 202:
|
||||
|
||||
Contributions from: Anatol Pomozov, Auke Kok, Harald Hoyer,
|
||||
Henrik Grindal Bakken, Josh Triplett, Kay Sievers, Lennart
|
||||
Poettering, Lukas Nykryn, Mantas Mikulėnas Marius Vollmer,
|
||||
Poettering, Lukas Nykryn, Mantas Mikulėnas, Marius Vollmer,
|
||||
Martin Jansa, Martin Pitt, Michael Biebl, Michal Schmidt,
|
||||
Mirco Tischler, Pali Rohar, Simon Peeters, Steven Hiscocks,
|
||||
Tom Gundersen, Zbigniew Jędrzejewski-Szmek
|
||||
@@ -21596,7 +21595,7 @@ CHANGES WITH 201:
|
||||
* 'systemctl status' will now show information about the
|
||||
network sockets a socket unit is listening on.
|
||||
|
||||
* 'systemctl status' will also shown information about any
|
||||
* 'systemctl status' will also show information about any
|
||||
drop-in configuration file for units. (Drop-In configuration
|
||||
files in this context are files such as
|
||||
/etc/systemd/system/foobar.service.d/*.conf)
|
||||
@@ -21929,7 +21928,7 @@ CHANGES WITH 198:
|
||||
journal output in reverse order (i.e. newest line first).
|
||||
|
||||
* journalctl gained a new "--pager-end" (or -e) option to jump
|
||||
to immediately jump to the end of the journal in the
|
||||
immediately to the end of the journal in the
|
||||
pager. This is only supported in conjunction with "less".
|
||||
|
||||
* journalctl gained a new "--user-unit=" option, that works
|
||||
@@ -22069,7 +22068,7 @@ CHANGES WITH 197:
|
||||
|
||||
* Unit files learnt a new condition ConditionACPower= which
|
||||
may be used to conditionalize a unit depending on whether an
|
||||
AC power source is connected or not, of whether the system
|
||||
AC power source is connected or not, or whether the system
|
||||
is running on battery power.
|
||||
|
||||
* systemctl gained a new "is-failed" verb that may be used in
|
||||
@@ -22391,7 +22390,7 @@ CHANGES WITH 192:
|
||||
and line break accordingly.
|
||||
|
||||
Contributions from: Dave Reisner, Kay Sievers, Lennart
|
||||
Poettering, Lukas Nykrynm, Mirco Tischler, Václav Pavlín
|
||||
Poettering, Lukas Nykryn, Mirco Tischler, Václav Pavlín
|
||||
|
||||
CHANGES WITH 191:
|
||||
|
||||
@@ -22500,7 +22499,7 @@ CHANGES WITH 190:
|
||||
* There's now a new RPM macro definition for the system preset
|
||||
dir: %_presetdir.
|
||||
|
||||
* journald will now warn if it ca not forward a message to the
|
||||
* journald will now warn if it cannot forward a message to the
|
||||
syslog daemon because its socket is full.
|
||||
|
||||
* timedated will no longer write or process /etc/timezone,
|
||||
|
||||
@@ -148,7 +148,7 @@ REQUIREMENTS:
|
||||
CONFIG_CFS_BANDWIDTH
|
||||
|
||||
Required for IPAddressDeny=, IPAddressAllow=, IPIngressFilterPath=,
|
||||
IPEgressFilterPath= in resource control unit settings unit settings:
|
||||
IPEgressFilterPath= in resource control unit settings:
|
||||
CONFIG_BPF
|
||||
CONFIG_BPF_SYSCALL
|
||||
CONFIG_BPF_JIT
|
||||
@@ -263,8 +263,8 @@ REQUIREMENTS:
|
||||
>= 13.1.0 is required to build BPF program by using GCC
|
||||
binutils >= 2.35
|
||||
awk, sed, grep, and similar tools
|
||||
clang,llvm >= 10 (optional, required to build BPF programs)
|
||||
>= 13 (optional, required to build the entire project)
|
||||
clang, llvm >= 10 (optional, required to build BPF programs)
|
||||
>= 13 (optional, required to build the entire project)
|
||||
|
||||
During runtime, you need the following additional
|
||||
dependencies:
|
||||
@@ -276,8 +276,8 @@ REQUIREMENTS:
|
||||
NOTE: If using dbus < 1.9.18, you should override the default
|
||||
policy directory (--with-dbuspolicydir=/etc/dbus-1/system.d).
|
||||
polkit (optional)
|
||||
gnupg >= 2.4 optional (for signature verification in: importctl,
|
||||
systemd-sysupdate)
|
||||
gnupg >= 2.4 (optional, for signature verification in: importctl,
|
||||
systemd-sysupdate)
|
||||
|
||||
To build in directory build/:
|
||||
meson setup build/ && ninja -C build/
|
||||
|
||||
@@ -6,12 +6,12 @@ System and Service Manager
|
||||
[](https://the-real-systemd.semaphoreci.com/projects/systemd)<br/>
|
||||
[](https://scan.coverity.com/projects/systemd)<br/>
|
||||
[](https://oss-fuzz-build-logs.storage.googleapis.com/index.html#systemd)<br/>
|
||||
[](https://github.com/systemd/systemd/actions/workflows/cifuzz.yml)</br>
|
||||
[](https://github.com/systemd/systemd/actions/workflows/cifuzz.yml)<br/>
|
||||
[](https://bestpractices.coreinfrastructure.org/projects/1369)<br/>
|
||||
[](https://fossies.org/linux/test/systemd-main.tar.gz/codespell.html)</br>
|
||||
[](https://translate.fedoraproject.org/engage/systemd/)</br>
|
||||
[](https://coveralls.io/github/systemd/systemd?branch=main)</br>
|
||||
[](https://repology.org/project/systemd/versions)</br>
|
||||
[](https://fossies.org/linux/test/systemd-main.tar.gz/codespell.html)<br/>
|
||||
[](https://translate.fedoraproject.org/engage/systemd/)<br/>
|
||||
[](https://coveralls.io/github/systemd/systemd?branch=main)<br/>
|
||||
[](https://repology.org/project/systemd/versions)<br/>
|
||||
[](https://securityscorecards.dev/viewer/?platform=github.com&org=systemd&repo=systemd)
|
||||
|
||||
## Details
|
||||
|
||||
@@ -137,7 +137,7 @@ SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
- sysupdate: add flag field for features and components, to require a restart
|
||||
of the update loop once they have been updated.
|
||||
|
||||
- confext/sysext: add policy file concept: json files that encode for rleevant
|
||||
- confext/sysext: add policy file concept: json files that encode for relevant
|
||||
confext/sysext ddis rules when to enable them, i.e. version checks. also use
|
||||
it for the garbage collector
|
||||
|
||||
@@ -191,7 +191,7 @@ SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
- store workload identity OIDC server contact info in cloud imds hwdb.
|
||||
|
||||
- systemd-analyze unit-shell-me-harder that has both host and unit trees around
|
||||
but mostly lives in unit namespces
|
||||
but mostly lives in unit namespaces
|
||||
|
||||
- os-release consumption at boot: version validation, and maybe in os-release
|
||||
|
||||
@@ -217,7 +217,7 @@ SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
- nspawn/vmspawn: add a concept how we can hand into the payload some proof
|
||||
that it is running on a certain host, which it can then include in the report,
|
||||
and which allows us to put together a map about which node runs as payload of
|
||||
which other note. in particular useful for transient nodes, as it gives them
|
||||
which other node. in particular useful for transient nodes, as it gives them
|
||||
a better location
|
||||
|
||||
- add a small varlink service that wraps the raw sftp logic (without ssh) after a
|
||||
@@ -284,7 +284,7 @@ SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
- firstboot: optionally accept credentials at firstboot without authentication
|
||||
|
||||
- firstboot/sysinstall: add simple interface for prompting users to enable
|
||||
"features" exposed by of sysupdate.
|
||||
"features" exposed by sysupdate.
|
||||
|
||||
- a tool that can prep credentials, put them in the ESP, for provisioning
|
||||
systems for SBC or UEFI/HTTP boot. Should be doing what sysinstall does with
|
||||
@@ -535,7 +535,7 @@ SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
when it is otherwise off
|
||||
|
||||
- add growvol and makevol options for /etc/crypttab, similar to
|
||||
x-systemd.growfs and x-systemd-makefs.
|
||||
x-systemd.growfs and x-systemd.makefs.
|
||||
|
||||
- Add knob to cryptsetup, to trigger automatic reboot on failure to unlock
|
||||
disk. Enable this by default for rootfs, also in gpt-auto-generator
|
||||
@@ -1198,7 +1198,7 @@ SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
inspiration from IMA log)
|
||||
|
||||
- Hook up journald's FSS logic with TPM2: seal the verification disk by
|
||||
time-based policy, so that the verification key can remain on host and ve
|
||||
time-based policy, so that the verification key can remain on host and be
|
||||
validated via TPM.
|
||||
|
||||
- Hook up systemd-journal-upload with RESTART_RESET=1 logic (should probably
|
||||
@@ -1726,10 +1726,10 @@ SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
- Maybe introduce an InodeRef structure inspired by PidRef, which references a
|
||||
specific inode, and combines: a path, an O_PATH fd, and possibly a FID into
|
||||
one. Why? We often pass around path and fd separately in chaseat() and similar
|
||||
calls. Because passing around both separately is cumbersome we sometimes only
|
||||
one pass one, once the other and sometimes both. It would make the code a lot
|
||||
simpler if we could path both around at the same time in a simple way, via an
|
||||
InodeRef which *both* pins the inode via an fd, *and* gives us a friendly
|
||||
calls. Because passing around both separately is cumbersome we sometimes pass
|
||||
only one, sometimes the other, and sometimes both. It would make the code a
|
||||
lot simpler if we could pass both around at the same time in a simple way, via
|
||||
an InodeRef which *both* pins the inode via an fd, *and* gives us a friendly
|
||||
name for it.
|
||||
|
||||
- maybe introduce an OSC sequence that signals when we ask for a password, so
|
||||
@@ -1960,9 +1960,9 @@ SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
- pam_systemd: on interactive logins, maybe show SUPPORT_END information at
|
||||
login time, à la motd
|
||||
|
||||
- pam_systemd_home: add module parameter to control whether to only accept
|
||||
only password or only pcks11/fido2 auth, and then use this to hook nicely
|
||||
into two of the three PAM stacks gdm provides.
|
||||
- pam_systemd_home: add module parameter to control whether to accept only
|
||||
password or only pkcs11/fido2 auth, and then use this to hook nicely into two
|
||||
of the three PAM stacks gdm provides.
|
||||
See discussion at https://github.com/authselect/authselect/pull/311
|
||||
|
||||
- paranoia: whenever we process passwords, call mlock() on the memory
|
||||
@@ -2119,7 +2119,7 @@ SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
- ptyfwd: use osc context information in vmspawn/nspawn/… to optionally only
|
||||
listen to ^]]] key when no further vmspawn/nspawn context is allocated
|
||||
|
||||
- ptyfwd: usec osc context information to propagate status messages from
|
||||
- ptyfwd: use osc context information to propagate status messages from
|
||||
vmspawn/nspawn to service manager's "status" string, reporting what is
|
||||
currently in the fg
|
||||
|
||||
|
||||
+1
-1
@@ -57,7 +57,7 @@ The text format of the .catalog files is as follows:
|
||||
For each message ID (in combination with a locale) only a single entry may be defined.
|
||||
Every entry consists of:
|
||||
* A separator line beginning with `-- `, followed by a hexadecimal message ID formatted as lower case ASCII string.
|
||||
Optionally, the message ID may be suffixed by a space and a locale identifier, such as `de` or `fr\_FR`, if i10n is required.
|
||||
Optionally, the message ID may be suffixed by a space and a locale identifier, such as `de` or `fr_FR`, if l10n is required.
|
||||
* A series of entry headers, in RFC822-style but not supporting continuation lines.
|
||||
Some header fields may appear more than once per entry.
|
||||
The following header fields are currently known (but additional fields may be added later):
|
||||
|
||||
@@ -203,9 +203,9 @@ To create and start a transient (scope, service or slice) unit in the cgroup tre
|
||||
|
||||
The properties array of `StartTransientUnit()` may take many of the settings that may also be configured in unit files. Not all parameters are currently accepted though, but we plan to cover more properties with future release. Currently you may set the `Description`, `Slice` and all dependency types of units, as well as `RemainAfterExit`, `ExecStart` for service units, `TimeoutStopUSec` and `PIDs` for scope units, and `CPUAccounting`, `CPUShares`, `BlockIOAccounting`, `BlockIOWeight`, `BlockIOReadBandwidth`, `BlockIOWriteBandwidth`, `BlockIODeviceWeight`, `MemoryAccounting`, `MemoryLimit`, `DevicePolicy`, `DeviceAllow` for services/scopes/slices. These fields map directly to their counterparts in unit files and as normal D-Bus object properties. The exception here is the `PIDs` field of scope units which is used for construction of the scope only and specifies the initial PIDs to add to the scope object.
|
||||
|
||||
To alter resource control properties at runtime use the `SetUnitProperty()` call on the `Manager` object or `SetProperty()` on the individual Unit objects. This also takes an array of properties to set, in the same format as `StartTransientUnit()` takes. Note again that this is not a dictionary, and allows properties to be set multiple times with a single invocation. THis is useful for array properties: if a property is assigned the empty array it will be reset to the empty array itself, however if it is assigned a non-empty array then this array is appended to the previous array. This mimics behaviour of array settings in unit files. Note that most settings may only be set during creation of units with `StartTransientUnit()`, and may not be altered later on. The exception here are the resource control settings, more specifically `CPUAccounting`, `CPUShares`, `BlockIOAccounting`, `BlockIOWeight`, `BlockIOReadBandwidth`, `BlockIOWriteBandwidth`, `BlockIODeviceWeight`, `MemoryAccounting`, `MemoryLimit`, `DevicePolicy`, `DeviceAllow` for services/scopes/slices. Note that the standard D-Bus `org.freedesktop.DBus.Properties.Set()` call is currently not supported by any of the unit objects to set these properties, but might eventually (note however, that it is substantially less useful as it only allows setting a single property at a time, resulting in races).
|
||||
To alter resource control properties at runtime use the `SetUnitProperties()` call on the `Manager` object or `SetProperties()` on the individual Unit objects. This also takes an array of properties to set, in the same format as `StartTransientUnit()` takes. Note again that this is not a dictionary, and allows properties to be set multiple times with a single invocation. This is useful for array properties: if a property is assigned the empty array it will be reset to the empty array itself, however if it is assigned a non-empty array then this array is appended to the previous array. This mimics behaviour of array settings in unit files. Note that most settings may only be set during creation of units with `StartTransientUnit()`, and may not be altered later on. The exception here are the resource control settings, more specifically `CPUAccounting`, `CPUShares`, `BlockIOAccounting`, `BlockIOWeight`, `BlockIOReadBandwidth`, `BlockIOWriteBandwidth`, `BlockIODeviceWeight`, `MemoryAccounting`, `MemoryLimit`, `DevicePolicy`, `DeviceAllow` for services/scopes/slices. Note that the standard D-Bus `org.freedesktop.DBus.Properties.Set()` call is currently not supported by any of the unit objects to set these properties, but might eventually (note however, that it is substantially less useful as it only allows setting a single property at a time, resulting in races).
|
||||
|
||||
The [`systemctl set-property`](https://www.freedesktop.org/software/systemd/man/latest/systemctl.html) command internally is little more than a wrapper around `SetUnitProperty()`. The [`systemd-run`](https://www.freedesktop.org/software/systemd/man/latest/systemd-run.html) tool is a wrapper around `StartTransientUnit()`. It may be used to either run a process as a transient service in the background, where it is invoked from PID 1, or alternatively as a scope unit in the foreground, where it is run from the `systemd-run` process itself.
|
||||
The [`systemctl set-property`](https://www.freedesktop.org/software/systemd/man/latest/systemctl.html) command internally is little more than a wrapper around `SetUnitProperties()`. The [`systemd-run`](https://www.freedesktop.org/software/systemd/man/latest/systemd-run.html) tool is a wrapper around `StartTransientUnit()`. It may be used to either run a process as a transient service in the background, where it is invoked from PID 1, or alternatively as a scope unit in the foreground, where it is run from the `systemd-run` process itself.
|
||||
|
||||
### Enumeration
|
||||
|
||||
|
||||
+1
-1
@@ -503,7 +503,7 @@ systemd-nspawn -i test.raw \
|
||||
```
|
||||
|
||||
This boots the specified disk image as `systemd-nspawn` container, and passes
|
||||
the root password `mysecret`and default locale `C.UTF-8` to use to it. This
|
||||
the root password `mysecret` and the default locale `C.UTF-8` to it. This
|
||||
data is then propagated by default to `systemd-sysusers.service` and
|
||||
`systemd-firstboot.service`, where it is applied. (Note that these services
|
||||
will only do so if these settings in `/etc/` are so far unset, i.e. they only
|
||||
|
||||
@@ -9,7 +9,7 @@ SPDX-License-Identifier: LGPL-2.1-or-later
|
||||
|
||||
*TL;DR: The systemd service manager may optionally maintain a set of file
|
||||
descriptors for each service. Those file descriptors are under control of the
|
||||
service. Storing file descriptors in the manager makes is easier to restart
|
||||
service. Storing file descriptors in the manager makes it easier to restart
|
||||
services without dropping connections or losing state.*
|
||||
|
||||
Since its inception `systemd` has supported the *socket* *activation*
|
||||
|
||||
@@ -133,7 +133,7 @@ maliciously formatted file systems; there's a good chance that file system
|
||||
images can be used as attack vectors, exploiting the kernel.
|
||||
Thus it is necessary to validate the home directory image *before* mounting it and establishing a minimal level of trust.
|
||||
Since the user record data is cryptographically signed and user records not signed with a recognized private
|
||||
key are not accepted, a minimal level of trust between the system and the homedirectory image is established.
|
||||
key are not accepted, a minimal level of trust between the system and the home directory image is established.
|
||||
|
||||
Rationale for storing the home directory one level below to root directory of
|
||||
the contained file system:
|
||||
|
||||
@@ -332,7 +332,7 @@ services copied onto the host.
|
||||
|
||||
## Logging
|
||||
|
||||
Several fields are autotmatically added to log messages generated by a portable
|
||||
Several fields are automatically added to log messages generated by a portable
|
||||
service (or about a portable service, e.g.: start/stop logs from systemd).
|
||||
The `PORTABLE=` field will refer to the name of the portable image where the unit
|
||||
was loaded from. In case extensions are used, additionally there will be a `PORTABLE_ROOT=` field, referring to the name of the image used as the base layer (i.e.: `RootImage=` or `RootDirectory=`), and one `PORTABLE_EXTENSION=` field for
|
||||
|
||||
@@ -105,7 +105,7 @@ systemd itself requires random numbers as well, including for the following uses
|
||||
and thus the runtime context the service manager maintains can be neatly matched up with
|
||||
the log data a specific service invocation generated.
|
||||
systemd also initializes `/etc/machine-id` with a randomized UUID.
|
||||
(systemd also makes use of the randomized "boot id" the kernel exposes in `/proc/sys/kernel/random boot_id`).
|
||||
(systemd also makes use of the randomized "boot id" the kernel exposes in `/proc/sys/kernel/random/boot_id`).
|
||||
These UUIDs are exclusively Type 4 UUIDs, i.e. randomly generated ones.
|
||||
|
||||
* systemd maintains various hash tables internally.
|
||||
|
||||
@@ -98,13 +98,13 @@ interfaces are "merged": domains existing on one but not the other will "just
|
||||
work" and vice versa.
|
||||
|
||||
And one more note: the domain routing logic implemented is a tiny bit more
|
||||
complex that what described above: if there two interfaces have search domains
|
||||
that are suffix of each other, and a name is looked up that matches both, the
|
||||
interface with the longer match will win and get the lookup routed to is DNS
|
||||
complex than what is described above: if two interfaces have search domains
|
||||
that are suffixes of each other, and a name is looked up that matches both, the
|
||||
interface with the longer match will win and get the lookup routed to its DNS
|
||||
servers. Only if the match has the same length, then both will be used in
|
||||
parallel. Example: one interface has `~foo.example.com` as routing domain, and
|
||||
another one `example.com` has search domain. A lookup for
|
||||
`waldo.foo.example.com` is the exclusively routed to the first interface's DNS
|
||||
another one has `example.com` as search domain. A lookup for
|
||||
`waldo.foo.example.com` is exclusively routed to the first interface's DNS
|
||||
server, since it matches by three suffix labels instead of just two. The fact
|
||||
that the matching length is taken into consideration for the routing decision
|
||||
is particularly relevant if you have one interface with the `~.` routing domain
|
||||
|
||||
@@ -362,7 +362,7 @@ typically requires enrolment of TLS server certificates in the system
|
||||
firmware, but provides transport integrity, authenticity and
|
||||
confidentiality. Acquiring the various resources via plain HTTP should
|
||||
generally be sufficient too, as the key resources acquired this way
|
||||
area generally authenticated before use via other mechanisms, see above.
|
||||
are generally authenticated before use via other mechanisms, see above.
|
||||
|
||||
## Building
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@ In systemd we leave much of the file system layout open to the operating system,
|
||||
All of them must be available before the host systemd is first executed.
|
||||
|
||||
- `/var` does not have to be mounted when the host systemd is first invoked, however,
|
||||
it must be configured so that it is mounted writable before local-fs.target is reached (for example, by simply listing it in` /etc/fstab`).
|
||||
it must be configured so that it is mounted writable before local-fs.target is reached (for example, by simply listing it in `/etc/fstab`).
|
||||
|
||||
- `/tmp` is recommended to be a tmpfs (default), but doesn't have to.
|
||||
If configured, it must be mounted before local-fs.target is reached (for example, by listing it in `/etc/fstab`).
|
||||
|
||||
@@ -402,5 +402,5 @@ about activated Verity images before they are activated.
|
||||
→ **Measured hash** covers the string `verity:`, followed by the Verity device
|
||||
name, followed by `:`, followed by a hexadecimal formatted string indicating
|
||||
the root hash of the Verity image, followed by `:`, followed by a comma
|
||||
separatec list of PKCS#7 signature key's serial (formatted in hexadecimal), `/`, and
|
||||
separated list of PKCS#7 signature key's serial (formatted in hexadecimal), `/`, and
|
||||
key issuer (formatted in Base64).
|
||||
@@ -20,7 +20,7 @@ _`systemd-resolved`_ provides a set of APIs on the bus for resolving DNS resourc
|
||||
|
||||
Below you'll find examples for two of these calls, to show how to use them.
|
||||
Note that glibc offers similar (and more portable) calls in _getaddrinfo()_, _getnameinfo()_ and _res\_query()_.
|
||||
Of these _getaddrinfo()_ and _getnameinfo()_ are directed to the calls above via the _nss-resolve_ NSS module, but _req\_query()_ is not.
|
||||
Of these _getaddrinfo()_ and _getnameinfo()_ are directed to the calls above via the _nss-resolve_ NSS module, but _res\_query()_ is not.
|
||||
There are a number of reasons why it might be preferable to invoke `systemd-resolved`'s bus calls rather than the glibc APIs:
|
||||
|
||||
1. Bus APIs are naturally asynchronous, which the glibc APIs generally are not.
|
||||
@@ -88,7 +88,7 @@ int main(int argc, char*argv[]) {
|
||||
AF_UNSPEC, /* Which address family to look for */
|
||||
UINT64_C(0)); /* Input flags parameter */
|
||||
if (r < 0) {
|
||||
fprintf(stderr, "Failed to resolve hostnme: %s\n", error.message);
|
||||
fprintf(stderr, "Failed to resolve hostname: %s\n", error.message);
|
||||
sd_bus_error_free(&error);
|
||||
goto finish;
|
||||
}
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
for example with the <option>--what=all</option> switch.</para>
|
||||
|
||||
<para>The <filename>capsule@.service</filename> unit invokes a <command>systemd --user</command>
|
||||
service manager process. This means unit files are looked for according to the sames rules as for regular user
|
||||
service manager process. This means unit files are looked for according to the same rules as for regular user
|
||||
service managers, for example in
|
||||
<filename>/var/lib/capsules/<replaceable>NAME</replaceable>/.config/systemd/user/</filename>.</para>
|
||||
|
||||
|
||||
@@ -156,7 +156,7 @@ stag
|
||||
set of well-known private DNS zone domains is used as negative
|
||||
trust anchors.</para>
|
||||
|
||||
<para>It is also possibly to define per-interface negative trust
|
||||
<para>It is also possible to define per-interface negative trust
|
||||
anchors using the <varname>DNSSECNegativeTrustAnchors=</varname>
|
||||
setting in
|
||||
<citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>
|
||||
|
||||
@@ -33,7 +33,7 @@
|
||||
for each unit and for each queued job. The unit objects implement a generic
|
||||
<interfacename>Unit</interfacename> interface as well as a type-specific interface. For example, service units
|
||||
implement both <interfacename>org.freedesktop.systemd1.Unit</interfacename> and
|
||||
<interfacename>org.freedesktop.system1.Service</interfacename>. The manager object can list
|
||||
<interfacename>org.freedesktop.systemd1.Service</interfacename>. The manager object can list
|
||||
unit and job objects or directly convert a unit name or job identifier to a bus path of the corresponding
|
||||
D-Bus object.</para>
|
||||
|
||||
@@ -1518,7 +1518,7 @@ node /org/freedesktop/systemd1 {
|
||||
<orderedlist>
|
||||
<listitem><para>Send a D-Bus message that will turn off status messages.</para></listitem>
|
||||
<listitem><para>Block until a reply to that message is received.</para></listitem>
|
||||
<listitem><para>Print multiples lines without being interrupted by status messages.</para></listitem>
|
||||
<listitem><para>Print multiple lines without being interrupted by status messages.</para></listitem>
|
||||
<listitem><para>Send a D-Bus message that will reset <varname>ShowStatus</varname> back to its
|
||||
original value.</para></listitem>
|
||||
</orderedlist>
|
||||
@@ -2086,7 +2086,7 @@ node /org/freedesktop/systemd1 {
|
||||
operations are allowed through the polkit privilege system. Operations which modify unit state
|
||||
(<function>StartUnit()</function>, <function>StopUnit()</function>, <function>KillUnit()</function>,
|
||||
<function>KillUnitSubgroup()</function>, <function>QueueSignalUnit()</function>,
|
||||
<function>RestartUnit()</function> and similar, <function>SetProperty()</function>) require
|
||||
<function>RestartUnit()</function> and similar, <function>SetUnitProperties()</function>) require
|
||||
<interfacename>org.freedesktop.systemd1.manage-units</interfacename>. Operations which modify unit file
|
||||
enablement state (<function>EnableUnitFiles()</function>, <function>DisableUnitFiles()</function>,
|
||||
<function>EnableUnitFilesWithFlags()</function>, <function>DisableUnitFilesWithFlags()</function>,
|
||||
@@ -5209,12 +5209,12 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
|
||||
for more details on how to retrieve these file descriptors. Unlike the <varname>ExtraFileDescriptors</varname>
|
||||
input property, <varname>ExtraFileDescriptorNames</varname> only contains names and not the file descriptors.</para>
|
||||
|
||||
<para><varname>ManagedOOMMemoryPressureDurationUSec</varname> implement the destination parameter of the
|
||||
<para><varname>ManagedOOMMemoryPressureDurationUSec</varname> implements the destination parameter of the
|
||||
unit file setting <varname>ManagedOOMMemoryPressureDurationSec=</varname> listed in
|
||||
<citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
|
||||
Note the time unit is expressed in <literal>μs</literal>.</para>
|
||||
|
||||
<para><varname>ProtectControlGroupsEx</varname> implement the destination parameter of the
|
||||
<para><varname>ProtectControlGroupsEx</varname> implements the destination parameter of the
|
||||
unit file setting <varname>ProtectControlGroups=</varname> listed in
|
||||
<citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
|
||||
Unlike boolean <varname>ProtectControlGroups</varname>, <varname>ProtectControlGroupsEx</varname>
|
||||
@@ -5225,7 +5225,7 @@ node /org/freedesktop/systemd1/unit/avahi_2ddaemon_2eservice {
|
||||
<citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
|
||||
Note <varname>PrivatePIDs</varname> is a string type to allow adding more values in the future.</para>
|
||||
|
||||
<para><varname>ProtectHostnameEx</varname> implement the destination parameter of the
|
||||
<para><varname>ProtectHostnameEx</varname> implements the destination parameter of the
|
||||
unit file setting <varname>ProtectHostname=</varname> listed in
|
||||
<citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
|
||||
Unlike boolean <varname>ProtectHostname</varname>, <varname>ProtectHostnameEx</varname> is a pair of
|
||||
@@ -12047,7 +12047,7 @@ node /org/freedesktop/systemd1/unit/system_2eslice {
|
||||
|
||||
<para>Most properties correspond directly with the matching settings in slice unit files.</para>
|
||||
|
||||
<para><varname>ManagedOOMMemoryPressureDurationUSec</varname> implement the destination parameter of the
|
||||
<para><varname>ManagedOOMMemoryPressureDurationUSec</varname> implements the destination parameter of the
|
||||
unit file setting <varname>ManagedOOMMemoryPressureDurationSec=</varname> listed in
|
||||
<citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
|
||||
Note the time unit is expressed in <literal>μs</literal>.</para>
|
||||
@@ -12726,10 +12726,10 @@ node /org/freedesktop/systemd1/unit/session_2d1_2escope {
|
||||
|
||||
<para><varname>Controller</varname> contains the bus name (unique or well-known) that is notified when
|
||||
the scope unit is to be shut down via a <function>RequestStop()</function> signal (see below). This is
|
||||
set when the scope is created. If not set, the scope's processes will terminated with
|
||||
set when the scope is created. If not set, the scope's processes will be terminated with
|
||||
<constant>SIGTERM</constant> directly.</para>
|
||||
|
||||
<para><varname>ManagedOOMMemoryPressureDurationUSec</varname> implement the destination parameter of the
|
||||
<para><varname>ManagedOOMMemoryPressureDurationUSec</varname> implements the destination parameter of the
|
||||
unit file setting <varname>ManagedOOMMemoryPressureDurationSec=</varname> listed in
|
||||
<citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
|
||||
Note the time unit is expressed in <literal>μs</literal>.</para>
|
||||
|
||||
@@ -96,7 +96,7 @@ node /org/freedesktop/sysupdate1 {
|
||||
|
||||
<para>The <function>JobRemoved()</function> signal is sent each time a job finishes,
|
||||
is canceled or fails. It also carries the job ID and object path, followed by a numeric status
|
||||
code. If the status is zero, the job has succeed. A positive status should be treated as an
|
||||
code. If the status is zero, the job has succeeded. A positive status should be treated as an
|
||||
exit code (i.e. <literal>EXIT_FAILURE</literal>), and a negative status should be treated as a
|
||||
negative errno-style error code (i.e. <literal>-EINVAL</literal>).</para>
|
||||
</refsect2>
|
||||
|
||||
+1
-1
@@ -122,7 +122,7 @@
|
||||
<para>By default, all unit files whose names start with a prefix generated from the image's file name are copied
|
||||
out. Specifically, the prefix is determined from the image file name with any suffix such as
|
||||
<filename>.raw</filename> removed, truncated at the first occurrence of an underscore character
|
||||
(<literal>_</literal>), if there is one. The underscore logic is supposed to be used to versioning so that the
|
||||
(<literal>_</literal>), if there is one. The underscore logic is supposed to be used for versioning so that
|
||||
an image file <filename>foobar_47.11.raw</filename> will result in a unit file matching prefix of
|
||||
<filename>foobar</filename>. This prefix is then compared with all unit files names contained in the image in
|
||||
the usual directories, but only unit file names where the prefix is followed by <literal>-</literal>,
|
||||
|
||||
+1
-1
@@ -249,7 +249,7 @@
|
||||
|
||||
<listitem><para>The textual label to assign to the partition if none is assigned yet. Note that this
|
||||
setting is not used for matching. It is also not used when a label is already set for an existing
|
||||
partition. It is thus only used when a partition is newly created or when an existing one had a no
|
||||
partition. It is thus only used when a partition is newly created or when an existing one had no
|
||||
label set (that is: an empty label). If not specified, a label derived from the partition type is
|
||||
automatically used. Simple specifier expansion is supported, see below.</para>
|
||||
|
||||
|
||||
@@ -238,7 +238,7 @@
|
||||
due to lack of memory, in which case an <constant>SD_BUS_ERROR_NO_MEMORY</constant> error is set instead,
|
||||
and <constant>-ENOMEM</constant> is returned.</para>
|
||||
|
||||
<para><function>sd_bus_error_set_errnof()</function> and <function>sd_bus_error_set_errnof()</function>
|
||||
<para><function>sd_bus_error_set_errnof()</function> and <function>sd_bus_error_set_errnofv()</function>
|
||||
are similar to <function>sd_bus_error_set_errno()</function>, but in addition to
|
||||
<parameter>error</parameter>, take a <citerefentry
|
||||
project='man-pages'><refentrytitle>printf</refentrytitle><manvolnum>3</manvolnum></citerefentry> format
|
||||
|
||||
@@ -42,10 +42,10 @@
|
||||
If <parameter>acquired</parameter> is not <constant>NULL</constant>, this function calls
|
||||
<ulink url="https://dbus.freedesktop.org/doc/dbus-specification.html#bus-messages-list-names">
|
||||
org.freedesktop.DBus.ListNames</ulink> to retrieve the list of currently-owned names on the bus. If
|
||||
<parameter>acquired</parameter> is not <constant>NULL</constant>, the function calls
|
||||
<parameter>activatable</parameter> is not <constant>NULL</constant>, the function calls
|
||||
<ulink url="https://dbus.freedesktop.org/doc/dbus-specification.html#bus-messages-list-activatable-names">
|
||||
org.freedesktop.DBus.ListActivableNames</ulink> to retrieve the list of all names on the bus that can be
|
||||
activated. Note that ownership of the arrays returned by <function>sd_bus_list_names()</function> in
|
||||
org.freedesktop.DBus.ListActivatableNames</ulink> to retrieve the list of all names on the bus that can
|
||||
be activated. Note that ownership of the arrays returned by <function>sd_bus_list_names()</function> in
|
||||
<parameter>acquired</parameter> and <parameter>activatable</parameter> is transferred to the caller and
|
||||
hence, the caller is responsible for freeing these arrays and their contents.</para>
|
||||
</refsect1>
|
||||
|
||||
@@ -19,7 +19,7 @@
|
||||
<refnamediv>
|
||||
<refname>sd_bus_message_get_cookie</refname>
|
||||
<refname>sd_bus_message_get_reply_cookie</refname>
|
||||
<refpurpose>Returns the transaction cookie of a message</refpurpose>
|
||||
<refpurpose>Return the transaction cookie of a message</refpurpose>
|
||||
</refnamediv>
|
||||
|
||||
<refsynopsisdiv>
|
||||
@@ -86,7 +86,7 @@
|
||||
|
||||
<listitem><para>No cookie has been assigned to this message. This either indicates that the
|
||||
message has not been sent yet and hence has no cookie assigned, or that the message is not a method
|
||||
response message and hence carries a reply cookie field.</para></listitem>
|
||||
response message and hence does not carry a reply cookie field.</para></listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
</refsect2>
|
||||
|
||||
@@ -29,8 +29,8 @@
|
||||
<funcdef>int <function>sd_bus_message_read_array</function></funcdef>
|
||||
<paramdef>sd_bus_message *<parameter>m</parameter></paramdef>
|
||||
<paramdef>char <parameter>type</parameter></paramdef>
|
||||
<paramdef>const void **<parameter>ptr</parameter></paramdef>
|
||||
<paramdef>size_t *<parameter>size</parameter></paramdef>
|
||||
<paramdef>const void **<parameter>ret_ptr</parameter></paramdef>
|
||||
<paramdef>size_t *<parameter>ret_size</parameter></paramdef>
|
||||
</funcprototype>
|
||||
</funcsynopsis>
|
||||
</refsynopsisdiv>
|
||||
@@ -38,16 +38,16 @@
|
||||
<refsect1>
|
||||
<title>Description</title>
|
||||
|
||||
<para><function>sd_bus_message_read_array()</function> provides access to an array elements in the
|
||||
bus message <parameter>m</parameter>. The "read pointer" in the message must be right before an array of type
|
||||
<parameter>type</parameter>. As a special case, <parameter>type</parameter> may be
|
||||
<constant>NUL</constant>, in which case any trivial type is acceptable. A pointer to the array data is returned
|
||||
in the parameter <parameter>ptr</parameter> and the size of array data (in bytes) is returned in the
|
||||
parameter <parameter>size</parameter>. If the returned <parameter>size</parameter> parameter is 0, a
|
||||
valid non-null pointer will be returned as <parameter>ptr</parameter>, but it may not be
|
||||
dereferenced. The data is aligned as appropriate for the data type. The data is part of the message — it
|
||||
may not be modified and is valid only as long as the message is referenced. After this function returns,
|
||||
the "read pointer" points at the next element after the array.</para>
|
||||
<para><function>sd_bus_message_read_array()</function> provides access to an array of elements in the
|
||||
bus message <parameter>m</parameter>. The "read pointer" in the message must be right before an array of
|
||||
type <parameter>type</parameter>. A pointer to the array data is returned in the parameter
|
||||
<parameter>ret_ptr</parameter> and the size of the array data (in bytes) is returned in the parameter
|
||||
<parameter>ret_size</parameter>. If this returns a positive value and the returned
|
||||
<parameter>ret_size</parameter> is 0, a valid non-<constant>NULL</constant> pointer will be returned as
|
||||
<parameter>ret_ptr</parameter>, but it may not be dereferenced. The data is aligned as appropriate for
|
||||
the data type. The data is part of the message — it may not be modified and is valid only as long as the
|
||||
message is referenced. If this returns a positive value, the "read pointer" points at the next element
|
||||
after the array.</para>
|
||||
|
||||
<para>Note that this function only supports arrays of trivial types, i.e. arrays of booleans, the various
|
||||
integer types, as well as floating point numbers. In particular it may not be used for arrays of strings,
|
||||
|
||||
@@ -44,14 +44,15 @@
|
||||
<refsect1>
|
||||
<title>Description</title>
|
||||
|
||||
<para><function>sd_bus_set_watch_bind()</function> may be used to enable or disable client-side watching of server
|
||||
socket binding for a bus connection object. If the <parameter>b</parameter> is true, the feature is enabled,
|
||||
otherwise disabled (which is the default). When enabled, and the selected bus address refers to an
|
||||
<filename>AF_UNIX</filename> socket in the file system which does not exist while the connection attempt is made an
|
||||
<citerefentry project='man-pages'><refentrytitle>inotify</refentrytitle><manvolnum>7</manvolnum></citerefentry> watch is installed on
|
||||
it, waiting for the socket to appear. As soon as the socket appears the connection is made. This functionality is
|
||||
useful in particular in early-boot programs that need to run before the system bus is available, but want to
|
||||
connect to it the instant it may be connected to.</para>
|
||||
<para><function>sd_bus_set_watch_bind()</function> may be used to enable or disable client-side watching
|
||||
of server socket binding for a bus connection object. If <parameter>b</parameter> is true, the feature is
|
||||
enabled, otherwise disabled (which is the default). When enabled, and the selected bus address refers to
|
||||
an <filename>AF_UNIX</filename> socket in the file system which does not exist while the connection
|
||||
attempt is made, an
|
||||
<citerefentry project='man-pages'><refentrytitle>inotify</refentrytitle><manvolnum>7</manvolnum></citerefentry>
|
||||
watch is installed on it, waiting for the socket to appear. As soon as the socket appears the connection
|
||||
is made. This functionality is useful in particular in early-boot programs that need to run before the
|
||||
system bus is available, but want to connect to it the instant it may be connected to.</para>
|
||||
|
||||
<para><function>sd_bus_get_watch_bind()</function> may be used to query the current setting of this feature. It
|
||||
returns zero when the feature is disabled, and positive if enabled.</para>
|
||||
|
||||
@@ -144,7 +144,7 @@
|
||||
<para>The <function>sd_device_enumerator_add_nomatch_sysname()</function> function adds a filter
|
||||
so that devices whose sysname equals to <parameter>sysname</parameter> are excluded from the
|
||||
enumeration. This is useful for excluding specific devices from the enumeration process.
|
||||
When called multiple times, features are ANDed.</para>
|
||||
When called multiple times, filters are ANDed.</para>
|
||||
|
||||
<para>The <function>sd_device_enumerator_add_match_tag()</function> function adds a filter so that
|
||||
only devices tagged with <parameter>tag</parameter> are enumerated. When called multiple times,
|
||||
|
||||
@@ -78,11 +78,11 @@
|
||||
<para><function>sd_event_source_ref()</function> may be used to increase by one the internal reference
|
||||
counter of the event source object specified as <parameter>source</parameter>.</para>
|
||||
|
||||
<para><function>sd_event_source_unref()</function>,
|
||||
<function>sd_bus_creds_unrefp()</function> and
|
||||
<function>sd_bus_creds_ref()</function> execute no operation if
|
||||
the passed event source object is
|
||||
<constant>NULL</constant>.</para>
|
||||
<para><function>sd_event_source_ref()</function> and
|
||||
<function>sd_event_source_unref()</function> execute no operation if the passed event source
|
||||
object is <constant>NULL</constant>. <function>sd_event_source_unrefp()</function> will first
|
||||
dereference its argument, which must not be <constant>NULL</constant>, and will execute no
|
||||
operation if <emphasis>that</emphasis> is <constant>NULL</constant>.</para>
|
||||
|
||||
<para>Note that event source objects stay alive and may be dispatched as long as they have a reference
|
||||
counter greater than zero. In order to drop a reference of an event source and make sure the associated
|
||||
|
||||
@@ -163,7 +163,7 @@
|
||||
<function>sd_journal_print()</function> and <function>sd_journal_send()</function> described above, which are based
|
||||
on format strings, and do strip trailing whitespace.</para>
|
||||
|
||||
<para><function>sd_journal_perror()</function> is a similar to
|
||||
<para><function>sd_journal_perror()</function> is similar to
|
||||
<citerefentry project='die-net'><refentrytitle>perror</refentrytitle><manvolnum>3</manvolnum></citerefentry>
|
||||
and writes a message to the journal that consists of the passed
|
||||
string, suffixed with ": " and a human-readable representation of
|
||||
|
||||
@@ -117,8 +117,8 @@
|
||||
|
||||
<para><function>sd_journal_query_unique()</function> returns 0 on success or a negative errno-style error
|
||||
code. <function>sd_journal_enumerate_unique()</function> and
|
||||
<function>sd_journal_query_available_unique()</function> return a positive integer if the next field data
|
||||
has been read, 0 when no more fields remain, or a negative errno-style error code.
|
||||
<function>sd_journal_enumerate_available_unique()</function> return a positive integer if the next field
|
||||
data has been read, 0 when no more fields remain, or a negative errno-style error code.
|
||||
<function>sd_journal_restart_unique()</function> does not return anything.</para>
|
||||
|
||||
<refsect2>
|
||||
|
||||
+1
-1
@@ -155,7 +155,7 @@ net.bridge.bridge-nf-call-arptables = 0
|
||||
|
||||
<para>This method forces the module to be always loaded. Please
|
||||
note that, unless the <filename>br_netfilter</filename> module is
|
||||
loaded, bridged packets will not be filtered with Netfilter
|
||||
loaded, bridged packets will not be filtered by Netfilter
|
||||
(starting with kernel 3.18), so simply not loading the module is
|
||||
sufficient to avoid filtering.</para>
|
||||
</example>
|
||||
|
||||
+5
-6
@@ -740,8 +740,8 @@ Jan 12 10:46:45 example.com bluetoothd[8900]: gatt-time-server: Input/output err
|
||||
(e.g.: with <option>RootImage=</option>, <option>PrivateMounts=</option>, etc.). This command
|
||||
supports bind-mounting directories, regular files, device nodes, <constant>AF_UNIX</constant>
|
||||
socket nodes, as well as FIFOs. The bind mount is ephemeral, and it is undone as soon as the
|
||||
current unit process exists. Note that the namespace mentioned here, where the bind mount will be
|
||||
added to, is the one where the main service process runs. Other processes (those exececuted by
|
||||
current unit process exits. Note that the namespace mentioned here, where the bind mount will be
|
||||
added to, is the one where the main service process runs. Other processes (those executed by
|
||||
<option>ExecReload=</option>, <option>ExecStartPre=</option>, etc.) run in distinct namespaces.
|
||||
</para>
|
||||
|
||||
@@ -767,15 +767,14 @@ Jan 12 10:46:45 example.com bluetoothd[8900]: gatt-time-server: Input/output err
|
||||
<option>RootImage=</option>/<option>RootDirectory=</option>). The following argument, if any, is
|
||||
interpreted as a colon-separated tuple of partition name and comma-separated list of mount options
|
||||
for that partition. The format is the same as the service <option>MountImages=</option>
|
||||
setting. When combined with the <option>--read-only</option> switch, a ready-only mount is
|
||||
setting. When combined with the <option>--read-only</option> switch, a read-only mount is
|
||||
created. When combined with the <option>--mkdir</option> switch, the destination path is first
|
||||
created before the mount is applied.</para>
|
||||
|
||||
<para>Note that this option is currently only supported for units that run within a mount namespace
|
||||
(i.e. with <option>RootImage=</option>, <option>PrivateMounts=</option>, etc.). Note that the
|
||||
namespace mentioned here where the image mount will be added to, is the one where the main service
|
||||
process runs. Note that the namespace mentioned here, where the bind mount will be
|
||||
added to, is the one where the main service process runs. Other processes (those exececuted by
|
||||
namespace mentioned here, where the image mount will be added to, is the one where the main
|
||||
service process runs. Other processes (those executed by
|
||||
<option>ExecReload=</option>, <option>ExecStartPre=</option>, etc.) run in distinct namespaces.
|
||||
</para>
|
||||
|
||||
|
||||
@@ -82,7 +82,7 @@
|
||||
the boot loader random seed with a new value derived from the kernel entropy pool.</para></listitem>
|
||||
</orderedlist>
|
||||
|
||||
<para>This logic should ensure that the kernel's entropy pool is seeded during earliest bool already, if
|
||||
<para>This logic should ensure that the kernel's entropy pool is seeded during earliest boot already, if
|
||||
possible, but the highest quality entropy is propagated back to both on-disk seeds.</para>
|
||||
</refsect1>
|
||||
|
||||
|
||||
@@ -19,7 +19,7 @@
|
||||
<refnamediv>
|
||||
<refname>systemd-bsod.service</refname>
|
||||
<refname>systemd-bsod</refname>
|
||||
<refpurpose>Displays boot-time emergency log message in full screen</refpurpose>
|
||||
<refpurpose>Display boot-time emergency log message in full screen</refpurpose>
|
||||
</refnamediv>
|
||||
|
||||
<refsynopsisdiv>
|
||||
|
||||
@@ -37,7 +37,7 @@
|
||||
<title>Description</title>
|
||||
|
||||
<para><filename>systemd-factory-reset</filename> is a tool that can query the current factory reset
|
||||
state, request factory request operations or complete them.</para>
|
||||
state, request factory reset operations or complete them.</para>
|
||||
|
||||
<para>Some of the functionality is also available via the
|
||||
<filename>/run/systemd/io.systemd.FactoryReset</filename> Varlink service (implemented via the
|
||||
|
||||
@@ -124,8 +124,8 @@
|
||||
<term><varname>fsck.repair</varname></term>
|
||||
|
||||
<listitem>
|
||||
<para>The contents of the credentials are parsed as same as the kernel command line options with
|
||||
the same name. See above for more details.</para>
|
||||
<para>The contents of the credentials are parsed in the same way as the kernel command line options
|
||||
of the same name. See above for more details.</para>
|
||||
|
||||
<xi:include href="version-info.xml" xpointer="v258"/>
|
||||
</listitem>
|
||||
|
||||
@@ -82,7 +82,7 @@
|
||||
active kernel consoles will be enabled. This option will be ignored when the system is running in a
|
||||
container.</para>
|
||||
|
||||
<para>When <literal>builtins</literal> is specified, <filename>serial-getty@.service</filename> for
|
||||
<para>When <literal>builtin</literal> is specified, <filename>serial-getty@.service</filename> for
|
||||
available virtualizer consoles will be enabled. This option will be ignored when the system is
|
||||
running in a container.</para>
|
||||
|
||||
|
||||
@@ -45,10 +45,10 @@
|
||||
Unless limited by one of the options specified below, all journal entries accessible to the user
|
||||
the program is running as will be uploaded, and then the program will wait and send new entries
|
||||
as they become available.</para>
|
||||
|
||||
<para><command>systemd-journal-upload</command> transfers the raw content of journal file and
|
||||
uses HTTP as a transport protocol.</para>
|
||||
|
||||
|
||||
<para><command>systemd-journal-upload</command> transfers the raw content of journal files and
|
||||
uses HTTP as a transport protocol.</para>
|
||||
|
||||
<para><filename>systemd-journal-upload.service</filename> is a system service that uses
|
||||
<command>systemd-journal-upload</command> to upload journal entries to a server. It uses the
|
||||
configuration in
|
||||
|
||||
@@ -75,8 +75,8 @@
|
||||
<term><varname>quotacheck.mode</varname></term>
|
||||
|
||||
<listitem>
|
||||
<para>The contents of the credential is parsed as same as the kernel command line option with the
|
||||
same name. See above for more details.</para>
|
||||
<para>The contents of the credential are parsed in the same way as the kernel command line option
|
||||
of the same name. See above for more details.</para>
|
||||
|
||||
<xi:include href="version-info.xml" xpointer="v258"/>
|
||||
</listitem>
|
||||
|
||||
@@ -75,7 +75,7 @@
|
||||
entropy when loading the random seed. With this option this behaviour may be changed: it either takes
|
||||
a boolean parameter or the special string <literal>force</literal>. Defaults to false, in which case
|
||||
no entropy is credited. If true, entropy is credited if the random seed file and system state pass
|
||||
various superficial concisistency checks. If set to <literal>force</literal> entropy is credited,
|
||||
various superficial consistency checks. If set to <literal>force</literal> entropy is credited,
|
||||
regardless of these checks, as long as the random seed file exists.</para>
|
||||
|
||||
<xi:include href="version-info.xml" xpointer="v243"/></listitem>
|
||||
|
||||
@@ -63,7 +63,7 @@
|
||||
|
||||
<para>The report additionally includes the measurement event log, and the public area of the signing key.
|
||||
The public area is provided as a JSON encoded <constant>TPMT_PUBLIC</constant> structure, and in PEM
|
||||
encooded form.</para>
|
||||
encoded form.</para>
|
||||
|
||||
<para>The preceding components are all executed under the audit session, and the report is only generated
|
||||
if that session remains exclusive throughout. Because the audit session attestation records whether the
|
||||
|
||||
@@ -1268,9 +1268,10 @@ Ports=eth2</programlisting>
|
||||
<varlistentry>
|
||||
<term><varname>Layer2SpecificHeader=</varname></term>
|
||||
<listitem>
|
||||
<para>Specifies layer2specific header type of the session. One of <literal>none</literal> or <literal>default</literal>. Defaults to <literal>default</literal>.</para>
|
||||
<para>Specifies the layer 2 specific header type of the session. One of <literal>none</literal> or
|
||||
<literal>default</literal>. Defaults to <literal>default</literal>.</para>
|
||||
|
||||
<xi:include href="version-info.xml" xpointer="v242"/>
|
||||
<xi:include href="version-info.xml" xpointer="v242"/>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
|
||||
+1
-1
@@ -251,7 +251,7 @@ r - 500-900
|
||||
|
||||
<para>Only applies to lines of type <varname>u</varname> and should otherwise
|
||||
be left unset (or <literal>-</literal>). It is recommended to omit this, unless
|
||||
a shell different <filename>/usr/sbin/nologin</filename> must be used.</para>
|
||||
a shell different from <filename>/usr/sbin/nologin</filename> must be used.</para>
|
||||
</refsect2>
|
||||
</refsect1>
|
||||
|
||||
|
||||
+1
-1
@@ -53,7 +53,7 @@
|
||||
a boot loader. When used with <ulink url="https://www.qemu.org/docs/master/">qemu</ulink>, a UKI can also
|
||||
be executed through "direct kernel boot", see example below.</para>
|
||||
|
||||
<para><command>ukify</command> can also be used generate other types of UKI-like images, in particular
|
||||
<para><command>ukify</command> can also be used to generate other types of UKI-like images, in particular
|
||||
extensions. See the description of the <command>build</command> verb below. <command>ukify</command> can
|
||||
also generate certificates and keys for SecureBoot and PCR signing, see the description of the
|
||||
<command>genkey</command> verb below. <command>ukify</command> can also print detailed information about
|
||||
|
||||
Reference in new issue
Block a user