Lennart Poettering
1f03294048
Let's add a boolean MatchXAttr= setting to the [Source] and [Target] sections of transfer files that allows restricting individual instances to specific systems, via extended attributes attached to them. If enabled, the following extended attributes are checked: user.uapi.match_hostname → the hostname user.uapi.match_machine_id → the machine ID user.uapi.match_machine_tags → the machine tags (TAGS= in machine-info) user.uapi.match_image_id → IMAGE_ID= from os-release user.uapi.match_image_version → IMAGE_VERSION= from os-release user.uapi.match_os_id → ID= from os-release user.uapi.match_os_version → VERSION_ID= from os-release In the [Source] section it is enabled by default, so that whoever publishes instances can restrict them to specific systems without every transfer file having to opt in. In the [Target] section it is off by default, i.e. installed instances are only filtered if requested. The checks are applied to the extended attributes listed in UAPI.16 manifests (relevant for sources) as well as to the extended attributes of files and directories found on disk (relevant for targets and local sources). Instances that do not match are entirely ignored, i.e. they are neither installed nor vacuumed. Since the extended attributes listed in UAPI.16 manifests are applied to the installed instances, the restrictions are retained on the target. The local system properties (hostname, machine ID, machine tags and the relevant os-release fields) are only read when they are needed for the first time, i.e. when a candidate actually carries one of these attributes. If --root=/--image= is used they are read from there. The setting is also exposed as boolean matchXAttr field of transfers defined via the io.systemd.SysUpdate.Provider Varlink interface.
System and Service Manager
Details
Most documentation is available on systemd's website.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release