dilim/systemd
1
0 Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-11-06 05:17:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
24548be0bfa4d95de93ca940df8c2fe0ca8914b5
systemd/units
T
History
Christian Brauner 24548be0bf keyring-setup: add systemd-keyring-setup 
The kernel has various keyrings that early userspace may choose to set
up. Right now it has the .fs-verity and .dm-verity keyrings and in the
next kernel it will also have a .bpf keyring.

All three keyrings accept X.509 certificates in DER form. The
.dm-verity and .bpf keyrings are inactive and restricted by default
unless the respective kernel command line options are passed that leave
them unrestricted. Both keyrings are ignored until they are restricted.
IOW, restricting them causes the kernel to use them for signature
verification.

The .fs-verity keyring has slightly different semantics. It is always
active and is taken into account as soon as it contains a key.

Add systemd-keyring-setup which provisions the keyrings based on the
VOA spec from the kernel-keyring role with the keyring as the context:

  .dm-verity -> kernel-keyring/dm-verity/
  .fs-verity -> kernel-keyring/fs-verity/
  .bpf       -> kernel-keyring/bpf/

Trust anchors are read from the trust-anchor-kernel-keyring/
counterpart. Note that the "trust-anchor-*" prefix is mandated by the
spec.

The systemd-keyring-setup binary reads
<os>/kernel-keyring/<context>/x509/*-certificate.pem and the
trust-anchor-kernel-keyring/ counterpart from all VOA load paths and
enrolls the certificates into the corresponding keyring. Afterwards it
restricts the keyring to certificates signed by an enrolled key and
drops the SetAttr permission. Hence, neither the restriction nor the
mask can be changed anymore.

The binary may run in the initrd and on the host. A second run detects
a sealed keyring by its permission mask, skips certificates that are
enrolled already and enrolls certificates that are signed by an already
enrolled key.

Any unprovisioned keyrings are sealed at the end of a run even when
empty. Failing to enroll a certificate still causes the keyring to be
sealed. We can make this more flexible in the future but I don't think
leaving a keyring open just because enrolling a key failed makes sense.

Note that a file holding more than one certificate is refused.

Note that on a second call to add_key() for a certificate with the same
subject and key the kernel silently replaces the first. We can detect
this by reading the keyring's members before and after enrollment.

The binary exits with EX_DATAERR for input that can be fixed and
EXIT_FAILURE for kernel refusals. --dry-run only shows what would be
enrolled, optionally as JSON. The service isn't enabled by default and
the tool is marked experimental for now.

systemd-keyring-setup is written in Rust on top of the systemd_shared
crate. The VOA lookup, the keyring and X.509 helpers and everything
else it uses stay C in libsystemd-shared. All lookups are anchored at
the root directory which is opened once. The program, its unit and its
man page are only built with Rust support.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-10-26 18:55:53 +01:00
..
user
meson: add feature flag for storage
2026-10-25 09:34:00 +09:00
user-.slice.d
logind: don't delay login for root even if systemd-user-sessions.service is not activated yet
2022-07-12 22:54:39 +01:00
user@0.service.d
tree-wide: fix typo
2022-07-20 13:15:37 +09:00
user@.service.d
logind: don't delay login for root even if systemd-user-sessions.service is not activated yet
2022-07-12 22:54:39 +01:00
basic.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
blockdev@.target
units/blockdev@.target: conflict with umount.target
2023-09-27 12:33:40 +02:00
bluetooth.target
units: adjust Descriptions of various units
2021-06-30 13:25:16 +02:00
boot-complete.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
breakpoint-pre-basic.service.in
units: some improvements in breakpoint-* units.
2025-01-03 08:32:43 +01:00
breakpoint-pre-mount.service.in
units: some improvements in breakpoint-* units.
2025-01-03 08:32:43 +01:00
breakpoint-pre-switch-root.service.in
units: some improvements in breakpoint-* units.
2025-01-03 08:32:43 +01:00
breakpoint-pre-udev.service.in
units: some improvements in breakpoint-* units.
2025-01-03 08:32:43 +01:00
capsule.slice
units: add systemd-capsule@.service
2024-03-14 11:34:04 +01:00
capsule@.service.in
units/{user,capsule}@.service: issue daemon-reexec when notify-reloading
2024-10-11 10:36:08 +02:00
clonesetup.target
clonesetup: add support to clone devices via /etc/clonetab
2026-07-10 14:01:24 +02:00
console-getty.service.in
getty: remove --issue-file parameter
2026-02-03 21:00:19 +09:00
container-getty@.service.in
getty: remove --issue-file parameter
2026-02-03 21:00:19 +09:00
cryptsetup-pre.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
cryptsetup.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
debug-shell.service.in
units: order sysinit.target, debug-shell.service after systemd-vconsole-setup
2023-05-19 17:47:14 +02:00
dev-hugepages.mount
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
dev-mqueue.mount
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
emergency.service.in
units: use relative path
2024-03-16 05:31:44 +09:00
emergency.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
exit.target
units: add JobTimeoutAction= to exit.target and friends
2024-05-18 01:28:14 +09:00
factory-reset-now.target
units: refuse manual operations on factory-reset-now.target and friends
2025-03-05 17:03:59 +01:00
factory-reset.target
factory-reset: revamp infrastructure
2025-03-05 12:37:26 +01:00
final.target
units: correct description of final.target
2021-07-02 18:29:54 +02:00
first-boot-complete.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
getty-pre.target
tree-wide: use https for the 0pointer.de doc links
2023-06-23 13:46:56 +01:00
getty.target
tree-wide: use https for the 0pointer.de doc links
2023-06-23 13:46:56 +01:00
getty@.service.in
getty: remove --issue-file parameter
2026-02-03 21:00:19 +09:00
graphical.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
halt.target
units: add JobTimeoutAction= to exit.target and friends
2024-05-18 01:28:14 +09:00
hibernate.target
units: adjust Descriptions of various units
2021-06-30 13:25:16 +02:00
hybrid-sleep.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
imports-pre.target
import-generator: optionally create loopback devices after download
2025-02-21 10:03:32 +01:00
imports.target
import-generator: optionally create loopback devices after download
2025-02-21 10:03:32 +01:00
initrd-cleanup.service
units: add missing Documentation=
2025-09-18 21:54:36 +01:00
initrd-fs.target
units: change order of settings to match order in other similar unit
2021-04-20 19:11:07 +02:00
initrd-parse-etc.service.in
units: add missing Documentation=
2025-09-18 21:54:36 +01:00
initrd-root-device.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
initrd-root-fs.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
initrd-switch-root.service
units: add missing Documentation=
2025-09-18 21:54:36 +01:00
initrd-switch-root.target
units: add missing Documentation=
2025-09-18 21:54:36 +01:00
initrd-udevadm-cleanup-db.service
units: add missing Documentation=
2025-09-18 21:54:36 +01:00
initrd-usr-fs.target
fstab-generator: if usr= is specified, mount it to /sysusr/usr/ first
2021-04-20 18:26:17 +02:00
initrd.target
fstab-generator: if usr= is specified, mount it to /sysusr/usr/ first
2021-04-20 18:26:17 +02:00
integritysetup-pre.target
Add stand-alone dm-integrity support
2021-10-15 10:19:54 -05:00
integritysetup.target
Add stand-alone dm-integrity support
2021-10-15 10:19:54 -05:00
kexec.target
units: add JobTimeoutAction= to exit.target and friends
2024-05-18 01:28:14 +09:00
kmod-static-nodes.service.in
units: add missing Documentation=
2025-09-18 21:54:36 +01:00
ldconfig.service
meson: read more progs from PATH
2026-02-16 14:32:38 +01:00
local-fs-pre.target
units: adjust Descriptions of various units
2021-06-30 13:25:16 +02:00
local-fs.target
units: do more reordering of ordering config
2023-05-23 12:39:16 +02:00
machine.slice
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
machines.target
units/machines.target: fix typo
2025-07-11 21:38:58 +02:00
meson.build
keyring-setup: add systemd-keyring-setup
2026-10-26 18:55:53 +01:00
modprobe@.service
meson: read more progs from PATH
2026-02-16 14:32:38 +01:00
multi-user.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
network-online.target
tree-wide: replace obsolete wiki links with systemd.io/manpages
2022-05-21 14:29:14 +02:00
network-pre.target
tree-wide: replace obsolete wiki links with systemd.io/manpages
2022-05-21 14:29:14 +02:00
network.target
tree-wide: replace obsolete wiki links with systemd.io/manpages
2022-05-21 14:29:14 +02:00
nss-lookup.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
nss-user-lookup.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
paths.target
units: adjust Descriptions of various units
2021-06-30 13:25:16 +02:00
poweroff.target
units: adjust Descriptions of various units
2021-06-30 13:25:16 +02:00
printer.target
units: adjust Descriptions of various units
2021-06-30 13:25:16 +02:00
proc-sys-fs-binfmt_misc.automount
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
proc-sys-fs-binfmt_misc.mount
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
quotaon-root.service.in
units: make templates for quotaon and systemd-quotacheck service
2024-03-09 19:32:09 +00:00
quotaon@.service.in
units: make quota services bind to corresponding mount units
2024-03-10 22:57:22 +08:00
reboot.target
units: adjust Descriptions of various units
2021-06-30 13:25:16 +02:00
remote-cryptsetup.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
remote-fs-pre.target
units: adjust Descriptions of various units
2021-06-30 13:25:16 +02:00
remote-fs.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
remote-integritysetup.target
integritysetup: add remote-integritysetup.target to match remote-{crypt|verity}setup.target
2025-02-25 21:40:05 +01:00
remote-veritysetup.target
dm-verity: Remove usage of integrity
2021-10-14 12:17:02 -05:00
rescue.service.in
units: use relative path
2024-03-16 05:31:44 +09:00
rescue.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
rpcbind.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
serial-getty@.service.in
getty: remove --issue-file parameter
2026-02-03 21:00:19 +09:00
shutdown.target
units: adjust Descriptions of various units
2021-06-30 13:25:16 +02:00
sigpwr.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
sleep.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
slices.target
units: adjust Descriptions of various units
2021-06-30 13:25:16 +02:00
smartcard.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
sockets.target
units: adjust Descriptions of various units
2021-06-30 13:25:16 +02:00
soft-reboot.target
Revert "units: do not soft-reboot before soft-reboot.target reached"
2024-05-23 00:06:30 +09:00
sound.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
ssh-access.target
units/ssh-access.target: enable StopWhenUnneeded=
2025-07-22 15:01:26 +01:00
storage-target-mode.target
units: pull in plymouth when booting into storagetm mode
2023-11-13 15:45:16 +01:00
suspend-then-hibernate.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
suspend.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
swap.target
units: adjust Descriptions of various units
2021-06-30 13:25:16 +02:00
sys-fs-fuse-connections.mount
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
sys-kernel-config.mount
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
sys-kernel-debug.mount
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
sys-kernel-tracing.mount
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
sysinit.target
units: reorder/split unit dependency blocks
2022-09-15 14:59:11 +02:00
syslog.socket
various: turn off SO_PASSRIGHTS where fds are not expected
2025-06-17 13:16:44 +02:00
system-install.target
units: pull in basic.target rather than sysinit.target from system-install.target
2026-05-11 22:34:28 +01:00
system-systemd-cryptsetup.slice
tree-wide: get rid of backslashes in file names
2026-07-03 10:10:09 +02:00
system-systemd-mute-console.slice
tree-wide: get rid of backslashes in file names
2026-07-03 10:10:09 +02:00
system-systemd-veritysetup.slice
tree-wide: get rid of backslashes in file names
2026-07-03 10:10:09 +02:00
system-update-cleanup.service
units: stop using rm in system-update-cleanup.service
2026-03-18 14:58:43 +01:00
system-update-pre.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
system-update.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
systemd-ask-password-console.path
units: add dependency ordering for emergency.service conflicts
2022-09-15 14:59:11 +02:00
systemd-ask-password-console.service
ask-password-agent: send READY=1 when we established inotify watch
2025-01-02 16:37:57 +01:00
systemd-ask-password-wall.path
units: add dependency ordering for emergency.service conflicts
2022-09-15 14:59:11 +02:00
systemd-ask-password-wall.service
units: don't block on terminating agents
2025-03-03 10:47:09 +01:00
systemd-ask-password.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-ask-password@.service
ask-password: add Varlink API for querying passwords from the user
2025-01-02 16:39:05 +01:00
systemd-backlight@.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-battery-check.service.in
units/systemd-battery-check.service: split [Unit] options into groups
2025-09-30 16:34:54 +02:00
systemd-binfmt.service.in
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
systemd-bless-boot.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-boot-check-no-failures.service.in
units/systemd-boot-check-no-failures.service: drop unneeded dep on shutdown.target
2024-04-10 23:40:53 +08:00
systemd-boot-clear-sysfail.service
units: fix systemd-boot-clear-sysfail description
2025-05-14 09:34:07 +02:00
systemd-boot-random-seed.service
units: rename/rework systemd-boot-system-token.service → systemd-boot-random-seed.service
2023-01-04 15:18:10 +01:00
systemd-boot-update.service
systemd-boot-update: condition on UEFI
2026-06-24 13:05:34 +02:00
systemd-bootctl.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-bootctl@.service
bootctl: add Install() varlink API
2026-02-06 23:15:49 +01:00
systemd-bsod.service.in
Remove extra period at the end of systemd-bsod's unit description. (#33632)
2024-07-06 10:17:20 +01:00
systemd-confext-initrd.service
dissect,nspawn,sysext: enable TPM2 unlocking of DDIs, document it
2026-10-13 11:05:48 +00:00
systemd-confext-sysroot.service
dissect,nspawn,sysext: enable TPM2 unlocking of DDIs, document it
2026-10-13 11:05:48 +00:00
systemd-confext.service
dissect,nspawn,sysext: enable TPM2 unlocking of DDIs, document it
2026-10-13 11:05:48 +00:00
systemd-coredump-register.service.in
coredump: support kernel coredump socket protocol
2026-08-27 05:52:49 +09:00
systemd-coredump.socket
units: enable MaxConnectionsPerSocket= for all our Accept=yes units
2024-02-12 11:57:24 +01:00
systemd-coredump@.service.in
coredump: drop RestrictSUIDSGID= option (#38640)
2025-08-20 11:42:30 +01:00
systemd-coredumpd.service.in
units: allow disabling systemd-coredumpd.service
2026-09-08 14:31:45 +09:00
systemd-creds.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-creds@.service
units: don't set LISTEN_FDNAMES for varlink services explicitly
2024-08-26 15:40:15 +02:00
systemd-cryptenroll-firstboot.service
cryptenroll: add interactive --firstboot enrollment wizard
2026-06-27 17:28:39 +02:00
systemd-cryptenroll.socket
cryptenroll-varlink: allow access from all users
2026-10-13 11:33:06 +02:00
systemd-cryptenroll@.service
cryptenroll: expose enrollment as an io.systemd.CryptEnroll Varlink service
2026-06-27 17:28:39 +02:00
systemd-exit.service
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
systemd-factory-reset-complete.service.in
units: refuse manual operations on factory-reset-now.target and friends
2025-03-05 17:03:59 +01:00
systemd-factory-reset-reboot.service
factory-reset: revamp infrastructure
2025-03-05 12:37:26 +01:00
systemd-factory-reset-request.service.in
factory-reset: revamp infrastructure
2025-03-05 12:37:26 +01:00
systemd-factory-reset.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-factory-reset@.service.in
factory-reset: revamp infrastructure
2025-03-05 12:37:26 +01:00
systemd-firstboot.service
firstboot: apply hostname via hostnamed varlink API
2026-08-28 06:29:58 +09:00
systemd-fsck-root.service.in
fsck: add fsck.mode and fsck.repair credentials support
2025-07-16 05:47:38 +09:00
systemd-fsck@.service.in
fsck: add fsck.mode and fsck.repair credentials support
2025-07-16 05:47:38 +09:00
systemd-growfs-root.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-growfs@.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-halt.service
units: Use built-in halt and kexec features instead of systemctl
2023-06-22 10:33:18 +01:00
systemd-hibernate-clear.service.in
units: introduce systemd-hibernate-clear.service that clears
2024-04-03 22:07:43 +08:00
systemd-hibernate-resume.service.in
hibernate-resume: split out the logic of finding hibernate location
2023-09-07 20:21:16 +08:00
systemd-hibernate.service.in
units: update Description= for systemd-sleep units
2024-01-15 02:59:25 +08:00
systemd-homed-activate.service
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
systemd-homed-firstboot.service
homectl: mute console while running firstboot prompts
2025-09-26 16:19:43 +02:00
systemd-homed.service.in
homed: always use quotactl_fd() if its available
2025-03-31 11:51:15 +02:00
systemd-hostnamed.service.in
units: allow io.systemd.Hostname to be available earlier
2026-03-20 10:04:26 +01:00
systemd-hostnamed.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-hwdb-update.service.in
units: do more reordering of ordering config
2023-05-23 12:39:16 +02:00
systemd-hybrid-sleep.service.in
units: update Description= for systemd-sleep units
2024-01-15 02:59:25 +08:00
systemd-imds-early-network.service.in
units: do not fail if imds is not configured
2026-05-27 04:36:05 +09:00
systemd-imds-import.service.in
Revert "units: drop After=network-online.target from imds services"
2026-06-19 20:05:14 +02:00
systemd-imds-metrics.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-imds-metrics@.service.in
imds: expose instance metadata as an io.systemd.Metrics provider
2026-06-22 22:03:12 +02:00
systemd-imdsd.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-imdsd@.service.in
imds: add new systemd-imdsd.service that makes IMDS data accessible locally
2026-03-26 10:54:15 +01:00
systemd-importd.service.in
units: unify deps between service and socket units
2025-04-30 21:27:37 +02:00
systemd-importd.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-journal-catalog-update.service
units: do more reordering of ordering config
2023-05-23 12:39:16 +02:00
systemd-journal-flush.service
unit: also stop systemd-journal-flush.service on soft-reboot
2024-05-26 03:11:24 +09:00
systemd-journal-gatewayd.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-journal-gatewayd.socket
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
systemd-journal-remote.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-journal-remote.socket
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
systemd-journal-upload.service.in
systemd-journal-upload: Increase failure tolerance (#19426, #2877)
2023-10-12 23:10:59 +01:00
systemd-journalctl-metrics.socket
units: tag more units correctly with varlink xattrs
2026-06-24 11:47:28 +01:00
systemd-journalctl-metrics@.service
journal: expose last 10 high priority logs as metrics
2026-06-23 12:41:38 +02:00
systemd-journalctl.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-journalctl@.service
journalctl-vl-server: allow querying units for specific uid in system scope
2026-02-23 10:43:00 +01:00
systemd-journald-audit.socket
units/systemd-{udevd,journald}*.socket: enable DeferTrigger=
2025-06-30 13:10:43 +02:00
systemd-journald-dev-log.socket
units/systemd-{udevd,journald}*.socket: enable DeferTrigger=
2025-06-30 13:10:43 +02:00
systemd-journald-metrics.socket
journald: expose message counters as metrics
2026-10-10 10:38:15 +02:00
systemd-journald-sync@.service
journal: explicitly sync namespaced journals before stopping socket units
2024-05-02 19:41:01 +02:00
systemd-journald-varlink@.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-journald.service.in
journald: expose message counters as metrics
2026-10-10 10:38:15 +02:00
systemd-journald.socket
units/systemd-{udevd,journald}*.socket: enable DeferTrigger=
2025-06-30 13:10:43 +02:00
systemd-journald@.service.in
journald: use common_parse_argv()
2026-10-21 22:08:12 +02:00
systemd-journald@.socket
units/systemd-journald@.socket: enable SO_TIMESTAMP
2025-06-17 13:16:07 +02:00
systemd-kexec.service
units: Use built-in halt and kexec features instead of systemctl
2023-06-22 10:33:18 +01:00
systemd-keyring-setup.service.in
keyring-setup: add systemd-keyring-setup
2026-10-26 18:55:53 +01:00
systemd-localed.service.in
localed: modernization
2024-01-09 21:57:46 +08:00
systemd-logind-metrics.socket
logind: expose session and suspend metrics
2026-10-10 10:40:03 +02:00
systemd-logind-varlink.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-logind.service.in
logind: allow read/write to char-hvc devices
2024-10-22 23:44:47 +02:00
systemd-loop@.service
units: use --relax in systemd-loop@.service
2026-09-22 16:04:26 +02:00
systemd-machine-id-commit.service
units/systemd-machine-id-commit: retitle
2024-03-14 10:26:45 +01:00
systemd-machine-tag@.service
units: add systemd-machine-tag@.service template
2026-06-01 10:56:16 +02:00
systemd-machined.service.in
machined: allow running in --user mode
2025-09-25 22:43:59 +02:00
systemd-machined.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-modules-load.service.in
units: Accept modules_load and rd.modules_load in systemd-modules-load.service
2024-03-17 13:33:45 +01:00
systemd-mountfsd.service.in
mountfsd: Add CAP_SYS_PTRACE and CAP_SYS_CHROOT
2026-03-20 19:19:10 +01:00
systemd-mountfsd.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-mute-console.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-mute-console@.service
man: correct a few manpage references
2026-06-06 10:47:10 +01:00
systemd-network-generator.service.in
units: use Title Case for network generator description string
2025-10-20 18:17:47 +02:00
systemd-networkd-persistent-storage.service
units: add Before=shutdown.target to systemd-networkd-persistent-storage.service
2024-04-26 22:16:33 +02:00
systemd-networkd-resolve-hook.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-networkd-varlink-metrics.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-networkd-varlink.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-networkd-wait-online.service.in
networkd: call networkd a "network management" rather "network configuration" tool
2025-10-20 18:17:29 +02:00
systemd-networkd-wait-online@.service.in
networkd: call networkd a "network management" rather "network configuration" tool
2025-10-20 18:17:29 +02:00
systemd-networkd.service.in
metrics: add networkd related metrics
2026-02-18 17:58:33 +09:00
systemd-networkd.socket
units: let's set a socket name for networkd rtnl socket
2025-11-15 07:52:42 +01:00
systemd-nspawn@.service.in
dissect,nspawn,sysext: enable TPM2 unlocking of DDIs, document it
2026-10-13 11:05:48 +00:00
systemd-nsresourced.service.in
nsresourced: refuse writable overlayfs whose upper outlives the namespace
2026-08-12 10:49:34 +02:00
systemd-nsresourced.socket.in
nresourced: add user.userbd.* xattrs to nsresourced userdb socket
2026-07-13 09:53:15 +02:00
systemd-oomd.service.in
units: unify deps between service and socket units
2025-04-30 21:27:37 +02:00
systemd-oomd.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-pcrextend.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-pcrextend@.service.in
units: don't set LISTEN_FDNAMES for varlink services explicitly
2024-08-26 15:40:15 +02:00
systemd-pcrfs-root.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-pcrfs@.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-pcrlock-file-system.service.in
units: retitle systemd-pcrextend.{service,socket}, change TPM2→TPM
2024-03-14 10:26:45 +01:00
systemd-pcrlock-firmware-code.service.in
units: retitle systemd-pcrextend.{service,socket}, change TPM2→TPM
2024-03-14 10:26:45 +01:00
systemd-pcrlock-firmware-config.service.in
units: retitle systemd-pcrextend.{service,socket}, change TPM2→TPM
2024-03-14 10:26:45 +01:00
systemd-pcrlock-machine-id.service.in
units: retitle systemd-pcrextend.{service,socket}, change TPM2→TPM
2024-03-14 10:26:45 +01:00
systemd-pcrlock-make-policy.service.in
units: retitle systemd-pcrextend.{service,socket}, change TPM2→TPM
2024-03-14 10:26:45 +01:00
systemd-pcrlock-secureboot-authority.service.in
units: retitle systemd-pcrextend.{service,socket}, change TPM2→TPM
2024-03-14 10:26:45 +01:00
systemd-pcrlock-secureboot-policy.service.in
units: retitle systemd-pcrextend.{service,socket}, change TPM2→TPM
2024-03-14 10:26:45 +01:00
systemd-pcrlock.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-pcrlock@.service.in
units: don't set LISTEN_FDNAMES for varlink services explicitly
2024-08-26 15:40:15 +02:00
systemd-pcrlogin@.service.in
pcrextend: add support for measuring a user record, to be executed on first login of the user
2026-05-22 12:15:12 +02:00
systemd-pcrmachine.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-pcrnvdone.service.in
units: Run systemd-pcrnvdone in initrd
2026-06-04 11:23:59 +01:00
systemd-pcrosseparator.service.in
pcrextend: measure another separator at boot
2026-03-26 16:11:34 +01:00
systemd-pcrphase-factory-reset.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-pcrphase-initrd.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-pcrphase-storage-target-mode.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-pcrphase-sysinit.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-pcrphase.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-pcrproduct.service.in
units: make use of nvpcrs only after the NV anchor completion measurement is done
2026-03-26 16:11:34 +01:00
systemd-portabled.service.in
units/systemd-portabled: enable NoNewPrivileges=
2026-01-21 23:13:09 +01:00
systemd-poweroff.service
units: adjust Descriptions of various units
2021-06-30 13:25:16 +02:00
systemd-pstore.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-ptybrokerd.service.in
ptybroker: add new component that allocates pty on client request
2026-10-21 13:19:49 +02:00
systemd-ptybrokerd.socket
ptybroker: add new component that allocates pty on client request
2026-10-21 13:19:49 +02:00
systemd-quotacheck-root.service.in
quotacheck: add quotacheck.mode credential support
2025-07-16 05:47:38 +09:00
systemd-quotacheck@.service.in
quotacheck: add quotacheck.mode credential support
2025-07-16 05:47:38 +09:00
systemd-random-seed.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-reboot.service
units: adjust Descriptions of various units
2021-06-30 13:25:16 +02:00
systemd-remount-fs.service.in
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
systemd-repart.service
units: don't force the loading of the loop and dm_mod modules in systemd-repart.service
2025-09-18 08:46:34 +09:00
systemd-repart.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-repart@.service
repart: add basic Varlink support, for now only with a ListCandidateDevices() call
2025-09-23 09:22:04 +02:00
systemd-report-basic.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-report-basic@.service.in
units: add missing Documentation= key to systemd-report units
2026-05-23 12:58:23 +02:00
systemd-report-cgroup.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-report-cgroup@.service.in
units: add missing Documentation= key to systemd-report units
2026-05-23 12:58:23 +02:00
systemd-report-diskhealth.socket
report: add metrics source that reports disk health data
2026-10-16 16:10:23 +02:00
systemd-report-diskhealth@.service.in
report: add metrics source that reports disk health data
2026-10-16 16:10:23 +02:00
systemd-report-diskspace.socket
report: add metrics source that reports current disk space data
2026-09-25 16:43:13 +02:00
systemd-report-diskspace@.service.in
report: add metrics source that reports current disk space data
2026-09-25 16:43:13 +02:00
systemd-report-files.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-report-files@.service.in
report: add simple metrics provider that just reads files
2026-06-19 05:23:18 +02:00
systemd-report-geoip.socket
report: add a simple geoip source
2026-10-17 07:52:31 +02:00
systemd-report-geoip@.service.in
report: add a simple geoip source
2026-10-17 07:52:31 +02:00
systemd-report-hwmon.socket
report: suppress some metrics of hw owned by the host on containers
2026-10-08 17:30:21 +02:00
systemd-report-hwmon@.service.in
report: add backend for reporting temperature sensors
2026-09-23 16:31:41 +02:00
systemd-report-netstat.socket
report: Add network statistics metrics generator
2026-10-09 07:55:32 +02:00
systemd-report-netstat@.service.in
report: Add network statistics metrics generator
2026-10-09 07:55:32 +02:00
systemd-report-sign-plain.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-report-sign-plain@.service.in
units: harden systemd-report-sign-plain@.service
2026-06-25 10:33:01 +01:00
systemd-report-sign-tpm2.socket
report: Add a TPM2 signing backend
2026-08-20 15:30:20 +02:00
systemd-report-sign-tpm2@.service.in
report: Add a TPM2 signing backend
2026-08-20 15:30:20 +02:00
systemd-report-sign-tsm.socket
units: tag more units correctly with varlink xattrs
2026-06-24 11:47:28 +01:00
systemd-report-sign-tsm@.service.in
report: add systemd-report-sign-tsm backend
2026-06-22 20:42:35 +02:00
systemd-report.socket
units: add /run/varlink/registry/ symlink to systemd-report.socket
2026-10-22 21:08:10 +02:00
systemd-report@.service.in
report: turn systemd-report itself into a varlink service
2026-06-19 05:23:18 +02:00
systemd-resolved-monitor.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-resolved-varlink.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-resolved.service.in
units: unify deps between service and socket units
2025-04-30 21:27:37 +02:00
systemd-rfkill.service.in
units: Bump various oneshot unit timeouts to 90s
2024-03-14 00:10:48 +09:00
systemd-rfkill.socket
units: condition out a few services in the initrd
2023-07-05 10:58:47 +09:00
systemd-soft-reboot.service
Revert "units: do not soft-reboot before soft-reboot.target reached"
2024-05-23 00:06:30 +09:00
systemd-storage-block.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-storage-block@.service.in
storage: add systemd-storage-block@.service provider
2026-04-29 12:25:47 +02:00
systemd-storage-fs.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-storage-fs@.service.in
storage: add systemd-storage-fs@.service provider
2026-04-29 12:25:47 +02:00
systemd-storagetm.service.in
units: explicitly reset TTY before running stuff on console
2025-09-18 21:30:31 +02:00
systemd-suspend-then-hibernate.service.in
units: update Description= for systemd-sleep units
2024-01-15 02:59:25 +08:00
systemd-suspend.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-sysctl.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-sysext-initrd.service
dissect,nspawn,sysext: enable TPM2 unlocking of DDIs, document it
2026-10-13 11:05:48 +00:00
systemd-sysext-sysroot.service
dissect,nspawn,sysext: enable TPM2 unlocking of DDIs, document it
2026-10-13 11:05:48 +00:00
systemd-sysext.service
dissect,nspawn,sysext: enable TPM2 unlocking of DDIs, document it
2026-10-13 11:05:48 +00:00
systemd-sysext.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-sysext@.service
units: don't set LISTEN_FDNAMES for varlink services explicitly
2024-08-26 15:40:15 +02:00
systemd-sysinstall.service
sysinstall: Add varlink interface
2026-07-03 11:16:46 +02:00
systemd-sysinstall.socket
sysinstall: Add varlink interface
2026-07-03 11:16:46 +02:00
systemd-sysinstall@.service
sysinstall: Add varlink interface
2026-07-03 11:16:46 +02:00
systemd-sysupdate-auto-enable.service.in
sysupdate: move back to libexecdir to mark as experimental
2026-08-26 19:51:31 +01:00
systemd-sysupdate-notify-bootctl.socket
bootctl: add link-auto/LinkAuto and auto-link on completed system update
2026-06-24 13:05:34 +02:00
systemd-sysupdate-notify-bootctl@.service
bootctl: add link-auto/LinkAuto and auto-link on completed system update
2026-06-24 13:05:34 +02:00
systemd-sysupdate-notify-pcrlock.socket
pcrlock: recompute PCR policy on completed system update
2026-06-24 13:05:34 +02:00
systemd-sysupdate-notify-pcrlock@.service.in
pcrlock: recompute PCR policy on completed system update
2026-06-24 13:05:34 +02:00
systemd-sysupdate-notify-sysext.socket
sysext: refresh sysexts and confexts on completed system update
2026-06-24 13:05:34 +02:00
systemd-sysupdate-notify-sysext@.service
sysext: refresh sysexts and confexts on completed system update
2026-06-24 13:05:34 +02:00
systemd-sysupdate-reboot.service.in
sysupdate: move back to libexecdir to mark as experimental
2026-08-26 19:51:31 +01:00
systemd-sysupdate-reboot.timer
unit: add units for new "systemd-sysupdate" tool
2022-03-19 00:13:55 +01:00
systemd-sysupdate-update.service.in
units: run systemd-sysupdate-update.service with --loop=16
2026-10-13 09:34:28 +02:00
systemd-sysupdate-update.timer
sysupdate: Add basic varlink interface scaffolding
2026-06-26 13:01:31 +01:00
systemd-sysupdate.socket
sysupdate: Add basic varlink interface scaffolding
2026-06-26 13:01:31 +01:00
systemd-sysupdate@.service.in
sysupdate: Permit mount namespaces in Varlink service
2026-09-05 08:22:45 +02:00
systemd-sysupdated.service.in
sysupdated: Permit mount namespaces
2024-11-06 15:44:11 -05:00
systemd-sysusers.service
units: introduce systemd-tmpfiles-setup-dev-early.service
2023-08-12 07:55:20 +09:00
systemd-time-wait-sync.service.in
treewide: fix typos
2023-09-19 10:05:38 +02:00
systemd-timedated.service.in
timedated: modernization
2024-01-09 21:57:45 +08:00
systemd-timesyncd.service.in
timesyncd: order after systemd-resolved
2026-08-15 13:12:50 -07:00
systemd-tmpfiles-clean.service
units: Use ImportCredential= where applicable
2023-06-08 14:09:36 +02:00
systemd-tmpfiles-clean.timer
units: skip some units in the initrd
2021-05-22 15:58:40 +09:00
systemd-tmpfiles-setup-dev-early.service
units: introduce systemd-tmpfiles-setup-dev-early.service
2023-08-12 07:55:20 +09:00
systemd-tmpfiles-setup-dev.service
units: introduce systemd-tmpfiles-setup-dev-early.service
2023-08-12 07:55:20 +09:00
systemd-tmpfiles-setup.service
units/systemd-tmpfiles-setup.service: explicitly set RestrictSUIDSGID=no
2025-07-09 11:08:31 +02:00
systemd-tpm2-clear.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-tpm2-setup-early.service.in
tpm2-setup: treat NvPCR init outside initrd as error
2026-10-13 20:41:53 +02:00
systemd-tpm2-setup.service.in
tpm2: Don't fail NvPCR initialization if there is no initial write policy available
2026-10-12 10:54:09 +02:00
systemd-tpm2-swtpm.service.in
units: properly wait for swtpm to finish before the initrd transition
2026-07-09 13:33:06 +02:00
systemd-udev-load-credentials.service
units: introduce systemd-udev-load-credentials.service
2024-04-16 09:45:43 +09:00
systemd-udev-settle.service
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
systemd-udev-trigger.service
udev: drop home-grown udev-ctrl socket
2026-07-18 05:29:59 +09:00
systemd-udevd-kernel.socket
units/systemd-{udevd,journald}*.socket: enable DeferTrigger=
2025-06-30 13:10:43 +02:00
systemd-udevd-varlink.socket
udev: drop home-grown udev-ctrl socket
2026-07-18 05:29:59 +09:00
systemd-udevd.service.in
udev-watch: reimplement with fanotify
2026-10-12 04:04:37 +09:00
systemd-update-done.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-update-utmp.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-user-sessions.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-userdb-load-credentials.service
man: correct a few manpage references
2026-06-06 10:47:10 +01:00
systemd-userdbd.service.in
units: unify deps between service and socket units
2025-04-30 21:27:37 +02:00
systemd-userdbd.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-validatefs@.service.in
units/systemd-validatefs@.service: FailureAction= is a [Unit] knob
2025-03-31 19:23:51 +02:00
systemd-varlink-monitord.socket
varlink-monitord: Add BPF-based varlink traffic monitor daemon
2026-10-14 13:53:03 +02:00
systemd-varlink-monitord@.service.in
varlink-monitord: Add BPF-based varlink traffic monitor daemon
2026-10-14 13:53:03 +02:00
systemd-vconsole-setup.service.in
units: disable start rate limit for systemd-vconsole-setup.service
2023-11-25 13:27:17 +01:00
systemd-vmspawn@.service.in
units: systems might take a while to boot
2025-07-11 18:17:04 +02:00
systemd-volatile-root.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
time-set.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
time-sync.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
timers.target
units: adjust Descriptions of various units
2021-06-30 13:25:16 +02:00
tmp.mount
core/mount: rework GracefulOptions= to be just x-systemd.graceful-option=
2025-02-12 18:16:44 +01:00
tpm2.target
units: also require /dev/tpm0 to be around before tpm2.target can be reached
2025-03-05 12:37:48 +01:00
umount.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
usb-gadget.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
user-runtime-dir@.service.in
logind: automatically pull in systemd-pcrlogin@.service on first login
2026-05-22 12:15:14 +02:00
user.slice
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
user@.service.in
logind: automatically pull in systemd-pcrlogin@.service on first login
2026-05-22 12:15:14 +02:00
var-lib-machines.mount
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
veritysetup-pre.target
dm-verity: Remove usage of integrity
2021-10-14 12:17:02 -05:00
veritysetup.target
dm-verity: Remove usage of integrity
2021-10-14 12:17:02 -05:00