commit 2e049329b06241f853066f495daf27386b3e3c24
Author: Pete Travis <immanetize(a)fedoraproject.org>
Date: Thu Oct 9 21:37:53 2014 -0600
the best thing about systemd is
en-US/System_Daemons.xml | 207 +++------------------------------------------
1 files changed, 14 insertions(+), 193 deletions(-)
---
diff --git a/en-US/System_Daemons.xml b/en-US/System_Daemons.xml
index 59c4504..a9fff93 100644
--- a/en-US/System_Daemons.xml
+++ b/en-US/System_Daemons.xml
@@ -21,223 +21,44 @@
</itemizedlist>
</section>
<section id="systemd-private">
- <title>Isolating Services</title>
+ <title>systemd 215</title>
<para>
- Two new security-related options are now available to limit long-running services
that do not require access to physical devices or the network.
+ <systemitem class="daemon">systemd</systemitem> in Fedora 21
has been updated to version 215. This release includes substantial enhancements,
including improved resource management, service isolation and other security improvements,
and network management from <systemitem class="daemon"
>systemd-networkd</systemitem>.
</para>
<para>
- The <literal>PrivateDevices</literal> setting, when set to
<literal>yes</literal>, provides the service with a private, minimal
<filename class="devicefile">/dev</filename> that does not include
physical devices. This allows long-running services to have limited access, increasing
security.
+ Many of these improvements enhance management of services running inside
containers, and management of the containers themselves.
<command>systemd-nspawn</command> creates securely isolated containers, and
tools such as <command>machinectl</command> are available to manage them.
<systemitem class="daemon">systemd-networkd</systemitem> provides
network services for the containers, and <systemitem class="daemon"
>systemd</systemitem> itself manages resource allocations.
</para>
<para>
- The <literal>PrivateNetwork</literal> setting, when set to
<literal>yes</literal>, provides the service with a network isolated to only a
loopback interface. This ensures that long-running services that do not require network
access are cut off from the network.
- </para>
- <para>
- For detailed information, refer to <ulink
url="https://fedoraproject.org/wiki/Changes/PrivateDevicesAndPrivate...
/>
- </para>
- </section>
- <section id="systemd-stateless">
- <title>Stateless Systems</title>
- <para>
- The <ulink
url="https://fedoraproject.org/wiki/Features/UsrMove">usrmov...
Feature in Fedora 17 began a convention of distribution provided configurations residing
in <filename>/usr</filename>, with overriding administrator provided
configurations in <filename>/etc</filename>. The systemd project's
stateless systems effort goes a step further, to ensure that a system can boot
<emphasis>without</emphasis> the configuration files in
<filename>/etc</filename>.
- </para>
- <para>
- This capabiity allows systems to be reset to a factory state, or various
installation types to share a predictable base system. Read <ulink
url="http://0pointer.de/blog/projects/stateless.html" /> to learn about the
potential of stateless systems.
- </para>
- <para>
- Changes to <systemitem class="daemon">systemd</systemitem>
that enable stateless systems include:
- </para>
- <itemizedlist>
- <listitem>
- <para>
- <emphasis>systemd-sysusers</emphasis>
- </para>
- <para>
- The <systemitem>systemd-sysitems</systemitem> utlity creates system
users in <filename>/etc/passwd</filename> and system groups in
<filename>/etc/groups</filename> based on declared entries in
<filename>/usr/lib/sysusers.d/</filename>. This ensures that crucial accounts
are available in early boot.
+ To learn more about enhancements to <systemitem class="daemon"
>systemd</systemitem>, read:
+ <itemizedlist>
+ <listitem>
+ <para>
+ <filename>/usr/share/doc/systemd/NEWS</filename> for the upstream
changelog.
</para>
</listitem>
<listitem>
<para>
- <emphasis>tmpfiles snippet for
<filename>/etc/filename</filename></emphasis>
- </para>
- <para>
- <filename>/usr/lib/tmpfiles.d/etc.conf</filename> rebuilds
essential files in <filename>/etc</filename>, should they be missing.
Notably, a symlink is created linking <filename>/etc/os-release</filename> to
<filename>/usr/lib/os-release</filename>.
+ Manpages and other documentation provided with the systemd package, listed with
<command>rpm -qd systemd</command>.
</para>
</listitem>
<listitem>
<para>
- <emphasis>ConditionNeedsUpdate directive</emphasis>
- </para>
- <para>
- Service units can conditionally run only when related files in
<filename>/etc</filename> or <filename>/var</filename> are older
than the correlating files in <filename>/usr</filename>
+ <ulink
url="http://0pointer.net/blog/projects/stateless.html"
/> for an overview of many changes and their intent.
</para>
</listitem>
<listitem>
<para>
- <emphasis>systemd presets</emphasis>
- </para>
- <para>
- The new command <command>systemctl preset-all</command> applices
service preset settings to all unit files. The equivalent operation if the system is
booted with an empty <filename class="directory" >/etc</filename>.
Preset files for crucial services are provided with systemd in <filename
class="directory" >/usr/lib/systemd/system-preset/</filename>
+ <ulink
url="http://www.freedesktop.org/wiki/Software/systemd/"
/> for a comprehensive overview of systemd.
</para>
</listitem>
<listitem>
<para>
- <emphasis>/var recreation</emphasis>
- </para>
- <para>
- A tmpfiles snippet,
<filename>/usr/lib/tmpfiles.d/var.conf</filename>, recreates the basic
structure of <filename class="directory">/var</filename>, if
<filename class="directory" >/var</filename> is empty.
+ <ulink
url="https://fedoraproject.org/wiki/SysVinit_to_Systemd_Cheatsheet&q... /> for
users new to Fedora and <systemitem class="daemon"
>systemd</systemitem>
</para>
</listitem>
-
</itemizedlist>
- </section>
-
-
- <listitem>
- <para>
- <emphasis>DefaultInstance= for templates</emphasis>
- </para>
- <para>
- A templated unit file can unclude a
<option>DefaultInstance=</option> option. If the template unit is enabled
without declaring an instance, the value of <option>DefaultInstance</option>
is used.
- </para>
- </listitem>
-
-
-
- <para>
- nspawn uses devices cgroup controller, only permits access,creaton to,of API
device notes ie /dev/null /dev/random, access for pty
- systemd-nspawn has --tmpfs=/path switch to create a tmpfs at /path in the
container
- `systemd-nspawn --image` boots disk images and linux installations following the
discoverable partition specification.
- `systemd-nspawn --network-macvlan=` sets up a private macvlan interface;
compliments Kind=macvlan setting in .netdev files
- systemd-network-wait-online is new, waits for network connectiviry using
systemd-networkd
- /usr/lib/systemd/network/80-container-host0.network
- /usr/lib/systemd/network/80-container-ve.network
- systemd ships .network file for systemd-networkd that automatically configures
DHCP for network interfaces created by nspawn's --network-veth= or --network-bridge=
- unit files gain DeviceAllow to whitelist device access, uses names from
/proc/devices
- /etc/systemd/network/*.link, man systemd.link
- netword veth interfaces prefixed with vb- if --network-bridge or ve- if
--network-veth
- new tool to save/restore rfkill state on shutdown/reboot [what? how?]
- restore state of keyboard backlights in addition to screen backlights
- $XDG_RUNTIME_DIR are individual tmpfs instances, allows quota settings, superior
isolation. Set default size in logind.conf:RuntimeDirectorySize= defaults to 10% of
available physical memory
- logind automatically turns off automatic suspending on laptop lid close iff more
than one display is closed. This had been left to DEs, but what about when the system
starts with the lid closed?
- After resuming from suspend, the system won't suspend again for 30s. The
system won't suspend due to a laptop lid close until 3 minutes after resume. This
gives peripherals that might be used or block suspend time to come up.
- systemd-run --property= for resource control properties ie BlockIOWeight=10
- systemd-run --uid --gid --setenv also works in scope mode
-
- systemd-machine-id-setup has --root arg to operate on a given root directory
- `machinectl poweroff` to shut down container
- MAC addresses for nspawn containers with the --network-interface= are generated
from machineID, so they can be consistent.
- Logic for handling legacy init scripts moved out of PID1 and into a dynamically
run generator that creates unit files on demand. Units that need the network
automatically get a dependency for network-online.target
- fsck.repair= boot option declares how the kernel deals with unclean filesystems
- preen=safe repair only, yes=force yes, no=no repair
- systemd-udevd runs in dissociated mount namespace. To mount directories from udev
rules, make sure to pull in mount units via SYSTEMD_WANTS properties.
- systemd native support for tcpwrappers removed
- system.conf option gains DefaultTImerAccuracySec= that sets default AccuracySec=
for .timer units.
- timer units get WakeSystem= switch to resume from suspend (given [common]
hardware support)
- timer units gain Persistent= switch to save to disk when last triggered, causes
units to trigger if their last scheduled time was missed due to poweroff.
-
- """
-As an experimental feature, udev now tries to lock the
-disk device node (flock(LOCK_SH|LOCK_NB)) while it
-executes events for the disk or any of its partitions.
-Applications like partitioning programs can lock the
-disk device node (flock(LOCK_EX)) and claim temporary
-device ownership that way; udev will entirely skip all event
-handling for this disk and its partitions. If the disk
-was opened for writing, the close will trigger a partition
-table rescan in udev's "watch" facility, and if needed
-synthesize "change" events for the disk and all its partitions.
-This is now unconditionally enabled, and if it turns out to
-cause major problems, we might turn it on only for specific
-devices, or might need to disable it entirely. Device Mapper
-devices are excluded from this logic.
-"""
- /dev/log and /dev/initctl moved to /run with symlinks so PrivateSystem units can
get them.
- systemd-notify fixed to send messages as from the invoking script and not
systemd-notify itself.
- ReadOnlyDirectories= now applied recursively to submounts. systemd-nspawn
--read-only does the same thing.
- New unit file RestrictAddressFamilies= restricts the socket address familiew that
units are given access to. ie AF_INET,AF_UNIX
- units get RuntimeDirectory= RuntimeDirectoryMode= to declare /run workingdirs
- units get DeviceAllow= setting to glob against device group names
- systemd.conf gains options to set defaults:
- DefaultCPUAccounting=
- DefaultBlockIOAccounting=
- DefaultMemoryAccounting=
- - can turn on or off accounting for units, overridden by individual unit
configs
-
- systemd-gpt-auto-generator can discover /srv,/,/home,swap. Supports LUKS.
http://www.freedesktop.org/wiki/Specifications/DiscoverablePartitionsSpec
-
- systemd doesn't consider dom0s to be virtual machines.
- Restart=on-abnormal triggers automatic restarts on all abnormal exit statii,
restarts harder than on-failure
- Socket units can be owned by SocketUser= or SocketGroup=
- ProtectedHome= makes home inaccessible
- ProtectedSystem= makes /usr/ read only
- systemd-netowrkd runs as "systemd-network" user so it can't write
to root owned files.
- kbus has support for loading policy into the kernel
- kbus has support for loading policy into the kernel
- systemd-resolved runs as systemd-resolve user
- systemd-resolved provides different /etc/resolv.conf to different interfaces
- resolved symlink from /etc/resolv.conf should target
/run/systemd/resolv/something
- systemd-bus-proxyd runs as systemd-bus-proxy
- networkd does veth for containers, and GRE, VTI,IPIP,SIT tunnels
- networkd supports matching on system virtualization, arch, kernel command line,
hostname, machineID
- networkd doesn't dynamically load kernel modules, assumes the kernel can do
it.
- systemd-detect-virt works without privs
- REstartForceExitStatus= return value for main service process exit; force restart
of all child processes if seen
- Systemctl -H (for remote machines) can connect to containers, ie `systemctl -H
user@host:containername`
- udev uses dev_port from sysfs instead of dev_id; ensures consistent naming even
if devices have the same hardware address on system bus
- machined reads /etc/os-release and /usr/lib/os-release, value shown in machinectl
(contaniers>
- machined reads container IPs, value shown in machinectl
- file-heirarchy(7) describes minimized, modernized version of the filesystem
systemd expects, similar to heir(5) or FHS. tool: systemd-path
- systemd-nspawn filters syscals for kernel module loading, io port access,
swap, kexec, more; for security
- boot options: systemd.wants= systemd.mask= systemd.debug-shell(TTY9)
- journald defaults to SplitMode=uid so users can see their coredumps
- coredumpctl gains 'info' commmand to show details
- systemd-coredump logs stack trace of running dumps to journal
- systemd-coredup optionally stores to /var/lib/systemd/coredump instead of
journal
- /dev/loop-control /dev/btrfs-control /dev/fd* owned by 'disk' group
- cryptsetup-pre for services that need to run before encypted mounts are up
- network-pre.target for services like firewall that must start before network
is up
- service presets??
- systemctl is-system-running
- tmpfiles:
- L+ force symlink
- b+ force block device
- c+ force character device
- C option to copy files
- p+ force fifo
- Omitting source for target automatically grabs correlating path based from
/usr/share/factory/path
- mount units have SloppyOptions= mapping to -s of `mount`.
- rpm macros for sysusers, sysctl, binfmt
- input group for input devices compliments audio and video groups
- networkd does DHCPv4 server
- netowrkd does vxlan virtual networks, tun/tap devices, dummy devices
- networkd does predictable address assignments to its local interfaces.
- netowrkd does automatic allocation of address ranges for interfaces from a
pool, used to manage large numbers of interfaces, useful for many nspawn instances.
- systemd-timesyncd - ntp client, saves state to disc for RTC-less systems,
runs as systemd-timesync
- systemctl list-timers;systemctl list-sockets gets --recursive to list timers
and sockets inside containers.
- FailureAction= option is triggered on unit failure
- hostnamed exposes kernel n-v-r, helpful for -H
- hostnamed prefers /etc/hostname over dhcp (unless localhost or empty)
- when restoring brightness, stay away from lowest setting or lowest 5%
- bootchart can show cgroup information
- cgroup cpu quotas can be set with CPUQuota=NN% option
- StartupCPUShares= and StartupIOWeight= sets limits only during startup
- systemctl status with no arguments returns:
- starting: startup
- running: normal runtime
- degraded: at least one failed service
- maintenance: rescue/emergency mode
- stopping: shutdown
- - useful with containers
- systemctl list-machines shows containers running systemd and their state
- systemctl gets -r switch to recursively enumerate units in containers
- partition discovery logic will honor GPT partition flags for read only,
ignore
- two GPT UUIDs, on discovery, will be mounted as / - for 32,64bit arm.
- logind clears all IPC objects on user logout, controlled by RemoveIPC= in
logind.conf
- journald emergency messages forwarded to all users in the way of `wall`
- </para>
- -->
-
-
+ </para>
+ </section>
</section>