Systemd 255 is here with improved UKI support
- Reference: 1702035792
- News link: https://www.theregister.co.uk/2023/12/08/systemd_255_is_here/
- Source link:
Although [1]Systemd 255 mainly consolidates and builds on changes that were announced earlier, it does have some new features.
A visible one may prove to be the new [2]BSOD service , which is genuinely more welcome than it sounds. Yes, it does stand for Blue Screen Of Death just like in Windows, but the idea is that [3]LOG_EMERG level messages – meaning an inoperable system – will be displayed on the machine's console full-screen. This severity of error usually means that the computer failed to boot, and the new tool can even try to display a QR code, facilitating the first line of recourse of any competent BOFH: looking the error message up on Google.
[4]
Version 255 is FF in hexadecimal and 11111111 in binary: a byte with all eight bits set. Next spring will see version 256, meaning 0b100000000 or 0x100, and we suspect that a few distros may have problems with that version number – but they are probably small issues. A bigger one is that this release requires distributions to have completed the [5]/usr merge process. This requirement was announced well in advance, and we [6]discussed what it means back when systemd 254 came out. Merging the /usr hierarchies was a [7]Fedora initiative , and was completed back in 2012 in Fedora 17, aka "Beefy Miracle." It has also been the default in new installations of Ubuntu since 19.04, and in [8]openSUSE Tumbleweed since 2021 .
[9]
[10]
Debian [11]started the /usr merge process in 2016, but as LWN [12]reported in 2018 it hit some problems, and even by last June these were [13]not completely resolved . However, back in October, the Debian developers [14]lifted the moratorium on moving files from locations under the root directory to ones under /usr ; the project [15]status page has more details. The process may be complete by Debian 13, expected in 2025. The current Debian "Bookworm" uses systemd 252, and we expect that it will until its end of life, so systemd 255 won't affect Debian stable releases.
Version 255 will be the last one that supports v1 of the kernel's [16]cgroups feature . Some other features are now deprecated or turned off, such as support for SysV service scripts, the SystemdOptions EFI variable, and user-specified system suspend, hibernate and hybrid-sleep states in the [17]systemd-sleep.conf file . Using the kernel command-line parameters to disable TCP/IP now turns off more IPv6 functionality. Only the initrd can now switch the root filesystem, and to do that on running systems, sysadmins should use the soft-reboot function introduced in systemd 254.
[18]
Over two dozen of the changes related to Agent P's new Unified Kernel Image boot files, which we [19]examined in depth last year . Support for this [20]started appearing in systemd 252 and more [21]supporting tools came with systemd 253. There is still more to come – for instance, release 255 introduces a new [22]systemd-pcrlock tool for handling TPM2 PCR "measurements". PCR stands for Platform Configuration Registers; the first eight (0-7) are stipulated by the [23]Trusted Computing Group specification . PCRs 8 and upwards are defined by the OS, as explained in this [24]Fedora Magazine article .
[25]Rocky Linux and Oracle Unbreakable Linux also hit 9.3
[26]GhostBSD makes FreeBSD a little less frightening for the Linux loyal
[27]Red Hat retires mailing list, leaving Linux loyalists to read between the lines
[28]Microsoft slips out Windows Server 2022 with extended support for 10 years
We explained how this stuff works in the earlier three articles, linked above. The executive summary is that this new tooling improves support for booting Linux with Intel and Microsoft's Secure Boot feature, including automatically unlocking fully encrypted disks using keys held in the TPM2 chip's memory. The goal is not needing a human to manually enter a passphrase before the computer boots up. That's fine if you encrypt your laptop's hard disk, but it's very much not fine for a server in a remote datacenter somewhere, or for an encrypted VM. Secure Boot used to be a Windows-only feature, but TPM2 support is required for Windows 11, and for [29]Windows Server 2022 if you use Bitlocker encryption.
Most Linux users will probably first meet systemd 255 in Ubuntu 24.04 and Fedora 40, both due early next year. ®
Get our [30]Tech Resources
[1] https://lists.freedesktop.org/archives/systemd-devel/2023-December/049745.html
[2] https://www.freedesktop.org/software/systemd/man/latest/systemd-bsod.service.html
[3] https://man7.org/linux/man-pages/man3/syslog.3.html
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZXNLvrQvEtNZ7GcdZQR3vQAAAAM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://www.freedesktop.org/wiki/Software/systemd/TheCaseForTheUsrMerge/
[6] https://www.theregister.com/2023/08/02/systemd_254/
[7] https://fedoraproject.org/wiki/Features/UsrMove
[8] https://en.opensuse.org/openSUSE:Usr_merge
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZXNLvrQvEtNZ7GcdZQR3vQAAAAM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZXNLvrQvEtNZ7GcdZQR3vQAAAAM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2016/11/24/debian_testing_merged_codeusrcode/
[12] https://lwn.net/Articles/773342/
[13] https://lwn.net/Articles/933043/
[14] https://lists.debian.org/debian-devel-announce/2023/10/msg00003.html
[15] https://wiki.debian.org/UsrMerge
[16] https://man7.org/linux/man-pages/man7/cgroups.7.html
[17] https://www.freedesktop.org/software/systemd/man/latest/systemd-sleep.conf.html
[18] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZXNLvrQvEtNZ7GcdZQR3vQAAAAM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[19] https://www.theregister.com/2022/10/26/tightening_linux_boot_process_microsoft_poettering/
[20] https://www.theregister.com/2022/11/03/version_252_systemd/
[21] https://www.theregister.com/2023/02/17/systemd_253/
[22] https://www.freedesktop.org/software/systemd/man/latest/systemd-pcrlock.html
[23] https://trustedcomputinggroup.org/resource/tcg-efi-platform-specification/
[24] https://fedoramagazine.org/automatically-decrypt-your-disk-using-tpm2/
[25] https://www.theregister.com/2023/11/21/rocky_n_oracle_linux_9_3/
[26] https://www.theregister.com/2023/11/07/ghostbsd_23_10/
[27] https://www.theregister.com/2023/10/11/red_hat_closed_rhsa_announce/
[28] https://www.theregister.com/2021/08/19/windows_server_2022/
[29] https://www.theregister.com/2021/08/19/windows_server_2022/
[30] https://whitepapers.theregister.com/
Mixed feelings.
At least let me customize the shade easily if it becomes "A Thing" to use the color #007FFF ?
Mine is the one with a swatch pack in the pocket, fancying #120A8F or #FF6700....
Re: Mixed feelings.
or just replace the screen with goatse.cx?
Re: Mixed feelings.
That would be an insult to the image, my good internet denizen!
Although I could see the ability to load custom images, splash animations, and the like being shoehorned in at some point.
Icon because, well, that's what I'd set mine to...
GOTO hell systemd
Recently updated OSs on my local network, after managing to avoid dealing with the shitty "S" for many years, finally had to face up to it to get rid of silly DNS problems, unwanted link-local routes amongst other things, Of course fixing them is one thing, stopping them returning again and again like stupid zombie puppies is another! Resenting the time & effort I was forced to spend learning how to fix this nonsense. I respectfully submit the following commands for your perusal . . .
sudo systemctl mask avahi-daemon
sudo systemctl mask dhcpcd.service
any other things that people like remove to reclaim control over their own computers?
Re: GOTO hell systemd
Not actually a direct removal but-
sudo apt install init-system-helpers sysv-rc sysvinit sysvinit-core sysvinit-utils
Thank God I run Slackware.....!
Another option
Thank God/god I run Devuan, although I also run Linux Mint mainly so I can use some more up to date software (KiCad primarily). That also allows me to get some experience with "the beast".
Makes sense
After copying Window's monolithic philosophy, shody coding methods, and general bad ideas, systemd is now copying the BSoD.
I suspect people will end up seeing it more than they care to.
Pottering's current employer being of no surprise to anyone.
Re: "shody"
I admire your word coinage, i.e. the combination of "shoddy" and "shady" ... :-)
Re: "shody"
Thanks, I almost went with "shaddy".
Oh
"it's very much not fine for a server in a remote datacenter somewhere, or for an encrypted VM."
So with Poettering now a M$ droid, is this the next small step in embrace - extend - extinguish?
What is it with the systemd devs finding obscure ways to provide info? If it's inteligent enough to produce a QR which will point to what might be wrong, then surely it could cope with just printing it on the screen where we can see it without having to resort to jumping though hoops. It's bad enough having to use journalctl to find out what's going on because they decided that wrting to logs was far too obvious.
Oh what a tangled web...
I suppose the BSOD is required to real with the binary logs that require the system to be able to boot to read the logs that tell you why the system hasn't booted.