Inguqulo 262 yesistimu yesistimu kanye nomphathi wesevisi isiyatholakala manje, ifaka phakathi ukuthuthukiswa okukhulu ngemva kwezinyanga ezintathu zokuthuthukiswa. Lokhu kukhishwa kuyaphawuleka ngokuthuthukisa ukwakheka kwayo kwezindawo ezilula ezi-virtualized, ukuthuthukisa amaphrothokholi e-cryptographic axhunywe kuma-Trusted Platform Modules (TPMs), kanye nokwengeza imisebenzi ebalulekile kumathuluzi endabuko njenge-run0 kanye ne-systemd-sysupdate.
Njengoba kuneziqukathi ezidinga umkhawulo omncane wesistimu engqondweni, i-systemd manje inikeza ikhono lokuhlanganisa ifayela elilodwa elisebenzisekayo elinokuxhumanisa okungaguquki. Lokhu kuhlanganiswa (okunikwe amandla nge-Meson ngamapharamitha anjenge -`-Dsystemd-multicall-binary=true` ) kuklanyelwe ukusebenza njengenqubo yokuqalisa (i-PID 1) eziqukathini ezincane kakhulu, kugwema ukusetshenziswa kwezingcingo ze-`dlopen()` ukulayisha amalabhulali ashukumisayo futhi kuncike ekusesheni okulula komsebenzisi neqembu esikhundleni se-NSS ejwayelekile.
Ngaphezu kwalokho, i-executable manje ifaka ngaphakathi isethi yamafayela eyunithi abalulekile ( njenge-basic.target, sysinit.target, multi-user.target, kanye ne-reboot.target, phakathi kwabanye). Lawa mafayela afakiwe asetshenziswa njenge-fallback uma kungenzeki ukulayisha ukucushwa kusuka kudiski, okuvumela isitsha ukuthi siqale ngaphandle kokufaka amafayela eyunithi ngokusobala.
Ukuphathwa kwesevisi kanye nokulungiswa kwamaphutha
Ukuze kuncishiswe ingozi yokuqalisa kabusha okuvumelanisiwe lapho izinsizakalo eziningi zihluleka ngesikhathi esisodwa, ipharamitha ethi `RestartRandomizedDelaySec` yethulwe . Le nqubomgomo yengeza ukubambezeleka okungahleliwe (okusatshalaliswa ngokulinganayo) ngaphambi kokuba isevisi iqale kabusha ngokuzenzakalelayo, okungezwa esikhathini esilungiselelwe ku-`RestartSec`. Ngaphezu kwalokho, amayunithi esilayi afaka i-`ActivatingConcurrencyMax`, umkhawulo onquma inani eliphezulu lamayunithi angasetshenziswa ngesikhathi esisodwa ngaphakathi kwesigaba; noma yikuphi ukusebenza okweqile kufakwa emgqeni kuze kube yilapho izikhala zamandla zitholakala.
Ezindaweni ezidinga ukutholakala okuphezulu okuqhubekayo (njengamaseva abalulekile), ipharamitha ye-LUOSession yasetshenziswa kumayunithi esevisi. Le pharamitha iyala i-systemd ukuthi idale amaseshini e-Live Update Orchestrator, ivumela izibuyekezo ezishisayo ze-kernel yesistimu ngaphandle kokuphazamisa ukusebenza kwesevisi futhi ilondoloze isimo sezinqubo namadivayisi.
I-TPM2, i-fscrypt, kanye nokuphepha kwesitoreji
Ezinye izici ezintsha kule nguqulo zifaka phakathi indlela iziqinisekiso ezivalwe ku-TPM manje ezixhunyaniswe ngayo ngqo nokhiye wazo wempande yesitoreji (SRK), ukuvimbela ukuhlaselwa kwe-man-in-the-middle (MitM) yizingxenye eziphakathi ezizama ukuvimba idatha ekhishwe ukubethela. Ukubhaliswa kweziqinisekiso ze-PIN ye-TPM2 nge-systemd-cryptenroll kufaka i-algorithm ye-Argon2id njengokuzenzakalelayo, okukhiqiza izinto eziyinhloko eziqinile kakhulu kunokuqaliswa kwefa (direct/PBKDF2).
Ezingeni lokugcina lomsebenzisi, i-systemd-homed ishintshe indlela yayo yokwenza amafolda abethelwe kusetshenziswa uhlelo lwamafayela lwe-fscrypt: ukudalwa okusha kuzolandela izinqubomgomo zenguqulo 2 (fscrypt v2), okuvumela ukhiye oyinhloko ukuthi uhlale kukhiye wesistimu yamafayela futhi ubonakale ezindaweni ezahlukene zamagama. Amafolda e-fscrypt v1 azohlala esebenza, yize engeke abe nendlela yokuthuthukisa eya ku-v2.
Ngaphezu kwalokho, ukwesekwa kwe-boot yemvelo kufakiwe kwi-module ye-dm-clone kernel, evumela ukukhiqizwa kwama-clone angaguqulwa kusuka kumadivayisi ebhulokhi yokufunda kuphela, acutshungulwa yi-systemd-clonesetup-generator ngokufunda kusuka ku-/etc/clonetab.
Ukuthuthukiswa kwe-athomu kanye nezinguquko zemvelo
I- suite ye-systemd-sysupdate, eyenzelwe izibuyekezo zesistimu ngokushintsha ama-partitions nama-directory nge-atomically, manje igcina isizindalwazi esiqhubekayo samafayela afakiwe. Umyalo wokuhlanza ungeziwe ukuze kuhlanzwe amafayela angafuneki , futhi umqondo "wezingxenye eziphakanyisiwe" usuwamukelwe. Lezi zingxenye zingahlolwa ngokuguquguqukayo ngokusekelwe ekwakhiweni komshini noma kuma-MachineTags ukuze kufakwe umshayeli ngokuzenzakalela.
Ezinye izinguquko ezibalulekile kunguqulo 262 zifaka:
- uhlelo lwe-systemd-vmspawn: Ingeza usekelo lokusebenzisa imishini ebonakalayo eyimfihlo ngaphansi kokwakhiwa kwe-Intel TDX (–coco=tdx), ijoyina i-AMD SEV-SNP.
- I-OpenSSL kanye nokubhaliswa: Uhlelo lokungaguquguquki kwerekhodi (i-Forward Secure Sealing, FSS) luyathuthwa lusuka kulabhulali ye-libgcrypt luye emisebenzini ye-cryptographic yomdabu ye-OpenSSL. Ukusekelwa kokuqala kokuhlanganiswa kwe-OpenSSL 4 nakho kuyangezwa.
- Itheminali Nokusetshenziswa Kahle: I-run0 privilege escalation utility ingeza izinketho ezihambisana ne-sudo ezifana ne--k, -K, kanye ne--v ukuze kusethwe kabusha noma kuqinisekiswe isikhathi sokuphelelwa yisikhathi sokugunyazwa kwe-Polkit. I-vconsole ivumela ukusetha usayizi wefonti ku-100% noma ku-200% kusetshenziswa i-FONT_SCALE, futhi izixwayiso zephasiwedi zamathokheni e-FIDO2 manje zizobonisa imizamo ye-PIN esele.
- uhlelo lwe-systemd-sysctl: Manje ifaka ifulegi elithi –verify ukuze kuhlolwe ngokuphinda kufundwe ukuthi inani elibhalwe ohlelweni lisetshenzisiwe ngempela.
Okokugcina, uma unesithakazelo sokufunda okwengeziwe, ungathola imininingwane kusixhumanisi esilandelayo.