Arian van Putten
bb2c842b1f
The imds-network= meson option has never had an effect on the generated network configuration. It arrived in168a7f7770together with the IMDS generator, which wired IMDS_NETWORK_LOCKED_DEFAULT (turned into IMDS_NETWORK_DEFAULT byc3e4e8a527) into the generator's arg_network_mode. But the generator only ever compares that variable against IMDS_NETWORK_OFF, to decide whether to pull systemd-imds-early-network.service into the initial transaction, and "off" is not one of the option's choices. It also never forwards the mode on to systemd-imds-early-network.service, neither as a command line switch nor via a drop-in. 85-imds-early.network is written by systemd-imds-early-network.service, which runs "systemd-imdsd --setup-network", and that code path's arg_network_mode was left at _IMDS_NETWORK_MODE_INVALID. As setup_network() requires "!= IMDS_NETWORK_UNLOCKED" before emitting the "prohibit" routes, the unset sentinel behaves exactly like "locked". At first that went unnoticed, because the option defaulted to "locked" as well: the documented default matched the implemented behaviour by accident, and only "-Dimds-network=unlocked" was quietly ignored.6240d420d6("meson: unlock imds network by default") then flipped the default by reordering the option's choices, i.e. moved a macro that nothing consumed. From that point on the default was wrong for everybody: unless systemd.imds.network= is passed on the kernel command line, every generated network file locks the IMDS endpoint down, no matter how the build is configured.ac64b2dfa3later documented the new default in man:systemd-imdsd@.service(8) (#42687), which meant the documentation now described behaviour that does not exist. In practice this rarely became visible until the previous commit, since systemd-imdsd --setup-network mostly lost its race against udev and wrote no network file at all. Initialize arg_network_mode from IMDS_NETWORK_DEFAULT, the same way imds-generator.c does. No other code distinguishes the INVALID sentinel from a real mode; the remaining users compare against IMDS_NETWORK_OFF and IMDS_NETWORK_UNLOCKED only. The kernel command line still overrides the build-time default, and the only difference in the generated network file are the two "prohibit" routes: the fwmark routing table and the matching routing policy rule are written in either mode, as before.
System and Service Manager
Details
Most documentation is available on systemd's website.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release