SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
cd4379bb54fa9465f0aa172699e2e61df0ca33ea
systemd/units
T
History
Luca Boccassi cd4379bb54 nsresourced: harden the transient UID/GID write restriction (#43196) 
nsresourced hands out transient, recyclable UID/GID ranges to
unprivileged user namespaces, and a BPF-LSM policy is what keeps a
client from leaving inodes owned by its transient range on a file system
that outlives the namespace, so that a later client which gets the same
range can't inherit them.

The old policy decided based on the mount a write went through, which is
forgeable: unshare(CLONE_NEWNS) gives you clones of every mount with
fresh mount IDs but the same superblock, and the mount namespace's owner
is yours to pick. overlayfs sidesteps it entirely. So this reworks the
check to look at where the write actually lands on disk.

The first commit (Christian Brauner's) replaces the per-mount allowlist
with two questions answered from fields the client can't forge and that
survive mount cloning: does the file system die together with the user
namespace (sb->s_user_ns at or below the managed one), and does the
transient ID actually reach the disk, or does an idmapped mount
translate it into something else first. It walks the userns chain
upwards so a nested namespace can't escape it. The map layout changed,
so the pins move to userns-restrict.v2 and the old ones are removed on
install.

The second commit handles overlayfs. A write through an overlay creates
the file on the upper layer via vfs_create(), which only trips the inode
LSM hooks, not the path hooks we attach to, and the one path hook that
does fire sees the overlay mount, which belongs to the managed namespace
and so looks like it dies with it even though the upper may be
persistent. So we judge the upper at mount time in sb_kern_mount and
refuse a writable overlay unless its upper dies with the namespace too.
Reading overlayfs' private ovl_fs/ovl_layer uses CO-RE type flavors
guarded by bpf_core_type_exists(), and the service now orders after
modprobe@overlay.service.

The third commit deals with restarts. The managed set only lives in the
pinned maps, so an upgrade that changes the map layout comes up with
empty maps and every already-running namespace silently loses its
restriction. manager_startup() now re-adds the live registry entries to
the maps in the same pass that reaps the dead ones. The setgroups()
denial is restored from a flag we now store in the registry.

One consequence: a managed namespace can only mount a writable overlay
whose upper dies with it, e.g. a tmpfs it set up itself. If you need a
writable persistent upperdir (mkosi does), use a plain unprivileged user
namespace for that, not a transient nsresourced range.
2026-08-21 22:05:25 +01:00
..
user
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
user-.slice.d
logind: don't delay login for root even if systemd-user-sessions.service is not activated yet
2022-07-12 22:54:39 +01:00
user@0.service.d
tree-wide: fix typo
2022-07-20 13:15:37 +09:00
user@.service.d
logind: don't delay login for root even if systemd-user-sessions.service is not activated yet
2022-07-12 22:54:39 +01:00
basic.target
…
blockdev@.target
units/blockdev@.target: conflict with umount.target
2023-09-27 12:33:40 +02:00
bluetooth.target
…
boot-complete.target
…
breakpoint-pre-basic.service.in
units: some improvements in breakpoint-* units.
2025-01-03 08:32:43 +01:00
breakpoint-pre-mount.service.in
units: some improvements in breakpoint-* units.
2025-01-03 08:32:43 +01:00
breakpoint-pre-switch-root.service.in
units: some improvements in breakpoint-* units.
2025-01-03 08:32:43 +01:00
breakpoint-pre-udev.service.in
units: some improvements in breakpoint-* units.
2025-01-03 08:32:43 +01:00
capsule.slice
units: add systemd-capsule@.service
2024-03-14 11:34:04 +01:00
capsule@.service.in
units/{user,capsule}@.service: issue daemon-reexec when notify-reloading
2024-10-11 10:36:08 +02:00
clonesetup.target
clonesetup: add support to clone devices via /etc/clonetab
2026-07-10 14:01:24 +02:00
console-getty.service.in
getty: remove --issue-file parameter
2026-02-03 21:00:19 +09:00
container-getty@.service.in
getty: remove --issue-file parameter
2026-02-03 21:00:19 +09:00
cryptsetup-pre.target
…
cryptsetup.target
…
debug-shell.service.in
units: order sysinit.target, debug-shell.service after systemd-vconsole-setup
2023-05-19 17:47:14 +02:00
dev-hugepages.mount
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
dev-mqueue.mount
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
emergency.service.in
units: use relative path
2024-03-16 05:31:44 +09:00
emergency.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
exit.target
units: add JobTimeoutAction= to exit.target and friends
2024-05-18 01:28:14 +09:00
factory-reset-now.target
units: refuse manual operations on factory-reset-now.target and friends
2025-03-05 17:03:59 +01:00
factory-reset.target
factory-reset: revamp infrastructure
2025-03-05 12:37:26 +01:00
final.target
…
first-boot-complete.target
…
getty-pre.target
tree-wide: use https for the 0pointer.de doc links
2023-06-23 13:46:56 +01:00
getty.target
tree-wide: use https for the 0pointer.de doc links
2023-06-23 13:46:56 +01:00
getty@.service.in
getty: remove --issue-file parameter
2026-02-03 21:00:19 +09:00
graphical.target
…
halt.target
units: add JobTimeoutAction= to exit.target and friends
2024-05-18 01:28:14 +09:00
hibernate.target
…
hybrid-sleep.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
imports-pre.target
import-generator: optionally create loopback devices after download
2025-02-21 10:03:32 +01:00
imports.target
import-generator: optionally create loopback devices after download
2025-02-21 10:03:32 +01:00
initrd-cleanup.service
units: add missing Documentation=
2025-09-18 21:54:36 +01:00
initrd-fs.target
units: change order of settings to match order in other similar unit
2021-04-20 19:11:07 +02:00
initrd-parse-etc.service.in
units: add missing Documentation=
2025-09-18 21:54:36 +01:00
initrd-root-device.target
…
initrd-root-fs.target
…
initrd-switch-root.service
units: add missing Documentation=
2025-09-18 21:54:36 +01:00
initrd-switch-root.target
units: add missing Documentation=
2025-09-18 21:54:36 +01:00
initrd-udevadm-cleanup-db.service
units: add missing Documentation=
2025-09-18 21:54:36 +01:00
initrd-usr-fs.target
…
initrd.target
fstab-generator: if usr= is specified, mount it to /sysusr/usr/ first
2021-04-20 18:26:17 +02:00
integritysetup-pre.target
…
integritysetup.target
…
kexec.target
units: add JobTimeoutAction= to exit.target and friends
2024-05-18 01:28:14 +09:00
kmod-static-nodes.service.in
units: add missing Documentation=
2025-09-18 21:54:36 +01:00
ldconfig.service
meson: read more progs from PATH
2026-02-16 14:32:38 +01:00
local-fs-pre.target
…
local-fs.target
units: do more reordering of ordering config
2023-05-23 12:39:16 +02:00
machine.slice
…
machines.target
units/machines.target: fix typo
2025-07-11 21:38:58 +02:00
meson.build
report: Add a TPM2 signing backend
2026-08-20 15:30:20 +02:00
modprobe@.service
meson: read more progs from PATH
2026-02-16 14:32:38 +01:00
multi-user.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
network-online.target
…
network-pre.target
…
network.target
…
nss-lookup.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
nss-user-lookup.target
…
paths.target
…
poweroff.target
…
printer.target
…
proc-sys-fs-binfmt_misc.automount
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
proc-sys-fs-binfmt_misc.mount
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
quotaon-root.service.in
units: make templates for quotaon and systemd-quotacheck service
2024-03-09 19:32:09 +00:00
quotaon@.service.in
units: make quota services bind to corresponding mount units
2024-03-10 22:57:22 +08:00
reboot.target
…
remote-cryptsetup.target
…
remote-fs-pre.target
units: adjust Descriptions of various units
2021-06-30 13:25:16 +02:00
remote-fs.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
remote-integritysetup.target
integritysetup: add remote-integritysetup.target to match remote-{crypt|verity}setup.target
2025-02-25 21:40:05 +01:00
remote-veritysetup.target
…
rescue.service.in
units: use relative path
2024-03-16 05:31:44 +09:00
rescue.target
…
rpcbind.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
serial-getty@.service.in
getty: remove --issue-file parameter
2026-02-03 21:00:19 +09:00
shutdown.target
…
sigpwr.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
sleep.target
…
slices.target
…
smartcard.target
…
sockets.target
units: adjust Descriptions of various units
2021-06-30 13:25:16 +02:00
soft-reboot.target
Revert "units: do not soft-reboot before soft-reboot.target reached"
2024-05-23 00:06:30 +09:00
sound.target
…
ssh-access.target
units/ssh-access.target: enable StopWhenUnneeded=
2025-07-22 15:01:26 +01:00
storage-target-mode.target
units: pull in plymouth when booting into storagetm mode
2023-11-13 15:45:16 +01:00
suspend-then-hibernate.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
suspend.target
…
swap.target
…
sys-fs-fuse-connections.mount
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
sys-kernel-config.mount
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
sys-kernel-debug.mount
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
sys-kernel-tracing.mount
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
sysinit.target
units: reorder/split unit dependency blocks
2022-09-15 14:59:11 +02:00
syslog.socket
various: turn off SO_PASSRIGHTS where fds are not expected
2025-06-17 13:16:44 +02:00
system-install.target
units: pull in basic.target rather than sysinit.target from system-install.target
2026-05-11 22:34:28 +01:00
system-systemd-cryptsetup.slice
tree-wide: get rid of backslashes in file names
2026-07-03 10:10:09 +02:00
system-systemd-mute-console.slice
tree-wide: get rid of backslashes in file names
2026-07-03 10:10:09 +02:00
system-systemd-veritysetup.slice
tree-wide: get rid of backslashes in file names
2026-07-03 10:10:09 +02:00
system-update-cleanup.service
units: stop using rm in system-update-cleanup.service
2026-03-18 14:58:43 +01:00
system-update-pre.target
…
system-update.target
…
systemd-ask-password-console.path
units: add dependency ordering for emergency.service conflicts
2022-09-15 14:59:11 +02:00
systemd-ask-password-console.service
ask-password-agent: send READY=1 when we established inotify watch
2025-01-02 16:37:57 +01:00
systemd-ask-password-wall.path
units: add dependency ordering for emergency.service conflicts
2022-09-15 14:59:11 +02:00
systemd-ask-password-wall.service
units: don't block on terminating agents
2025-03-03 10:47:09 +01:00
systemd-ask-password.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-ask-password@.service
ask-password: add Varlink API for querying passwords from the user
2025-01-02 16:39:05 +01:00
systemd-backlight@.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-battery-check.service.in
units/systemd-battery-check.service: split [Unit] options into groups
2025-09-30 16:34:54 +02:00
systemd-binfmt.service.in
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
systemd-bless-boot.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-boot-check-no-failures.service.in
units/systemd-boot-check-no-failures.service: drop unneeded dep on shutdown.target
2024-04-10 23:40:53 +08:00
systemd-boot-clear-sysfail.service
units: fix systemd-boot-clear-sysfail description
2025-05-14 09:34:07 +02:00
systemd-boot-random-seed.service
units: rename/rework systemd-boot-system-token.service → systemd-boot-random-seed.service
2023-01-04 15:18:10 +01:00
systemd-boot-update.service
systemd-boot-update: condition on UEFI
2026-06-24 13:05:34 +02:00
systemd-bootctl.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-bootctl@.service
bootctl: add Install() varlink API
2026-02-06 23:15:49 +01:00
systemd-bsod.service.in
Remove extra period at the end of systemd-bsod's unit description. (#33632)
2024-07-06 10:17:20 +01:00
systemd-confext-initrd.service
sysext: provide a cmdline kill switch for the sysext/confext merging logic
2026-04-07 09:51:03 +02:00
systemd-confext-sysroot.service
sysext: provide a cmdline kill switch for the sysext/confext merging logic
2026-04-07 09:51:03 +02:00
systemd-confext.service
sysext: provide a cmdline kill switch for the sysext/confext merging logic
2026-04-07 09:51:03 +02:00
systemd-coredump.socket
units: enable MaxConnectionsPerSocket= for all our Accept=yes units
2024-02-12 11:57:24 +01:00
systemd-coredump@.service.in
coredump: drop RestrictSUIDSGID= option (#38640)
2025-08-20 11:42:30 +01:00
systemd-creds.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-creds@.service
units: don't set LISTEN_FDNAMES for varlink services explicitly
2024-08-26 15:40:15 +02:00
systemd-cryptenroll-firstboot.service
cryptenroll: add interactive --firstboot enrollment wizard
2026-06-27 17:28:39 +02:00
systemd-cryptenroll.socket
cryptenroll: expose enrollment as an io.systemd.CryptEnroll Varlink service
2026-06-27 17:28:39 +02:00
systemd-cryptenroll@.service
cryptenroll: expose enrollment as an io.systemd.CryptEnroll Varlink service
2026-06-27 17:28:39 +02:00
systemd-exit.service
…
systemd-factory-reset-complete.service.in
units: refuse manual operations on factory-reset-now.target and friends
2025-03-05 17:03:59 +01:00
systemd-factory-reset-reboot.service
factory-reset: revamp infrastructure
2025-03-05 12:37:26 +01:00
systemd-factory-reset-request.service.in
factory-reset: revamp infrastructure
2025-03-05 12:37:26 +01:00
systemd-factory-reset.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-factory-reset@.service.in
factory-reset: revamp infrastructure
2025-03-05 12:37:26 +01:00
systemd-firstboot.service
firstboot: optionally, don't query for keymap unless connected to a real VT
2025-09-26 16:40:14 +02:00
systemd-fsck-root.service.in
fsck: add fsck.mode and fsck.repair credentials support
2025-07-16 05:47:38 +09:00
systemd-fsck@.service.in
fsck: add fsck.mode and fsck.repair credentials support
2025-07-16 05:47:38 +09:00
systemd-growfs-root.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-growfs@.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-halt.service
units: Use built-in halt and kexec features instead of systemctl
2023-06-22 10:33:18 +01:00
systemd-hibernate-clear.service.in
units: introduce systemd-hibernate-clear.service that clears
2024-04-03 22:07:43 +08:00
systemd-hibernate-resume.service.in
hibernate-resume: split out the logic of finding hibernate location
2023-09-07 20:21:16 +08:00
systemd-hibernate.service.in
units: update Description= for systemd-sleep units
2024-01-15 02:59:25 +08:00
systemd-homed-activate.service
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
systemd-homed-firstboot.service
homectl: mute console while running firstboot prompts
2025-09-26 16:19:43 +02:00
systemd-homed.service.in
homed: always use quotactl_fd() if its available
2025-03-31 11:51:15 +02:00
systemd-hostnamed.service.in
units: allow io.systemd.Hostname to be available earlier
2026-03-20 10:04:26 +01:00
systemd-hostnamed.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-hwdb-update.service.in
units: do more reordering of ordering config
2023-05-23 12:39:16 +02:00
systemd-hybrid-sleep.service.in
units: update Description= for systemd-sleep units
2024-01-15 02:59:25 +08:00
systemd-imds-early-network.service.in
units: do not fail if imds is not configured
2026-05-27 04:36:05 +09:00
systemd-imds-import.service.in
Revert "units: drop After=network-online.target from imds services"
2026-06-19 20:05:14 +02:00
systemd-imds-metrics.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-imds-metrics@.service.in
imds: expose instance metadata as an io.systemd.Metrics provider
2026-06-22 22:03:12 +02:00
systemd-imdsd.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-imdsd@.service.in
imds: add new systemd-imdsd.service that makes IMDS data accessible locally
2026-03-26 10:54:15 +01:00
systemd-importd.service.in
units: unify deps between service and socket units
2025-04-30 21:27:37 +02:00
systemd-importd.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-journal-catalog-update.service
units: do more reordering of ordering config
2023-05-23 12:39:16 +02:00
systemd-journal-flush.service
unit: also stop systemd-journal-flush.service on soft-reboot
2024-05-26 03:11:24 +09:00
systemd-journal-gatewayd.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-journal-gatewayd.socket
…
systemd-journal-remote.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-journal-remote.socket
…
systemd-journal-upload.service.in
systemd-journal-upload: Increase failure tolerance (#19426, #2877)
2023-10-12 23:10:59 +01:00
systemd-journalctl-metrics.socket
units: tag more units correctly with varlink xattrs
2026-06-24 11:47:28 +01:00
systemd-journalctl-metrics@.service
journal: expose last 10 high priority logs as metrics
2026-06-23 12:41:38 +02:00
systemd-journalctl.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-journalctl@.service
journalctl-vl-server: allow querying units for specific uid in system scope
2026-02-23 10:43:00 +01:00
systemd-journald-audit.socket
units/systemd-{udevd,journald}*.socket: enable DeferTrigger=
2025-06-30 13:10:43 +02:00
systemd-journald-dev-log.socket
units/systemd-{udevd,journald}*.socket: enable DeferTrigger=
2025-06-30 13:10:43 +02:00
systemd-journald-sync@.service
journal: explicitly sync namespaced journals before stopping socket units
2024-05-02 19:41:01 +02:00
systemd-journald-varlink@.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-journald.service.in
journald: support reloading configuration at runtime
2025-07-10 21:38:36 +02:00
systemd-journald.socket
units/systemd-{udevd,journald}*.socket: enable DeferTrigger=
2025-06-30 13:10:43 +02:00
systemd-journald@.service.in
units: drop dependencies of soft-reboot.target from systemd-journald@.service
2024-05-17 11:57:53 +09:00
systemd-journald@.socket
units/systemd-journald@.socket: enable SO_TIMESTAMP
2025-06-17 13:16:07 +02:00
systemd-kexec.service
units: Use built-in halt and kexec features instead of systemctl
2023-06-22 10:33:18 +01:00
systemd-localed.service.in
localed: modernization
2024-01-09 21:57:46 +08:00
systemd-logind-varlink.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-logind.service.in
logind: allow read/write to char-hvc devices
2024-10-22 23:44:47 +02:00
systemd-loop@.service
units: add generic service for attaching a file to a loopback device
2025-02-21 09:57:02 +01:00
systemd-machine-id-commit.service
units/systemd-machine-id-commit: retitle
2024-03-14 10:26:45 +01:00
systemd-machine-tag@.service
units: add systemd-machine-tag@.service template
2026-06-01 10:56:16 +02:00
systemd-machined.service.in
machined: allow running in --user mode
2025-09-25 22:43:59 +02:00
systemd-machined.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-modules-load.service.in
units: Accept modules_load and rd.modules_load in systemd-modules-load.service
2024-03-17 13:33:45 +01:00
systemd-mountfsd.service.in
mountfsd: Add CAP_SYS_PTRACE and CAP_SYS_CHROOT
2026-03-20 19:19:10 +01:00
systemd-mountfsd.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-mute-console.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-mute-console@.service
man: correct a few manpage references
2026-06-06 10:47:10 +01:00
systemd-network-generator.service.in
units: use Title Case for network generator description string
2025-10-20 18:17:47 +02:00
systemd-networkd-persistent-storage.service
units: add Before=shutdown.target to systemd-networkd-persistent-storage.service
2024-04-26 22:16:33 +02:00
systemd-networkd-resolve-hook.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-networkd-varlink-metrics.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-networkd-varlink.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-networkd-wait-online.service.in
networkd: call networkd a "network management" rather "network configuration" tool
2025-10-20 18:17:29 +02:00
systemd-networkd-wait-online@.service.in
networkd: call networkd a "network management" rather "network configuration" tool
2025-10-20 18:17:29 +02:00
systemd-networkd.service.in
metrics: add networkd related metrics
2026-02-18 17:58:33 +09:00
systemd-networkd.socket
units: let's set a socket name for networkd rtnl socket
2025-11-15 07:52:42 +01:00
systemd-nspawn@.service.in
units: systems might take a while to boot
2025-07-11 18:17:04 +02:00
systemd-nsresourced.service.in
nsresourced: refuse writable overlayfs whose upper outlives the namespace
2026-08-12 10:49:34 +02:00
systemd-nsresourced.socket.in
nresourced: add user.userbd.* xattrs to nsresourced userdb socket
2026-07-13 09:53:15 +02:00
systemd-oomd.service.in
units: unify deps between service and socket units
2025-04-30 21:27:37 +02:00
systemd-oomd.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-pcrextend.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-pcrextend@.service.in
units: don't set LISTEN_FDNAMES for varlink services explicitly
2024-08-26 15:40:15 +02:00
systemd-pcrfs-root.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-pcrfs@.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-pcrlock-file-system.service.in
units: retitle systemd-pcrextend.{service,socket}, change TPM2→TPM
2024-03-14 10:26:45 +01:00
systemd-pcrlock-firmware-code.service.in
units: retitle systemd-pcrextend.{service,socket}, change TPM2→TPM
2024-03-14 10:26:45 +01:00
systemd-pcrlock-firmware-config.service.in
units: retitle systemd-pcrextend.{service,socket}, change TPM2→TPM
2024-03-14 10:26:45 +01:00
systemd-pcrlock-machine-id.service.in
units: retitle systemd-pcrextend.{service,socket}, change TPM2→TPM
2024-03-14 10:26:45 +01:00
systemd-pcrlock-make-policy.service.in
units: retitle systemd-pcrextend.{service,socket}, change TPM2→TPM
2024-03-14 10:26:45 +01:00
systemd-pcrlock-secureboot-authority.service.in
units: retitle systemd-pcrextend.{service,socket}, change TPM2→TPM
2024-03-14 10:26:45 +01:00
systemd-pcrlock-secureboot-policy.service.in
units: retitle systemd-pcrextend.{service,socket}, change TPM2→TPM
2024-03-14 10:26:45 +01:00
systemd-pcrlock.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-pcrlock@.service.in
units: don't set LISTEN_FDNAMES for varlink services explicitly
2024-08-26 15:40:15 +02:00
systemd-pcrlogin@.service.in
pcrextend: add support for measuring a user record, to be executed on first login of the user
2026-05-22 12:15:12 +02:00
systemd-pcrmachine.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-pcrnvdone.service.in
units: Run systemd-pcrnvdone in initrd
2026-06-04 11:23:59 +01:00
systemd-pcrosseparator.service.in
pcrextend: measure another separator at boot
2026-03-26 16:11:34 +01:00
systemd-pcrphase-factory-reset.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-pcrphase-initrd.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-pcrphase-storage-target-mode.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-pcrphase-sysinit.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-pcrphase.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-pcrproduct.service.in
units: make use of nvpcrs only after the NV anchor completion measurement is done
2026-03-26 16:11:34 +01:00
systemd-portabled.service.in
units/systemd-portabled: enable NoNewPrivileges=
2026-01-21 23:13:09 +01:00
systemd-poweroff.service
…
systemd-pstore.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-quotacheck-root.service.in
quotacheck: add quotacheck.mode credential support
2025-07-16 05:47:38 +09:00
systemd-quotacheck@.service.in
quotacheck: add quotacheck.mode credential support
2025-07-16 05:47:38 +09:00
systemd-random-seed.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-reboot.service
…
systemd-remount-fs.service.in
man: update links to "API File Systems"
2024-05-28 14:48:56 +02:00
systemd-repart.service
units: don't force the loading of the loop and dm_mod modules in systemd-repart.service
2025-09-18 08:46:34 +09:00
systemd-repart.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-repart@.service
repart: add basic Varlink support, for now only with a ListCandidateDevices() call
2025-09-23 09:22:04 +02:00
systemd-report-basic.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-report-basic@.service.in
units: add missing Documentation= key to systemd-report units
2026-05-23 12:58:23 +02:00
systemd-report-cgroup.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-report-cgroup@.service.in
units: add missing Documentation= key to systemd-report units
2026-05-23 12:58:23 +02:00
systemd-report-files.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-report-files@.service.in
report: add simple metrics provider that just reads files
2026-06-19 05:23:18 +02:00
systemd-report-sign-plain.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-report-sign-plain@.service.in
units: harden systemd-report-sign-plain@.service
2026-06-25 10:33:01 +01:00
systemd-report-sign-tpm2.socket
report: Add a TPM2 signing backend
2026-08-20 15:30:20 +02:00
systemd-report-sign-tpm2@.service.in
report: Add a TPM2 signing backend
2026-08-20 15:30:20 +02:00
systemd-report-sign-tsm.socket
units: tag more units correctly with varlink xattrs
2026-06-24 11:47:28 +01:00
systemd-report-sign-tsm@.service.in
report: add systemd-report-sign-tsm backend
2026-06-22 20:42:35 +02:00
systemd-report.socket
units: tag more units correctly with varlink xattrs
2026-06-24 11:47:28 +01:00
systemd-report@.service.in
report: turn systemd-report itself into a varlink service
2026-06-19 05:23:18 +02:00
systemd-resolved-monitor.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-resolved-varlink.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-resolved.service.in
units: unify deps between service and socket units
2025-04-30 21:27:37 +02:00
systemd-rfkill.service.in
units: Bump various oneshot unit timeouts to 90s
2024-03-14 00:10:48 +09:00
systemd-rfkill.socket
units: condition out a few services in the initrd
2023-07-05 10:58:47 +09:00
systemd-soft-reboot.service
Revert "units: do not soft-reboot before soft-reboot.target reached"
2024-05-23 00:06:30 +09:00
systemd-storage-block.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-storage-block@.service.in
storage: add systemd-storage-block@.service provider
2026-04-29 12:25:47 +02:00
systemd-storage-fs.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-storage-fs@.service.in
storage: add systemd-storage-fs@.service provider
2026-04-29 12:25:47 +02:00
systemd-storagetm.service.in
units: explicitly reset TTY before running stuff on console
2025-09-18 21:30:31 +02:00
systemd-suspend-then-hibernate.service.in
units: update Description= for systemd-sleep units
2024-01-15 02:59:25 +08:00
systemd-suspend.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-sysctl.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-sysext-initrd.service
sysext: provide a cmdline kill switch for the sysext/confext merging logic
2026-04-07 09:51:03 +02:00
systemd-sysext-sysroot.service
sysext: provide a cmdline kill switch for the sysext/confext merging logic
2026-04-07 09:51:03 +02:00
systemd-sysext.service
sysext: provide a cmdline kill switch for the sysext/confext merging logic
2026-04-07 09:51:03 +02:00
systemd-sysext.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-sysext@.service
units: don't set LISTEN_FDNAMES for varlink services explicitly
2024-08-26 15:40:15 +02:00
systemd-sysinstall.service
sysinstall: Add varlink interface
2026-07-03 11:16:46 +02:00
systemd-sysinstall.socket
sysinstall: Add varlink interface
2026-07-03 11:16:46 +02:00
systemd-sysinstall@.service
sysinstall: Add varlink interface
2026-07-03 11:16:46 +02:00
systemd-sysupdate-auto-enable.service
sysupdate: In the auto-enable service, don't enable all features
2026-07-28 15:20:09 +09:00
systemd-sysupdate-notify-bootctl.socket
bootctl: add link-auto/LinkAuto and auto-link on completed system update
2026-06-24 13:05:34 +02:00
systemd-sysupdate-notify-bootctl@.service
bootctl: add link-auto/LinkAuto and auto-link on completed system update
2026-06-24 13:05:34 +02:00
systemd-sysupdate-notify-pcrlock.socket
pcrlock: recompute PCR policy on completed system update
2026-06-24 13:05:34 +02:00
systemd-sysupdate-notify-pcrlock@.service.in
pcrlock: recompute PCR policy on completed system update
2026-06-24 13:05:34 +02:00
systemd-sysupdate-notify-sysext.socket
sysext: refresh sysexts and confexts on completed system update
2026-06-24 13:05:34 +02:00
systemd-sysupdate-notify-sysext@.service
sysext: refresh sysexts and confexts on completed system update
2026-06-24 13:05:34 +02:00
systemd-sysupdate-reboot.service
meson: move systemd-sysupdate to /usr/bin/
2026-05-13 15:09:27 +01:00
systemd-sysupdate-reboot.timer
…
systemd-sysupdate-update.service
units: update all components in systemd-sysupdate-update.service
2026-07-15 13:27:48 +02:00
systemd-sysupdate-update.timer
sysupdate: Add basic varlink interface scaffolding
2026-06-26 13:01:31 +01:00
systemd-sysupdate.socket
sysupdate: Add basic varlink interface scaffolding
2026-06-26 13:01:31 +01:00
systemd-sysupdate@.service
sysupdate: Add basic varlink interface scaffolding
2026-06-26 13:01:31 +01:00
systemd-sysupdated.service.in
sysupdated: Permit mount namespaces
2024-11-06 15:44:11 -05:00
systemd-sysusers.service
units: introduce systemd-tmpfiles-setup-dev-early.service
2023-08-12 07:55:20 +09:00
systemd-time-wait-sync.service.in
treewide: fix typos
2023-09-19 10:05:38 +02:00
systemd-timedated.service.in
timedated: modernization
2024-01-09 21:57:45 +08:00
systemd-timesyncd.service.in
timesyncd: order after systemd-resolved
2026-08-15 13:12:50 -07:00
systemd-tmpfiles-clean.service
units: Use ImportCredential= where applicable
2023-06-08 14:09:36 +02:00
systemd-tmpfiles-clean.timer
…
systemd-tmpfiles-setup-dev-early.service
units: introduce systemd-tmpfiles-setup-dev-early.service
2023-08-12 07:55:20 +09:00
systemd-tmpfiles-setup-dev.service
units: introduce systemd-tmpfiles-setup-dev-early.service
2023-08-12 07:55:20 +09:00
systemd-tmpfiles-setup.service
units/systemd-tmpfiles-setup.service: explicitly set RestrictSUIDSGID=no
2025-07-09 11:08:31 +02:00
systemd-tpm2-clear.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-tpm2-setup-early.service.in
pcrextend: measure another separator at boot
2026-03-26 16:11:34 +01:00
systemd-tpm2-setup.service.in
core: introduce ConditionSecurity=measured-os
2026-03-26 16:11:34 +01:00
systemd-tpm2-swtpm.service.in
units: properly wait for swtpm to finish before the initrd transition
2026-07-09 13:33:06 +02:00
systemd-udev-load-credentials.service
units: introduce systemd-udev-load-credentials.service
2024-04-16 09:45:43 +09:00
systemd-udev-settle.service
…
systemd-udev-trigger.service
udev: drop home-grown udev-ctrl socket
2026-07-18 05:29:59 +09:00
systemd-udevd-kernel.socket
units/systemd-{udevd,journald}*.socket: enable DeferTrigger=
2025-06-30 13:10:43 +02:00
systemd-udevd-varlink.socket
udev: drop home-grown udev-ctrl socket
2026-07-18 05:29:59 +09:00
systemd-udevd.service.in
udev: drop home-grown udev-ctrl socket
2026-07-18 05:29:59 +09:00
systemd-update-done.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-update-utmp.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-user-sessions.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
systemd-userdb-load-credentials.service
man: correct a few manpage references
2026-06-06 10:47:10 +01:00
systemd-userdbd.service.in
units: unify deps between service and socket units
2025-04-30 21:27:37 +02:00
systemd-userdbd.socket
units: tag all .varlink sockets with the right xattrs
2026-06-23 23:10:01 +02:00
systemd-validatefs@.service.in
units/systemd-validatefs@.service: FailureAction= is a [Unit] knob
2025-03-31 19:23:51 +02:00
systemd-vconsole-setup.service.in
units: disable start rate limit for systemd-vconsole-setup.service
2023-11-25 13:27:17 +01:00
systemd-vmspawn@.service.in
units: systems might take a while to boot
2025-07-11 18:17:04 +02:00
systemd-volatile-root.service.in
Drop split-usr and unmerged-usr support
2023-07-28 19:34:03 +01:00
time-set.target
…
time-sync.target
…
timers.target
…
tmp.mount
core/mount: rework GracefulOptions= to be just x-systemd.graceful-option=
2025-02-12 18:16:44 +01:00
tpm2.target
units: also require /dev/tpm0 to be around before tpm2.target can be reached
2025-03-05 12:37:48 +01:00
umount.target
…
usb-gadget.target
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
user-runtime-dir@.service.in
logind: automatically pull in systemd-pcrlogin@.service on first login
2026-05-22 12:15:14 +02:00
user.slice
…
user@.service.in
logind: automatically pull in systemd-pcrlogin@.service on first login
2026-05-22 12:15:14 +02:00
var-lib-machines.mount
license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
veritysetup-pre.target
…
veritysetup.target
…