Kuenderera mberi nekufungidzira kwekuvandudza kutenderera, mushure memwedzi mina yekusimudzira yakavhurwa kuvhurwa kweshanduro nyowani ye systemd 248.
Mune iyi vhezheni itsva se inopa rutsigiro rwemifananidzo yekuwedzera madhairekitori system, zvinoshandiswa systemd-cryptenroll, pamwe neiyo kugona kuvhura LUKS2 uchishandisa TPM2 machipisi uye FIDO2 tokeni, kuvhura madhiraivha mune yakasarudzika IPC chinongedzo nzvimbo, uye zvimwe zvakawanda.
Main nyowani maficha e systemd 248
Mune iyi vhezheni itsva pfungwa yemifananidzo yekuwedzera mifananidzo yakaitwa, iyo inogona kushandiswa kuwedzera dhairekitori renzvimbo uye nekuwedzera mamwe mafaera panguva dzekumhanya, kunyangwe kana madhairekitori akataurwa akaiswa kuverenga-chete. Kana mufananidzo wekuwedzera system wakakwidzwa, zvirimo zvakafukidzwa munzvimbo yepamusoro uchishandisa OverlayFS.
Imwe shanduko inomira pachena ndeyekuti se yakurudzira itsva yekushandisa systemd-sysext yekubatanidza, kusunungura, kuona uye kugadzirisa mifananidzo system yekuwedzera, pamwe neiyo systemd-sysext.service sevhisi yakawedzerwa kuti igoisa otomatiki mifananidzo yakaiswa kare panguva yebhoti. Kune zvikamu, iyo YekuwedzeraImages inogadziriswa inoitwa, iyo inogona kushandiswa kubatanidza system yekuwedzera mifananidzo kune iyo FS namespace hutongi hwehumwe hwakazvimiririra masevhisi.
Systemd-cryptsetup inowedzera kugona kuburitsa URI kubva kuchiratidzo chePKCS # 11 uye kiyi yakavharidzirwa kubva kuLUKS2 metadata musoro muJSON fomati, iyo inobvumira iyo yakavhurika ruzivo rweyakavharirwa chishandiso kuti ibatanidzwe mumudziyo pachawo pasina kubatanidza mafaira ekunze, nekuwedzera inopa rutsigiro rwekuvhura LUKS2 yakavharidzirwa zvikamu uchishandisa TPM2 machipisi uye FIDO2 tokeni, kuwedzera kune akambotsigirwa PKCS # 11 tokeni. Kurodha libfido2 kunoitwa kuburikidza dlopen (), i.e. kuwanikwa kunotariswa pane kubhururuka, kwete sekuomarara kwakaomarara.
Zvakare, mune systemd 248 systemd-networkd yakawedzera rutsigiro rweBATMAN mesh protocol («Zviri nani Nzira Kune Nhare Adhoc Networking), iyo inokutendera kuti ugadzire zvakatemerwa maratidziro, yega yega node painobatana kuburikidza neyakavakidzana node.
Izvo zvakare zvakasimbiswa izvo kuiswa kweyekutanga mhinduro maitiro ekukanganwa kwakadzikama pane systemd-oomd system, pamwe neiyo DefaultMemoryPressureDurationSec sarudzo yekumisikidza nguva yekumirira kuburitswa kwezviwanikwa usati wakanganisa dhiraivha. Systemd-oomd inoshandisa iyo PSI (Pressure Stall Ruzivo) kernel subsystem uye inobvumidza kuona kuoneka kwekunonoka nekuda kwekushaikwa kwezviwanikwa uye nekusarudzika kuvhara zviwanikwa-zvakanyanya maitiro padanho uko iyo system isati yave mune yakaoma mamiriro uye isingatange kudzora zvakanyanya cache uye kufambisa dhata kuchinjanisa chikamu.
Wakawedzera YakavanzikaIPC paramendeque inobvumidza iwe kumisikidza kuvhurwa kwemaitiro mune yakasarudzika IPC nzvimbo mune yeyuniti faira iine zvitupa zvadzo uye mutsara wemeseji. Kubatanidza dhiraivha kune yakatogadzirwa IPC chitupa nzvimbo, iyo IPCNamespacePath sarudzo inopihwa.
Nguva yemakanda anowanikwa, otomatiki chizvarwa chehurongwa hwekufona matafura akaitwa ye seccomp mafirita.
Of the dzimwe shanduko dzinomira pachena:
- Iyo systemd-distribu yekushandisa yawedzera kugona kumisikidza yakavharidzirwa migove uchishandisa TPM2 machipisi, semuenzaniso kugadzira yakavharidzirwa / var kupatsanura pane yekutanga bhuti.
- Wakawedzera iyo systemd-cryptenroll yekushandisa kusunga TPM2, FIDO2, uye PKCS # 11 tokeni kuLUKS zvikamu, pamwe nekusunungura uye kuona tokeni, kusunga makiyi ekudzivirira, uye kumisikidza password yekuwana.
- ExecPaths uye NoExecPaths marongero akawedzerwa kuti ashandise mureza weexexec kune zvimwe zvikamu zvefaira system.
- Wakawedzera kernel yekuraira mutsara paramende - "midzi = tmpfs", iyo inobvumira iyo midziyo yekumisikidza kuti iiswe kune yenguva pfupi kuchengetwa iri mu RAM uchishandisa Tmpfs.
- Bhokisi rine mamiriro ekunze akasvinuka anogona kugadziriswa kuburikidza neManejaEnvironment sarudzo mune system.conf kana mushandisi.conf, kwete chete kuburikidza nekernel yekuraira tambo uye yuniti faira marongero.
- Panguva yekubatanidza, unogona kushandisa iyo fexecve () system yekufona panzvimbo pe execve () kutanga matanho ekuderedza kunonoka pakati pekuongorora mamiriro ekuchengetedza nekuishandisa.