diff options
author | 2018-12-18 20:50:16 +0100 | |
---|---|---|
committer | 2018-12-18 20:50:16 +0100 | |
commit | ff03aee4b7802190774fe7a42a239782f6a9beff (patch) | |
tree | a2dd8d77b55ed2d5482f1484ac5f4dca99cb63a3 | |
parent | Merge pull request #11182 from poettering/fileio-more-paranoia (diff) | |
parent | NEWS: add a note about symlink following in .wants and .requires (diff) | |
download | systemd-ff03aee4b7802190774fe7a42a239782f6a9beff.tar.gz systemd-ff03aee4b7802190774fe7a42a239782f6a9beff.tar.bz2 systemd-ff03aee4b7802190774fe7a42a239782f6a9beff.zip |
Merge pull request #11201 from keszybz/more-news
Some git history rewriting and more news
-rw-r--r-- | NEWS | 20 |
1 files changed, 20 insertions, 0 deletions
@@ -2,6 +2,26 @@ systemd System and Service Manager CHANGES WITH 240 in spe: + * NoNewPrivileges=yes has been set for all long-running services + implemented by systemd. Previously, this was problematic due to + SELinux (as this would also prohibit the transition from PID1's label + to the service's label). This restriction has since been lifted, but + an SELinux policy update is required. + (See e.g. https://github.com/fedora-selinux/selinux-policy/pull/234.) + + * When unit files are loaded from disk, previously systemd would + sometimes (depending on the unit loading order) load units from the + target path of symlinks in .wants/ or .requires/ directories of other + units. This meant that unit could be loaded from different paths + depending on whether the unit was requested explicitly or as a + dependency of another unit, not honouring the priority of directories + in search path. It also meant that it was possible to successfully + load and start units which are not found in the unit search path, as + long as they were requested as a dependency and linked to from + .wants/ or .requires/. The target paths of those symlinks are not + used for loading units anymore and the unit file must be found in + the search path. + * A new service type has been added: Type=exec. It's very similar to Type=simple but ensures the service manager will wait for both fork() and execve() of the main service binary to complete before proceeding |