FOSSWire
Search/
Linux Kernel & OS

systemd v262 released with TPM security and DNS-SD changes

Brief written by the FOSSWire AI editor from systemd How we write

1 min read 45 reads

Key Takeaway

systemd v262 introduces TPM-sealed credential pinning to prevent MITM attacks and fixes DNS-SD service registration behavior.

Summary

The systemd project has released version 262, which includes significant security enhancements and several breaking changes. Key updates include pinning TPM-sealed credentials to the TPM's SRK to prevent interposer attacks and correcting DNS-SD service unregistration behavior in systemd-resolved. Additionally, several experimental APIs and legacy options are being phased out in preparation for version 263.

Technical changes in systemd v262

  • TPM Security: TPM-sealed credentials are now pinned to the TPM's SRK, protecting communication via a private key known only to that specific TPM.
  • DNS-SD: Services registered via systemd-resolved's D-Bus method are now automatically unregistered when the client disconnects.
  • Environment Handling: UnsetEnvironment= is now applied after ExecStart= environment variable expansion.
  • Service Management: Services of Type=notify-reload must now catch or block ReloadSignal= upon sending READY=1 to avoid protocol errors.
  • Clock Changes: Rate-limit timers (e.g., StartLimitIntervalSec=) now use CLOCK_BOOTTIME instead of CLOCK_MONOTONIC, meaning suspended time counts toward limits.
  • udevd: The legacy UNIX socket /run/udev/control has been replaced by a symlink to the Varlink socket.

Why it matters

Users and developers should review service definitions and scripts, particularly those relying on specific DNS-SD behaviors, environment variable ordering, or journalctl field filtering.

Original reference: github.com →