systemd v262-rc3 introduces TPM security improvements and breaking changes

Brief written by the FOSSWire AI editor from systemd How we write

September 21, 2026 1 min read 58 reads

Key Takeaway

The v262-rc3 release introduces TPM-sealed credential pinning to prevent MITM attacks and implements several breaking changes to service behavior and API usage.

Summary

The systemd v262-rc3 release candidate includes significant security hardening for TPM-sealed credentials by pinning them to the TPM's SRK. It also introduces several breaking changes, such as automatic unregistration of DNS-SD services in systemd-resolved when clients disconnect and stricter requirements for Type=notify-reload services. Additionally, several deprecated Meson options and legacy EFI variables have been removed.

Technical changes in systemd v262-rc3

TPM Security: TPM-sealed credentials are now pinned to the TPM's SRK to prevent MITM interposer attacks.
systemd-resolved: DNS-SD services registered via D-Bus are now automatically unregistered upon client disconnection, matching Avahi behavior.
Service Management: Services using Type=notify-reload must now catch or block ReloadSignal= after sending READY=1 to avoid protocol errors.
Environment Handling: UnsetEnvironment= is now applied after ExecStart= environment expansion.
Clock Changes: Rate-limit timers (e.g., StartLimitIntervalSec=) now use CLOCK_BOOTTIME instead of CLOCK_MONOTONIC, meaning suspended time counts toward limits.
udev: The legacy UNIX socket for systemd-udevd control has been replaced by a symlink to the Varlink socket.

Why it matters

Developers using systemd-resolved for DNS-SD or writing custom services with specific reload signals must update their implementations to avoid service failures or unexpected unregistrations.

Original reference: github.com →