What's new in systemd

on YouTube ↗32m

" summary

Systemd adds concrete primitives for authenticated and measured boot: sd-boot plus PID1 services calculate PCRs, write boot-phase values, and bind disk decryption keys and service secrets to the local machine and OS so secrets only unlock under specific measured states. systemd-measure precomputes PCR values and ukify embeds signed PCR policies into Unified Kernel Images. Credentials can be hierarchical and delivered from disk, TPM, or the bootloader; vmm_notify_socket passes readiness and exit status into guests; soft-reboot and fd-based APIs reduce race conditions.

AI-written summary · about

" chapters (6)

1. 0:00Start
2. 0:31Release, release, release.
3. 14:02(Sub)Features
4. 16:54Discoverable Disk Images
5. 20:25Credentials
6. 24:36Boot phase paths

" related talks

• 01h 18mSystemd & TPMsLennart Poettering · Linux Security Summit Europe 2024
• 47msystemd and TPM2Lennart Poettering · Linux Security Summit North America 2023
• 01h 05mImmutable and Stateless Systems with systemdLennart Poettering · foss-north 2017
• 35mNew security features in systemdZbigniew Jędrzejewski-Szmek · DevConf.CZ 2026
• 39mTowards Measured Boot Out of the BoxMatthew Garrett · Linux Security Summit 2016
• 27mSecure Boot auto enrollmentvincent dagonneau · Linux Plumbers Conference 2022
• 34mUsing systemd features to secure servicesZbigniew Jędrzejewski-Szmek · DevConf.CZ 2020
• 41mBeing Systematic with systemdChris Simmonds · Embedded Linux Conference Europe 2022