I-Systemd 260: I-TPM2, i-sandboxing, kanye namakhono amasha ku-Linux

Hardware Guide » Ukuthenga Imihlahlandlela » I-Systemd 260: I-TPM2, i-sandboxing, kanye namakhono amasha ku-Linux

Lapho kufika uhlelo lwe-260 Ukusatshalaliswa kwe-Linux kuthatha esinye isinyathelo esibalulekile esiya ohlelweni lwesimanje, oluphephile oluqondiswe ezindaweni zamafu, i-virtualization, kanye nokwenza izinto ngokuzenzakalela. Le nguqulo ayigcini nje ngokucwebezela imininingwane: yethula izinguquko ezibalulekile ekuqaliseni, ukuphathwa kwensizakalo, ukuxhumana, ukusetshenziswa kwe-TPM2 ukuze kube nobuqotho nokubethela, kanye namakhono e-sandboxing asezingeni lokushayela.

Ngesikhathi esifanayo, iphrojekthi iqinisa imibhalo yayo kanye nendlela yayo yokusebenza ne- ama-intelligence agentsLokhu kwenza kucace ukuthi i-systemd iyinsika ebalulekile lapho amathuluzi amaningi okuthuthukisa nokubona axhumeka khona. Uma uphatha izinhlelo ze-Linux kumaseva, efwini, kuma-desktop ezinkampani, noma kuma-lab, kufanelekile ukuthatha isikhashana ukubuyekeza zonke lezi zici ezintsha ukuze uhlele izibuyekezo nokulungiswa kokucushwa.

Ukuvalelisa kokugcina kuSistimu V kanye nokuthembela ngokuphelele kuma-drive endabuko

Enye yezinguquko eziphawuleka kakhulu ku-systemd 260 yi- ukuhoxiswa okuphelele kokusekelwa kwezikripthi zeSistimu VInqubo yokuqalisa yakudala esekelwe ku-/etc/init.d ibilokhu iqedwa iminyaka eminingi, kodwa manje iyanyamalala ngempumelelo kukhodi yesistimu.

Lokhu kusho ukuthi izingxenye ezibangela ukuhlangana phakathi kwezikripthi ze-SysV namayunithi endabuko zisusiwe: ijeneretha yendawo yesistimu ye-rc, i-rc-local.service, ijeneretha yesistimu ye-sysv kanye nokufakwa kwesistimu ye-sysv Azisekho. Ngenxa yalokho, noma iyiphi insizakalo esancike kulezi zindlela zakudala ngeke iqale ezinhlelweni ezisebenzisa i-systemd 260.

Ngesikhathi senqubo yokuhlanza, izinketho eziningana zokwakha zeMeson nazo zimakwe njengezingasebenzi noma ezisusiwe. -Drc-local=, -Dsysvinit-path= kanye -Dsysvrcnd-path= ezinye zigcinwa esiqwini sezinkumbulo, kanti ezinye zifana -Ukuhlolwa kokuhlukanisa= kanye no-Dcryptolib= Zisuswa ngqo. Kungumyalezo ocacile: konke kumele kudlule kumayunithi endawo kanye nengqalasizinda yesimanje yesistimu.

Kwezingqalasizinda eziningi zaseYurophu ezisathembele ezingxenyeni ezindala, lolu shintsho ludinga ukubuyekezwa kwezinsizakalo zangaphakathi, izikripthi ezenziwe ngokwezifiso, kanye nokusetshenziswa kwefa. Ukuthuthela kumafayela eyunithi achazwe kahle akusanconywa nje kuphela; kuyimpoqo uma ufuna ukuqhubeka nokusebenzisa izinsizakalo ekusabalalisweni okuhlanganisa i-systemd 260.

Izidingo eziphezulu ze-kernel kanye nokugxila ezindaweni zamanje

Inguqulo entsha iphakamisa izinga le-kernel: kusukela manje kuqhubeke, Inguqulo ye-Linux esekelwayo okungenani ingu-5.10ukushiya amagatsha amadala kakhulu njengo-5.4. Ngaphezu kwalokho, iphrojekthi ikhombisa ukuthi umgomo ukusebenza ku- i-kernel 5.14 noma ngaphezulufuthi ikakhulukazi incoma Uchungechunge 6.6 ukuze usebenzise zonke izici ezitholakalayo.

Lokhu kwanda kwezidingo ngokuvamile akuyona inkinga ekusakazweni kwesimanje, kodwa kungenza izinto zibe nzima ezindaweni ezigcina kakhulu noma ezixazululweni ezifakiwe ezigcinwe iminyaka eminingi. Ngaphambi kokuthuthukela ku-systemd 260, kuyalulekwa ukuhlola ukuthi iyiphi i-kernel esetshenziswayo, ikakhulukazi ku Izikhungo zedatha zaseYurophu ezinokuthunyelwa kwesikhathi eside noma ezithombeni ezenziwe ngokwezifiso.

Ngakolunye uhlangothi lwe-spectrum, ukusatshalaliswa kokukhishwa okugoqekayo njenge-Arch Linux noma i-openSUSE Tumbleweed, okuthandwa kakhulu kulabo abafuna izici zakamuva, kuvame ukufaka ngokushesha ama-kernel amasha namagatsha amasha e-systemd. Abanye, njenge-Fedora, balondoloza izinga lokuzinza enguqulweni enkulu ye-systemd kuyo yonke impilo yokukhishwa ngakunye, okuvumela isikhathi esengeziwe sokuhlela ukufuduka.

I-TPM2, ubuqotho be-boot, kanye nokusekelwa okuthuthukisiwe kwe-SRK

Enye yezindawo lapho i-systemd ithuthuka khona kakhulu ukuhlanganiswa kwayo ne- I-TPM2 (I-Trusted Platform Module 2.0)Le chip, evame kakhulu kuma-motherboard e-UEFI anamuhla kanye nehadiwe yebanga eliphakathi neliphezulu, ikuvumela ukuthi uqinise izimfihlo esimweni sesistimu, ulinganise izigaba zokuqalisa, kanye vula amavolumu abethelwe ngokuzenzakalelayo lapho indawo injengoba kulindelekile.

I-Systemd 260 ithuthukisa lokhu kuhlanganiswa ngokungeza amathuluzi nezinsizakalo ezimboza izigaba ezahlukene zenqubo yokuqalisa. Ingxenye ebalulekile... ukusethwa kwe-systemd-tpm2, obhekene nokulungisa ingqalasizinda ezungeze Ukhiye Womsuka Wesitoreji (SRK) ye-TPM. Lo khiye oyinhloko usebenza njengesisekelo se-cryptographic sokuvikela ukuxhumana ne-chip nokugcina ezinye izimfihlo ngokuphephile.

Ngesikhathi sokuqalisa, izigaba ezimbili zingahlukaniswa: esasekuqaleni kakhulu ku-initrd kanye nesinye ohlelweni lwezimpande. Kwesokuqala, isevisi ebizwa ngokuthi “Ukusethwa Kwe-Early TPM SRK” ihlola ukuthi i-TPM isivele inayo i-SRK egciniwe futhi, uma ingekho, iyayidala bese iyenza itholakale okwesikhashana ngaphansi /run/systemd/tpm2-srk-public-key.*Kamuva, uma uhlelo lwangempela lwefayela selufakiwe, isevisi izohlanganisa i-SRK futhi iqinisekise ukuthi ukhiye ugcinwe ku- /var/lib/systemd/tpm2-srk-public-key.pem Kuhambisana naleyo eku-TPM.

Ezimweni ezilungiselelwe kahle, okufakiwe kwejenali okufana nalokhu kuyabonwa. "I-SRK isivele igcinwe ku-TPM" kanye nemiyalezo ekhombisa ukuthi unyawo lwe-SRK luhambisana nolulindelwe. Uma, ngakolunye uhlangothi, indawo ingahambisani (isibonelo, ekusethweni nge-Yocto noma emabhodini afana ne-Raspberry Pi ene-SPI TPM kanye nezindlela zokuqalisa ngokwezifiso ezine-U-Boot kanye ne-boot elinganisiwe), kungase kuvele izimo lapho i-systemd yehluleka ukudala lawa mafayela ngaphansi kwe-/var/lib/systemd, okuphakamisa ukungabaza ngokuthi i-SRK ilungiselelwe kahle yini.

Uma isimo se-TPM sishintshile, izingxenye zishintshiwe, noma ukugeleza kokuqalisa kushintshiwe, inqubomgomo ehlobene nayo ingase ingasasebenzi. Ezimweni ezinjalo, abanye abanakekeli batusa sula isikhala se-TPM noma inqubomgomo bese ubhalisa kabusha ukhiye, kulandela izinqubo ezifana nalezo ezichazwe kumhlahlandlela wokubethela amadiski nge-TPM ezindaweni ezifana ne-openSUSE, lapho kuchazwe khona ngokuningiliziwe ukuthi ungaphinda kanjani inqubomgomo ye-PCR futhi uxhume kabusha ukuvula ivolumu.

Ngaphandle kwe-SRK, okunye ukuthuthuka okusebenzayo ukwethulwa ku-udev kwensizakalo yangaphakathi ebizwa ngokuthi i-tpm2_idLeli thuluzi elihlanganisiwe lisebenza lapho uhlelo luthola idivayisi ye-TPM2 futhi Ikhipha ngokuzenzakalelayo isihlonzi somkhiqizi kanye nemodeli.Lokhu kwenza kube lula ukuqoqwa kwehadiwe yezokuphepha, okuwusizo kakhulu ekuphathweni komphakathi, ezinkampanini ezilawulwayo, noma ezingqalasizinda ezibalulekile lapho kudingeka khona ukwazi ngokunembile ukuthi yimaphi amamojula e-TPM asetshenziswayo.

Ukuhlanganiswa nengqalasizinda yokulinganisa ukuqala kuqiniswa namayunithi athile afana nalawa i-systemd-pcrextendyiziphi izenzakalo zelogi ezifana ne-“enter-initrd”, “leave-initrd”, “sysinit”, noma “ready” kuma-PCR ahlukene (isibonelo, i-PCR 11). Lokhu kulandelana kwezandiso kuvumela i-TPM ukuthi iqoqe irekhodi eliqinisekisiwe ngokwe-cryptographic lokugeleza kokuqalisa, elingasetshenziswa ngezinqubomgomo ze-Trusted Boot noma I-UKI (Izithombe ze-Unified Kernel) eziqinisekisa isimo somshini ngaphambi kokukhulula okhiye.

Izindlela zokuphepha kanye nokufakwa kwe-sandbox kwezinsizakalo nge-systemd

I-Systemd ayiqali nje kuphela izinqubo: futhi inikeza isethi ebanzi kakhulu ye iziqondiso ze-sandboxing ukuhlukanisa izinsizakalo nokunciphisa umonakalo uma kwenzeka kube nokuyekethisa. Le ndlela "yokuzivikela ngokujulile" incike kumaqembu e-c, izikhala zamagama, amakhono e-kernel, kanye nezihlungi zezingcingo zesistimu (seccomp).

Ukuhlola isimo sesevisi ethile, i-systemd ifaka ithuluzi ukuhlaziya ukuphepha kwesistimuUma isebenza, ikhiqiza umbiko onenkomba yokuchayeka esikalini esingu-0 kuya ku-10, lapho okuphansi kungcono khona. Umbiko uhlukanisa ukuvikelwa okunikwe amandla noma okungekho (ukuhlukaniswa kwenethiwekhi, ukufinyelela ohlelweni lwamafayela, amadivayisi, njll.), okwenza kube lula kakhulu ukubona ubuthakathaka. yiziphi izinguquko ezidingekayo bese uhlola ukuthi izinguquko ezethulwe ziyawuthuthukisa ngempela yini umphumela.

Esikhundleni sokuhlela iyunithi yokuqala—ezolahleka ekubuyekezweni kwephakheji esikhathini esizayo—kunconywa ukudala yenzeke ngaphezulu en /etc/systemd/system/mi-servicio.service.d/ ngefayela, isibonelo, sandbox.confNgemva kokuyilungisa, mane ulayishe kabusha ukucushwa nge i-systemctl daemon-yokulayisha kabusha bese uqala kabusha isevisi ukuze imikhawulo emisha isebenze.

Ezingeni lesistimu yamafayela, enye yezinketho ezibaluleke kakhulu I-ProtectSystem=Amanani afana nalawa strict, full o true Bafaka izingxenye ezahlukene zesihlahla ngendlela yokufunda kuphela. Umkhuba ojwayelekile, uma kungenzeka, ukusebenzisa I-ProtectSystem=eqinileLokhu kwenza i-/usr, /boot, /efi, kanye ne-/etc ifundeke kuphela kule nsizakalo. Uma uhlelo lokusebenza ludinga ukubhalela amafolda athile, luvunyelwe ukwenza kanjalo kusetshenziswa Funda i-WritePaths=/indlela ngobunye.

Ukuze kuthuthukiswe ubumfihlo, kunconywa futhi ukuthi kukhawulelwe ukufinyelela kumarekhodi abasebenzisi ngokusebenzisa I-ProtectHome=iqinisookuvimbela isevisi ekufundeni /home, /root, noma /run/user. Ngaphezu kwalokho, I-PrivateTmp=iqiniso Idala isikhala esihlukanisiwe se-/tmp kanye ne-/var/tmp, ivimbela ukubonakala kwamafayela esikhashana phakathi kwezinqubo.

Kumadivayisi, Ama-PrivateDevices=yiqiniso Ifihla umuthi wangempela we-/dev bese iwufaka esikhundleni sawo ngesethi encane yamadivayisi e-pseudo aphephile (null, zero, okungahleliwe, njll.). Uma iyunithi idinga idivayisi ethile (isibonelo, i-serial port noma i-disk block), ingavunyelwa kusetshenziswa I-DeviceAllow=/dev/xxx rw noma kumodi yokufunda kuphela.

Inethiwekhi nayo iyivektha eyisihluthulelo. I-PrivateNetwork=iqiniso Kudalwa isikhala segama lenethiwekhi esihlukanisiwe, kushiye i-loopback kuphela; isevisi ngeke ibone izixhumi ezibonakalayo futhi ngeke ikwazi ukuxhumana nomhlaba wangaphandle. Ngaphandle kwalokho, ungakhawulela ukuthi yimiphi imindeni yekheli engayisebenzisa RestrictAddressFamilies=kuvumela i-AF_INET kanye ne-AF_INET6 kuphela ye-IPv4/IPv6, i-AF_UNIX yama-socket endawo noma ngisho none ukuthuthukisa amakhono enethiwekhi aseJapane ngokugcwele.

Ngokuphathelene namalungelo obunikazi, isiqondiso Akukho Amalungelo Amasha=iqiniso Ingenye yamandla amakhulu: ivimbela inqubo ekutholeni amalungelo amasha ngokusebenzisa ama-setuid binary noma izinguquko zamandla. Ngamafuphi, noma ngabe insizakalo isebenzisa ikhodi esengozini, akufanele ikwazi ukukhula iye ezisekelweni ngokusebenzisa izindlela zendabuko. Kuhlanganiswe ne CapabilityBoundingSet=Ngokuchaza uhlu oluqondile lwamakhono avunyelwe (isb., i-CAP_NET_BIND_SERVICE kuphela yokulalela kuma-port aphansi), indawo yokuhlasela iyancishiswa.

Ukuze uqhubekele phambili, i-systemd ivumela ukuhlunga izingcingo zesistimu nge I-SystemCallFilter=Esikhundleni sokugcina uhlu lwe-syscalls olusetshenziswa ngesandla, kusetshenziswa amaqembu achazwe ngaphambilini, njenge @system-service, @network-io, @basic-io noma ukuphika amaqembu afana ~@privileged. Nge isihlungi se-syscall-analyze se-systemd Kungenzeka ukuhlola ukuthi yiziphi izingcingo ezithile ezingezona ezeqembu ngalinye. Lokhu kuvumela ukwakhiwa kwephrofayili yokusebenza elinganiselwe kakhulu, efana nalokho okunganikezwa yibhokisi lesanti elizinikele.

Ezinye izinguquko ezifanele yilezi: I-ProtectKernelTunables=true, okuvimbela ukuguqulwa kwamapharamitha e-kernel ku-/proc/sys kanye ne-/sys, Amamojula e-ProtectKernel=ayiqinisookuvimbela ukulayisha noma ukulayisha amamojula, I-ProtectKernelLogs=iqinisookuvimbela ukufunda amarejista e-kernel, kanye Ama-ProtectControl Groups=ayiqinisookuyinto evimbayo ebhalela uhla lweqembu lama-cgroup. Konke lokhu kuhlangana kalula namakhono amasha okuhlukaniswa komsebenzisi afana Abasebenzisi Abazimele=abagcwele, okuthi kunguqulo 260 ibuyekezwe ukuze ihlele uhla oluphelele lwama-ID omsebenzisi, kususwe izindlela zokuxazululwa zangaphambilini ezidingekayo ezindaweni ezine-systemd enezidleke.

Ama-PrivateUsers, i-xaccess, kanye nezilawuli zokufinyelela zedivayisi ezintsha

Umshini Abasebenzisi AbazimeleYakhelwe ukusebenzisa izinsizakalo endaweni yobunikazi bomsebenzisi ehlukanisiwe, ihlanganiswe ku-systemd 260. Inketho Abasebenzisi Abazimele=abagcwele Manje ibala uhlu oluphelele lwezihlonzi, yenza izinto zibe lula ezitsheni kanye nasezinhlelweni ezinezimo zesistimu ezifakwe ezisekelweni ezinguqulo ezindala (ngaphambi kuka-257). Lokhu kuthuthukiswa kususe ama-hacks ayesetshenziswa ukuthola lezi zimo ezindala.

Ngesikhathi esifanayo, izingxenye ezifana i-systemd-logind kanye ne-systemd-udevd Baqala umqondo wokuthi ukufinyelela kwe-xLe ndlela igcwalisa umqondo wakudala we- ukufinyelelaI-xaccess inikeza ukufinyelela kumadivayisi athile (isb., umsindo noma ividiyo) kubasebenzisi abanezikhathi zezithombe zangaphambili emshinini wendawo. Izimvume zingadluliselwa ku-xaccess. abasebenzisi abakude abanezikhathi eziphawulwe ngokukhethekileukuze, isibonelo, umsebenzisi oxhunywe ngedeskithophu ekude akwazi ukufinyelela amadivayisi okubonisa i-GPU endawo ngaphandle kokunikeza izimvume ezibanzi ohlelweni lonke.

Ukucushwa kwalezi zikhathi kuhilela iziguquguquko zemvelo ezivezwe nge-PAM, ikakhulukazi I-PAMXDG_SESSION_EXTRA_DEVICE_ACCESS=Lokhu kuvumela ukuchaza ukuthi yimaphi amadivayisi athile awela ngaphansi kwalolu hlaka. Kuyindlela ehambisana kakhulu nokuhambisana nomthetho kanye nezidingo zokuvikela idatha ze-European Union, ezidinga ubuncane kanye nokulandeleka ekufinyeleleni ihadiwe ebucayi.

i-mstack, i-systemd-mstack kanye namathuluzi amasha esiqukathi

Endaweni yokufakwa kweziqukathi, i-systemd 260 yethula ukusebenza i-mstack kanye nomyalo ohambisanayo, i-systemd-mstackUmqondo ngemuva kwe-mstack ukuvumela ukuchaza i- I-OverlayFS ngokusekelwe esakhiweni sencwadi ekhethekile ebizwa ngokuthi .mstack/, okulandela incazelo ethile yokuhlela izendlalelo zayo.

Ithuluzi elisha lomugqa womyalo, i-systemd-mstack, lenza kube lula ukusebenza nalezi "zitaki" zesistimu yamafayela ngokusebenzisana, okunezela ukuguquguquka lapho kusethwa izindawo ezinezingqimba zeziqukathi noma izinsizakalo ezihlukanisiwe kakhulu. Lokhu kusebenza kuhlobene nokuthuthukiswa ku i-systemd-importd, eyandisa ukwesekwa kwayo kwe- Landa futhi uphathe izithombe ze-OCILokhu kuqinisa indima ye-systemd njengenjini yokufaka ama-container kanye ne-sandboxing, into evame kakhulu kubahlinzeki bamafu baseYurophu kanye namapulatifomu esimanje okusingatha.

Inethiwekhi: Ukuhlanganiswa neModemManager kanye nezinketho ezintsha zokusebenza

Esigabeni senethiwekhi, i-systemd-networkd iyaqhubeka nokuba yigugu. Esinye sezici zayo ezintsha eziphawulekayo ukuthi ukuhlanganiswa neModemManager kusetshenziswa iphrothokholi ethi “ukuxhuma okulula”Lokhu kukuvumela ukuthi uphathe amamodemu kanye nokuxhumeka kweselula ngqo kusuka kunethiwekhi ngaphandle kokuthembela kumathuluzi angaphandle.

Ukuze kusekelwe lokhu kugeleza, kufakwe isigaba esisha. kumafayela okucushwa, ngamapharamitha afana nalawa APN=, AllowedAuthenticationMechanisms=, User=, Password=, IPFamily=, AllowRoaming=, PIN=, OperatorId=, RouteMetric= y UseGateway=Lokhu kwenza kube lula ukuthunyelwa ku izindawo zasemakhaya noma izindawo ezinokuxhumana okusekelwe kumanethiwekhi eselula, itholakala kakhulu ezindaweni ezithile zaseYurophu lapho kungekho khona njalo i-fiber noma izingcingo zasekhaya ezisezingeni eliphezulu.

Ngokuphathelene nokusebenza, amafayela .isixhumanisi i-systemd-networkd ifaka izinketho ezintsha ngqo zamadivayisi e-Ethernet. Phakathi kwazo kukhona: I-ScatterGather, i-ScatterGatherFragmentList, i-TCPECNSegmentationOffload, i-TCPMangleIdSegmentationOffload, i-GenericReceiveOffloadList kanye ne-GenericReceiveOffloadUDPForwardingLezi zinketho zivumela ukulungiswa kokufakwa komsebenzi kuhadiwe kanye nabashayeli, into ebalulekile kumanethiwekhi ezinkampani, izikhungo zedatha, kanye nabahlinzeki bezinsizakalo abadinga ukunciphisa yonke imizuzwana yokulibaziseka.

Ngaphezu kwalokho, ama-interface UVarlink noJSON i-systemd-networkd manje isiyakwazi ukubika amakheli e-IP ngefomethi okufundeka kubantu (izintambo) ngenkathi kugcinwa ukumelwa njengeqoqo lezinombolo eziphelele. Lokhu kwenza kube lula ukuhlanganiswa namadeshibhodi okuqapha, izikripthi zokuphatha, noma amathuluzi ezinkampani zangaphandle angafuni ukubhekana namafomethi ezinombolo angacacile.

Ukuphatheka kwesevisi, imishini ebonakalayo yesikhashana, kanye nezinsizakalo ezingenamalungelo

Isiqephu i-systemd-portableIsofthiwe enesibopho sokuphatha izinsizakalo "eziphathekayo" ezifakwe ezithombeni ithola ikhono elithakazelisayo kakhulu: ingasebenza njengesevisi yezinga lomsebenzisiLokhu kusho ukuthi abasebenzisi abangenamalungelo, ngesikhathi sabo esivamile, bangakwazi ukuqalisa nokuphatha izinsizakalo eziphathekayo ngaphakathi kwendawo yabo ngaphandle kokusebenzisa amalungelo e-sudo noma aphezulu.

Ngaphezu kwalokho, kusukela kule nguqulo, ithini eliphathekayo dala izinqubomgomo futhi usungule isithombe esihlotshaniswa nesevisi ephathekayoLokhu kuvimbela isithombe ukuthi singashintshwa ngaphandle kokusinamathisela kabusha. Ngakho-ke abasebenzisi bangasetha izindawo ezizimele ezineziqinisekiso ezengeziwe zokungaguquki, okukhanga kakhulu amalabhorethri, izindawo zokuthuthukiswa, kanye namabhokisi e-sandbox okuhlola.

Ngakolunye uhlangothi, i-systemd-vmspawn — ithuluzi eliklanyelwe ukuqalisa imishini ebonakalayo ngendlela ehlanganisiwe ne-systemd— landisa amakhono alo okubhalisa ku i-systemd-machined ngaphakathi kweseshini yomsebenzisiIphinde yethule inketho –okwesikhashana ukudala imishini yesikhashana ebhujiswa ekupheleni kokusetshenziswa kwayo. Lokhu kuhambisana kahle namapayipi e-CI/CD, amakilasi abonakalayo, noma amapulatifomu ezemfundo aseYurophu adinga ukuphakamisa nokudonsa imishini ngokushesha nangendlela elawulwayo.

Ukulawulwa okuhle kwe-CPU, inkumbulo, kanye nokuhlela nge-SCHED_EXT kanye ne-THP

I-Systemd 260 iphinde igxile ekulawuleni ukusebenza ngezinqubomgomo ezintsha. Inketho yesevisi Inqubomgomo Yokuhlela I-CPU= manje yamukela inani ext, okusebenzisa ishejuli SCHED_EXTLo mhleli wendlela ehlukile uvula umnyango wokuthi izivivinyo ngezinqubomgomo ezahlukene zokuhlela ngokwezindinganiso ze-kernel, into engaba nesithakazelo kuma-laboratory e-R&D noma ezindaweni ezikhethekile kakhulu zokusabalalisa.

Endaweni yememori kuvela InkumbuloTHP=okuvumela ukuphatha ukusetshenziswa kwe Amakhasi Amakhulu Abonakalayo (THP) ngesevisi ngayinye. Esikhundleni sokuba nokuziphatha komhlaba wonke kulo lonke uhlelo, kunganqunywa ukuthi iyunithi ethile kufanele isebenzise i-THP, iyikhubaze, noma isebenzise izindlela eziphakathi. Ngezicelo ezibalulekile ebhange, emshuwalense, noma ekuphathweni komphakathi, lokhu kulawula okuhlanganisiwe kungenza umehluko ku ukubambezeleka, ukusetshenziswa kwememori, kanye nokusebenza.

Imiyalo emisha ku-systemctl kanye nokusetshenziswa okwandisiwe kwe-Varlink

I-commando eyaziwayo systemctl iwina i-oda elisha: okuphawulwe ngomugqaLesi senzo sibiza ngaphakathi indlela ye-D-Bus. Imisebenzi Ephawulwe Nge-Enqueue() futhi ivumela ukusebenza ngemigqa yemisebenzi nezinsizakalo ezikhethiwe kusengaphambili. Nakuba lokhu kungase kubonakale njengemininingwane emincane, kubalulekile kumaqembu okusebenza ahlela amapulazi amakhulu eseva Kungenye futhi ithuluzi lokuthuthukisa ukuthunyelwa kanye nokusebenza ngokuzenzakalela.

Ngesikhathi esifanayo, iphrojekthi iyaqhubeka nokwandisa ukusetshenziswa kwe I-Varlink njengendlela yokuxhumana phakathi kwezingxenye. Izingxenye eziningi ze-systemd zidalula izixhumi ze-Varlink ezizinzile, ezenza kube lula ukuhlanganiswa namathuluzi angaphandle, amadeshibhodi enziwe ngokwezifiso, noma ama-ejenti okuqapha adinga ukufinyelela okuhlelekile kolwazi lwesistimu.

Izinkambu zokuhlonza uhlelo kanye nolwazi lomsebenzisi

Isici esisha esimangalisayo kodwa esiwusizo kwezinye izabelo ukwethulwa kwensimu I-FANCY_NAME= endaweni yokugcina umlando /etc/os-releaseLe nsimu ifana ne-PRETTY_NAME, kodwa ivumela Ukulandelana kwe-ANSI kanye nezinhlamvu ze-Unicode eziyinkimbinkimbi kakhuluNgenxa yalokhu, ukusatshalaliswa okukhethekile kanye nezinhlelo kungavezwa ngamagama akhangayo noma ahlukile.

Inani le-FANCY_NAME lingabukwa ngomphathi wesistimu, kusetshenziswa igama le-systemd-host noma lapho kuxoxiswana hostnamectlNakuba kuyishintsho elincane, ezindaweni zedeskithophu kanye namaphaneli okuphatha izithombe kungaba wusizo kuzo thola uhlelo ngokushesha lokho kuphathwa, ikakhulukazi uma kukhulunywa ngezinhlobo eziningi ezisuselwe kuzo.

Imibhalo ethile yama-ejenti e-AI kanye nomsebenzi wokubuyekezwa osizwayo

Esinye sezibonakaliso ezithakazelisa kakhulu zokuthi intuthuko yesistimu iya kuphi ukubonakala kwemibhalo eqondiswe ngqo ku- ama-intelligence agentsIfayela lifakiwe endaweni yokugcina impahla AGENTS.mdyakhelwe amathuluzi okuhlaziya ikhodi kanye nabasizi bokuhlela, futhi njengoba abanye bephawulile iziqondiso zobuchwepheshe, ukuqonda kangcono ukwakheka kwephrojekthi, isitayela, ukugeleza kwentuthuko, kanye neziqondiso zomnikelo.

Lo mbhalo uchaza izingxenye, izindlela zokwakha, indlela yokusebenzisa izivivinyo nokuhlanganiswa, kanye neziqondiso zokukhiqiza ama-patches amukelekayo. Inhloso iwukuba ama-ejenti e-AI abukeza ikhodi noma akhiqize izinguquko ukuze asebenze nawo umongo oqinile wokuthi i-systemd ihlelwe kanjaniukunciphisa amaphutha kanye neziphakamiso ezingalungile.

Eceleni kwe-AGENTS.md kuvela ifayela elibizwa ngokuthi CLAUDE.mdLokhu kubhekisela ngokusobala kweyokuqala futhi kugxile ekuqondiseni ithuluzi le-Claude Code, elingomunye wabasizi bokuthuthukiswa abasekelwe ku-AI abasetshenziswa kakhulu. Ngale ndlela, iphrojekthi ifaka ngokusobala i-AI emjikelezweni wayo wokuthuthukiswa.

Ngaphezu kwalokho, ifayela lokucushwa lifakiwe. u-claude-review.ymllapho kuchazwa khona ukuthi inqubo yokuhlaziya izicelo zoshintsho (izicelo zokudonsa) kufanele ibuyekezwe kanjani, ngosizo lwe-Claude Code. Kulesi simo, iminikelo esebenzise i-AI iyadingeka ukuze ifake amalebula okudalula njengoba Co-developed-by kuma-patches, okushiya ubufakazi bokuthi ithuluzi elizenzakalelayo liye lahlanganyela ekudalweni kwekhodi.

Ngazo zonke lezi zinguquko—ukuhlanza ukwesekwa kwefa, ukulungiswa kwe-sandboxing, ukuthuthukiswa kwe-TPM2 kanye ne-SRK, ukuhlanganiswa kwenethiwekhi okuthuthukisiwe, amakhono amasha okuphatheka, kanye nemibhalo eyenzelwe ama-ejenti ahlakaniphile— uhlelo lwe-260 Lokhu kuqinisa indima yayo ebalulekile ohlelweni lwesimanje lwe-Linux. Kubaphathi nabathuthukisi eSpain naseYurophu, inselele esheshayo ihilela ukubuyekeza ama-kernel, ukulungisa ukucushwa kwe-boot kanye nezinsizakalo, nokusebenzisa lezi zici ukwakha ingqalasizinda ephephile, ezenzakalelayo ehambisana nokusetshenziswa kwesistimu yamanje.