Why did you do this to me?!

Transcription

1

2 Systemd

3 Why did you do this to me?! 3

4 1996: Linux Distros adopt SysV-init 2001: LSB standardizes init scripts 2010: Mobile Distros and Parallel Boot : Still in Good Shape? 4

5 What's wrong with sysvinit? Nothing But it could do many things better It's slow It's hard to parallelize Too coarse synchronization points LSB dependencies only do what you need 50% of the time Have you ever tried to kill all processes spawned by a user session? No automatic restart of services No unified logging No unified resource limit handling 5

6 Why systemd? Considered several alternatives, systemd was selected for several reasons It certainly polarizes the users today Some of that is certainly because it's new It seems to be the solution most distros are standardizing on 6

7 Hard to like systemd, then? It isn't, once you get to know to it better It changes a lot of things You need to learn a lot of new commands Let's be honest, many of them do things you cant do with sysvinit Some time-honored features (like inittab) are gone It is an intrusive change, and fixing up the fallout has been a significant amount of work Backward compatibility is not high on the list of development priorities We provide some level of backward compatibility 7

8 Systemd Concepts

9 Generic concepts systemd replaces the traditional init process It's not one, but a collection of DBus services Activate services on demand rather than up-front One-stop for boot, shutdown and power management integrated logging unified command line tools for almost everything automatic restart of services cgroups and security compartments for everything multi-seat hosts handling of ACPI power management events 9

10 Unit files Unit files describe targets (i.e. synchonization points) and services (what used to be init scripts) Runlevels are replaced by targets Runlevel 3: multi-user.target Runlevel 5: graphical.target Many of what LSB standard used is done in unit files Plus a few more, for instance with LSB you could never say my service needs to be started before kdm 10

11 Sessions and Seats A seat is the set of hardware available at one work place (graphics card, keyboard, mouse, usb devices) A session is created once a user is logged on, using a specific seat Only one session can be active per seat Default seat (for Linux consoles) is seat0 Hardware is assigned to seats This replaces ConsoleKit 11

12 Sample service unit file: sshd.service # This is a comment! [Unit] Description=OpenSSH Daemon After=network.target LSB Analogs/Equivalents [Unit] # Description:... # Required-Start: $network [Service] EnvironmentFile=/etc/sysconfig/ssh ExecStartPre=/usr/sbin/sshd-gen-keysstart ExecStart=/usr/sbin/sshd -D $SSHD_OPTS ExecReload=/bin/kill -HUP $MAINPID KillMode=process Restart=always [Service] # <- All of these used to be # <- open coded in the init script # <# <# <Automated Restart: didn't exist previously [Install] WantedBy=multi-user.target [Install] # Default-Start:

13 Cgroups for Everything Systemd puts each service and each session into a separate cgroup Sessions also get assigned an audit ID matching their cgroup ID You can restrict these cgroups in all the way the kernel supports IO bandwidth, memory or CPU consumption, etc 13

14 Getting Started with Systemd Tools

15 Very Rough Cheat Sheet The following overview is far from exhaustive This is just meant as a starting point to help you exploring systemd and its tools 15

16 Service status You want a list of all started services and their status systemctl You want the status of service foobar: systemctl status foobar.service $ systemctl status icecream.service Loaded: Active: CGroup: icecream.service LSB: icecc loaded (/etc/init.d/icecream) active (running) since Fri, :27:31 CEST; 4 days ago name=systemd:/system/icecream.service 4786 /usr/sbin/icecc-scheduler -d -l /var/log/icecc_sch /usr/sbin/iceccd -d -l /var/log/iceccd --nice 5 -u... Apr 19 09:27:31 foobar systemd[1]: Starting LSB: icecc... Apr 19 09:27:31 foobar icecream[4777]: Starting Distribut... Apr 19 09:27:31 foobar systemd[1]: Started LSB: icecc. 16

17 Start / Stop / Enable Services systemctl <verb> foobar.service Where <verb> is one of start, stop, restart, tryrestart, reload systemctl kill foobar.service Kill all processes in the cgroup of this service systemctl <verb> foobar.service Where <verb> is one of enable, disable 17

18 We'll still be friends, pstree # systemd-cgls system 1 /sbin/init showopts icecream.service 4786 /usr/sbin/icecc-scheduler -d -l /var/log/icecc_scheduler 4791 /usr/sbin/iceccd -d -l /var/log/iceccd --nice 5 -u icecream -b /... colord.service 1677 /usr/lib/colord udisks2.service 1498 /usr/lib/udisks2/udisksd --no-debug rtkit-daemon.service 1353 /usr/lib/rtkit/rtkit-daemon upower.service 1161 /usr/lib/upower/upowerd accounts-daemon.service 1125 /usr/lib/accounts-daemon xdm.service 964 /usr/sbin/gdm 966 /usr/lib/gdm/gdm-simple-slave --display-id /org/gnome/displayman /usr/bin/xorg :0 -background none -verbose -auth /run/gdm/auth-f gdm-session-worker [pam/gdm-password] 18

19 Session Handling List all sessions: loginctl [list sessions] Show session details: loginctl session status <session number> Forcefully terminate a session: loginctl kill session kill user terminate seat <name> 19

20 Session Handling, continued 3 mkraft (7025) Since: Thu :37:59 CEST; 56min ago Leader: 2303 (sddm helper) Seat: seat0; vc7 Display: :0 Service: sddm; type x11; class user Desktop: KDE State: active Unit: session 3.scope 2303 /usr/lib/sddm/sddm helper socket /tmp/sddm authb22d1e /bin/sh /usr/bin/startkde 2358 /usr/bin/dbus launch sh syntax exit with session /usr /bin/dbus daemon fork print pid 5 print address /usr/bin/ssh agent /usr/bin/gpg agent sh daemon kee /usr/bin/gpg agent sh daemon keep display write e /usr/lib64/libexec/kf5/start_kdeinit kded +kcminit_star kdeinit5: Running klauncher [kdeinit5] fd= kded5 [kdeinit5] 2407 /usr/bin/kaccess 2415 kwrapper5 /usr/bin/ksmserver 2416 /usr/bin/ksmserver 2422 /usr/bin/kactivitymanagerd start daemon 2424 /usr/bin/kglobalaccel /usr/lib/dconf service 2437 kwin_x /usr/bin/baloo_file 20

21 And it comes with lots more stuff See how your configuration differs from the vendor defaults systemd delta Analyze boot times and bottlenecks systemd analyze 21

22 SUSE backward compatibility insserv, chkconfig and /sbin/service will still be supported Old style rcfoobar start redirected to new systemd tools automatically LSB compatibility for targets like $network... still available And of course init scripts are still supported! 22

23 References Systemd on SLE12 : Check our official documentation systemd Upstream: Check manpages, they are extremely verbose If something is missing there, please report a bug! 23

24 BTRFS

25 Why Btrfs? Features! Scalability (16 EiB) including effective shrink Supports offline in-place migration from ext2, ext3 Support for Copy on Write Powerful Snapshot capabilities Other Capabilities: SSD optimization (TRIM support) Data integrity (checksums) 25

26 Btrfs Functionality Maturity Today Future Copy on Write Inode Cache Snapshots Auto Defrag Subvolumes RAID Metadata Integrity Compression Data Integrity Send / Receive Online metadata scrubbing Hot add / remove Manual Defragmentation Seeding devices Manual Deduplication Multiple Devices Quota Groups Big Metadata 26

27

28 Btrfs Disk Space And Extents # btrfs filesystem df / Data: total=14.50gb, used=12.20gb System, DUP: total=8.00mb, used=12.00kb System: total=4.00mb, used=0.00 Metadata, DUP: total=1.75gb, used=904.11mb # df h / Filesystem /dev/sda7 # Size 20G Used Avail Use% Mounted on 14G 4.3G 77% / Disk utilization 12,2GB + 2x 0,9GB + = 14 GB 29

29 Technology Overview Subvolume Normal Filesystem With Subvolumes FSTREE FSTREE / /usr /opt SubVols / / opt / usr 30

30 Technology Overview Subvolume A complete filesystem tree Usually appears as a sub-directory in the parent fs Can be mounted separately Not just a subdirectory Simliar to two foreign filesystems, which are using the same pool of data blocks (and other infrastructure) Benefits different parts (subvolumes) of a filesystem can have different attributes, such as quotas or snapshotting rules Copy on Write is possible across volumes Basic commandline management btrfs subvolume 31

31 Technology Overview Snapshots Copy on Write on a full subvolume tree instead of a single file only Every snapshot is again a subvolume of its own Snapshots (as subvolumes) can be mounted and accessed as every other subvolume Snapshots can be created read-only Basic commandline management btrfs subvolume snapshot 32

32 Requirements Single file rollback ( undochange ) Subvolume based rollback User interface: cmdline and YaST2 integration Snapshots for YaST2 and zypper activities Automated snapshots (time based) Automated snapshot cleanup (time/number based) Allow to work with several kernels 33

33 Snapshotting / Challenges Multiple Kernels separate /boot zypper integration System integrity and Compliance Don't allow to roll back certain log-files etc. Solution: subvolumes instead of directories for /tmp /opt /srv /var/spool /var/log /var/run /var/tmp 34

34 Snapshots in SUSE Linux Enterprise 11 SP2 Snapshotting / We have decided to go the way of / in a subvolume Disadvantages of this model are mitigated by Support from the YaST2 Partitioner to install and configure Using set-default for the root filesystem to make migration as smooth as possible enable use of normal rescue systems 35

35 Snapshotting / Partitions / Subvolumes 36

36 snapper (1) cmdline tool to manage snapshots Commands snapper list-configs snapper create-config <subvolume> snapper list snapper create snapper modify <number> snapper delete <number> snapper status <number1>..<number2> snapper diff <number1>..<number2> [files] snapper undochange <number1>..<number2> [files] snapper cleanup <cleanup-algorithm> 37

37 snapper (2) Configuration files: /etc/snapper/configs/<per subvol> /etc/sysconfig/snapper Time based snapshots Rules for deleting snapshots automatically 38

38 snapper example :33 (0) ~ ios root (0) # snapper list Type # Pre # Date Cleanup Description single 0 current single 1 Wed 17 Aug :30:01 PM CEST timeline timeline pre 2 Wed 17 Aug :31:54 PM CEST number yast lan post 3 2 Wed 17 Aug :32:46 PM CEST number pre 4 Wed 17 Aug :32:48 PM CEST number yast lan post 5 4 Wed 17 Aug :32:59 PM CEST number pre 6 Wed 17 Aug :36:10 PM CEST number zypp(zypper) post 7 6 Wed 17 Aug :36:11 PM CEST number pre 8 Wed 17 Aug :36:16 PM CEST number zypp(zypper) post 9 8 Wed 17 Aug :36:19 PM CEST number pre 10 Wed 17 Aug :36:26 PM CEST number yast printer post Wed 17 Aug :37:21 PM CEST number single 12 Wed 17 Aug :30:01 PM CEST timeline timeline single 13 Wed 17 Aug :30:01 PM CEST timeline timeline single 14 Wed 17 Aug :30:01 PM CEST timeline timeline single 15 Wed 17 Aug :30:01 PM CEST timeline timeline single 16 Wed 17 Aug :30:01 PM CEST timeline timeline single 17 Wed 17 Aug :30:01 PM CEST timeline timeline single 18 Wed 17 Aug :30:01 PM CEST timeline timeline single 19 Thu 18 Aug :30:02 AM CEST timeline timeline single 20 Thu 18 Aug :30:01 PM CEST timeline timeline 39

39 snapper configuration :45 (0) ~ #... ios root # cat /etc/snapper/configs/root # cleanup hourly snapshots after some time TIMELINE_CLEANUP="yes" # subvolume to snapshot SUBVOLUME="/" # limits for timeline cleanup TIMELINE_MIN_AGE="1800" # filesystem type TIMELINE_LIMIT_HOURLY="10" FSTYPE="btrfs" TIMELINE_LIMIT_DAILY="10" TIMELINE_LIMIT_MONTHLY="10" # run daily number cleanup TIMELINE_LIMIT_YEARLY="10" NUMBER_CLEANUP="yes" # limit for number cleanup # cleanup empty pre post pairs NUMBER_MIN_AGE="1800" EMPTY_PRE_POST_CLEANUP="yes" NUMBER_LIMIT="100" # limits for empty pre post pair cleanup # create hourly snapshots TIMELINE_CREATE="yes" EMPTY_PRE_POST_MIN_AGE="1800" #... 40

40 ZYpp Integration ZYpp plugin for calling snapper on specific actions Uses pairs of snapshots: one snapshot on ZYpp transaction start one snapshot on ZYpp transaction stop Knowledge about pairs is stored in the snapshot metadata :34 (0) ~ ios root (0) # cat /.snapshots/8/info.xml <?xml version="1.0"?> <snapshot> <type>pre</type> <num>8</num> <date> :36:16</date> <description>zypp(zypper)</description> <cleanup>number</cleanup> </snapshot> :34 (0) ~ ios root (0) # cat /.snapshots/9/info.xml <?xml version="1.0"?> <snapshot> <type>post</type> <num>9</num> <date> :36:19</date> <pre_num>8</pre_num> <cleanup>number</cleanup> </snapshot> 41

41 YaST2 integration Similar to ZYpp Snapshot-Pair with every start of a YaST module Description covers the name of the module :32 (0) ~ ios root (0) # cat /.snapshots/10/info.xml <?xml version="1.0"?> <snapshot> <type>pre</type> <num>10</num> <date> :36:26</date> <description>yast printer</description> <cleanup>number</cleanup> </snapshot> :32 (0) ~ ios root (0) # cat /.snapshots/11/info.xml <?xml version="1.0"?> <snapshot> <type>post</type> <num>11</num> <date> :37:21</date> <pre_num>10</pre_num> <cleanup>number</cleanup> </snapshot> 42

42 Managing Difference With YaST2 43

43 Time for Questions

44

45 Appendix

46 Overriding defaults for a service With sysvinit, if you want to do anything more advanced that enable/disable a service, you need to edit the init script This doesn't go well with security updates Systemd supports that nicely Assume you want to modify settings for foobar.service Create /etc/systemd/system/foobar.service.d Drop a file named mysettings.conf in there: [Service] InaccessibleDirectories=/precious MemoryLimit=1G 47

47 Improved Security for Everything Restrict services and sessions using namespaces Linux kernel namespaces are the technology underlying Linux containers blacklist directories require private /tmp directory whitelist devices to which access is granted Specify user/group to run as Assign Linux kernel capabilities (CAP_FOOBAR) Set ulimit values 48

48