mirror of
https://git.proxmox.com/git/systemd
synced 2025-06-05 05:39:28 +00:00
1086 lines
91 KiB
HTML
1086 lines
91 KiB
HTML
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>systemd.exec</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><style>
|
||
a.headerlink {
|
||
color: #c60f0f;
|
||
font-size: 0.8em;
|
||
padding: 0 4px 0 4px;
|
||
text-decoration: none;
|
||
visibility: hidden;
|
||
}
|
||
|
||
a.headerlink:hover {
|
||
background-color: #c60f0f;
|
||
color: white;
|
||
}
|
||
|
||
h1:hover > a.headerlink, h2:hover > a.headerlink, h3:hover > a.headerlink, dt:hover > a.headerlink {
|
||
visibility: visible;
|
||
}
|
||
</style><a href="index.html">Index </a>·
|
||
<a href="systemd.directives.html">Directives </a>·
|
||
<a href="../python-systemd/index.html">Python </a>·
|
||
<a href="../libudev/index.html">libudev </a>·
|
||
<a href="../libudev/index.html">gudev </a><span style="float:right">systemd 214</span><hr><div class="refentry"><a name="systemd.exec"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>systemd.exec — Execution environment configuration</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><p><code class="filename"><em class="replaceable"><code>service</code></em>.service</code>,
|
||
<code class="filename"><em class="replaceable"><code>socket</code></em>.socket</code>,
|
||
<code class="filename"><em class="replaceable"><code>mount</code></em>.mount</code>,
|
||
<code class="filename"><em class="replaceable"><code>swap</code></em>.swap</code></p></div><div class="refsect1"><a name="idm214195915600"></a><h2 id="Description">Description<a class="headerlink" title="Permalink to this headline" href="#Description">¶</a></h2><p>Unit configuration files for services, sockets,
|
||
mount points, and swap devices share a subset of
|
||
configuration options which define the execution
|
||
environment of spawned processes.</p><p>This man page lists the configuration options
|
||
shared by these four unit types. See
|
||
<a href="systemd.unit.html"><span class="citerefentry"><span class="refentrytitle">systemd.unit</span>(5)</span></a>
|
||
for the common options of all unit configuration
|
||
files, and
|
||
<a href="systemd.service.html"><span class="citerefentry"><span class="refentrytitle">systemd.service</span>(5)</span></a>,
|
||
<a href="systemd.socket.html"><span class="citerefentry"><span class="refentrytitle">systemd.socket</span>(5)</span></a>,
|
||
<a href="systemd.swap.html"><span class="citerefentry"><span class="refentrytitle">systemd.swap</span>(5)</span></a>,
|
||
and
|
||
<a href="systemd.mount.html"><span class="citerefentry"><span class="refentrytitle">systemd.mount</span>(5)</span></a>
|
||
for more information on the specific unit
|
||
configuration files. The execution specific
|
||
configuration options are configured in the [Service],
|
||
[Socket], [Mount], or [Swap] sections, depending on the unit
|
||
type.</p></div><div class="refsect1"><a name="idm214194423040"></a><h2 id="Options">Options<a class="headerlink" title="Permalink to this headline" href="#Options">¶</a></h2><div class="variablelist"><dl class="variablelist"><dt id="WorkingDirectory="><span class="term"><code class="varname">WorkingDirectory=</code></span><a class="headerlink" title="Permalink to this term" href="#WorkingDirectory=">¶</a></dt><dd><p>Takes an absolute
|
||
directory path. Sets the working
|
||
directory for executed processes. If
|
||
not set, defaults to the root directory
|
||
when systemd is running as a system
|
||
instance and the respective user's
|
||
home directory if run as
|
||
user.</p></dd><dt id="RootDirectory="><span class="term"><code class="varname">RootDirectory=</code></span><a class="headerlink" title="Permalink to this term" href="#RootDirectory=">¶</a></dt><dd><p>Takes an absolute
|
||
directory path. Sets the root
|
||
directory for executed processes, with
|
||
the
|
||
<a href="chroot.html"><span class="citerefentry"><span class="refentrytitle">chroot</span>(2)</span></a>
|
||
system call. If this is used, it must
|
||
be ensured that the process and all
|
||
its auxiliary files are available in
|
||
the <code class="function">chroot()</code>
|
||
jail.</p></dd><dt id="User="><span class="term"><code class="varname">User=</code>, </span><span class="term"><code class="varname">Group=</code></span><a class="headerlink" title="Permalink to this term" href="#User=">¶</a></dt><dd><p>Sets the Unix user
|
||
or group that the processes are executed
|
||
as, respectively. Takes a single user or group
|
||
name or ID as argument. If no group is
|
||
set, the default group of the user is
|
||
chosen.</p></dd><dt id="SupplementaryGroups="><span class="term"><code class="varname">SupplementaryGroups=</code></span><a class="headerlink" title="Permalink to this term" href="#SupplementaryGroups=">¶</a></dt><dd><p>Sets the supplementary
|
||
Unix groups the processes are executed
|
||
as. This takes a space-separated list
|
||
of group names or IDs. This option may
|
||
be specified more than once in which
|
||
case all listed groups are set as
|
||
supplementary groups. When the empty
|
||
string is assigned the list of
|
||
supplementary groups is reset, and all
|
||
assignments prior to this one will
|
||
have no effect. In any way, this
|
||
option does not override, but extends
|
||
the list of supplementary groups
|
||
configured in the system group
|
||
database for the
|
||
user.</p></dd><dt id="Nice="><span class="term"><code class="varname">Nice=</code></span><a class="headerlink" title="Permalink to this term" href="#Nice=">¶</a></dt><dd><p>Sets the default nice
|
||
level (scheduling priority) for
|
||
executed processes. Takes an integer
|
||
between -20 (highest priority) and 19
|
||
(lowest priority). See
|
||
<a href="setpriority.html"><span class="citerefentry"><span class="refentrytitle">setpriority</span>(2)</span></a>
|
||
for details.</p></dd><dt id="OOMScoreAdjust="><span class="term"><code class="varname">OOMScoreAdjust=</code></span><a class="headerlink" title="Permalink to this term" href="#OOMScoreAdjust=">¶</a></dt><dd><p>Sets the adjustment
|
||
level for the Out-Of-Memory killer for
|
||
executed processes. Takes an integer
|
||
between -1000 (to disable OOM killing
|
||
for this process) and 1000 (to make
|
||
killing of this process under memory
|
||
pressure very likely). See <a class="ulink" href="https://www.kernel.org/doc/Documentation/filesystems/proc.txt" target="_top">proc.txt</a>
|
||
for details.</p></dd><dt id="IOSchedulingClass="><span class="term"><code class="varname">IOSchedulingClass=</code></span><a class="headerlink" title="Permalink to this term" href="#IOSchedulingClass=">¶</a></dt><dd><p>Sets the IO scheduling
|
||
class for executed processes. Takes an
|
||
integer between 0 and 3 or one of the
|
||
strings <code class="option">none</code>,
|
||
<code class="option">realtime</code>,
|
||
<code class="option">best-effort</code> or
|
||
<code class="option">idle</code>. See
|
||
<a href="ioprio_set.html"><span class="citerefentry"><span class="refentrytitle">ioprio_set</span>(2)</span></a>
|
||
for details.</p></dd><dt id="IOSchedulingPriority="><span class="term"><code class="varname">IOSchedulingPriority=</code></span><a class="headerlink" title="Permalink to this term" href="#IOSchedulingPriority=">¶</a></dt><dd><p>Sets the IO scheduling
|
||
priority for executed processes. Takes
|
||
an integer between 0 (highest
|
||
priority) and 7 (lowest priority). The
|
||
available priorities depend on the
|
||
selected IO scheduling class (see
|
||
above). See
|
||
<a href="ioprio_set.html"><span class="citerefentry"><span class="refentrytitle">ioprio_set</span>(2)</span></a>
|
||
for details.</p></dd><dt id="CPUSchedulingPolicy="><span class="term"><code class="varname">CPUSchedulingPolicy=</code></span><a class="headerlink" title="Permalink to this term" href="#CPUSchedulingPolicy=">¶</a></dt><dd><p>Sets the CPU
|
||
scheduling policy for executed
|
||
processes. Takes one of
|
||
<code class="option">other</code>,
|
||
<code class="option">batch</code>,
|
||
<code class="option">idle</code>,
|
||
<code class="option">fifo</code> or
|
||
<code class="option">rr</code>. See
|
||
<a href="sched_setscheduler.html"><span class="citerefentry"><span class="refentrytitle">sched_setscheduler</span>(2)</span></a>
|
||
for details.</p></dd><dt id="CPUSchedulingPriority="><span class="term"><code class="varname">CPUSchedulingPriority=</code></span><a class="headerlink" title="Permalink to this term" href="#CPUSchedulingPriority=">¶</a></dt><dd><p>Sets the CPU
|
||
scheduling priority for executed
|
||
processes. The available priority
|
||
range depends on the selected CPU
|
||
scheduling policy (see above). For
|
||
real-time scheduling policies an
|
||
integer between 1 (lowest priority)
|
||
and 99 (highest priority) can be used.
|
||
See <a href="sched_setscheduler.html"><span class="citerefentry"><span class="refentrytitle">sched_setscheduler</span>(2)</span></a>
|
||
for details.
|
||
</p></dd><dt id="CPUSchedulingResetOnFork="><span class="term"><code class="varname">CPUSchedulingResetOnFork=</code></span><a class="headerlink" title="Permalink to this term" href="#CPUSchedulingResetOnFork=">¶</a></dt><dd><p>Takes a boolean
|
||
argument. If true, elevated CPU
|
||
scheduling priorities and policies
|
||
will be reset when the executed
|
||
processes fork, and can hence not leak
|
||
into child processes. See
|
||
<a href="sched_setscheduler.html"><span class="citerefentry"><span class="refentrytitle">sched_setscheduler</span>(2)</span></a>
|
||
for details. Defaults to false.</p></dd><dt id="CPUAffinity="><span class="term"><code class="varname">CPUAffinity=</code></span><a class="headerlink" title="Permalink to this term" href="#CPUAffinity=">¶</a></dt><dd><p>Controls the CPU
|
||
affinity of the executed
|
||
processes. Takes a space-separated
|
||
list of CPU indices. This option may
|
||
be specified more than once in which
|
||
case the specificed CPU affinity masks
|
||
are merged. If the empty string is
|
||
assigned, the mask is reset, all
|
||
assignments prior to this will have no
|
||
effect. See
|
||
<a href="sched_setaffinity.html"><span class="citerefentry"><span class="refentrytitle">sched_setaffinity</span>(2)</span></a>
|
||
for details.</p></dd><dt id="UMask="><span class="term"><code class="varname">UMask=</code></span><a class="headerlink" title="Permalink to this term" href="#UMask=">¶</a></dt><dd><p>Controls the file mode
|
||
creation mask. Takes an access mode in
|
||
octal notation. See
|
||
<a href="umask.html"><span class="citerefentry"><span class="refentrytitle">umask</span>(2)</span></a>
|
||
for details. Defaults to
|
||
0022.</p></dd><dt id="Environment="><span class="term"><code class="varname">Environment=</code></span><a class="headerlink" title="Permalink to this term" href="#Environment=">¶</a></dt><dd><p>Sets environment
|
||
variables for executed
|
||
processes. Takes a space-separated
|
||
list of variable assignments. This
|
||
option may be specified more than once
|
||
in which case all listed variables
|
||
will be set. If the same variable is
|
||
set twice, the later setting will
|
||
override the earlier setting. If the
|
||
empty string is assigned to this
|
||
option, the list of environment
|
||
variables is reset, all prior
|
||
assignments have no effect.
|
||
Variable expansion is not performed
|
||
inside the strings, however, specifier
|
||
expansion is possible. The $ character has
|
||
no special meaning.
|
||
If you need to assign a value containing spaces
|
||
to a variable, use double quotes (")
|
||
for the assignment.</p><p>Example:
|
||
</p><pre class="programlisting">Environment="VAR1=word1 word2" VAR2=word3 "VAR3=$word 5 6"</pre><p>
|
||
gives three variables "<code class="literal">VAR1</code>",
|
||
"<code class="literal">VAR2</code>", "<code class="literal">VAR3</code>"
|
||
with the values "<code class="literal">word1 word2</code>",
|
||
"<code class="literal">word3</code>", "<code class="literal">$word 5 6</code>".
|
||
</p><p>
|
||
See
|
||
<a href="environ.html"><span class="citerefentry"><span class="refentrytitle">environ</span>(7)</span></a>
|
||
for details about environment variables.</p></dd><dt id="EnvironmentFile="><span class="term"><code class="varname">EnvironmentFile=</code></span><a class="headerlink" title="Permalink to this term" href="#EnvironmentFile=">¶</a></dt><dd><p>Similar to
|
||
<code class="varname">Environment=</code> but
|
||
reads the environment variables from a
|
||
text file. The text file should
|
||
contain new-line-separated variable
|
||
assignments. Empty lines and lines
|
||
starting with ; or # will be ignored,
|
||
which may be used for commenting. A line
|
||
ending with a backslash will be concatenated
|
||
with the following one, allowing multiline variable
|
||
definitions. The parser strips leading
|
||
and trailing whitespace from the values
|
||
of assignments, unless you use
|
||
double quotes (").</p><p>The argument passed should be an
|
||
absolute filename or wildcard
|
||
expression, optionally prefixed with
|
||
"<code class="literal">-</code>", which indicates
|
||
that if the file does not exist, it
|
||
will not be read and no error or warning
|
||
message is logged. This option may be
|
||
specified more than once in which case
|
||
all specified files are read. If the
|
||
empty string is assigned to this
|
||
option, the list of file to read is
|
||
reset, all prior assignments have no
|
||
effect.</p><p>The files listed with this
|
||
directive will be read shortly before
|
||
the process is executed (more
|
||
specifically, after all
|
||
processes from a previous unit state
|
||
terminated. This means you can
|
||
generate these files in one unit
|
||
state, and read it with this option in
|
||
the next). Settings from these files
|
||
override settings made with
|
||
<code class="varname">Environment=</code>. If
|
||
the same variable is set twice from
|
||
these files, the files will be read in
|
||
the order they are specified and the
|
||
later setting will override the
|
||
earlier setting.</p></dd><dt id="StandardInput="><span class="term"><code class="varname">StandardInput=</code></span><a class="headerlink" title="Permalink to this term" href="#StandardInput=">¶</a></dt><dd><p>Controls where file
|
||
descriptor 0 (STDIN) of the executed
|
||
processes is connected to. Takes one
|
||
of <code class="option">null</code>,
|
||
<code class="option">tty</code>,
|
||
<code class="option">tty-force</code>,
|
||
<code class="option">tty-fail</code> or
|
||
<code class="option">socket</code>. If
|
||
<code class="option">null</code> is selected,
|
||
standard input will be connected to
|
||
<code class="filename">/dev/null</code>,
|
||
i.e. all read attempts by the process
|
||
will result in immediate EOF. If
|
||
<code class="option">tty</code> is selected,
|
||
standard input is connected to a TTY
|
||
(as configured by
|
||
<code class="varname">TTYPath=</code>, see
|
||
below) and the executed process
|
||
becomes the controlling process of the
|
||
terminal. If the terminal is already
|
||
being controlled by another process, the
|
||
executed process waits until the current
|
||
controlling process releases the
|
||
terminal.
|
||
<code class="option">tty-force</code>
|
||
is similar to <code class="option">tty</code>,
|
||
but the executed process is forcefully
|
||
and immediately made the controlling
|
||
process of the terminal, potentially
|
||
removing previous controlling
|
||
processes from the
|
||
terminal. <code class="option">tty-fail</code> is
|
||
similar to <code class="option">tty</code> but if
|
||
the terminal already has a controlling
|
||
process start-up of the executed
|
||
process fails. The
|
||
<code class="option">socket</code> option is only
|
||
valid in socket-activated services,
|
||
and only when the socket configuration
|
||
file (see
|
||
<a href="systemd.socket.html"><span class="citerefentry"><span class="refentrytitle">systemd.socket</span>(5)</span></a>
|
||
for details) specifies a single socket
|
||
only. If this option is set, standard
|
||
input will be connected to the socket
|
||
the service was activated from, which
|
||
is primarily useful for compatibility
|
||
with daemons designed for use with the
|
||
traditional
|
||
<a href="inetd.html"><span class="citerefentry"><span class="refentrytitle">inetd</span>(8)</span></a>
|
||
daemon. This setting defaults to
|
||
<code class="option">null</code>.</p></dd><dt id="StandardOutput="><span class="term"><code class="varname">StandardOutput=</code></span><a class="headerlink" title="Permalink to this term" href="#StandardOutput=">¶</a></dt><dd><p>Controls where file
|
||
descriptor 1 (STDOUT) of the executed
|
||
processes is connected to. Takes one
|
||
of <code class="option">inherit</code>,
|
||
<code class="option">null</code>,
|
||
<code class="option">tty</code>,
|
||
<code class="option">syslog</code>,
|
||
<code class="option">kmsg</code>,
|
||
<code class="option">journal</code>,
|
||
<code class="option">syslog+console</code>,
|
||
<code class="option">kmsg+console</code>,
|
||
<code class="option">journal+console</code> or
|
||
<code class="option">socket</code>. If set to
|
||
<code class="option">inherit</code>, the file
|
||
descriptor of standard input is
|
||
duplicated for standard output. If set
|
||
to <code class="option">null</code>, standard
|
||
output will be connected to
|
||
<code class="filename">/dev/null</code>,
|
||
i.e. everything written to it will be
|
||
lost. If set to <code class="option">tty</code>,
|
||
standard output will be connected to a
|
||
tty (as configured via
|
||
<code class="varname">TTYPath=</code>, see
|
||
below). If the TTY is used for output
|
||
only, the executed process will not
|
||
become the controlling process of the
|
||
terminal, and will not fail or wait
|
||
for other processes to release the
|
||
terminal. <code class="option">syslog</code>
|
||
connects standard output to the
|
||
<a href="syslog.html"><span class="citerefentry"><span class="refentrytitle">syslog</span>(3)</span></a>
|
||
system syslog
|
||
service. <code class="option">kmsg</code>
|
||
connects it with the kernel log buffer
|
||
which is accessible via
|
||
<a href="dmesg.html"><span class="citerefentry"><span class="refentrytitle">dmesg</span>(1)</span></a>. <code class="option">journal</code>
|
||
connects it with the journal which is
|
||
accessible via
|
||
<a href="journalctl.html"><span class="citerefentry"><span class="refentrytitle">journalctl</span>(1)</span></a>
|
||
(Note that everything that is written
|
||
to syslog or kmsg is implicitly stored
|
||
in the journal as well, those options
|
||
are hence supersets of this
|
||
one). <code class="option">syslog+console</code>,
|
||
<code class="option">journal+console</code> and
|
||
<code class="option">kmsg+console</code> work
|
||
similarly but copy the output to the
|
||
system console as
|
||
well. <code class="option">socket</code> connects
|
||
standard output to a socket from
|
||
socket activation, semantics are
|
||
similar to the respective option of
|
||
<code class="varname">StandardInput=</code>.
|
||
This setting defaults to the value set
|
||
with
|
||
<code class="option">DefaultStandardOutput=</code>
|
||
in
|
||
<a href="systemd-system.conf.html"><span class="citerefentry"><span class="refentrytitle">systemd-system.conf</span>(5)</span></a>,
|
||
which defaults to
|
||
<code class="option">journal</code>.</p></dd><dt id="StandardError="><span class="term"><code class="varname">StandardError=</code></span><a class="headerlink" title="Permalink to this term" href="#StandardError=">¶</a></dt><dd><p>Controls where file
|
||
descriptor 2 (STDERR) of the
|
||
executed processes is connected to.
|
||
The available options are identical to
|
||
those of
|
||
<code class="varname">StandardOutput=</code>,
|
||
with one exception: if set to
|
||
<code class="option">inherit</code> the file
|
||
descriptor used for standard output is
|
||
duplicated for standard error. This
|
||
setting defaults to the value set with
|
||
<code class="option">DefaultStandardError=</code>
|
||
in
|
||
<a href="systemd-system.conf.html"><span class="citerefentry"><span class="refentrytitle">systemd-system.conf</span>(5)</span></a>,
|
||
which defaults to
|
||
<code class="option">inherit</code>.</p></dd><dt id="TTYPath="><span class="term"><code class="varname">TTYPath=</code></span><a class="headerlink" title="Permalink to this term" href="#TTYPath=">¶</a></dt><dd><p>Sets the terminal
|
||
device node to use if standard input, output,
|
||
or error are connected to a
|
||
TTY (see above). Defaults to
|
||
<code class="filename">/dev/console</code>.</p></dd><dt id="TTYReset="><span class="term"><code class="varname">TTYReset=</code></span><a class="headerlink" title="Permalink to this term" href="#TTYReset=">¶</a></dt><dd><p>Reset the terminal
|
||
device specified with
|
||
<code class="varname">TTYPath=</code> before and
|
||
after execution. Defaults to
|
||
"<code class="literal">no</code>".</p></dd><dt id="TTYVHangup="><span class="term"><code class="varname">TTYVHangup=</code></span><a class="headerlink" title="Permalink to this term" href="#TTYVHangup=">¶</a></dt><dd><p>Disconnect all clients
|
||
which have opened the terminal device
|
||
specified with
|
||
<code class="varname">TTYPath=</code>
|
||
before and after execution. Defaults
|
||
to
|
||
"<code class="literal">no</code>".</p></dd><dt id="TTYVTDisallocate="><span class="term"><code class="varname">TTYVTDisallocate=</code></span><a class="headerlink" title="Permalink to this term" href="#TTYVTDisallocate=">¶</a></dt><dd><p>If the terminal
|
||
device specified with
|
||
<code class="varname">TTYPath=</code> is a
|
||
virtual console terminal, try to
|
||
deallocate the TTY before and after
|
||
execution. This ensures that the
|
||
screen and scrollback buffer is
|
||
cleared. Defaults to
|
||
"<code class="literal">no</code>".</p></dd><dt id="SyslogIdentifier="><span class="term"><code class="varname">SyslogIdentifier=</code></span><a class="headerlink" title="Permalink to this term" href="#SyslogIdentifier=">¶</a></dt><dd><p>Sets the process name
|
||
to prefix log lines sent to syslog or
|
||
the kernel log buffer with. If not set,
|
||
defaults to the process name of the
|
||
executed process. This option is only
|
||
useful when
|
||
<code class="varname">StandardOutput=</code> or
|
||
<code class="varname">StandardError=</code> are
|
||
set to <code class="option">syslog</code> or
|
||
<code class="option">kmsg</code>.</p></dd><dt id="SyslogFacility="><span class="term"><code class="varname">SyslogFacility=</code></span><a class="headerlink" title="Permalink to this term" href="#SyslogFacility=">¶</a></dt><dd><p>Sets the syslog
|
||
facility to use when logging to
|
||
syslog. One of <code class="option">kern</code>,
|
||
<code class="option">user</code>,
|
||
<code class="option">mail</code>,
|
||
<code class="option">daemon</code>,
|
||
<code class="option">auth</code>,
|
||
<code class="option">syslog</code>,
|
||
<code class="option">lpr</code>,
|
||
<code class="option">news</code>,
|
||
<code class="option">uucp</code>,
|
||
<code class="option">cron</code>,
|
||
<code class="option">authpriv</code>,
|
||
<code class="option">ftp</code>,
|
||
<code class="option">local0</code>,
|
||
<code class="option">local1</code>,
|
||
<code class="option">local2</code>,
|
||
<code class="option">local3</code>,
|
||
<code class="option">local4</code>,
|
||
<code class="option">local5</code>,
|
||
<code class="option">local6</code> or
|
||
<code class="option">local7</code>. See
|
||
<a href="syslog.html"><span class="citerefentry"><span class="refentrytitle">syslog</span>(3)</span></a>
|
||
for details. This option is only
|
||
useful when
|
||
<code class="varname">StandardOutput=</code> or
|
||
<code class="varname">StandardError=</code> are
|
||
set to <code class="option">syslog</code>.
|
||
Defaults to
|
||
<code class="option">daemon</code>.</p></dd><dt id="SyslogLevel="><span class="term"><code class="varname">SyslogLevel=</code></span><a class="headerlink" title="Permalink to this term" href="#SyslogLevel=">¶</a></dt><dd><p>Default syslog level
|
||
to use when logging to syslog or the
|
||
kernel log buffer. One of
|
||
<code class="option">emerg</code>,
|
||
<code class="option">alert</code>,
|
||
<code class="option">crit</code>,
|
||
<code class="option">err</code>,
|
||
<code class="option">warning</code>,
|
||
<code class="option">notice</code>,
|
||
<code class="option">info</code>,
|
||
<code class="option">debug</code>. See
|
||
<a href="syslog.html"><span class="citerefentry"><span class="refentrytitle">syslog</span>(3)</span></a>
|
||
for details. This option is only
|
||
useful when
|
||
<code class="varname">StandardOutput=</code> or
|
||
<code class="varname">StandardError=</code> are
|
||
set to <code class="option">syslog</code> or
|
||
<code class="option">kmsg</code>. Note that
|
||
individual lines output by the daemon
|
||
might be prefixed with a different log
|
||
level which can be used to override
|
||
the default log level specified
|
||
here. The interpretation of these
|
||
prefixes may be disabled with
|
||
<code class="varname">SyslogLevelPrefix=</code>,
|
||
see below. For details see
|
||
<a href="sd-daemon.html"><span class="citerefentry"><span class="refentrytitle">sd-daemon</span>(3)</span></a>.
|
||
|
||
Defaults to
|
||
<code class="option">info</code>.</p></dd><dt id="SyslogLevelPrefix="><span class="term"><code class="varname">SyslogLevelPrefix=</code></span><a class="headerlink" title="Permalink to this term" href="#SyslogLevelPrefix=">¶</a></dt><dd><p>Takes a boolean
|
||
argument. If true and
|
||
<code class="varname">StandardOutput=</code> or
|
||
<code class="varname">StandardError=</code> are
|
||
set to <code class="option">syslog</code>,
|
||
<code class="option">kmsg</code> or
|
||
<code class="option">journal</code>, log lines
|
||
written by the executed process that
|
||
are prefixed with a log level will be
|
||
passed on to syslog with this log
|
||
level set but the prefix removed. If
|
||
set to false, the interpretation of
|
||
these prefixes is disabled and the
|
||
logged lines are passed on as-is. For
|
||
details about this prefixing see
|
||
<a href="sd-daemon.html"><span class="citerefentry"><span class="refentrytitle">sd-daemon</span>(3)</span></a>.
|
||
Defaults to true.</p></dd><dt id="TimerSlackNSec="><span class="term"><code class="varname">TimerSlackNSec=</code></span><a class="headerlink" title="Permalink to this term" href="#TimerSlackNSec=">¶</a></dt><dd><p>Sets the timer slack
|
||
in nanoseconds for the executed
|
||
processes. The timer slack controls
|
||
the accuracy of wake-ups triggered by
|
||
timers. See
|
||
<a href="prctl.html"><span class="citerefentry"><span class="refentrytitle">prctl</span>(2)</span></a>
|
||
for more information. Note that in
|
||
contrast to most other time span
|
||
definitions this parameter takes an
|
||
integer value in nano-seconds if no
|
||
unit is specified. The usual time
|
||
units are understood
|
||
too.</p></dd><dt id="LimitCPU="><span class="term"><code class="varname">LimitCPU=</code>, </span><span class="term"><code class="varname">LimitFSIZE=</code>, </span><span class="term"><code class="varname">LimitDATA=</code>, </span><span class="term"><code class="varname">LimitSTACK=</code>, </span><span class="term"><code class="varname">LimitCORE=</code>, </span><span class="term"><code class="varname">LimitRSS=</code>, </span><span class="term"><code class="varname">LimitNOFILE=</code>, </span><span class="term"><code class="varname">LimitAS=</code>, </span><span class="term"><code class="varname">LimitNPROC=</code>, </span><span class="term"><code class="varname">LimitMEMLOCK=</code>, </span><span class="term"><code class="varname">LimitLOCKS=</code>, </span><span class="term"><code class="varname">LimitSIGPENDING=</code>, </span><span class="term"><code class="varname">LimitMSGQUEUE=</code>, </span><span class="term"><code class="varname">LimitNICE=</code>, </span><span class="term"><code class="varname">LimitRTPRIO=</code>, </span><span class="term"><code class="varname">LimitRTTIME=</code></span><a class="headerlink" title="Permalink to this term" href="#LimitCPU=">¶</a></dt><dd><p>These settings control
|
||
various resource limits for executed
|
||
processes. See
|
||
<a href="setrlimit.html"><span class="citerefentry"><span class="refentrytitle">setrlimit</span>(2)</span></a>
|
||
for details. Use the string
|
||
<code class="varname">infinity</code> to
|
||
configure no limit on a specific
|
||
resource.</p></dd><dt id="PAMName="><span class="term"><code class="varname">PAMName=</code></span><a class="headerlink" title="Permalink to this term" href="#PAMName=">¶</a></dt><dd><p>Sets the PAM service
|
||
name to set up a session as. If set,
|
||
the executed process will be
|
||
registered as a PAM session under the
|
||
specified service name. This is only
|
||
useful in conjunction with the
|
||
<code class="varname">User=</code> setting. If
|
||
not set, no PAM session will be opened
|
||
for the executed processes. See
|
||
<a href="pam.html"><span class="citerefentry"><span class="refentrytitle">pam</span>(8)</span></a>
|
||
for details.</p></dd><dt id="CapabilityBoundingSet="><span class="term"><code class="varname">CapabilityBoundingSet=</code></span><a class="headerlink" title="Permalink to this term" href="#CapabilityBoundingSet=">¶</a></dt><dd><p>Controls which
|
||
capabilities to include in the
|
||
capability bounding set for the
|
||
executed process. See
|
||
<a href="capabilities.html"><span class="citerefentry"><span class="refentrytitle">capabilities</span>(7)</span></a>
|
||
for details. Takes a whitespace-separated
|
||
list of capability names as read by
|
||
<a href="cap_from_name.html"><span class="citerefentry"><span class="refentrytitle">cap_from_name</span>(3)</span></a>,
|
||
e.g. <code class="constant">CAP_SYS_ADMIN</code>,
|
||
<code class="constant">CAP_DAC_OVERRIDE</code>,
|
||
<code class="constant">CAP_SYS_PTRACE</code>.
|
||
Capabilities listed will be included
|
||
in the bounding set, all others are
|
||
removed. If the list of capabilities
|
||
is prefixed with "<code class="literal">~</code>",
|
||
all but the listed capabilities will
|
||
be included, the effect of the
|
||
assignment inverted. Note that this
|
||
option also affects the respective
|
||
capabilities in the effective,
|
||
permitted and inheritable capability
|
||
sets, on top of what
|
||
<code class="varname">Capabilities=</code>
|
||
does. If this option is not used, the
|
||
capability bounding set is not
|
||
modified on process execution, hence
|
||
no limits on the capabilities of the
|
||
process are enforced. This option may
|
||
appear more than once in which case
|
||
the bounding sets are merged. If the
|
||
empty string is assigned to this
|
||
option, the bounding set is reset to
|
||
the empty capability set, and all
|
||
prior settings have no effect. If set
|
||
to "<code class="literal">~</code>" (without any
|
||
further argument), the bounding set is
|
||
reset to the full set of available
|
||
capabilities, also undoing any
|
||
previous settings.</p></dd><dt id="SecureBits="><span class="term"><code class="varname">SecureBits=</code></span><a class="headerlink" title="Permalink to this term" href="#SecureBits=">¶</a></dt><dd><p>Controls the secure
|
||
bits set for the executed process. See
|
||
<a href="capabilities.html"><span class="citerefentry"><span class="refentrytitle">capabilities</span>(7)</span></a>
|
||
for details. Takes a list of strings:
|
||
<code class="option">keep-caps</code>,
|
||
<code class="option">keep-caps-locked</code>,
|
||
<code class="option">no-setuid-fixup</code>,
|
||
<code class="option">no-setuid-fixup-locked</code>,
|
||
<code class="option">noroot</code> and/or
|
||
<code class="option">noroot-locked</code>. This
|
||
option may appear more than once in
|
||
which case the secure bits are
|
||
ORed. If the empty string is assigned
|
||
to this option, the bits are reset to
|
||
0.</p></dd><dt id="Capabilities="><span class="term"><code class="varname">Capabilities=</code></span><a class="headerlink" title="Permalink to this term" href="#Capabilities=">¶</a></dt><dd><p>Controls the
|
||
<a href="capabilities.html"><span class="citerefentry"><span class="refentrytitle">capabilities</span>(7)</span></a>
|
||
set for the executed process. Take a
|
||
capability string describing the
|
||
effective, permitted and inherited
|
||
capability sets as documented in
|
||
<a href="cap_from_text.html"><span class="citerefentry"><span class="refentrytitle">cap_from_text</span>(3)</span></a>.
|
||
Note that these capability sets are
|
||
usually influenced (and filtered) by the capabilities
|
||
attached to the executed file. Due to
|
||
that
|
||
<code class="varname">CapabilityBoundingSet=</code>
|
||
is probably the much more useful
|
||
setting.</p></dd><dt id="ReadWriteDirectories="><span class="term"><code class="varname">ReadWriteDirectories=</code>, </span><span class="term"><code class="varname">ReadOnlyDirectories=</code>, </span><span class="term"><code class="varname">InaccessibleDirectories=</code></span><a class="headerlink" title="Permalink to this term" href="#ReadWriteDirectories=">¶</a></dt><dd><p>Sets up a new file
|
||
system namespace for executed
|
||
processes. These options may be used
|
||
to limit access a process might have
|
||
to the main file system
|
||
hierarchy. Each setting takes a
|
||
space-separated list of absolute
|
||
directory paths. Directories listed in
|
||
<code class="varname">ReadWriteDirectories=</code>
|
||
are accessible from within the
|
||
namespace with the same access rights
|
||
as from outside. Directories listed in
|
||
<code class="varname">ReadOnlyDirectories=</code>
|
||
are accessible for reading only,
|
||
writing will be refused even if the
|
||
usual file access controls would
|
||
permit this. Directories listed in
|
||
<code class="varname">InaccessibleDirectories=</code>
|
||
will be made inaccessible for
|
||
processes inside the namespace. Note
|
||
that restricting access with these
|
||
options does not extend to submounts
|
||
of a directory that are created later
|
||
on. These options may be specified
|
||
more than once in which case all
|
||
directories listed will have limited
|
||
access from within the namespace. If
|
||
the empty string is assigned to this
|
||
option, the specific list is reset,
|
||
and all prior assignments have no
|
||
effect.</p><p>Paths in
|
||
<code class="varname">ReadOnlyDirectories=</code>
|
||
and
|
||
<code class="varname">InaccessibleDirectories=</code>
|
||
may be prefixed with
|
||
"<code class="literal">-</code>", in which case
|
||
they will be ignored when they do not
|
||
exist. Note that using this
|
||
setting will disconnect propagation of
|
||
mounts from the service to the host
|
||
(propagation in the opposite direction
|
||
continues to work). This means that
|
||
this setting may not be used for
|
||
services which shall be able to
|
||
install mount points in the main mount
|
||
namespace.</p></dd><dt id="PrivateTmp="><span class="term"><code class="varname">PrivateTmp=</code></span><a class="headerlink" title="Permalink to this term" href="#PrivateTmp=">¶</a></dt><dd><p>Takes a boolean
|
||
argument. If true, sets up a new file
|
||
system namespace for the executed
|
||
processes and mounts private
|
||
<code class="filename">/tmp</code> and
|
||
<code class="filename">/var/tmp</code>
|
||
directories inside it that is not
|
||
shared by processes outside of the
|
||
namespace. This is useful to secure
|
||
access to temporary files of the
|
||
process, but makes sharing between
|
||
processes via
|
||
<code class="filename">/tmp</code> or
|
||
<code class="filename">/var/tmp</code>
|
||
impossible. If this is enabled, all
|
||
temporary files created by a service
|
||
in these directories will be removed
|
||
after the service is stopped. Defaults
|
||
to false. It is possible to run two or
|
||
more units within the same private
|
||
<code class="filename">/tmp</code> and
|
||
<code class="filename">/var/tmp</code>
|
||
namespace by using the
|
||
<code class="varname">JoinsNamespaceOf=</code>
|
||
directive, see
|
||
<a href="systemd.unit.html"><span class="citerefentry"><span class="refentrytitle">systemd.unit</span>(5)</span></a>
|
||
for details. Note that using this
|
||
setting will disconnect propagation of
|
||
mounts from the service to the host
|
||
(propagation in the opposite direction
|
||
continues to work). This means that
|
||
this setting may not be used for
|
||
services which shall be able to install
|
||
mount points in the main mount
|
||
namespace.</p></dd><dt id="PrivateDevices="><span class="term"><code class="varname">PrivateDevices=</code></span><a class="headerlink" title="Permalink to this term" href="#PrivateDevices=">¶</a></dt><dd><p>Takes a boolean
|
||
argument. If true, sets up a new /dev
|
||
namespace for the executed processes
|
||
and only adds API pseudo devices such
|
||
as <code class="filename">/dev/null</code>,
|
||
<code class="filename">/dev/zero</code> or
|
||
<code class="filename">/dev/random</code> (as
|
||
well as the pseudo TTY subsystem) to
|
||
it, but no physical devices such as
|
||
<code class="filename">/dev/sda</code>. This is
|
||
useful to securely turn off physical
|
||
device access by the executed
|
||
process. Defaults to false. Enabling
|
||
this option will also remove
|
||
<code class="constant">CAP_MKNOD</code> from
|
||
the capability bounding set for the
|
||
unit (see above), and set
|
||
<code class="varname">DevicePolicy=closed</code>
|
||
(see
|
||
<a href="systemd.resource-control.html"><span class="citerefentry"><span class="refentrytitle">systemd.resource-control</span>(5)</span></a>
|
||
for details). Note that using this
|
||
setting will disconnect propagation of
|
||
mounts from the service to the host
|
||
(propagation in the opposite direction
|
||
continues to work). This means that
|
||
this setting may not be used for
|
||
services which shall be able to
|
||
install mount points in the main mount
|
||
namespace.</p></dd><dt id="PrivateNetwork="><span class="term"><code class="varname">PrivateNetwork=</code></span><a class="headerlink" title="Permalink to this term" href="#PrivateNetwork=">¶</a></dt><dd><p>Takes a boolean
|
||
argument. If true, sets up a new
|
||
network namespace for the executed
|
||
processes and configures only the
|
||
loopback network device
|
||
"<code class="literal">lo</code>" inside it. No
|
||
other network devices will be
|
||
available to the executed process.
|
||
This is useful to securely turn off
|
||
network access by the executed
|
||
process. Defaults to false. It is
|
||
possible to run two or more units
|
||
within the same private network
|
||
namespace by using the
|
||
<code class="varname">JoinsNamespaceOf=</code>
|
||
directive, see
|
||
<a href="systemd.unit.html"><span class="citerefentry"><span class="refentrytitle">systemd.unit</span>(5)</span></a>
|
||
for details. Note that this option
|
||
will disconnect all socket families
|
||
from the host, this includes
|
||
AF_NETLINK and AF_UNIX. The latter has
|
||
the effect that AF_UNIX sockets in the
|
||
abstract socket namespace will become
|
||
unavailable to the processes (however,
|
||
those located in the file system will
|
||
continue to be
|
||
accessible).</p></dd><dt id="ProtectSystem="><span class="term"><code class="varname">ProtectSystem=</code></span><a class="headerlink" title="Permalink to this term" href="#ProtectSystem=">¶</a></dt><dd><p>Takes a boolean
|
||
argument or
|
||
"<code class="literal">full</code>". If true,
|
||
mounts the <code class="filename">/usr</code>
|
||
directory read-only for processes
|
||
invoked by this unit. If set to
|
||
"<code class="literal">full</code>" the
|
||
<code class="filename">/etc</code> is mounted
|
||
read-only, too. This setting ensures
|
||
that any modification of the vendor
|
||
supplied operating system (and
|
||
optionally its configuration) is
|
||
prohibited for the service. It is
|
||
recommended to enable this setting for
|
||
all long-running services, unless they
|
||
are involved with system updates or
|
||
need to modify the operating system in
|
||
other ways. Note however, that
|
||
processes retaining the CAP_SYS_ADMIN
|
||
capability can undo the effect of this
|
||
setting. This setting is hence
|
||
particularly useful for daemons which
|
||
have this capability removed, for
|
||
example with
|
||
<code class="varname">CapabilityBoundingSet=</code>. Defaults
|
||
to off.</p></dd><dt id="ProtectHome="><span class="term"><code class="varname">ProtectHome=</code></span><a class="headerlink" title="Permalink to this term" href="#ProtectHome=">¶</a></dt><dd><p>Takes a boolean
|
||
argument or
|
||
"<code class="literal">read-only</code>". If true,
|
||
the directories
|
||
<code class="filename">/home</code> and
|
||
<code class="filename">/run/user</code> are
|
||
made inaccessible and empty for
|
||
processes invoked by this unit. If set
|
||
to "<code class="literal">read-only</code>" the
|
||
two directores are made read-only
|
||
instead. It is recommended to enable
|
||
this setting for all long-running
|
||
services (in particular network-facing
|
||
ones), to ensure they cannot get access
|
||
to private user data, unless the
|
||
services actually require access to
|
||
the user's private data. Note however,
|
||
that processes retaining the
|
||
CAP_SYS_ADMIN capability can undo the
|
||
effect of this setting. This setting
|
||
is hence particularly useful for
|
||
daemons which have this capability
|
||
removed, for example with
|
||
<code class="varname">CapabilityBoundingSet=</code>. Defaults
|
||
to off.</p></dd><dt id="MountFlags="><span class="term"><code class="varname">MountFlags=</code></span><a class="headerlink" title="Permalink to this term" href="#MountFlags=">¶</a></dt><dd><p>Takes a mount
|
||
propagation flag:
|
||
<code class="option">shared</code>,
|
||
<code class="option">slave</code> or
|
||
<code class="option">private</code>, which
|
||
control whether mounts in the file
|
||
system namespace set up for this
|
||
unit's processes will receive or
|
||
propagate mounts or unmounts. See
|
||
<a href="mount.html"><span class="citerefentry"><span class="refentrytitle">mount</span>(2)</span></a>
|
||
for details. Defaults to
|
||
<code class="option">shared</code>. Use
|
||
<code class="option">shared</code> to ensure that
|
||
mounts and unmounts are propagated
|
||
from the host to the container and
|
||
vice versa. Use <code class="option">slave</code>
|
||
to run processes so that none of their
|
||
mounts and unmounts will propagate to
|
||
the host. Use <code class="option">private</code>
|
||
to also ensure that no mounts and
|
||
unmounts from the host will propagate
|
||
into the unit processes'
|
||
namespace. Note that
|
||
<code class="option">slave</code> means that file
|
||
systems mounted on the host might stay
|
||
mounted continously in the unit's
|
||
namespace, and thus keep the device
|
||
busy. Note that the file system
|
||
namespace related options
|
||
(<code class="varname">PrivateTmp=</code>,
|
||
<code class="varname">PrivateDevices=</code>,
|
||
<code class="varname">ReadOnlySystem=</code>,
|
||
<code class="varname">ProtectedHome=</code>,
|
||
<code class="varname">ReadOnlyDirectories=</code>,
|
||
<code class="varname">InaccessibleDirectories=</code>
|
||
and
|
||
<code class="varname">ReadWriteDirectories=</code>)
|
||
require that mount and unmount
|
||
propagation from the unit's file
|
||
system namespace is disabled, and
|
||
hence downgrade
|
||
<code class="option">shared</code> to
|
||
<code class="option">slave</code>.
|
||
</p></dd><dt id="UtmpIdentifier="><span class="term"><code class="varname">UtmpIdentifier=</code></span><a class="headerlink" title="Permalink to this term" href="#UtmpIdentifier=">¶</a></dt><dd><p>Takes a four
|
||
character identifier string for an
|
||
utmp/wtmp entry for this service. This
|
||
should only be set for services such
|
||
as <span class="command"><strong>getty</strong></span>
|
||
implementations where utmp/wtmp
|
||
entries must be created and cleared
|
||
before and after execution. If the
|
||
configured string is longer than four
|
||
characters, it is truncated and the
|
||
terminal four characters are
|
||
used. This setting interprets %I style
|
||
string replacements. This setting is
|
||
unset by default, i.e. no utmp/wtmp
|
||
entries are created or cleaned up for
|
||
this service.</p></dd><dt id="SELinuxContext="><span class="term"><code class="varname">SELinuxContext=</code></span><a class="headerlink" title="Permalink to this term" href="#SELinuxContext=">¶</a></dt><dd><p>Set the SELinux
|
||
security context of the executed
|
||
process. If set, this will override
|
||
the automated domain
|
||
transition. However, the policy still
|
||
needs to autorize the transition. This
|
||
directive is ignored if SELinux is
|
||
disabled. If prefixed by
|
||
"<code class="literal">-</code>", all errors will
|
||
be ignored. See
|
||
<a href="setexeccon.html"><span class="citerefentry"><span class="refentrytitle">setexeccon</span>(3)</span></a>
|
||
for details.</p></dd><dt id="AppArmorProfile="><span class="term"><code class="varname">AppArmorProfile=</code></span><a class="headerlink" title="Permalink to this term" href="#AppArmorProfile=">¶</a></dt><dd><p>Takes a profile name as argument.
|
||
The process executed by the unit will switch to
|
||
this profile when started. Profiles must already
|
||
be loaded in the kernel, or the unit will fail.
|
||
This result in a non operation if AppArmor is not
|
||
enabled. If prefixed by "<code class="literal">-</code>", all errors
|
||
will be ignored.
|
||
</p></dd><dt id="IgnoreSIGPIPE="><span class="term"><code class="varname">IgnoreSIGPIPE=</code></span><a class="headerlink" title="Permalink to this term" href="#IgnoreSIGPIPE=">¶</a></dt><dd><p>Takes a boolean
|
||
argument. If true, causes <code class="constant">SIGPIPE</code> to be
|
||
ignored in the executed
|
||
process. Defaults to true because
|
||
<code class="constant">SIGPIPE</code> generally is useful only in
|
||
shell pipelines.</p></dd><dt id="NoNewPrivileges="><span class="term"><code class="varname">NoNewPrivileges=</code></span><a class="headerlink" title="Permalink to this term" href="#NoNewPrivileges=">¶</a></dt><dd><p>Takes a boolean
|
||
argument. If true, ensures that the
|
||
service process and all its children
|
||
can never gain new privileges. This
|
||
option is more powerful than the respective
|
||
secure bits flags (see above), as it
|
||
also prohibits UID changes of any
|
||
kind. This is the simplest, most
|
||
effective way to ensure that a process
|
||
and its children can never elevate
|
||
privileges again.</p></dd><dt id="SystemCallFilter="><span class="term"><code class="varname">SystemCallFilter=</code></span><a class="headerlink" title="Permalink to this term" href="#SystemCallFilter=">¶</a></dt><dd><p>Takes a
|
||
space-separated list of system call
|
||
names. If this setting is used, all
|
||
system calls executed by the unit
|
||
processes except for the listed ones
|
||
will result in immediate process
|
||
termination with the
|
||
<code class="constant">SIGSYS</code> signal
|
||
(whitelisting). If the first character
|
||
of the list is "<code class="literal">~</code>",
|
||
the effect is inverted: only the
|
||
listed system calls will result in
|
||
immediate process termination
|
||
(blacklisting). If running in user
|
||
mode and this option is used,
|
||
<code class="varname">NoNewPrivileges=yes</code>
|
||
is implied. This feature makes use of the
|
||
Secure Computing Mode 2 interfaces of
|
||
the kernel ('seccomp filtering') and
|
||
is useful for enforcing a minimal
|
||
sandboxing environment. Note that the
|
||
<code class="function">execve</code>,
|
||
<code class="function">rt_sigreturn</code>,
|
||
<code class="function">sigreturn</code>,
|
||
<code class="function">exit_group</code>,
|
||
<code class="function">exit</code> system calls
|
||
are implicitly whitelisted and do not
|
||
need to be listed explicitly. This
|
||
option may be specified more than once
|
||
in which case the filter masks are
|
||
merged. If the empty string is
|
||
assigned, the filter is reset, all
|
||
prior assignments will have no
|
||
effect.</p><p>If you specify both types of
|
||
this option (i.e. whitelisting and
|
||
blacklisting), the first encountered
|
||
will take precedence and will dictate
|
||
the default action (termination or
|
||
approval of a system call). Then the
|
||
next occurrences of this option will
|
||
add or delete the listed system calls
|
||
from the set of the filtered system
|
||
calls, depending of its type and the
|
||
default action. (For example, if you have started
|
||
with a whitelisting of
|
||
<code class="function">read</code> and
|
||
<code class="function">write</code>, and right
|
||
after it add a blacklisting of
|
||
<code class="function">write</code>, then
|
||
<code class="function">write</code> will be
|
||
removed from the set.)
|
||
</p></dd><dt id="SystemCallErrorNumber="><span class="term"><code class="varname">SystemCallErrorNumber=</code></span><a class="headerlink" title="Permalink to this term" href="#SystemCallErrorNumber=">¶</a></dt><dd><p>Takes an
|
||
"<code class="literal">errno</code>" error number
|
||
name to return when the system call
|
||
filter configured with
|
||
<code class="varname">SystemCallFilter=</code>
|
||
is triggered, instead of terminating
|
||
the process immediately. Takes an
|
||
error name such as
|
||
<code class="constant">EPERM</code>,
|
||
<code class="constant">EACCES</code> or
|
||
<code class="constant">EUCLEAN</code>. When this
|
||
setting is not used, or when the empty
|
||
string is assigned, the process will be
|
||
terminated immediately when the filter
|
||
is triggered.</p></dd><dt id="SystemCallArchitectures="><span class="term"><code class="varname">SystemCallArchitectures=</code></span><a class="headerlink" title="Permalink to this term" href="#SystemCallArchitectures=">¶</a></dt><dd><p>Takes a space
|
||
separated list of architecture
|
||
identifiers to include in the system
|
||
call filter. The known architecture
|
||
identifiers are
|
||
<code class="constant">x86</code>,
|
||
<code class="constant">x86-64</code>,
|
||
<code class="constant">x32</code>,
|
||
<code class="constant">arm</code> as well as
|
||
the special identifier
|
||
<code class="constant">native</code>. Only
|
||
system calls of the specified
|
||
architectures will be permitted to
|
||
processes of this unit. This is an
|
||
effective way to disable compatibility
|
||
with non-native architectures for
|
||
processes, for example to prohibit
|
||
execution of 32-bit x86 binaries on
|
||
64-bit x86-64 systems. The special
|
||
<code class="constant">native</code> identifier
|
||
implicitly maps to the native
|
||
architecture of the system (or more
|
||
strictly: to the architecture the
|
||
system manager is compiled for). If
|
||
running in user mode and this option
|
||
is used,
|
||
<code class="varname">NoNewPrivileges=yes</code>
|
||
is implied. Note that setting this
|
||
option to a non-empty list implies
|
||
that <code class="constant">native</code> is
|
||
included too. By default, this option
|
||
is set to the empty list, i.e. no
|
||
architecture system call filtering is
|
||
applied.</p></dd><dt id="RestrictAddressFamilies="><span class="term"><code class="varname">RestrictAddressFamilies=</code></span><a class="headerlink" title="Permalink to this term" href="#RestrictAddressFamilies=">¶</a></dt><dd><p>Restricts the set of
|
||
socket address families accessible to
|
||
the processes of this unit. Takes a
|
||
space-separated list of address family
|
||
names to whitelist, such as
|
||
<code class="constant">AF_UNIX</code>,
|
||
<code class="constant">AF_INET</code> or
|
||
<code class="constant">AF_INET6</code>. When
|
||
prefixed with <code class="constant">~</code>
|
||
the listed address families will be
|
||
applied as blacklist, otherwise as
|
||
whitelist. Note that this restricts
|
||
access to the
|
||
<a href="socket.html"><span class="citerefentry"><span class="refentrytitle">socket</span>(2)</span></a>
|
||
system call only. Sockets passed into
|
||
the process by other means (for
|
||
example, by using socket activation
|
||
with socket units, see
|
||
<a href="systemd.socket.html"><span class="citerefentry"><span class="refentrytitle">systemd.socket</span>(5)</span></a>)
|
||
are unaffected. Also, sockets created
|
||
with <code class="function">socketpair()</code>
|
||
(which creates connected AF_UNIX
|
||
sockets only) are unaffected. Note
|
||
that this option has no effect on
|
||
32-bit x86 and is ignored (but works
|
||
correctly on x86-64). If running in user
|
||
mode and this option is used,
|
||
<code class="varname">NoNewPrivileges=yes</code>
|
||
is implied. By default, no
|
||
restriction applies, all address
|
||
families are accessible to
|
||
processes. If assigned the empty
|
||
string, any previous list changes are
|
||
undone.</p><p>Use this option to limit
|
||
exposure of processes to remote
|
||
systems, in particular via exotic
|
||
network protocols. Note that in most
|
||
cases, the local
|
||
<code class="constant">AF_UNIX</code> address
|
||
family should be included in the
|
||
configured whitelist as it is
|
||
frequently used for local
|
||
communication, including for
|
||
<a href="syslog.html"><span class="citerefentry"><span class="refentrytitle">syslog</span>(2)</span></a>
|
||
logging.</p></dd><dt id="Personality="><span class="term"><code class="varname">Personality=</code></span><a class="headerlink" title="Permalink to this term" href="#Personality=">¶</a></dt><dd><p>Controls which
|
||
kernel architecture
|
||
<a href="uname.html"><span class="citerefentry"><span class="refentrytitle">uname</span>(2)</span></a>
|
||
shall report, when invoked by unit
|
||
processes. Takes one of
|
||
<code class="constant">x86</code> and
|
||
<code class="constant">x86-64</code>. This is
|
||
useful when running 32-bit services on
|
||
a 64-bit host system. If not specified,
|
||
the personality is left unmodified and
|
||
thus reflects the personality of the
|
||
host system's
|
||
kernel.</p></dd><dt id="RuntimeDirectory="><span class="term"><code class="varname">RuntimeDirectory=</code>, </span><span class="term"><code class="varname">RuntimeDirectoryMode=</code></span><a class="headerlink" title="Permalink to this term" href="#RuntimeDirectory=">¶</a></dt><dd><p>Takes a list of
|
||
directory names. If set, one or more
|
||
directories by the specified names
|
||
will be created below
|
||
<code class="filename">/run</code> (for system
|
||
services) or below
|
||
<code class="varname">$XDG_RUNTIME_DIR</code>
|
||
(for user services) when the unit is
|
||
started, and removed when the unit is
|
||
stopped. The directories will have the
|
||
access mode specified in
|
||
<code class="varname">RuntimeDirectoryMode=</code>,
|
||
and will be owned by the user and
|
||
group specified in
|
||
<code class="varname">User=</code> and
|
||
<code class="varname">Group=</code>. Use this to
|
||
manage one or more runtime directories
|
||
of the unit and bind their lifetime to
|
||
the daemon runtime. The specified
|
||
directory names must be relative, and
|
||
may not include a
|
||
"<code class="literal">/</code>", i.e. must refer
|
||
to simple directories to create or
|
||
remove. This is particularly useful
|
||
for unprivileged daemons that cannot
|
||
create runtime directories in
|
||
<code class="filename">/run</code> due to lack
|
||
of privileges, and to make sure the
|
||
runtime directory is cleaned up
|
||
automatically after use. For runtime
|
||
directories that require more complex
|
||
or different configuration or lifetime
|
||
guarantees, please consider using
|
||
<a href="tmpfiles.d.html"><span class="citerefentry"><span class="refentrytitle">tmpfiles.d</span>(5)</span></a>.</p></dd></dl></div></div><div class="refsect1"><a name="idm214191115952"></a><h2 id="Environment variables in spawned processes">Environment variables in spawned processes<a class="headerlink" title="Permalink to this headline" href="#Environment%20variables%20in%20spawned%20processes">¶</a></h2><p>Processes started by the system are executed in
|
||
a clean environment in which select variables
|
||
listed below are set. System processes started by systemd
|
||
do not inherit variables from PID 1, but processes
|
||
started by user systemd instances inherit all
|
||
environment variables from the user systemd instance.
|
||
</p><div class="variablelist"><dl class="variablelist"><dt id="$PATH"><span class="term"><code class="varname">$PATH</code></span><a class="headerlink" title="Permalink to this term" href="#%24PATH">¶</a></dt><dd><p>Colon-separated list
|
||
of directiories to use when launching
|
||
executables. Systemd uses a fixed
|
||
value of
|
||
<code class="filename">/usr/local/sbin</code>:<code class="filename">/usr/local/bin</code>:<code class="filename">/usr/sbin</code>:<code class="filename">/usr/bin</code>:<code class="filename">/sbin</code>:<code class="filename">/bin</code>.
|
||
</p></dd><dt id="$LANG"><span class="term"><code class="varname">$LANG</code></span><a class="headerlink" title="Permalink to this term" href="#%24LANG">¶</a></dt><dd><p>Locale. Can be set in
|
||
<a href="locale.conf.html"><span class="citerefentry"><span class="refentrytitle">locale.conf</span>(5)</span></a>
|
||
or on the kernel command line (see
|
||
<a href="systemd.html"><span class="citerefentry"><span class="refentrytitle">systemd</span>(1)</span></a>
|
||
and
|
||
<a href="kernel-command-line.html"><span class="citerefentry"><span class="refentrytitle">kernel-command-line</span>(7)</span></a>).
|
||
</p></dd><dt id="$USER"><span class="term"><code class="varname">$USER</code>, </span><span class="term"><code class="varname">$LOGNAME</code>, </span><span class="term"><code class="varname">$HOME</code>, </span><span class="term"><code class="varname">$SHELL</code></span><a class="headerlink" title="Permalink to this term" href="#%24USER">¶</a></dt><dd><p>User name (twice), home
|
||
directory, and the login shell.
|
||
The variables are set for the units that
|
||
have <code class="varname">User=</code> set,
|
||
which includes user
|
||
<span class="command"><strong>systemd</strong></span> instances.
|
||
See
|
||
<a href="passwd.html"><span class="citerefentry"><span class="refentrytitle">passwd</span>(5)</span></a>.
|
||
</p></dd><dt id="$XDG_RUNTIME_DIR"><span class="term"><code class="varname">$XDG_RUNTIME_DIR</code></span><a class="headerlink" title="Permalink to this term" href="#%24XDG_RUNTIME_DIR">¶</a></dt><dd><p>The directory for volatile
|
||
state. Set for the user <span class="command"><strong>systemd</strong></span>
|
||
instance, and also in user sessions.
|
||
See
|
||
<a href="pam_systemd.html"><span class="citerefentry"><span class="refentrytitle">pam_systemd</span>(8)</span></a>.
|
||
</p></dd><dt id="$XDG_SESSION_ID"><span class="term"><code class="varname">$XDG_SESSION_ID</code>, </span><span class="term"><code class="varname">$XDG_SEAT</code>, </span><span class="term"><code class="varname">$XDG_VTNR</code></span><a class="headerlink" title="Permalink to this term" href="#%24XDG_SESSION_ID">¶</a></dt><dd><p>The identifier of the
|
||
session, the seat name, and
|
||
virtual terminal of the session. Set
|
||
by
|
||
<a href="pam_systemd.html"><span class="citerefentry"><span class="refentrytitle">pam_systemd</span>(8)</span></a>
|
||
for login sessions.
|
||
<code class="varname">$XDG_SEAT</code> and
|
||
<code class="varname">$XDG_VTNR</code> will
|
||
only be set when attached to a seat and a
|
||
tty.</p></dd><dt id="$MAINPID"><span class="term"><code class="varname">$MAINPID</code></span><a class="headerlink" title="Permalink to this term" href="#%24MAINPID">¶</a></dt><dd><p>The PID of the units
|
||
main process if it is known. This is
|
||
only set for control processes as
|
||
invoked by
|
||
<code class="varname">ExecReload=</code> and
|
||
similar. </p></dd><dt id="$MANAGERPID"><span class="term"><code class="varname">$MANAGERPID</code></span><a class="headerlink" title="Permalink to this term" href="#%24MANAGERPID">¶</a></dt><dd><p>The PID of the user
|
||
<span class="command"><strong>systemd</strong></span> instance,
|
||
set for processes spawned by it.
|
||
</p></dd><dt id="$LISTEN_FDS"><span class="term"><code class="varname">$LISTEN_FDS</code>, </span><span class="term"><code class="varname">$LISTEN_PID</code></span><a class="headerlink" title="Permalink to this term" href="#%24LISTEN_FDS">¶</a></dt><dd><p>Information about file
|
||
descriptors passed to a service for
|
||
socket activation. See
|
||
<a href="sd_listen_fds.html"><span class="citerefentry"><span class="refentrytitle">sd_listen_fds</span>(3)</span></a>.
|
||
</p></dd><dt id="$TERM"><span class="term"><code class="varname">$TERM</code></span><a class="headerlink" title="Permalink to this term" href="#%24TERM">¶</a></dt><dd><p>Terminal type, set
|
||
only for units connected to a terminal
|
||
(<code class="varname">StandardInput=tty</code>,
|
||
<code class="varname">StandardOutput=tty</code>,
|
||
or
|
||
<code class="varname">StandardError=tty</code>).
|
||
See
|
||
<a href="termcap.html"><span class="citerefentry"><span class="refentrytitle">termcap</span>(5)</span></a>.
|
||
</p></dd></dl></div><p>Additional variables may be configured by the
|
||
following means: for processes spawned in specific
|
||
units, use the <code class="varname">Environment=</code> and
|
||
<code class="varname">EnvironmentFile=</code> options above; to
|
||
specify variables globally, use
|
||
<code class="varname">DefaultEnvironment=</code> (see
|
||
<a href="systemd-system.conf.html"><span class="citerefentry"><span class="refentrytitle">systemd-system.conf</span>(5)</span></a>)
|
||
or the kernel option
|
||
<code class="varname">systemd.setenv=</code> (see
|
||
<a href="systemd.html"><span class="citerefentry"><span class="refentrytitle">systemd</span>(1)</span></a>). Additional
|
||
variables may also be set through PAM,
|
||
cf. <a href="pam_env.html"><span class="citerefentry"><span class="refentrytitle">pam_env</span>(8)</span></a>.</p></div><div class="refsect1"><a name="idm214191076464"></a><h2 id="See Also">See Also<a class="headerlink" title="Permalink to this headline" href="#See%20Also">¶</a></h2><p>
|
||
<a href="systemd.html"><span class="citerefentry"><span class="refentrytitle">systemd</span>(1)</span></a>,
|
||
<a href="systemctl.html"><span class="citerefentry"><span class="refentrytitle">systemctl</span>(8)</span></a>,
|
||
<a href="journalctl.html"><span class="citerefentry"><span class="refentrytitle">journalctl</span>(8)</span></a>,
|
||
<a href="systemd.unit.html"><span class="citerefentry"><span class="refentrytitle">systemd.unit</span>(5)</span></a>,
|
||
<a href="systemd.service.html"><span class="citerefentry"><span class="refentrytitle">systemd.service</span>(5)</span></a>,
|
||
<a href="systemd.socket.html"><span class="citerefentry"><span class="refentrytitle">systemd.socket</span>(5)</span></a>,
|
||
<a href="systemd.swap.html"><span class="citerefentry"><span class="refentrytitle">systemd.swap</span>(5)</span></a>,
|
||
<a href="systemd.mount.html"><span class="citerefentry"><span class="refentrytitle">systemd.mount</span>(5)</span></a>,
|
||
<a href="systemd.kill.html"><span class="citerefentry"><span class="refentrytitle">systemd.kill</span>(5)</span></a>,
|
||
<a href="systemd.resource-control.html"><span class="citerefentry"><span class="refentrytitle">systemd.resource-control</span>(5)</span></a>,
|
||
<a href="systemd.directives.html"><span class="citerefentry"><span class="refentrytitle">systemd.directives</span>(7)</span></a>,
|
||
<a href="tmpfiles.d.html"><span class="citerefentry"><span class="refentrytitle">tmpfiles.d</span>(5)</span></a>,
|
||
<a href="exec.html"><span class="citerefentry"><span class="refentrytitle">exec</span>(3)</span></a>
|
||
</p></div></div></body></html>
|