man/sysctl.d.xml

   1 <?xml version="1.0"?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   3 <!--
   4   SPDX-License-Identifier: LGPL-2.1+
   5
   6   Copyright 2011 Lennart Poettering
   7 -->
   8 <refentry id="sysctl.d"
   9     xmlns:xi="http://www.w3.org/2001/XInclude">
  10
  11   <refentryinfo>
  12     <title>sysctl.d</title>
  13     <productname>systemd</productname>
  14
  15     <authorgroup>
  16       <author>
  17         <contrib>Developer</contrib>
  18         <firstname>Lennart</firstname>
  19         <surname>Poettering</surname>
  20         <email>lennart@poettering.net</email>
  21       </author>
  22     </authorgroup>
  23   </refentryinfo>
  24
  25   <refmeta>
  26     <refentrytitle>sysctl.d</refentrytitle>
  27     <manvolnum>5</manvolnum>
  28   </refmeta>
  29
  30   <refnamediv>
  31     <refname>sysctl.d</refname>
  32     <refpurpose>Configure kernel parameters at boot</refpurpose>
  33   </refnamediv>
  34
  35   <refsynopsisdiv>
  36     <para><filename>/etc/sysctl.d/*.conf</filename></para>
  37     <para><filename>/run/sysctl.d/*.conf</filename></para>
  38     <para><filename>/usr/lib/sysctl.d/*.conf</filename></para>
  39   </refsynopsisdiv>
  40
  41   <refsect1>
  42     <title>Description</title>
  43
  44     <para>At boot,
  45     <citerefentry><refentrytitle>systemd-sysctl.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
  46     reads configuration files from the above directories to configure
  47     <citerefentry project='man-pages'><refentrytitle>sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>
  48     kernel parameters.</para>
  49   </refsect1>
  50
  51   <refsect1>
  52     <title>Configuration Format</title>
  53
  54     <para>The configuration files contain a list of variable
  55     assignments, separated by newlines. Empty lines and lines whose
  56     first non-whitespace character is <literal>#</literal> or
  57     <literal>;</literal> are ignored.</para>
  58
  59     <para>Note that either <literal>/</literal> or
  60     <literal>.</literal> may be used as separators within sysctl
  61     variable names. If the first separator is a slash, remaining
  62     slashes and dots are left intact. If the first separator is a dot,
  63     dots and slashes are interchanged.
  64     <literal>kernel.domainname=foo</literal> and
  65     <literal>kernel/domainname=foo</literal> are equivalent and will
  66     cause <literal>foo</literal> to be written to
  67     <filename>/proc/sys/kernel/domainname</filename>. Either
  68     <literal>net.ipv4.conf.enp3s0/200.forwarding</literal> or
  69     <literal>net/ipv4/conf/enp3s0.200/forwarding</literal> may be used
  70     to refer to
  71     <filename>/proc/sys/net/ipv4/conf/enp3s0.200/forwarding</filename>.
  72     </para>
  73
  74     <para>The settings configured with <filename>sysctl.d</filename>
  75     files will be applied early on boot. The network
  76     interface-specific options will also be applied individually for
  77     each network interface as it shows up in the system. (More
  78     specifically, <filename>net.ipv4.conf.*</filename>,
  79     <filename>net.ipv6.conf.*</filename>,
  80     <filename>net.ipv4.neigh.*</filename> and
  81     <filename>net.ipv6.neigh.*</filename>).</para>
  82
  83     <para>Many sysctl parameters only become available when certain
  84     kernel modules are loaded. Modules are usually loaded on demand,
  85     e.g. when certain hardware is plugged in or network brought up.
  86     This means that
  87     <citerefentry><refentrytitle>systemd-sysctl.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
  88     which runs during early boot will not configure such parameters if
  89     they become available after it has run. To set such parameters, it
  90     is recommended to add an
  91     <citerefentry><refentrytitle>udev</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  92     rule to set those parameters when they become available.
  93     Alternatively, a slightly simpler and less efficient option is to
  94     add the module to
  95     <citerefentry><refentrytitle>modules-load.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
  96     causing it to be loaded statically before sysctl settings are
  97     applied (see example below).</para>
  98   </refsect1>
  99
 100   <xi:include href="standard-conf.xml" xpointer="confd" />
 101
 102   <refsect1>
 103     <title>Examples</title>
 104     <example>
 105       <title>Set kernel YP domain name</title>
 106       <para><filename>/etc/sysctl.d/domain-name.conf</filename>:
 107       </para>
 108
 109       <programlisting>kernel.domainname=example.com</programlisting>
 110     </example>
 111
 112     <example>
 113       <title>Apply settings available only when a certain module is loaded (method one)</title>
 114       <para><filename>/etc/udev/rules.d/99-bridge.rules</filename>:
 115       </para>
 116
 117       <programlisting>ACTION=="add", SUBSYSTEM=="module", KERNEL=="br_netfilter", \
 118       RUN+="/usr/lib/systemd/systemd-sysctl --prefix=/net/bridge"
 119 </programlisting>
 120
 121       <para><filename>/etc/sysctl.d/bridge.conf</filename>:
 122       </para>
 123
 124       <programlisting>net.bridge.bridge-nf-call-ip6tables = 0
 125 net.bridge.bridge-nf-call-iptables = 0
 126 net.bridge.bridge-nf-call-arptables = 0
 127 </programlisting>
 128
 129       <para>This method applies settings when the module is
 130       loaded. Please note that, unless the <filename>br_netfilter</filename>
 131       module is loaded, bridged packets will not be filtered by
 132       Netfilter (starting with kernel 3.18), so simply not loading the
 133       module is sufficient to avoid filtering.</para>
 134     </example>
 135
 136     <example>
 137       <title>Apply settings available only when a certain module is loaded (method two)</title>
 138       <para><filename>/etc/modules-load.d/bridge.conf</filename>:
 139       </para>
 140
 141       <programlisting>br_netfilter</programlisting>
 142
 143       <para><filename>/etc/sysctl.d/bridge.conf</filename>:
 144       </para>
 145
 146       <programlisting>net.bridge.bridge-nf-call-ip6tables = 0
 147 net.bridge.bridge-nf-call-iptables = 0
 148 net.bridge.bridge-nf-call-arptables = 0
 149 </programlisting>
 150
 151       <para>This method forces the module to be always loaded. Please
 152       note that, unless the <filename>br_netfilter</filename> module is
 153       loaded, bridged packets will not be filtered with Netfilter
 154       (starting with kernel 3.18), so simply not loading the module is
 155       sufficient to avoid filtering.</para>
 156     </example>
 157   </refsect1>
 158
 159   <refsect1>
 160     <title>See Also</title>
 161     <para>
 162       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 163       <citerefentry><refentrytitle>systemd-sysctl.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 164       <citerefentry><refentrytitle>systemd-delta</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 165       <citerefentry project='man-pages'><refentrytitle>sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 166       <citerefentry project='man-pages'><refentrytitle>sysctl.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 167       <citerefentry project='man-pages'><refentrytitle>modprobe</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 168     </para>
 169   </refsect1>
 170
 171 </refentry>