man/systemd-system.conf.xml

   1 <?xml version='1.0'?>
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
   4 <!ENTITY % entities SYSTEM "custom-entities.ent" >
   5 %entities;
   6 ]>
   7 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
   8
   9 <refentry id="systemd-system.conf"
  10     xmlns:xi="http://www.w3.org/2001/XInclude">
  11   <refentryinfo>
  12     <title>systemd-system.conf</title>
  13     <productname>systemd</productname>
  14   </refentryinfo>
  15
  16   <refmeta>
  17     <refentrytitle>systemd-system.conf</refentrytitle>
  18     <manvolnum>5</manvolnum>
  19   </refmeta>
  20
  21   <refnamediv>
  22     <refname>systemd-system.conf</refname>
  23     <refname>system.conf.d</refname>
  24     <refname>systemd-user.conf</refname>
  25     <refname>user.conf.d</refname>
  26     <refpurpose>System and session service manager configuration files</refpurpose>
  27   </refnamediv>
  28
  29   <refsynopsisdiv>
  30     <para><filename>/etc/systemd/system.conf</filename>,
  31     <filename>/etc/systemd/system.conf.d/*.conf</filename>,
  32     <filename>/run/systemd/system.conf.d/*.conf</filename>,
  33     <filename>/usr/lib/systemd/system.conf.d/*.conf</filename></para>
  34
  35     <para><filename>~/.config/systemd/user.conf</filename>,
  36     <filename>/etc/systemd/user.conf</filename>,
  37     <filename>/etc/systemd/user.conf.d/*.conf</filename>,
  38     <filename>/run/systemd/user.conf.d/*.conf</filename>,
  39     <filename>/usr/lib/systemd/user.conf.d/*.conf</filename></para>
  40   </refsynopsisdiv>
  41
  42   <refsect1>
  43     <title>Description</title>
  44
  45     <para>When run as a system instance, <command>systemd</command> interprets the configuration file
  46     <filename>system.conf</filename> and the files in <filename>system.conf.d</filename> directories; when
  47     run as a user instance, it interprets the configuration file <filename>user.conf</filename> (either in
  48     the home directory of the user, or if not found, under <filename>/etc/systemd/</filename>) and the files
  49     in <filename>user.conf.d</filename> directories. These configuration files contain a few settings
  50     controlling basic manager operations.</para>
  51
  52     <para>See
  53     <citerefentry><refentrytitle>systemd.syntax</refentrytitle><manvolnum>7</manvolnum></citerefentry> for a
  54     general description of the syntax.</para>
  55   </refsect1>
  56
  57   <xi:include href="standard-conf.xml" xpointer="main-conf" />
  58
  59   <refsect1>
  60     <title>Options</title>
  61
  62     <para>All options are configured in the
  63     [Manager] section:</para>
  64
  65     <variablelist class='config-directives'>
  66
  67       <varlistentry>
  68         <term><varname>LogColor=</varname></term>
  69         <term><varname>LogLevel=</varname></term>
  70         <term><varname>LogLocation=</varname></term>
  71         <term><varname>LogTarget=</varname></term>
  72         <term><varname>LogTime=</varname></term>
  73         <term><varname>DumpCore=yes</varname></term>
  74         <term><varname>CrashChangeVT=no</varname></term>
  75         <term><varname>CrashShell=no</varname></term>
  76         <term><varname>CrashReboot=no</varname></term>
  77         <term><varname>ShowStatus=yes</varname></term>
  78         <term><varname>DefaultStandardOutput=journal</varname></term>
  79         <term><varname>DefaultStandardError=inherit</varname></term>
  80
  81         <listitem><para>Configures various parameters of basic manager operation. These options may be overridden by
  82         the respective process and kernel command line arguments. See
  83         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
  84         details.</para></listitem>
  85       </varlistentry>
  86
  87       <varlistentry>
  88         <term><varname>CtrlAltDelBurstAction=</varname></term>
  89
  90         <listitem><para>Defines what action will be performed
  91         if user presses Ctrl-Alt-Delete more than 7 times in 2s.
  92         Can be set to <literal>reboot-force</literal>, <literal>poweroff-force</literal>,
  93         <literal>reboot-immediate</literal>, <literal>poweroff-immediate</literal>
  94         or disabled with <literal>none</literal>. Defaults to
  95         <literal>reboot-force</literal>.
  96         </para></listitem>
  97       </varlistentry>
  98
  99       <varlistentry>
 100         <term><varname>CPUAffinity=</varname></term>
 101
 102         <listitem><para>Configures the CPU affinity for the service manager as well as the default CPU
 103         affinity for all forked off processes. Takes a list of CPU indices or ranges separated by either
 104         whitespace or commas. CPU ranges are specified by the lower and upper CPU indices separated by a
 105         dash. This option may be specified more than once, in which case the specified CPU affinity masks are
 106         merged. If the empty string is assigned, the mask is reset, all assignments prior to this will have
 107         no effect. Individual services may override the CPU affinity for their processes with the
 108         <varname>CPUAffinity=</varname> setting in unit files, see
 109         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para></listitem>
 110       </varlistentry>
 111
 112       <varlistentry>
 113         <term><varname>NUMAPolicy=</varname></term>
 114
 115         <listitem><para>Configures the NUMA memory policy for the service manager and the default NUMA memory policy
 116         for all forked off processes. Individual services may override the default policy with the
 117         <varname>NUMAPolicy=</varname> setting in unit files, see
 118         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para></listitem>
 119       </varlistentry>
 120
 121       <varlistentry>
 122         <term><varname>NUMAMask=</varname></term>
 123
 124         <listitem><para>Configures the NUMA node mask that will be associated with the selected NUMA policy. Note that
 125         <option>default</option> and <option>local</option> NUMA policies don't require explicit NUMA node mask and
 126         value of the option can be empty. Similarly to <varname>NUMAPolicy=</varname>, value can be overridden
 127         by individual services in unit files, see
 128         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para></listitem>
 129       </varlistentry>
 130
 131       <varlistentry>
 132         <term><varname>RuntimeWatchdogSec=</varname></term>
 133         <term><varname>RebootWatchdogSec=</varname></term>
 134         <term><varname>KExecWatchdogSec=</varname></term>
 135
 136         <listitem><para>Configure the hardware watchdog at runtime and at reboot. Takes a timeout value in
 137         seconds (or in other time units if suffixed with <literal>ms</literal>, <literal>min</literal>,
 138         <literal>h</literal>, <literal>d</literal>, <literal>w</literal>), or the special strings
 139         <literal>off</literal> or <literal>default</literal>. If set to <literal>off</literal>
 140         (alternatively: <literal>0</literal>) the watchdog logic is disabled: no watchdog device is opened,
 141         configured, or pinged. If set to the special string <literal>default</literal> the watchdog is opened
 142         and pinged in regular intervals, but the timeout is not changed from the default. If set to any other
 143         time value the watchdog timeout is configured to the specified value (or a value close to it,
 144         depending on hardware capabilities).</para>
 145
 146         <para>If <varname>RuntimeWatchdogSec=</varname> is set to a non-zero value, the watchdog hardware
 147         (<filename>/dev/watchdog0</filename> or the path specified with <varname>WatchdogDevice=</varname> or
 148         the kernel option <varname>systemd.watchdog-device=</varname>) will be programmed to automatically
 149         reboot the system if it is not contacted within the specified timeout interval. The system manager
 150         will ensure to contact it at least once in half the specified timeout interval. This feature requires
 151         a hardware watchdog device to be present, as it is commonly the case in embedded and server
 152         systems. Not all hardware watchdogs allow configuration of all possible reboot timeout values, in
 153         which case the closest available timeout is picked.</para>
 154
 155         <para><varname>RebootWatchdogSec=</varname> may be used to configure the hardware watchdog when the
 156         system is asked to reboot. It works as a safety net to ensure that the reboot takes place even if a
 157         clean reboot attempt times out. Note that the <varname>RebootWatchdogSec=</varname> timeout applies
 158         only to the second phase of the reboot, i.e. after all regular services are already terminated, and
 159         after the system and service manager process (PID 1) got replaced by the
 160         <filename>systemd-shutdown</filename> binary, see system
 161         <citerefentry><refentrytitle>bootup</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
 162         details. During the first phase of the shutdown operation the system and service manager remains
 163         running and hence <varname>RuntimeWatchdogSec=</varname> is still honoured. In order to define a
 164         timeout on this first phase of system shutdown, configure <varname>JobTimeoutSec=</varname> and
 165         <varname>JobTimeoutAction=</varname> in the [Unit] section of the
 166         <filename>shutdown.target</filename> unit. By default <varname>RuntimeWatchdogSec=</varname> defaults
 167         to 0 (off), and <varname>RebootWatchdogSec=</varname> to 10min.</para>
 168
 169         <para><varname>KExecWatchdogSec=</varname> may be used to additionally enable the watchdog when kexec
 170         is being executed rather than when rebooting. Note that if the kernel does not reset the watchdog on
 171         kexec (depending on the specific hardware and/or driver), in this case the watchdog might not get
 172         disabled after kexec succeeds and thus the system might get rebooted, unless
 173         <varname>RuntimeWatchdogSec=</varname> is also enabled at the same time.  For this reason it is
 174         recommended to enable <varname>KExecWatchdogSec=</varname> only if
 175         <varname>RuntimeWatchdogSec=</varname> is also enabled.</para>
 176
 177         <para>These settings have no effect if a hardware watchdog is not available.</para></listitem>
 178       </varlistentry>
 179
 180       <varlistentry>
 181         <term><varname>RuntimeWatchdogPreSec=</varname></term>
 182
 183         <listitem><para>Configure the hardware watchdog device pre-timeout value.
 184         Takes a timeout value in seconds (or in other time units similar to
 185         <varname>RuntimeWatchdogSec=</varname>). A watchdog pre-timeout is a
 186         notification generated by the watchdog before the watchdog reset might
 187         occur in the event the watchdog has not been serviced. This notification
 188         is handled by the kernel and can be configured to take an action (i.e.
 189         generate a kernel panic) using <varname>RuntimeWatchdogPreGovernor=</varname>.
 190         Not all watchdog hardware or drivers support generating a pre-timeout and
 191         depending on the state of the system, the kernel may be unable to take the
 192         configured action before the watchdog reboot. The watchdog will be configured
 193         to generate the pre-timeout event at the amount of time specified by
 194         <varname>RuntimeWatchdogPreSec=</varname> before the runtime watchdog timeout
 195         (set by <varname>RuntimeWatchdogSec=</varname>). For example, if the we have
 196         <varname>RuntimeWatchdogSec=30</varname> and
 197         <varname>RuntimeWatchdogPreSec=10</varname>, then the pre-timeout event
 198         will occur if the watchdog has not pinged for 20s (10s before the
 199         watchdog would fire). By default, <varname>RuntimeWatchdogPreSec=</varname>
 200         defaults to 0 (off). The value set for <varname>RuntimeWatchdogPreSec=</varname>
 201         must be smaller than the timeout value for <varname>RuntimeWatchdogSec=</varname>.
 202         This setting has no effect if a hardware watchdog is not available or the
 203         hardware watchdog does not support a pre-timeout and will be ignored by the
 204         kernel if the setting is greater than the actual watchdog timeout.</para></listitem>
 205       </varlistentry>
 206
 207       <varlistentry>
 208         <term><varname>RuntimeWatchdogPreGovernor=</varname></term>
 209
 210         <listitem><para>Configure the action taken by the hardware watchdog device
 211         when the pre-timeout expires. The default action for the pre-timeout event
 212         depends on the kernel configuration, but it is usually to log a kernel
 213         message. For a list of valid actions available for a given watchdog device,
 214         check the content of the
 215         <filename>/sys/class/watchdog/watchdog<replaceable>X</replaceable>/pretimeout_available_governors</filename>
 216         file. Typically, available governor types are <varname>noop</varname> and <varname>panic</varname>.
 217         Availability, names and functionality might vary depending on the specific device driver
 218         in use. If the <filename>pretimeout_available_governors</filename> sysfs file is empty,
 219         the governor might be built as a kernel module and might need to be manually loaded
 220         (e.g. <varname>pretimeout_noop.ko</varname>), or the watchdog device might not support
 221         pre-timeouts.</para></listitem>
 222       </varlistentry>
 223
 224       <varlistentry>
 225         <term><varname>WatchdogDevice=</varname></term>
 226
 227         <listitem><para>Configure the hardware watchdog device that the
 228         runtime and shutdown watchdog timers will open and use. Defaults
 229         to <filename>/dev/watchdog0</filename>. This setting has no
 230         effect if a hardware watchdog is not available.</para></listitem>
 231       </varlistentry>
 232
 233       <varlistentry>
 234         <term><varname>CapabilityBoundingSet=</varname></term>
 235
 236         <listitem><para>Controls which capabilities to include in the
 237         capability bounding set for PID 1 and its children. See
 238         <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 239         for details. Takes a whitespace-separated list of capability
 240         names as read by
 241         <citerefentry project='mankier'><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
 242         Capabilities listed will be included in the bounding set, all
 243         others are removed. If the list of capabilities is prefixed
 244         with ~, all but the listed capabilities will be included, the
 245         effect of the assignment inverted. Note that this option also
 246         affects the respective capabilities in the effective,
 247         permitted and inheritable capability sets. The capability
 248         bounding set may also be individually configured for units
 249         using the <varname>CapabilityBoundingSet=</varname> directive
 250         for units, but note that capabilities dropped for PID 1 cannot
 251         be regained in individual units, they are lost for
 252         good.</para></listitem>
 253       </varlistentry>
 254
 255       <varlistentry>
 256         <term><varname>NoNewPrivileges=</varname></term>
 257
 258         <listitem><para>Takes a boolean argument. If true, ensures that PID 1
 259         and all its children can never gain new privileges through
 260         <citerefentry project='man-pages'><refentrytitle>execve</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 261         (e.g. via setuid or setgid bits, or filesystem capabilities).
 262         Defaults to false. General purpose distributions commonly rely
 263         on executables with setuid or setgid bits and will thus not
 264         function properly with this option enabled. Individual units
 265         cannot disable this option.
 266         Also see <ulink url="https://docs.kernel.org/userspace-api/no_new_privs.html">No New Privileges Flag</ulink>.
 267         </para></listitem>
 268       </varlistentry>
 269
 270       <varlistentry>
 271         <term><varname>SystemCallArchitectures=</varname></term>
 272
 273         <listitem><para>Takes a space-separated list of architecture
 274         identifiers. Selects from which architectures system calls may
 275         be invoked on this system. This may be used as an effective
 276         way to disable invocation of non-native binaries system-wide,
 277         for example to prohibit execution of 32-bit x86 binaries on
 278         64-bit x86-64 systems. This option operates system-wide, and
 279         acts similar to the
 280         <varname>SystemCallArchitectures=</varname> setting of unit
 281         files, see
 282         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 283         for details. This setting defaults to the empty list, in which
 284         case no filtering of system calls based on architecture is
 285         applied. Known architecture identifiers are
 286         <literal>x86</literal>, <literal>x86-64</literal>,
 287         <literal>x32</literal>, <literal>arm</literal> and the special
 288         identifier <literal>native</literal>. The latter implicitly
 289         maps to the native architecture of the system (or more
 290         specifically, the architecture the system manager was compiled
 291         for). Set this setting to <literal>native</literal> to
 292         prohibit execution of any non-native binaries. When a binary
 293         executes a system call of an architecture that is not listed
 294         in this setting, it will be immediately terminated with the
 295         SIGSYS signal.</para></listitem>
 296       </varlistentry>
 297
 298       <varlistentry>
 299         <term><varname>TimerSlackNSec=</varname></term>
 300
 301         <listitem><para>Sets the timer slack in nanoseconds for PID 1,
 302         which is inherited by all executed processes, unless
 303         overridden individually, for example with the
 304         <varname>TimerSlackNSec=</varname> setting in service units
 305         (for details see
 306         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>).
 307         The timer slack controls the accuracy of wake-ups triggered by
 308         system timers. See
 309         <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 310         for more information. Note that in contrast to most other time
 311         span definitions this parameter takes an integer value in
 312         nano-seconds if no unit is specified. The usual time units are
 313         understood too.</para></listitem>
 314       </varlistentry>
 315
 316       <varlistentry>
 317         <term><varname>StatusUnitFormat=</varname></term>
 318
 319         <listitem><para>Takes <option>name</option>, <option>description</option> or
 320         <option>combined</option> as the value. If <option>name</option>, the system manager will use unit
 321         names in status messages (e.g. <literal>systemd-journald.service</literal>), instead of the longer
 322         and more informative descriptions set with <varname>Description=</varname> (e.g. <literal>Journal
 323         Logging Service</literal>). If <option>combined</option>, the system manager will use both unit names
 324         and descriptions in status messages (e.g. <literal>systemd-journald.service - Journal Logging
 325         Service</literal>).</para>
 326
 327         <para>See
 328         <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
 329         details about unit names and <varname>Description=</varname>.</para></listitem>
 330       </varlistentry>
 331
 332       <varlistentry>
 333         <term><varname>DefaultTimerAccuracySec=</varname></term>
 334
 335         <listitem><para>Sets the default accuracy of timer units. This
 336         controls the global default for the
 337         <varname>AccuracySec=</varname> setting of timer units, see
 338         <citerefentry><refentrytitle>systemd.timer</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 339         for details. <varname>AccuracySec=</varname> set in individual
 340         units override the global default for the specific unit.
 341         Defaults to 1min. Note that the accuracy of timer units is
 342         also affected by the configured timer slack for PID 1, see
 343         <varname>TimerSlackNSec=</varname> above.</para></listitem>
 344       </varlistentry>
 345
 346       <varlistentry>
 347         <term><varname>DefaultTimeoutStartSec=</varname></term>
 348         <term><varname>DefaultTimeoutStopSec=</varname></term>
 349         <term><varname>DefaultTimeoutAbortSec=</varname></term>
 350         <term><varname>DefaultRestartSec=</varname></term>
 351
 352         <listitem><para>Configures the default timeouts for starting, stopping and aborting of units, as well
 353         as the default time to sleep between automatic restarts of units, as configured per-unit in
 354         <varname>TimeoutStartSec=</varname>, <varname>TimeoutStopSec=</varname>,
 355         <varname>TimeoutAbortSec=</varname> and <varname>RestartSec=</varname> (for services, see
 356         <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 357         for details on the per-unit settings). For non-service units,
 358         <varname>DefaultTimeoutStartSec=</varname> sets the default <varname>TimeoutSec=</varname> value.
 359         </para>
 360
 361         <para><varname>DefaultTimeoutStartSec=</varname> and <varname>DefaultTimeoutStopSec=</varname>
 362         default to &DEFAULT_TIMEOUT; in the system manager and &DEFAULT_USER_TIMEOUT; in the user manager.
 363         <varname>DefaultTimeoutAbortSec=</varname> is not set by default so that all units fall back to
 364         <varname>TimeoutStopSec=</varname>. <varname>DefaultRestartSec=</varname> defaults to 100 ms.
 365         </para></listitem>
 366       </varlistentry>
 367
 368       <varlistentry>
 369         <term><varname>DefaultDeviceTimeoutSec=</varname></term>
 370
 371         <listitem><para>Configures the default timeout for waiting for devices. It can be changed per
 372         device via the <varname>x-systemd.device-timeout=</varname> option in <filename>/etc/fstab</filename>
 373         and <filename>/etc/crypttab</filename> (see
 374         <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 375         <citerefentry><refentrytitle>crypttab</refentrytitle><manvolnum>5</manvolnum></citerefentry>).
 376         Defaults to &DEFAULT_TIMEOUT; in the system manager and &DEFAULT_USER_TIMEOUT; in the user manager.
 377         </para></listitem>
 378       </varlistentry>
 379
 380       <varlistentry>
 381         <term><varname>DefaultStartLimitIntervalSec=</varname></term>
 382         <term><varname>DefaultStartLimitBurst=</varname></term>
 383
 384         <listitem><para>Configure the default unit start rate
 385         limiting, as configured per-service by
 386         <varname>StartLimitIntervalSec=</varname> and
 387         <varname>StartLimitBurst=</varname>. See
 388         <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 389         for details on the per-service settings.
 390         <varname>DefaultStartLimitIntervalSec=</varname> defaults to
 391         10s. <varname>DefaultStartLimitBurst=</varname> defaults to
 392         5.</para></listitem>
 393       </varlistentry>
 394
 395       <varlistentry>
 396         <term><varname>DefaultEnvironment=</varname></term>
 397
 398         <listitem><para>Configures environment variables passed to all executed processes. Takes a
 399         space-separated list of variable assignments. See <citerefentry
 400         project='man-pages'><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
 401         details about environment variables.</para>
 402
 403         <para>Simple <literal>%</literal>-specifier expansion is supported, see below for a list of supported
 404         specifiers.</para>
 405
 406         <para>Example:
 407
 408         <programlisting>DefaultEnvironment="VAR1=word1 word2" VAR2=word3 "VAR3=word 5 6"</programlisting>
 409
 410         Sets three variables
 411         <literal>VAR1</literal>,
 412         <literal>VAR2</literal>,
 413         <literal>VAR3</literal>.</para></listitem>
 414       </varlistentry>
 415
 416       <varlistentry>
 417         <term><varname>ManagerEnvironment=</varname></term>
 418
 419         <listitem><para>Takes the same arguments as <varname>DefaultEnvironment=</varname>, see above. Sets
 420         environment variables just for the manager process itself. In contrast to user managers, these variables
 421         are not inherited by processes spawned by the system manager, use <varname>DefaultEnvironment=</varname>
 422         for that. Note that these variables are merged into the existing environment block. In particular, in
 423         case of the system manager, this includes variables set by the kernel based on the kernel command line.</para>
 424
 425         <para>Setting environment variables for the manager process may be useful to modify its behaviour.
 426         See <ulink url="https://systemd.io/ENVIRONMENT">ENVIRONMENT</ulink> for a descriptions of some
 427         variables understood by <command>systemd</command>.</para>
 428
 429         <para>Simple <literal>%</literal>-specifier expansion is supported, see below for a list of supported
 430         specifiers.</para>
 431         </listitem>
 432       </varlistentry>
 433
 434       <varlistentry>
 435         <term><varname>DefaultCPUAccounting=</varname></term>
 436         <term><varname>DefaultMemoryAccounting=</varname></term>
 437         <term><varname>DefaultTasksAccounting=</varname></term>
 438         <term><varname>DefaultIOAccounting=</varname></term>
 439         <term><varname>DefaultIPAccounting=</varname></term>
 440
 441         <listitem><para>Configure the default resource accounting settings, as configured per-unit by
 442         <varname>CPUAccounting=</varname>, <varname>MemoryAccounting=</varname>,
 443         <varname>TasksAccounting=</varname>, <varname>IOAccounting=</varname> and
 444         <varname>IPAccounting=</varname>. See
 445         <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 446         for details on the per-unit settings. <varname>DefaultTasksAccounting=</varname> defaults to yes,
 447         <varname>DefaultMemoryAccounting=</varname> to
 448         &MEMORY_ACCOUNTING_DEFAULT;. <varname>DefaultCPUAccounting=</varname> defaults to yes if enabling CPU
 449         accounting doesn't require the CPU controller to be enabled (Linux 4.15+ using the unified hierarchy
 450         for resource control), otherwise it defaults to no. The other three settings default to
 451         no.</para></listitem>
 452       </varlistentry>
 453
 454       <varlistentry>
 455         <term><varname>DefaultTasksMax=</varname></term>
 456
 457         <listitem><para>Configure the default value for the per-unit <varname>TasksMax=</varname> setting. See
 458         <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 459         for details. This setting applies to all unit types that support resource control settings, with the exception
 460         of slice units. Defaults to 15% of the minimum of <varname>kernel.pid_max=</varname>, <varname>kernel.threads-max=</varname>
 461         and root cgroup <varname>pids.max</varname>.
 462         Kernel has a default value for <varname>kernel.pid_max=</varname> and an algorithm of counting in case of more than 32 cores.
 463         For example, with the default <varname>kernel.pid_max=</varname>, <varname>DefaultTasksMax=</varname> defaults to 4915,
 464         but might be greater in other systems or smaller in OS containers.</para></listitem>
 465       </varlistentry>
 466
 467       <varlistentry>
 468         <term><varname>DefaultLimitCPU=</varname></term>
 469         <term><varname>DefaultLimitFSIZE=</varname></term>
 470         <term><varname>DefaultLimitDATA=</varname></term>
 471         <term><varname>DefaultLimitSTACK=</varname></term>
 472         <term><varname>DefaultLimitCORE=</varname></term>
 473         <term><varname>DefaultLimitRSS=</varname></term>
 474         <term><varname>DefaultLimitNOFILE=</varname></term>
 475         <term><varname>DefaultLimitAS=</varname></term>
 476         <term><varname>DefaultLimitNPROC=</varname></term>
 477         <term><varname>DefaultLimitMEMLOCK=</varname></term>
 478         <term><varname>DefaultLimitLOCKS=</varname></term>
 479         <term><varname>DefaultLimitSIGPENDING=</varname></term>
 480         <term><varname>DefaultLimitMSGQUEUE=</varname></term>
 481         <term><varname>DefaultLimitNICE=</varname></term>
 482         <term><varname>DefaultLimitRTPRIO=</varname></term>
 483         <term><varname>DefaultLimitRTTIME=</varname></term>
 484
 485         <listitem><para>These settings control various default resource limits for processes executed by
 486         units. See
 487         <citerefentry><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
 488         details. These settings may be overridden in individual units using the corresponding
 489         <varname>LimitXXX=</varname> directives and they accept the same parameter syntax,
 490         see <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 491         for details. Note that these resource limits are only defaults
 492         for units, they are not applied to the service manager process (i.e. PID 1) itself.</para>
 493
 494         <para>Most of these settings are unset, which means the resource limits are inherited from the kernel or, if
 495         invoked in a container, from the container manager. However, the following have defaults:</para>
 496         <itemizedlist>
 497           <listitem><para><varname>DefaultLimitNOFILE=</varname> defaults to 1024:&HIGH_RLIMIT_NOFILE;.
 498           </para></listitem>
 499
 500           <listitem><para><varname>DefaultLimitMEMLOCK=</varname> defaults to 8M.</para></listitem>
 501
 502           <listitem><para><varname>DefaultLimitCORE=</varname> does not have a default but it is worth mentioning that
 503           <varname>RLIMIT_CORE</varname> is set to <literal>infinity</literal> by PID 1 which is inherited by its
 504           children.</para></listitem>
 505         </itemizedlist>
 506
 507         <para>Note that the service manager internally in PID 1 bumps <varname>RLIMIT_NOFILE</varname> and
 508         <varname>RLIMIT_MEMLOCK</varname> to higher values, however the limit is reverted to the mentioned
 509         defaults for all child processes forked off.</para>
 510       </listitem>
 511       </varlistentry>
 512
 513       <varlistentry>
 514         <term><varname>DefaultOOMPolicy=</varname></term>
 515
 516         <listitem><para>Configure the default policy for reacting to processes being killed by the Linux
 517         Out-Of-Memory (OOM) killer or <command>systemd-oomd</command>. This may be used to pick a global default for the per-unit
 518         <varname>OOMPolicy=</varname> setting. See
 519         <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 520         for details. Note that this default is not used for services that have <varname>Delegate=</varname>
 521         turned on.</para></listitem>
 522       </varlistentry>
 523
 524       <varlistentry>
 525         <term><varname>DefaultOOMScoreAdjust=</varname></term>
 526
 527         <listitem><para>Configures the default OOM score adjustments of processes run by the service
 528         manager. This defaults to unset (meaning the forked off processes inherit the service manager's OOM
 529         score adjustment value), except if the service manager is run for an unprivileged user, in which case
 530         this defaults to the service manager's OOM adjustment value plus 100 (this makes service processes
 531         slightly more likely to be killed under memory pressure than the manager itself). This may be used to
 532         pick a global default for the per-unit <varname>OOMScoreAdjust=</varname> setting. See
 533         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
 534         details. Note that this setting has no effect on the OOM score adjustment value of the service
 535         manager process itself, it retains the original value set during its invocation.</para></listitem>
 536       </varlistentry>
 537
 538       <varlistentry>
 539         <term><varname>DefaultSmackProcessLabel=</varname></term>
 540
 541         <listitem><para>Takes a <option>SMACK64</option> security label as the argument. The process executed
 542         by a unit will be started under this label if <varname>SmackProcessLabel=</varname> is not set in the
 543         unit. See <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 544         for the details.</para>
 545
 546         <para>If the value is <literal>/</literal>, only labels specified with <varname>SmackProcessLabel=</varname>
 547         are assigned and the compile-time default is ignored.</para></listitem>
 548       </varlistentry>
 549
 550       <varlistentry>
 551         <term><varname>ReloadLimitIntervalSec=</varname></term>
 552         <term><varname>ReloadLimitBurst=</varname></term>
 553
 554         <listitem><para>Rate limiting for daemon-reload requests. Default to unset, and any number of daemon-reload
 555         operations can be requested at any time. <varname>ReloadLimitIntervalSec=</varname> takes a value in seconds
 556         to configure the rate limit window, and <varname>ReloadLimitBurst=</varname> takes a positive integer to
 557         configure the maximum allowed number of reloads within the configured time window.</para></listitem>
 558       </varlistentry>
 559     </variablelist>
 560   </refsect1>
 561
 562   <refsect1>
 563     <title>Specifiers</title>
 564
 565     <para>Specifiers may be used in the <varname>DefaultEnvironment=</varname> and
 566     <varname>ManagerEnvironment=</varname> settings. The following expansions are understood:</para>
 567       <table class='specifiers'>
 568         <title>Specifiers available</title>
 569         <tgroup cols='3' align='left' colsep='1' rowsep='1'>
 570           <colspec colname="spec" />
 571           <colspec colname="mean" />
 572           <colspec colname="detail" />
 573           <thead>
 574             <row>
 575               <entry>Specifier</entry>
 576               <entry>Meaning</entry>
 577               <entry>Details</entry>
 578             </row>
 579           </thead>
 580           <tbody>
 581             <xi:include href="standard-specifiers.xml" xpointer="a"/>
 582             <xi:include href="standard-specifiers.xml" xpointer="A"/>
 583             <xi:include href="standard-specifiers.xml" xpointer="b"/>
 584             <xi:include href="standard-specifiers.xml" xpointer="B"/>
 585             <xi:include href="standard-specifiers.xml" xpointer="H"/>
 586             <xi:include href="standard-specifiers.xml" xpointer="l"/>
 587             <xi:include href="standard-specifiers.xml" xpointer="m"/>
 588             <xi:include href="standard-specifiers.xml" xpointer="M"/>
 589             <xi:include href="standard-specifiers.xml" xpointer="o"/>
 590             <xi:include href="standard-specifiers.xml" xpointer="v"/>
 591             <xi:include href="standard-specifiers.xml" xpointer="w"/>
 592             <xi:include href="standard-specifiers.xml" xpointer="W"/>
 593             <xi:include href="standard-specifiers.xml" xpointer="T"/>
 594             <xi:include href="standard-specifiers.xml" xpointer="V"/>
 595             <xi:include href="standard-specifiers.xml" xpointer="percent"/>
 596           </tbody>
 597         </tgroup>
 598       </table>
 599   </refsect1>
 600
 601   <refsect1>
 602       <title>History</title>
 603
 604       <variablelist>
 605         <varlistentry>
 606           <term>systemd 252</term>
 607           <listitem><para>Option <varname>DefaultBlockIOAccounting=</varname> was deprecated. Please switch
 608           to the unified cgroup hierarchy.</para></listitem>
 609         </varlistentry>
 610       </variablelist>
 611   </refsect1>
 612
 613   <refsect1>
 614       <title>See Also</title>
 615       <para>
 616         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 617         <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 618         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 619         <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 620         <citerefentry project='man-pages'><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 621         <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 622       </para>
 623   </refsect1>
 624
 625 </refentry>