2 <!DOCTYPE refentry PUBLIC
"-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
4 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
6 <refentry id=
"systemd.exec" xmlns:
xi=
"http://www.w3.org/2001/XInclude">
8 <title>systemd.exec
</title>
9 <productname>systemd
</productname>
13 <refentrytitle>systemd.exec
</refentrytitle>
14 <manvolnum>5</manvolnum>
18 <refname>systemd.exec
</refname>
19 <refpurpose>Execution environment configuration
</refpurpose>
23 <para><filename><replaceable>service
</replaceable>.service
</filename>,
24 <filename><replaceable>socket
</replaceable>.socket
</filename>,
25 <filename><replaceable>mount
</replaceable>.mount
</filename>,
26 <filename><replaceable>swap
</replaceable>.swap
</filename></para>
30 <title>Description
</title>
32 <para>Unit configuration files for services, sockets, mount points, and swap devices share a subset of
33 configuration options which define the execution environment of spawned processes.
</para>
35 <para>This man page lists the configuration options shared by these four unit types. See
36 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry> for the common
37 options of all unit configuration files, and
38 <citerefentry><refentrytitle>systemd.service
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
39 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
40 <citerefentry><refentrytitle>systemd.swap
</refentrytitle><manvolnum>5</manvolnum></citerefentry>, and
41 <citerefentry><refentrytitle>systemd.mount
</refentrytitle><manvolnum>5</manvolnum></citerefentry> for more
42 information on the specific unit configuration files. The execution specific configuration options are configured
43 in the [Service], [Socket], [Mount], or [Swap] sections, depending on the unit type.
</para>
45 <para>In addition, options which control resources through Linux Control Groups (cgroups) are listed in
46 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
47 Those options complement options listed here.
</para>
51 <title>Implicit Dependencies
</title>
53 <para>A few execution parameters result in additional, automatic dependencies to be added:
</para>
56 <listitem><para>Units with
<varname>WorkingDirectory=
</varname>,
<varname>RootDirectory=
</varname>,
57 <varname>RootImage=
</varname>,
<varname>RuntimeDirectory=
</varname>,
<varname>StateDirectory=
</varname>,
58 <varname>CacheDirectory=
</varname>,
<varname>LogsDirectory=
</varname> or
59 <varname>ConfigurationDirectory=
</varname> set automatically gain dependencies of type
60 <varname>Requires=
</varname> and
<varname>After=
</varname> on all mount units required to access the specified
61 paths. This is equivalent to having them listed explicitly in
62 <varname>RequiresMountsFor=
</varname>.
</para></listitem>
64 <listitem><para>Similarly, units with
<varname>PrivateTmp=
</varname> enabled automatically get mount
65 unit dependencies for all mounts required to access
<filename>/tmp/
</filename> and
66 <filename>/var/tmp/
</filename>. They will also gain an automatic
<varname>After=
</varname> dependency
68 <citerefentry><refentrytitle>systemd-tmpfiles-setup.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
71 <listitem><para>Units whose standard output or error output is connected to
<option>journal
</option> or
72 <option>kmsg
</option> (or their combinations with console output, see below) automatically acquire
73 dependencies of type
<varname>After=
</varname> on
74 <filename>systemd-journald.socket
</filename>.
</para></listitem>
76 <listitem><para>Units using
<varname>LogNamespace=
</varname> will automatically gain ordering and
77 requirement dependencies on the two socket units associated with
78 <filename>systemd-journald@.service
</filename> instances.
</para></listitem>
82 <!-- We don't have any default dependency here. -->
87 <para>The following settings may be used to change a service's view of the filesystem. Please note that the paths
88 must be absolute and must not contain a
<literal>..
</literal> path component.
</para>
90 <variablelist class='unit-directives'
>
93 <term><varname>ExecSearchPath=
</varname></term>
95 <listitem><para>Takes a colon separated list of absolute paths relative to which the executable
96 used by the
<varname>Exec*=
</varname> (e.g.
<varname>ExecStart=
</varname>,
97 <varname>ExecStop=
</varname>, etc.) properties can be found.
<varname>ExecSearchPath=
</varname>
98 overrides
<varname>$PATH
</varname> if
<varname>$PATH
</varname> is not supplied by the user through
99 <varname>Environment=
</varname>,
<varname>EnvironmentFile=
</varname> or
100 <varname>PassEnvironment=
</varname>. Assigning an empty string removes previous assignments
101 and setting
<varname>ExecSearchPath=
</varname> to a value multiple times will append
102 to the previous setting.
105 <xi:include href=
"version-info.xml" xpointer=
"v250"/></listitem>
109 <term><varname>WorkingDirectory=
</varname></term>
111 <listitem><para>Takes a directory path relative to the service's root directory specified by
112 <varname>RootDirectory=
</varname>, or the special value
<literal>~
</literal>. Sets the working directory for
113 executed processes. If set to
<literal>~
</literal>, the home directory of the user specified in
114 <varname>User=
</varname> is used. If not set, defaults to the root directory when systemd is running as a
115 system instance and the respective user's home directory if run as user. If the setting is prefixed with the
116 <literal>-
</literal> character, a missing working directory is not considered fatal. If
117 <varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname> is not set, then
118 <varname>WorkingDirectory=
</varname> is relative to the root of the system running the service manager. Note
119 that setting this parameter might result in additional dependencies to be added to the unit (see
120 above).
</para></listitem>
124 <term><varname>RootDirectory=
</varname></term>
126 <listitem><para>Takes a directory path relative to the host's root directory (i.e. the root of the system
127 running the service manager). Sets the root directory for executed processes, with the
<citerefentry
128 project='man-pages'
><refentrytitle>chroot
</refentrytitle><manvolnum>2</manvolnum></citerefentry> system
129 call. If this is used, it must be ensured that the process binary and all its auxiliary files are available in
130 the
<function>chroot()
</function> jail. Note that setting this parameter might result in additional
131 dependencies to be added to the unit (see above).
</para>
133 <para>The
<varname>MountAPIVFS=
</varname> and
<varname>PrivateUsers=
</varname> settings are particularly useful
134 in conjunction with
<varname>RootDirectory=
</varname>. For details, see below.
</para>
136 <para>If
<varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname> are used together with
137 <varname>NotifyAccess=
</varname> the notification socket is automatically mounted from the host into
138 the root environment, to ensure the notification interface can work correctly.
</para>
140 <para>Note that services using
<varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname> will
141 not be able to log via the syslog or journal protocols to the host logging infrastructure, unless the
142 relevant sockets are mounted from the host, specifically:
</para>
145 <citerefentry><refentrytitle>os-release
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
146 file will be made available for the service (read-only) as
147 <filename>/run/host/os-release
</filename>.
148 It will be updated automatically on soft reboot (see:
149 <citerefentry><refentrytitle>systemd-soft-reboot.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry>),
150 in case the service is configured to survive it.
</para>
153 <title>Mounting logging sockets into root environment
</title>
155 <programlisting>BindReadOnlyPaths=/dev/log /run/systemd/journal/socket /run/systemd/journal/stdout
</programlisting>
158 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/></listitem>
162 <term><varname>RootImage=
</varname></term>
164 <listitem><para>Takes a path to a block device node or regular file as argument. This call is similar
165 to
<varname>RootDirectory=
</varname> however mounts a file system hierarchy from a block device node
166 or loopback file instead of a directory. The device node or file system image file needs to contain a
167 file system without a partition table, or a file system within an MBR/MS-DOS or GPT partition table
168 with only a single Linux-compatible partition, or a set of file systems within a GPT partition table
169 that follows the
<ulink url=
"https://uapi-group.org/specifications/specs/discoverable_partitions_specification">Discoverable Partitions
170 Specification
</ulink>.
</para>
172 <para>When
<varname>DevicePolicy=
</varname> is set to
<literal>closed
</literal> or
173 <literal>strict
</literal>, or set to
<literal>auto
</literal> and
<varname>DeviceAllow=
</varname> is
174 set, then this setting adds
<filename>/dev/loop-control
</filename> with
<constant>rw
</constant> mode,
175 <literal>block-loop
</literal> and
<literal>block-blkext
</literal> with
<constant>rwm
</constant> mode
176 to
<varname>DeviceAllow=
</varname>. See
177 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
178 for the details about
<varname>DevicePolicy=
</varname> or
<varname>DeviceAllow=
</varname>. Also, see
179 <varname>PrivateDevices=
</varname> below, as it may change the setting of
180 <varname>DevicePolicy=
</varname>.
</para>
182 <para>Units making use of
<varname>RootImage=
</varname> automatically gain an
183 <varname>After=
</varname> dependency on
<filename>systemd-udevd.service
</filename>.
</para>
186 <citerefentry><refentrytitle>os-release
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
187 file will be made available for the service (read-only) as
188 <filename>/run/host/os-release
</filename>.
189 It will be updated automatically on soft reboot (see:
190 <citerefentry><refentrytitle>systemd-soft-reboot.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry>),
191 in case the service is configured to survive it.
</para>
193 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
195 <xi:include href=
"version-info.xml" xpointer=
"v233"/></listitem>
199 <term><varname>RootImageOptions=
</varname></term>
201 <listitem><para>Takes a comma-separated list of mount options that will be used on disk images specified by
202 <varname>RootImage=
</varname>. Optionally a partition name can be prefixed, followed by colon, in
203 case the image has multiple partitions, otherwise partition name
<literal>root
</literal> is implied.
204 Options for multiple partitions can be specified in a single line with space separators. Assigning an empty
205 string removes previous assignments. Duplicated options are ignored. For a list of valid mount options, please
207 <citerefentry project='man-pages'
><refentrytitle>mount
</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
210 <para>Valid partition names follow the
<ulink
211 url=
"https://uapi-group.org/specifications/specs/discoverable_partitions_specification">Discoverable Partitions Specification
</ulink>:
212 <constant>root
</constant>,
<constant>usr
</constant>,
<constant>home
</constant>,
<constant>srv
</constant>,
213 <constant>esp
</constant>,
<constant>xbootldr
</constant>,
<constant>tmp
</constant>,
214 <constant>var
</constant>.
</para>
216 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
218 <xi:include href=
"version-info.xml" xpointer=
"v247"/></listitem>
222 <term><varname>RootEphemeral=
</varname></term>
224 <listitem><para>Takes a boolean argument. If enabled, executed processes will run in an ephemeral
225 copy of the root directory or root image. The ephemeral copy is placed in
226 <filename>/var/lib/systemd/ephemeral-trees/
</filename> while the service is active and is cleaned up
227 when the service is stopped or restarted. If
<varname>RootDirectory=
</varname> is used and the root
228 directory is a subvolume, the ephemeral copy will be created by making a snapshot of the subvolume.
231 <para>To make sure making ephemeral copies can be made efficiently, the root directory or root image
232 should be located on the same filesystem as
<filename>/var/lib/systemd/ephemeral-trees/
</filename>.
233 When using
<varname>RootEphemeral=
</varname> with root directories, btrfs should be used as the
234 filesystem and the root directory should ideally be a subvolume which
<command>systemd
</command> can
235 snapshot to make the ephemeral copy. For root images, a filesystem with support for reflinks should
236 be used to ensure an efficient ephemeral copy.
</para>
238 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
240 <xi:include href=
"version-info.xml" xpointer=
"v254"/></listitem>
244 <term><varname>RootHash=
</varname></term>
246 <listitem><para>Takes a data integrity (dm-verity) root hash specified in hexadecimal, or the path to a file
247 containing a root hash in ASCII hexadecimal format. This option enables data integrity checks using dm-verity,
248 if the used image contains the appropriate integrity data (see above) or if
<varname>RootVerity=
</varname> is used.
249 The specified hash must match the root hash of integrity data, and is usually at least
256 bits (and hence
64
250 formatted hexadecimal characters) long (in case of SHA256 for example). If this option is not specified, but
251 the image file carries the
<literal>user.verity.roothash
</literal> extended file attribute (see
<citerefentry
252 project='man-pages'
><refentrytitle>xattr
</refentrytitle><manvolnum>7</manvolnum></citerefentry>), then the root
253 hash is read from it, also as formatted hexadecimal characters. If the extended file attribute is not found (or
254 is not supported by the underlying file system), but a file with the
<filename>.roothash
</filename> suffix is
255 found next to the image file, bearing otherwise the same name (except if the image has the
256 <filename>.raw
</filename> suffix, in which case the root hash file must not have it in its name), the root hash
257 is read from it and automatically used, also as formatted hexadecimal characters.
</para>
259 <para>If the disk image contains a separate
<filename>/usr/
</filename> partition it may also be
260 Verity protected, in which case the root hash may configured via an extended attribute
261 <literal>user.verity.usrhash
</literal> or a
<filename>.usrhash
</filename> file adjacent to the disk
262 image. There's currently no option to configure the root hash for the
<filename>/usr/
</filename> file
263 system via the unit file directly.
</para>
265 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
267 <xi:include href=
"version-info.xml" xpointer=
"v246"/></listitem>
271 <term><varname>RootHashSignature=
</varname></term>
273 <listitem><para>Takes a PKCS7 signature of the
<varname>RootHash=
</varname> option as a path to a
274 DER-encoded signature file, or as an ASCII base64 string encoding of a DER-encoded signature prefixed
275 by
<literal>base64:
</literal>. The dm-verity volume will only be opened if the signature of the root
276 hash is valid and signed by a public key present in the kernel keyring. If this option is not
277 specified, but a file with the
<filename>.roothash.p7s
</filename> suffix is found next to the image
278 file, bearing otherwise the same name (except if the image has the
<filename>.raw
</filename> suffix,
279 in which case the signature file must not have it in its name), the signature is read from it and
280 automatically used.
</para>
282 <para>If the disk image contains a separate
<filename>/usr/
</filename> partition it may also be
283 Verity protected, in which case the signature for the root hash may configured via a
284 <filename>.usrhash.p7s
</filename> file adjacent to the disk image. There's currently no option to
285 configure the root hash signature for the
<filename>/usr/
</filename> via the unit file
288 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
290 <xi:include href=
"version-info.xml" xpointer=
"v246"/></listitem>
294 <term><varname>RootVerity=
</varname></term>
296 <listitem><para>Takes the path to a data integrity (dm-verity) file. This option enables data integrity checks
297 using dm-verity, if
<varname>RootImage=
</varname> is used and a root-hash is passed and if the used image itself
298 does not contain the integrity data. The integrity data must be matched by the root hash. If this option is not
299 specified, but a file with the
<filename>.verity
</filename> suffix is found next to the image file, bearing otherwise
300 the same name (except if the image has the
<filename>.raw
</filename> suffix, in which case the verity data file must
301 not have it in its name), the verity data is read from it and automatically used.
</para>
303 <para>This option is supported only for disk images that contain a single file system, without an
304 enveloping partition table. Images that contain a GPT partition table should instead include both
305 root file system and matching Verity data in the same image, implementing the
<ulink
306 url=
"https://uapi-group.org/specifications/specs/discoverable_partitions_specification">Discoverable Partitions Specification
</ulink>.
</para>
308 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
310 <xi:include href=
"version-info.xml" xpointer=
"v246"/></listitem>
314 <term><varname>RootImagePolicy=
</varname></term>
315 <term><varname>MountImagePolicy=
</varname></term>
316 <term><varname>ExtensionImagePolicy=
</varname></term>
318 <listitem><para>Takes an image policy string as per
319 <citerefentry><refentrytitle>systemd.image-policy
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
320 to use when mounting the disk images (DDI) specified in
<varname>RootImage=
</varname>,
321 <varname>MountImage=
</varname>,
<varname>ExtensionImage=
</varname>, respectively. If not specified
322 the following policy string is the default for
<varname>RootImagePolicy=
</varname> and
<varname>MountImagePolicy
</varname>:
</para>
324 <programlisting>root=verity+signed+encrypted+unprotected+absent: \
325 usr=verity+signed+encrypted+unprotected+absent: \
326 home=encrypted+unprotected+absent: \
327 srv=encrypted+unprotected+absent: \
328 tmp=encrypted+unprotected+absent: \
329 var=encrypted+unprotected+absent
</programlisting>
331 <para>The default policy for
<varname>ExtensionImagePolicy=
</varname> is:
</para>
333 <programlisting>root=verity+signed+encrypted+unprotected+absent: \
334 usr=verity+signed+encrypted+unprotected+absent
</programlisting>
336 <xi:include href=
"version-info.xml" xpointer=
"v254"/></listitem>
340 <term><varname>MountAPIVFS=
</varname></term>
342 <listitem><para>Takes a boolean argument. If on, a private mount namespace for the unit's processes is created
343 and the API file systems
<filename>/proc/
</filename>,
<filename>/sys/
</filename>,
<filename>/dev/
</filename> and
344 <filename>/run/
</filename> (as an empty
<literal>tmpfs
</literal>) are mounted inside of it, unless they are
345 already mounted. Note that this option has no effect unless used in conjunction with
346 <varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname> as these four mounts are
347 generally mounted in the host anyway, and unless the root directory is changed, the private mount namespace
348 will be a
1:
1 copy of the host's, and include these four mounts. Note that the
<filename>/dev/
</filename> file
349 system of the host is bind mounted if this option is used without
<varname>PrivateDevices=
</varname>. To run
350 the service with a private, minimal version of
<filename>/dev/
</filename>, combine this option with
351 <varname>PrivateDevices=
</varname>.
</para>
353 <para>In order to allow propagating mounts at runtime in a safe manner,
<filename>/run/systemd/propagate/
</filename>
354 on the host will be used to set up new mounts, and
<filename>/run/host/incoming/
</filename> in the private namespace
355 will be used as an intermediate step to store them before being moved to the final mount point.
</para>
357 <xi:include href=
"version-info.xml" xpointer=
"v233"/></listitem>
361 <term><varname>ProtectProc=
</varname></term>
363 <listitem><para>Takes one of
<literal>noaccess
</literal>,
<literal>invisible
</literal>,
364 <literal>ptraceable
</literal> or
<literal>default
</literal> (which it defaults to). When set, this
365 controls the
<literal>hidepid=
</literal> mount option of the
<literal>procfs
</literal> instance for
366 the unit that controls which directories with process metainformation
367 (
<filename>/proc/
<replaceable>PID
</replaceable></filename>) are visible and accessible: when set to
368 <literal>noaccess
</literal> the ability to access most of other users' process metadata in
369 <filename>/proc/
</filename> is taken away for processes of the service. When set to
370 <literal>invisible
</literal> processes owned by other users are hidden from
371 <filename>/proc/
</filename>. If
<literal>ptraceable
</literal> all processes that cannot be
372 <function>ptrace()
</function>'ed by a process are hidden to it. If
<literal>default
</literal> no
373 restrictions on
<filename>/proc/
</filename> access or visibility are made. For further details see
374 <ulink url=
"https://docs.kernel.org/filesystems/proc.html#mount-options">The /proc
375 Filesystem
</ulink>. It is generally recommended to run most system services with this option set to
376 <literal>invisible
</literal>. This option is implemented via file system namespacing, and thus cannot
377 be used with services that shall be able to install mount points in the host file system
378 hierarchy. Note that the root user is unaffected by this option, so to be effective it has to be used
379 together with
<varname>User=
</varname> or
<varname>DynamicUser=yes
</varname>, and also without the
380 <literal>CAP_SYS_PTRACE
</literal> capability, which also allows a process to bypass this feature. It
381 cannot be used for services that need to access metainformation about other users' processes. This
382 option implies
<varname>MountAPIVFS=
</varname>.
</para>
384 <para>If the kernel doesn't support per-mount point
<option>hidepid=
</option> mount options this
385 setting remains without effect, and the unit's processes will be able to access and see other process
386 as if the option was not used.
</para>
388 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
390 <xi:include href=
"version-info.xml" xpointer=
"v247"/></listitem>
394 <term><varname>ProcSubset=
</varname></term>
396 <listitem><para>Takes one of
<literal>all
</literal> (the default) and
<literal>pid
</literal>. If
397 <literal>pid
</literal>, all files and directories not directly associated with process management and
398 introspection are made invisible in the
<filename>/proc/
</filename> file system configured for the
399 unit's processes. This controls the
<literal>subset=
</literal> mount option of the
400 <literal>procfs
</literal> instance for the unit. For further details see
<ulink
401 url=
"https://docs.kernel.org/filesystems/proc.html#mount-options">The /proc
402 Filesystem
</ulink>. Note that Linux exposes various kernel APIs via
<filename>/proc/
</filename>,
403 which are made unavailable with this setting. Since these APIs are used frequently this option is
404 useful only in a few, specific cases, and is not suitable for most non-trivial programs.
</para>
406 <para>Much like
<varname>ProtectProc=
</varname> above, this is implemented via file system mount
407 namespacing, and hence the same restrictions apply: it is only available to system services, it
408 disables mount propagation to the host mount table, and it implies
409 <varname>MountAPIVFS=
</varname>. Also, like
<varname>ProtectProc=
</varname> this setting is gracefully
410 disabled if the used kernel does not support the
<literal>subset=
</literal> mount option of
411 <literal>procfs
</literal>.
</para>
413 <xi:include href=
"version-info.xml" xpointer=
"v247"/></listitem>
417 <term><varname>BindPaths=
</varname></term>
418 <term><varname>BindReadOnlyPaths=
</varname></term>
420 <listitem><para>Configures unit-specific bind mounts. A bind mount makes a particular file or directory
421 available at an additional place in the unit's view of the file system. Any bind mounts created with this
422 option are specific to the unit, and are not visible in the host's mount table. This option expects a
423 whitespace separated list of bind mount definitions. Each definition consists of a colon-separated triple of
424 source path, destination path and option string, where the latter two are optional. If only a source path is
425 specified the source and destination is taken to be the same. The option string may be either
426 <literal>rbind
</literal> or
<literal>norbind
</literal> for configuring a recursive or non-recursive bind
427 mount. If the destination path is omitted, the option string must be omitted too.
428 Each bind mount definition may be prefixed with
<literal>-
</literal>, in which case it will be ignored
429 when its source path does not exist.
</para>
431 <para><varname>BindPaths=
</varname> creates regular writable bind mounts (unless the source file system mount
432 is already marked read-only), while
<varname>BindReadOnlyPaths=
</varname> creates read-only bind mounts. These
433 settings may be used more than once, each usage appends to the unit's list of bind mounts. If the empty string
434 is assigned to either of these two options the entire list of bind mounts defined prior to this is reset. Note
435 that in this case both read-only and regular bind mounts are reset, regardless which of the two settings is
438 <para>This option is particularly useful when
<varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname>
439 is used. In this case the source path refers to a path on the host file system, while the destination path
440 refers to a path below the root directory of the unit.
</para>
442 <para>Note that the destination directory must exist or systemd must be able to create it. Thus, it
443 is not possible to use those options for mount points nested underneath paths specified in
444 <varname>InaccessiblePaths=
</varname>, or under
<filename>/home/
</filename> and other protected
445 directories if
<varname>ProtectHome=yes
</varname> is
446 specified.
<varname>TemporaryFileSystem=
</varname> with
<literal>:ro
</literal> or
447 <varname>ProtectHome=tmpfs
</varname> should be used instead.
</para>
449 <xi:include href=
"version-info.xml" xpointer=
"v233"/></listitem>
453 <term><varname>MountImages=
</varname></term>
455 <listitem><para>This setting is similar to
<varname>RootImage=
</varname> in that it mounts a file
456 system hierarchy from a block device node or loopback file, but the destination directory can be
457 specified as well as mount options. This option expects a whitespace separated list of mount
458 definitions. Each definition consists of a colon-separated tuple of source path and destination
459 definitions, optionally followed by another colon and a list of mount options.
</para>
461 <para>Mount options may be defined as a single comma-separated list of options, in which case they
462 will be implicitly applied to the root partition on the image, or a series of colon-separated tuples
463 of partition name and mount options. Valid partition names and mount options are the same as for
464 <varname>RootImageOptions=
</varname> setting described above.
</para>
466 <para>Each mount definition may be prefixed with
<literal>-
</literal>, in which case it will be
467 ignored when its source path does not exist. The source argument is a path to a block device node or
468 regular file. If source or destination contain a
<literal>:
</literal>, it needs to be escaped as
469 <literal>\:
</literal>. The device node or file system image file needs to follow the same rules as
470 specified for
<varname>RootImage=
</varname>. Any mounts created with this option are specific to the
471 unit, and are not visible in the host's mount table.
</para>
473 <para>These settings may be used more than once, each usage appends to the unit's list of mount
474 paths. If the empty string is assigned, the entire list of mount paths defined prior to this is
477 <para>Note that the destination directory must exist or systemd must be able to create it. Thus, it
478 is not possible to use those options for mount points nested underneath paths specified in
479 <varname>InaccessiblePaths=
</varname>, or under
<filename>/home/
</filename> and other protected
480 directories if
<varname>ProtectHome=yes
</varname> is specified.
</para>
482 <para>When
<varname>DevicePolicy=
</varname> is set to
<literal>closed
</literal> or
483 <literal>strict
</literal>, or set to
<literal>auto
</literal> and
<varname>DeviceAllow=
</varname> is
484 set, then this setting adds
<filename>/dev/loop-control
</filename> with
<constant>rw
</constant> mode,
485 <literal>block-loop
</literal> and
<literal>block-blkext
</literal> with
<constant>rwm
</constant> mode
486 to
<varname>DeviceAllow=
</varname>. See
487 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
488 for the details about
<varname>DevicePolicy=
</varname> or
<varname>DeviceAllow=
</varname>. Also, see
489 <varname>PrivateDevices=
</varname> below, as it may change the setting of
490 <varname>DevicePolicy=
</varname>.
</para>
492 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
494 <xi:include href=
"version-info.xml" xpointer=
"v247"/></listitem>
498 <term><varname>ExtensionImages=
</varname></term>
500 <listitem><para>This setting is similar to
<varname>MountImages=
</varname> in that it mounts a file
501 system hierarchy from a block device node or loopback file, but instead of providing a destination
502 path, an overlay will be set up. This option expects a whitespace separated list of mount
503 definitions. Each definition consists of a source path, optionally followed by a colon and a list of
504 mount options.
</para>
506 <para>A read-only OverlayFS will be set up on top of
<filename>/usr/
</filename> and
507 <filename>/opt/
</filename> hierarchies for sysext images and
<filename>/etc/
</filename>
508 hierarchy for confext images. The order in which the images are listed will determine the
509 order in which the overlay is laid down: images specified first to last will result in overlayfs
510 layers bottom to top.
</para>
512 <para>Mount options may be defined as a single comma-separated list of options, in which case they
513 will be implicitly applied to the root partition on the image, or a series of colon-separated tuples
514 of partition name and mount options. Valid partition names and mount options are the same as for
515 <varname>RootImageOptions=
</varname> setting described above.
</para>
517 <para>Each mount definition may be prefixed with
<literal>-
</literal>, in which case it will be
518 ignored when its source path does not exist. The source argument is a path to a block device node or
519 regular file. If the source path contains a
<literal>:
</literal>, it needs to be escaped as
520 <literal>\:
</literal>. The device node or file system image file needs to follow the same rules as
521 specified for
<varname>RootImage=
</varname>. Any mounts created with this option are specific to the
522 unit, and are not visible in the host's mount table.
</para>
524 <para>These settings may be used more than once, each usage appends to the unit's list of image
525 paths. If the empty string is assigned, the entire list of mount paths defined prior to this is
528 <para>Each sysext image must carry a
<filename>/usr/lib/extension-release.d/extension-release.IMAGE
</filename>
529 file while each confext image must carry a
<filename>/etc/extension-release.d/extension-release.IMAGE
</filename>
530 file, with the appropriate metadata which matches
<varname>RootImage=
</varname>/
<varname>RootDirectory=
</varname>
532 <citerefentry><refentrytitle>os-release
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
533 To disable the safety check that the extension-release file name matches the image file name, the
534 <varname>x-systemd.relax-extension-release-check
</varname> mount option may be appended.
</para>
536 <para>When
<varname>DevicePolicy=
</varname> is set to
<literal>closed
</literal> or
537 <literal>strict
</literal>, or set to
<literal>auto
</literal> and
<varname>DeviceAllow=
</varname> is
538 set, then this setting adds
<filename>/dev/loop-control
</filename> with
<constant>rw
</constant> mode,
539 <literal>block-loop
</literal> and
<literal>block-blkext
</literal> with
<constant>rwm
</constant> mode
540 to
<varname>DeviceAllow=
</varname>. See
541 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
542 for the details about
<varname>DevicePolicy=
</varname> or
<varname>DeviceAllow=
</varname>. Also, see
543 <varname>PrivateDevices=
</varname> below, as it may change the setting of
544 <varname>DevicePolicy=
</varname>.
</para>
546 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
548 <xi:include href=
"version-info.xml" xpointer=
"v248"/></listitem>
552 <term><varname>ExtensionDirectories=
</varname></term>
554 <listitem><para>This setting is similar to
<varname>BindReadOnlyPaths=
</varname> in that it mounts a file
555 system hierarchy from a directory, but instead of providing a destination path, an overlay will be set
556 up. This option expects a whitespace separated list of source directories.
</para>
558 <para>A read-only OverlayFS will be set up on top of
<filename>/usr/
</filename> and
559 <filename>/opt/
</filename> hierarchies for sysext images and
<filename>/etc/
</filename>
560 hierarchy for confext images. The order in which the directories are listed will determine
561 the order in which the overlay is laid down: directories specified first to last will result in overlayfs
562 layers bottom to top.
</para>
564 <para>Each directory listed in
<varname>ExtensionDirectories=
</varname> may be prefixed with
<literal>-
</literal>,
565 in which case it will be ignored when its source path does not exist. Any mounts created with this option are
566 specific to the unit, and are not visible in the host's mount table.
</para>
568 <para>These settings may be used more than once, each usage appends to the unit's list of directories
569 paths. If the empty string is assigned, the entire list of mount paths defined prior to this is
572 <para>Each sysext directory must contain a
<filename>/usr/lib/extension-release.d/extension-release.IMAGE
</filename>
573 file while each confext directory must carry a
<filename>/etc/extension-release.d/extension-release.IMAGE
</filename>
574 file, with the appropriate metadata which matches
<varname>RootImage=
</varname>/
<varname>RootDirectory=
</varname>
576 <citerefentry><refentrytitle>os-release
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
</para>
578 <para>Note that usage from user units requires overlayfs support in unprivileged user namespaces,
579 which was first introduced in kernel v5.11.
</para>
581 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
583 <xi:include href=
"version-info.xml" xpointer=
"v251"/></listitem>
589 <title>User/Group Identity
</title>
591 <xi:include href=
"system-only.xml" xpointer=
"plural"/>
593 <variablelist class='unit-directives'
>
596 <term><varname>User=
</varname></term>
597 <term><varname>Group=
</varname></term>
599 <listitem><para>Set the UNIX user or group that the processes are executed as, respectively. Takes a single
600 user or group name, or a numeric ID as argument. For system services (services run by the system service
601 manager, i.e. managed by PID
1) and for user services of the root user (services managed by root's instance of
602 <command>systemd --user
</command>), the default is
<literal>root
</literal>, but
<varname>User=
</varname> may be
603 used to specify a different user. For user services of any other user, switching user identity is not
604 permitted, hence the only valid setting is the same user the user's service manager is running as. If no group
605 is set, the default group of the user is used. This setting does not affect commands whose command line is
606 prefixed with
<literal>+
</literal>.
</para>
608 <para>Note that this enforces only weak restrictions on the user/group name syntax, but will generate
609 warnings in many cases where user/group names do not adhere to the following rules: the specified
610 name should consist only of the characters a-z, A-Z,
0-
9,
<literal>_
</literal> and
611 <literal>-
</literal>, except for the first character which must be one of a-z, A-Z and
612 <literal>_
</literal> (i.e. digits and
<literal>-
</literal> are not permitted as first character). The
613 user/group name must have at least one character, and at most
31. These restrictions are made in
614 order to avoid ambiguities and to ensure user/group names and unit files remain portable among Linux
615 systems. For further details on the names accepted and the names warned about see
<ulink
616 url=
"https://systemd.io/USER_NAMES">User/Group Name Syntax
</ulink>.
</para>
618 <para>When used in conjunction with
<varname>DynamicUser=
</varname> the user/group name specified is
619 dynamically allocated at the time the service is started, and released at the time the service is
620 stopped — unless it is already allocated statically (see below). If
<varname>DynamicUser=
</varname>
621 is not used the specified user and group must have been created statically in the user database no
622 later than the moment the service is started, for example using the
623 <citerefentry><refentrytitle>sysusers.d
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
624 facility, which is applied at boot or package install time. If the user does not exist by then
625 program invocation will fail.
</para>
627 <para>If the
<varname>User=
</varname> setting is used the supplementary group list is initialized
628 from the specified user's default group list, as defined in the system's user and group
629 database. Additional groups may be configured through the
<varname>SupplementaryGroups=
</varname>
630 setting (see below).
</para></listitem>
634 <term><varname>DynamicUser=
</varname></term>
636 <listitem><para>Takes a boolean parameter. If set, a UNIX user and group pair is allocated
637 dynamically when the unit is started, and released as soon as it is stopped. The user and group will
638 not be added to
<filename>/etc/passwd
</filename> or
<filename>/etc/group
</filename>, but are managed
639 transiently during runtime. The
640 <citerefentry><refentrytitle>nss-systemd
</refentrytitle><manvolnum>8</manvolnum></citerefentry> glibc
641 NSS module provides integration of these dynamic users/groups into the system's user and group
642 databases. The user and group name to use may be configured via
<varname>User=
</varname> and
643 <varname>Group=
</varname> (see above). If these options are not used and dynamic user/group
644 allocation is enabled for a unit, the name of the dynamic user/group is implicitly derived from the
645 unit name. If the unit name without the type suffix qualifies as valid user name it is used directly,
646 otherwise a name incorporating a hash of it is used. If a statically allocated user or group of the
647 configured name already exists, it is used and no dynamic user/group is allocated. Note that if
648 <varname>User=
</varname> is specified and the static group with the name exists, then it is required
649 that the static user with the name already exists. Similarly, if
<varname>Group=
</varname> is
650 specified and the static user with the name exists, then it is required that the static group with
651 the name already exists. Dynamic users/groups are allocated from the UID/GID range
61184…
65519. It is
652 recommended to avoid this range for regular system or login users. At any point in time each UID/GID
653 from this range is only assigned to zero or one dynamically allocated users/groups in use. However,
654 UID/GIDs are recycled after a unit is terminated. Care should be taken that any processes running as
655 part of a unit for which dynamic users/groups are enabled do not leave files or directories owned by
656 these users/groups around, as a different unit might get the same UID/GID assigned later on, and thus
657 gain access to these files or directories. If
<varname>DynamicUser=
</varname> is enabled,
658 <varname>RemoveIPC=
</varname> and
<varname>PrivateTmp=
</varname> are implied (and cannot be turned
659 off). This ensures that the lifetime of IPC objects and temporary files created by the executed
660 processes is bound to the runtime of the service, and hence the lifetime of the dynamic
661 user/group. Since
<filename>/tmp/
</filename> and
<filename>/var/tmp/
</filename> are usually the only
662 world-writable directories on a system this ensures that a unit making use of dynamic user/group
663 allocation cannot leave files around after unit termination. Furthermore
664 <varname>NoNewPrivileges=
</varname> and
<varname>RestrictSUIDSGID=
</varname> are implicitly enabled
665 (and cannot be disabled), to ensure that processes invoked cannot take benefit or create SUID/SGID
666 files or directories. Moreover
<varname>ProtectSystem=strict
</varname> and
667 <varname>ProtectHome=read-only
</varname> are implied, thus prohibiting the service to write to
668 arbitrary file system locations. In order to allow the service to write to certain directories, they
669 have to be allow-listed using
<varname>ReadWritePaths=
</varname>, but care must be taken so that
670 UID/GID recycling doesn't create security issues involving files created by the service. Use
671 <varname>RuntimeDirectory=
</varname> (see below) in order to assign a writable runtime directory to a
672 service, owned by the dynamic user/group and removed automatically when the unit is terminated. Use
673 <varname>StateDirectory=
</varname>,
<varname>CacheDirectory=
</varname> and
674 <varname>LogsDirectory=
</varname> in order to assign a set of writable directories for specific
675 purposes to the service in a way that they are protected from vulnerabilities due to UID reuse (see
676 below). If this option is enabled, care should be taken that the unit's processes do not get access
677 to directories outside of these explicitly configured and managed ones. Specifically, do not use
678 <varname>BindPaths=
</varname> and be careful with
<constant>AF_UNIX
</constant> file descriptor
679 passing for directory file descriptors, as this would permit processes to create files or directories
680 owned by the dynamic user/group that are not subject to the lifecycle and access guarantees of the
681 service. Note that this option is currently incompatible with D-Bus policies, thus a service using
682 this option may currently not allocate a D-Bus service name (note that this does not affect calling
683 into other D-Bus services). Defaults to off.
</para>
685 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
689 <term><varname>SupplementaryGroups=
</varname></term>
691 <listitem><para>Sets the supplementary Unix groups the processes are executed as. This takes a space-separated
692 list of group names or IDs. This option may be specified more than once, in which case all listed groups are
693 set as supplementary groups. When the empty string is assigned, the list of supplementary groups is reset, and
694 all assignments prior to this one will have no effect. In any way, this option does not override, but extends
695 the list of supplementary groups configured in the system group database for the user. This does not affect
696 commands prefixed with
<literal>+
</literal>.
</para></listitem>
700 <term><varname>PAMName=
</varname></term>
702 <listitem><para>Sets the PAM service name to set up a session as. If set, the executed process will be
703 registered as a PAM session under the specified service name. This is only useful in conjunction with the
704 <varname>User=
</varname> setting, and is otherwise ignored. If not set, no PAM session will be opened for the
705 executed processes. See
<citerefentry
706 project='man-pages'
><refentrytitle>pam
</refentrytitle><manvolnum>8</manvolnum></citerefentry> for
709 <para>Note that for each unit making use of this option a PAM session handler process will be maintained as
710 part of the unit and stays around as long as the unit is active, to ensure that appropriate actions can be
711 taken when the unit and hence the PAM session terminates. This process is named
<literal>(sd-pam)
</literal> and
712 is an immediate child process of the unit's main process.
</para>
714 <para>Note that when this option is used for a unit it is very likely (depending on PAM configuration) that the
715 main unit process will be migrated to its own session scope unit when it is activated. This process will hence
716 be associated with two units: the unit it was originally started from (and for which
717 <varname>PAMName=
</varname> was configured), and the session scope unit. Any child processes of that process
718 will however be associated with the session scope unit only. This has implications when used in combination
719 with
<varname>NotifyAccess=
</varname><option>all
</option>, as these child processes will not be able to affect
720 changes in the original unit through notification messages. These messages will be considered belonging to the
721 session scope unit and not the original unit. It is hence not recommended to use
<varname>PAMName=
</varname> in
722 combination with
<varname>NotifyAccess=
</varname><option>all
</option>.
</para>
730 <title>Capabilities
</title>
732 <xi:include href=
"system-or-user-ns.xml" xpointer=
"plural"/>
734 <variablelist class='unit-directives'
>
737 <term><varname>CapabilityBoundingSet=
</varname></term>
739 <listitem><para>Controls which capabilities to include in the capability bounding set for the
740 executed process. See
<citerefentry
741 project='man-pages'
><refentrytitle>capabilities
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
742 for details. Takes a whitespace-separated list of capability names,
743 e.g.
<constant>CAP_SYS_ADMIN
</constant>,
<constant>CAP_DAC_OVERRIDE
</constant>,
744 <constant>CAP_SYS_PTRACE
</constant>. Capabilities listed will be included in the bounding set, all
745 others are removed. If the list of capabilities is prefixed with
<literal>~
</literal>, all but the
746 listed capabilities will be included, the effect of the assignment inverted. Note that this option
747 also affects the respective capabilities in the effective, permitted and inheritable capability
748 sets. If this option is not used, the capability bounding set is not modified on process execution,
749 hence no limits on the capabilities of the process are enforced. This option may appear more than
750 once, in which case the bounding sets are merged by
<constant>OR
</constant>, or by
751 <constant>AND
</constant> if the lines are prefixed with
<literal>~
</literal> (see below). If the
752 empty string is assigned to this option, the bounding set is reset to the empty capability set, and
753 all prior settings have no effect. If set to
<literal>~
</literal> (without any further argument),
754 the bounding set is reset to the full set of available capabilities, also undoing any previous
755 settings. This does not affect commands prefixed with
<literal>+
</literal>.
</para>
758 <citerefentry><refentrytitle>systemd-analyze
</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s
759 <command>capability
</command> command to retrieve a list of capabilities defined on the local
762 <para>Example: if a unit has the following,
763 <programlisting>CapabilityBoundingSet=CAP_A CAP_B
764 CapabilityBoundingSet=CAP_B CAP_C
</programlisting>
765 then
<constant index='false'
>CAP_A
</constant>,
<constant index='false'
>CAP_B
</constant>, and
766 <constant index='false'
>CAP_C
</constant> are set. If the second line is prefixed with
767 <literal>~
</literal>, e.g.,
768 <programlisting>CapabilityBoundingSet=CAP_A CAP_B
769 CapabilityBoundingSet=~CAP_B CAP_C
</programlisting>
770 then, only
<constant index='false'
>CAP_A
</constant> is set.
</para></listitem>
774 <term><varname>AmbientCapabilities=
</varname></term>
776 <listitem><para>Controls which capabilities to include in the ambient capability set for the executed
777 process. Takes a whitespace-separated list of capability names, e.g.
<constant>CAP_SYS_ADMIN
</constant>,
778 <constant>CAP_DAC_OVERRIDE
</constant>,
<constant>CAP_SYS_PTRACE
</constant>. This option may appear more than
779 once, in which case the ambient capability sets are merged (see the above examples in
780 <varname>CapabilityBoundingSet=
</varname>). If the list of capabilities is prefixed with
<literal>~
</literal>,
781 all but the listed capabilities will be included, the effect of the assignment inverted. If the empty string is
782 assigned to this option, the ambient capability set is reset to the empty capability set, and all prior
783 settings have no effect. If set to
<literal>~
</literal> (without any further argument), the ambient capability
784 set is reset to the full set of available capabilities, also undoing any previous settings. Note that adding
785 capabilities to the ambient capability set adds them to the process's inherited capability set.
</para><para>
786 Ambient capability sets are useful if you want to execute a process as a non-privileged user but still want to
787 give it some capabilities. Note that in this case option
<constant>keep-caps
</constant> is automatically added
788 to
<varname>SecureBits=
</varname> to retain the capabilities over the user
789 change.
<varname>AmbientCapabilities=
</varname> does not affect commands prefixed with
790 <literal>+
</literal>.
</para>
792 <xi:include href=
"version-info.xml" xpointer=
"v229"/></listitem>
799 <title>Security
</title>
801 <variablelist class='unit-directives'
>
804 <term><varname>NoNewPrivileges=
</varname></term>
806 <listitem><para>Takes a boolean argument. If true, ensures that the service process and all its
807 children can never gain new privileges through
<function>execve()
</function> (e.g. via setuid or
808 setgid bits, or filesystem capabilities). This is the simplest and most effective way to ensure that
809 a process and its children can never elevate privileges again. Defaults to false, but certain
810 settings override this and ignore the value of this setting. This is the case when
811 <varname>DynamicUser=
</varname>,
<varname>LockPersonality=
</varname>,
812 <varname>MemoryDenyWriteExecute=
</varname>,
<varname>PrivateDevices=
</varname>,
813 <varname>ProtectClock=
</varname>,
<varname>ProtectHostname=
</varname>,
814 <varname>ProtectKernelLogs=
</varname>,
<varname>ProtectKernelModules=
</varname>,
815 <varname>ProtectKernelTunables=
</varname>,
<varname>RestrictAddressFamilies=
</varname>,
816 <varname>RestrictNamespaces=
</varname>,
<varname>RestrictRealtime=
</varname>,
817 <varname>RestrictSUIDSGID=
</varname>,
<varname>SystemCallArchitectures=
</varname>,
818 <varname>SystemCallFilter=
</varname>, or
<varname>SystemCallLog=
</varname> are specified. Note that
819 even if this setting is overridden by them,
<command>systemctl show
</command> shows the original
820 value of this setting. In case the service will be run in a new mount namespace anyway and SELinux is
821 disabled, all file systems are mounted with
<constant>MS_NOSUID
</constant> flag. Also see
<ulink
822 url=
"https://docs.kernel.org/userspace-api/no_new_privs.html">No New Privileges
825 <para>Note that this setting only has an effect on the unit's processes themselves (or any processes
826 directly or indirectly forked off them). It has no effect on processes potentially invoked on request
827 of them through tools such as
<citerefentry
828 project='man-pages'
><refentrytitle>at
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
830 project='man-pages'
><refentrytitle>crontab
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
831 <citerefentry><refentrytitle>systemd-run
</refentrytitle><manvolnum>1</manvolnum></citerefentry>, or
832 arbitrary IPC services.
</para>
834 <xi:include href=
"version-info.xml" xpointer=
"v187"/></listitem>
838 <term><varname>SecureBits=
</varname></term>
840 <listitem><para>Controls the secure bits set for the executed process. Takes a space-separated combination of
841 options from the following list:
<option>keep-caps
</option>,
<option>keep-caps-locked
</option>,
842 <option>no-setuid-fixup
</option>,
<option>no-setuid-fixup-locked
</option>,
<option>noroot
</option>, and
843 <option>noroot-locked
</option>. This option may appear more than once, in which case the secure bits are
844 ORed. If the empty string is assigned to this option, the bits are reset to
0. This does not affect commands
845 prefixed with
<literal>+
</literal>. See
<citerefentry
846 project='man-pages'
><refentrytitle>capabilities
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
847 details.
</para></listitem>
854 <title>Mandatory Access Control
</title>
856 <xi:include href=
"system-only.xml" xpointer=
"plural"/>
858 <variablelist class='unit-directives'
>
861 <term><varname>SELinuxContext=
</varname></term>
863 <listitem><para>Set the SELinux security context of the executed process. If set, this will override the
864 automated domain transition. However, the policy still needs to authorize the transition. This directive is
865 ignored if SELinux is disabled. If prefixed by
<literal>-
</literal>, failing to set the SELinux
866 security context will be ignored, but it's still possible that the subsequent
867 <function>execve()
</function> may fail if the policy doesn't allow the transition for the
868 non-overridden context. This does not affect commands prefixed with
<literal>+
</literal>. See
870 project='die-net'
><refentrytitle>setexeccon
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
873 <xi:include href=
"version-info.xml" xpointer=
"v209"/></listitem>
877 <term><varname>AppArmorProfile=
</varname></term>
879 <listitem><para>Takes a profile name as argument. The process executed by the unit will switch to
880 this profile when started. Profiles must already be loaded in the kernel, or the unit will fail. If
881 prefixed by
<literal>-
</literal>, all errors will be ignored. This setting has no effect if AppArmor
882 is not enabled. This setting does not affect commands prefixed with
<literal>+
</literal>.
</para>
884 <xi:include href=
"version-info.xml" xpointer=
"v210"/>
889 <term><varname>SmackProcessLabel=
</varname></term>
891 <listitem><para>Takes a
<option>SMACK64
</option> security label as argument. The process executed by the unit
892 will be started under this label and SMACK will decide whether the process is allowed to run or not, based on
893 it. The process will continue to run under the label specified here unless the executable has its own
894 <option>SMACK64EXEC
</option> label, in which case the process will transition to run under that label. When not
895 specified, the label that systemd is running under is used. This directive is ignored if SMACK is
898 <para>The value may be prefixed by
<literal>-
</literal>, in which case all errors will be ignored. An empty
899 value may be specified to unset previous assignments. This does not affect commands prefixed with
900 <literal>+
</literal>.
</para>
902 <xi:include href=
"version-info.xml" xpointer=
"v218"/></listitem>
909 <title>Process Properties
</title>
911 <variablelist class='unit-directives'
>
914 <term><varname>LimitCPU=
</varname></term>
915 <term><varname>LimitFSIZE=
</varname></term>
916 <term><varname>LimitDATA=
</varname></term>
917 <term><varname>LimitSTACK=
</varname></term>
918 <term><varname>LimitCORE=
</varname></term>
919 <term><varname>LimitRSS=
</varname></term>
920 <term><varname>LimitNOFILE=
</varname></term>
921 <term><varname>LimitAS=
</varname></term>
922 <term><varname>LimitNPROC=
</varname></term>
923 <term><varname>LimitMEMLOCK=
</varname></term>
924 <term><varname>LimitLOCKS=
</varname></term>
925 <term><varname>LimitSIGPENDING=
</varname></term>
926 <term><varname>LimitMSGQUEUE=
</varname></term>
927 <term><varname>LimitNICE=
</varname></term>
928 <term><varname>LimitRTPRIO=
</varname></term>
929 <term><varname>LimitRTTIME=
</varname></term>
931 <listitem><para>Set soft and hard limits on various resources for executed processes. See
932 <citerefentry><refentrytitle>setrlimit
</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
933 details on the process resource limit concept. Process resource limits may be specified in two formats:
934 either as single value to set a specific soft and hard limit to the same value, or as colon-separated
935 pair
<option>soft:hard
</option> to set both limits individually
936 (e.g.
<literal>LimitAS=
4G:
16G
</literal>). Use the string
<option>infinity
</option> to configure no
937 limit on a specific resource. The multiplicative suffixes K, M, G, T, P and E (to the base
1024) may
938 be used for resource limits measured in bytes (e.g.
<literal>LimitAS=
16G
</literal>). For the limits
939 referring to time values, the usual time units ms, s, min, h and so on may be used (see
940 <citerefentry><refentrytitle>systemd.time
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
941 details). Note that if no time unit is specified for
<varname>LimitCPU=
</varname> the default unit of
942 seconds is implied, while for
<varname>LimitRTTIME=
</varname> the default unit of microseconds is
943 implied. Also, note that the effective granularity of the limits might influence their
944 enforcement. For example, time limits specified for
<varname>LimitCPU=
</varname> will be rounded up
945 implicitly to multiples of
1s. For
<varname>LimitNICE=
</varname> the value may be specified in two
946 syntaxes: if prefixed with
<literal>+
</literal> or
<literal>-
</literal>, the value is understood as
947 regular Linux nice value in the range -
20…
19. If not prefixed like this the value is understood as
948 raw resource limit parameter in the range
0…
40 (with
0 being equivalent to
1).
</para>
950 <para>Note that most process resource limits configured with these options are per-process, and
951 processes may fork in order to acquire a new set of resources that are accounted independently of the
952 original process, and may thus escape limits set. Also note that
<varname>LimitRSS=
</varname> is not
953 implemented on Linux, and setting it has no effect. Often it is advisable to prefer the resource
955 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
956 over these per-process limits, as they apply to services as a whole, may be altered dynamically at
957 runtime, and are generally more expressive. For example,
<varname>MemoryMax=
</varname> is a more
958 powerful (and working) replacement for
<varname>LimitRSS=
</varname>.
</para>
960 <para>Note that
<varname>LimitNPROC=
</varname> will limit the number of processes from one (real) UID and
961 not the number of processes started (forked) by the service. Therefore the limit is cumulative for all
962 processes running under the same UID. Please also note that the
<varname>LimitNPROC=
</varname> will not be
963 enforced if the service is running as root (and not dropping privileges). Due to these limitations,
964 <varname>TasksMax=
</varname> (see
<citerefentry><refentrytitle>systemd.resource-control
</refentrytitle>
965 <manvolnum>5</manvolnum></citerefentry>) is typically a better choice than
<varname>LimitNPROC=
</varname>.
968 <para>Resource limits not configured explicitly for a unit default to the value configured in the various
969 <varname>DefaultLimitCPU=
</varname>,
<varname>DefaultLimitFSIZE=
</varname>, … options available in
970 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>, and –
971 if not configured there – the kernel or per-user defaults, as defined by the OS (the latter only for user
972 services, see below).
</para>
974 <para>For system units these resource limits may be chosen freely. When these settings are configured
975 in a user service (i.e. a service run by the per-user instance of the service manager) they cannot be
976 used to raise the limits above those set for the user manager itself when it was first invoked, as
977 the user's service manager generally lacks the privileges to do so. In user context these
978 configuration options are hence only useful to lower the limits passed in or to raise the soft limit
979 to the maximum of the hard limit as configured for the user. To raise the user's limits further, the
980 available configuration mechanisms differ between operating systems, but typically require
981 privileges. In most cases it is possible to configure higher per-user resource limits via PAM or by
982 setting limits on the system service encapsulating the user's service manager, i.e. the user's
983 instance of
<filename>user@.service
</filename>. After making such changes, make sure to restart the
984 user's service manager.
</para>
987 <title>Resource limit directives, their equivalent
<command>ulimit
</command> shell commands and the unit used
</title>
990 <colspec colname='directive'
/>
991 <colspec colname='equivalent'
/>
992 <colspec colname='unit'
/>
993 <colspec colname='notes'
/>
996 <entry>Directive
</entry>
997 <entry><command>ulimit
</command> equivalent
</entry>
1004 <entry>LimitCPU=
</entry>
1005 <entry>ulimit -t
</entry>
1006 <entry>Seconds
</entry>
1010 <entry>LimitFSIZE=
</entry>
1011 <entry>ulimit -f
</entry>
1012 <entry>Bytes
</entry>
1016 <entry>LimitDATA=
</entry>
1017 <entry>ulimit -d
</entry>
1018 <entry>Bytes
</entry>
1019 <entry>Don't use. This limits the allowed address range, not memory use! Defaults to unlimited and should not be lowered. To limit memory use, see
<varname>MemoryMax=
</varname> in
<citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
</entry>
1022 <entry>LimitSTACK=
</entry>
1023 <entry>ulimit -s
</entry>
1024 <entry>Bytes
</entry>
1028 <entry>LimitCORE=
</entry>
1029 <entry>ulimit -c
</entry>
1030 <entry>Bytes
</entry>
1034 <entry>LimitRSS=
</entry>
1035 <entry>ulimit -m
</entry>
1036 <entry>Bytes
</entry>
1037 <entry>Don't use. No effect on Linux.
</entry>
1040 <entry>LimitNOFILE=
</entry>
1041 <entry>ulimit -n
</entry>
1042 <entry>Number of File Descriptors
</entry>
1043 <entry>Don't use. Be careful when raising the soft limit above
1024, since
<citerefentry project='man-pages'
><refentrytitle>select
</refentrytitle><manvolnum>2</manvolnum></citerefentry> cannot function with file descriptors above
1023 on Linux. Nowadays, the hard limit defaults to
524288, a very high value compared to historical defaults. Typically applications should increase their soft limit to the hard limit on their own, if they are OK with working with file descriptors above
1023, i.e. do not use
<citerefentry project='man-pages'
><refentrytitle>select
</refentrytitle><manvolnum>2</manvolnum></citerefentry>. Note that file descriptors are nowadays accounted like any other form of memory, thus there should not be any need to lower the hard limit. Use
<varname>MemoryMax=
</varname> to control overall service memory use, including file descriptor memory.
</entry>
1046 <entry>LimitAS=
</entry>
1047 <entry>ulimit -v
</entry>
1048 <entry>Bytes
</entry>
1049 <entry>Don't use. This limits the allowed address range, not memory use! Defaults to unlimited and should not be lowered. To limit memory use, see
<varname>MemoryMax=
</varname> in
<citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
</entry>
1052 <entry>LimitNPROC=
</entry>
1053 <entry>ulimit -u
</entry>
1054 <entry>Number of Processes
</entry>
1055 <entry>This limit is enforced based on the number of processes belonging to the user. Typically it's better to track processes per service, i.e. use
<varname>TasksMax=
</varname>, see
<citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
</entry>
1058 <entry>LimitMEMLOCK=
</entry>
1059 <entry>ulimit -l
</entry>
1060 <entry>Bytes
</entry>
1064 <entry>LimitLOCKS=
</entry>
1065 <entry>ulimit -x
</entry>
1066 <entry>Number of Locks
</entry>
1070 <entry>LimitSIGPENDING=
</entry>
1071 <entry>ulimit -i
</entry>
1072 <entry>Number of Queued Signals
</entry>
1076 <entry>LimitMSGQUEUE=
</entry>
1077 <entry>ulimit -q
</entry>
1078 <entry>Bytes
</entry>
1082 <entry>LimitNICE=
</entry>
1083 <entry>ulimit -e
</entry>
1084 <entry>Nice Level
</entry>
1088 <entry>LimitRTPRIO=
</entry>
1089 <entry>ulimit -r
</entry>
1090 <entry>Realtime Priority
</entry>
1094 <entry>LimitRTTIME=
</entry>
1095 <entry>ulimit -R
</entry>
1096 <entry>Microseconds
</entry>
1105 <term><varname>UMask=
</varname></term>
1107 <listitem><para>Controls the file mode creation mask. Takes an access mode in octal notation. See
1108 <citerefentry><refentrytitle>umask
</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
1109 details. Defaults to
0022 for system units. For user units the default value is inherited from the
1110 per-user service manager (whose default is in turn inherited from the system service manager, and
1111 thus typically also is
0022 — unless overridden by a PAM module). In order to change the per-user mask
1112 for all user services, consider setting the
<varname>UMask=
</varname> setting of the user's
1113 <filename>user@.service
</filename> system service instance. The per-user umask may also be set via
1114 the
<varname>umask
</varname> field of a user's
<ulink url=
"https://systemd.io/USER_RECORD">JSON User
1115 Record
</ulink> (for users managed by
1116 <citerefentry><refentrytitle>systemd-homed.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry>
1117 this field may be controlled via
<command>homectl --umask=
</command>). It may also be set via a PAM
1118 module, such as
<citerefentry
1119 project='man-pages'
><refentrytitle>pam_umask
</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
</para></listitem>
1123 <term><varname>CoredumpFilter=
</varname></term>
1125 <listitem><para>Controls which types of memory mappings will be saved if the process dumps core
1126 (using the
<filename>/proc/
<replaceable>pid
</replaceable>/coredump_filter
</filename> file). Takes a
1127 whitespace-separated combination of mapping type names or numbers (with the default base
16). Mapping
1128 type names are
<constant>private-anonymous
</constant>,
<constant>shared-anonymous
</constant>,
1129 <constant>private-file-backed
</constant>,
<constant>shared-file-backed
</constant>,
1130 <constant>elf-headers
</constant>,
<constant>private-huge
</constant>,
1131 <constant>shared-huge
</constant>,
<constant>private-dax
</constant>,
<constant>shared-dax
</constant>,
1132 and the special values
<constant>all
</constant> (all types) and
<constant>default
</constant> (the
1133 kernel default of
<literal><constant>private-anonymous
</constant>
1134 <constant>shared-anonymous
</constant> <constant>elf-headers
</constant>
1135 <constant>private-huge
</constant></literal>). See
1136 <citerefentry project='man-pages'
><refentrytitle>core
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1137 for the meaning of the mapping types. When specified multiple times, all specified masks are
1138 ORed. When not set, or if the empty value is assigned, the inherited value is not changed.
</para>
1141 <title>Add DAX pages to the dump filter
</title>
1143 <programlisting>CoredumpFilter=default private-dax shared-dax
</programlisting>
1146 <xi:include href=
"version-info.xml" xpointer=
"v246"/>
1151 <term><varname>KeyringMode=
</varname></term>
1153 <listitem><para>Controls how the kernel session keyring is set up for the service (see
<citerefentry
1154 project='man-pages'
><refentrytitle>session-keyring
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
1155 details on the session keyring). Takes one of
<option>inherit
</option>,
<option>private
</option>,
1156 <option>shared
</option>. If set to
<option>inherit
</option> no special keyring setup is done, and the kernel's
1157 default behaviour is applied. If
<option>private
</option> is used a new session keyring is allocated when a
1158 service process is invoked, and it is not linked up with any user keyring. This is the recommended setting for
1159 system services, as this ensures that multiple services running under the same system user ID (in particular
1160 the root user) do not share their key material among each other. If
<option>shared
</option> is used a new
1161 session keyring is allocated as for
<option>private
</option>, but the user keyring of the user configured with
1162 <varname>User=
</varname> is linked into it, so that keys assigned to the user may be requested by the unit's
1163 processes. In this mode multiple units running processes under the same user ID may share key material. Unless
1164 <option>inherit
</option> is selected the unique invocation ID for the unit (see below) is added as a protected
1165 key by the name
<literal>invocation_id
</literal> to the newly created session keyring. Defaults to
1166 <option>private
</option> for services of the system service manager and to
<option>inherit
</option> for
1167 non-service units and for services of the user service manager.
</para>
1169 <xi:include href=
"version-info.xml" xpointer=
"v235"/></listitem>
1173 <term><varname>OOMScoreAdjust=
</varname></term>
1175 <listitem><para>Sets the adjustment value for the Linux kernel's Out-Of-Memory (OOM) killer score for
1176 executed processes. Takes an integer between -
1000 (to disable OOM killing of processes of this unit)
1177 and
1000 (to make killing of processes of this unit under memory pressure very likely). See
<ulink
1178 url=
"https://docs.kernel.org/filesystems/proc.html">The /proc Filesystem
</ulink> for
1179 details. If not specified defaults to the OOM score adjustment level of the service manager itself,
1180 which is normally at
0.
</para>
1182 <para>Use the
<varname>OOMPolicy=
</varname> setting of service units to configure how the service
1183 manager shall react to the kernel OOM killer or
<command>systemd-oomd
</command> terminating a process of the service. See
1184 <citerefentry><refentrytitle>systemd.service
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1185 for details.
</para></listitem>
1189 <term><varname>TimerSlackNSec=
</varname></term>
1190 <listitem><para>Sets the timer slack in nanoseconds for the executed processes. The timer slack controls the
1191 accuracy of wake-ups triggered by timers. See
1192 <citerefentry><refentrytitle>prctl
</refentrytitle><manvolnum>2</manvolnum></citerefentry> for more
1193 information. Note that in contrast to most other time span definitions this parameter takes an integer value in
1194 nano-seconds if no unit is specified. The usual time units are understood too.
</para></listitem>
1198 <term><varname>Personality=
</varname></term>
1200 <listitem><para>Controls which kernel architecture
<citerefentry
1201 project='man-pages'
><refentrytitle>uname
</refentrytitle><manvolnum>2</manvolnum></citerefentry> shall
1202 report, when invoked by unit processes. Takes one of the architecture identifiers
1203 <constant>arm64
</constant>,
<constant>arm64-be
</constant>,
<constant>arm
</constant>,
1204 <constant>arm-be
</constant>,
<constant>x86
</constant>,
<constant>x86-
64</constant>,
1205 <constant>ppc
</constant>,
<constant>ppc-le
</constant>,
<constant>ppc64
</constant>,
1206 <constant>ppc64-le
</constant>,
<constant>s390
</constant> or
<constant>s390x
</constant>. Which
1207 personality architectures are supported depends on the kernel's native architecture. Usually the
1208 64-bit versions of the various system architectures support their immediate
32-bit personality
1209 architecture counterpart, but no others. For example,
<constant>x86-
64</constant> systems support the
1210 <constant>x86-
64</constant> and
<constant>x86
</constant> personalities but no others. The personality
1211 feature is useful when running
32-bit services on a
64-bit host system. If not specified, the
1212 personality is left unmodified and thus reflects the personality of the host system's kernel. This
1213 option is not useful on architectures for which only one native word width was ever available, such
1214 as
<constant>m68k
</constant> (
32-bit only) or
<constant>alpha
</constant> (
64-bit only).
</para>
1216 <xi:include href=
"version-info.xml" xpointer=
"v209"/></listitem>
1220 <term><varname>IgnoreSIGPIPE=
</varname></term>
1222 <listitem><para>Takes a boolean argument. If true, causes
<constant>SIGPIPE
</constant> to be ignored in the
1223 executed process. Defaults to true because
<constant>SIGPIPE
</constant> generally is useful only in shell
1224 pipelines.
</para></listitem>
1231 <title>Scheduling
</title>
1233 <variablelist class='unit-directives'
>
1236 <term><varname>Nice=
</varname></term>
1238 <listitem><para>Sets the default nice level (scheduling priority) for executed processes. Takes an
1239 integer between -
20 (highest priority) and
19 (lowest priority). In case of resource contention,
1240 smaller values mean more resources will be made available to the unit's processes, larger values mean
1241 less resources will be made available. See
1242 <citerefentry><refentrytitle>setpriority
</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
1243 details.
</para></listitem>
1247 <term><varname>CPUSchedulingPolicy=
</varname></term>
1249 <listitem><para>Sets the CPU scheduling policy for executed processes. Takes one of
<option>other
</option>,
1250 <option>batch
</option>,
<option>idle
</option>,
<option>fifo
</option> or
<option>rr
</option>. See
1251 <citerefentry project='man-pages'
><refentrytitle>sched_setscheduler
</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
1252 details.
</para></listitem>
1256 <term><varname>CPUSchedulingPriority=
</varname></term>
1258 <listitem><para>Sets the CPU scheduling priority for executed processes. The available priority range
1259 depends on the selected CPU scheduling policy (see above). For real-time scheduling policies an
1260 integer between
1 (lowest priority) and
99 (highest priority) can be used. In case of CPU resource
1261 contention, smaller values mean less CPU time is made available to the service, larger values mean
1262 more. See
<citerefentry
1263 project='man-pages'
><refentrytitle>sched_setscheduler
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1264 for details.
</para></listitem>
1268 <term><varname>CPUSchedulingResetOnFork=
</varname></term>
1270 <listitem><para>Takes a boolean argument. If true, elevated CPU scheduling priorities and policies
1271 will be reset when the executed processes call
1272 <citerefentry project='man-pages'
><refentrytitle>fork
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
1273 and can hence not leak into child processes. See
1274 <citerefentry project='man-pages'
><refentrytitle>sched_setscheduler
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1275 for details. Defaults to false.
</para></listitem>
1279 <term><varname>CPUAffinity=
</varname></term>
1281 <listitem><para>Controls the CPU affinity of the executed processes. Takes a list of CPU indices or ranges
1282 separated by either whitespace or commas. Alternatively, takes a special
"numa" value in which case systemd
1283 automatically derives allowed CPU range based on the value of
<varname>NUMAMask=
</varname> option. CPU ranges
1284 are specified by the lower and upper CPU indices separated by a dash. This option may be specified more than
1285 once, in which case the specified CPU affinity masks are merged. If the empty string is assigned, the mask
1286 is reset, all assignments prior to this will have no effect. See
1287 <citerefentry project='man-pages'
><refentrytitle>sched_setaffinity
</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
1288 details.
</para></listitem>
1292 <term><varname>NUMAPolicy=
</varname></term>
1294 <listitem><para>Controls the NUMA memory policy of the executed processes. Takes a policy type, one of:
1295 <option>default
</option>,
<option>preferred
</option>,
<option>bind
</option>,
<option>interleave
</option> and
1296 <option>local
</option>. A list of NUMA nodes that should be associated with the policy must be specified
1297 in
<varname>NUMAMask=
</varname>. For more details on each policy please see,
1298 <citerefentry><refentrytitle>set_mempolicy
</refentrytitle><manvolnum>2</manvolnum></citerefentry>. For overall
1299 overview of NUMA support in Linux see,
1300 <citerefentry project='man-pages'
><refentrytitle>numa
</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
1303 <xi:include href=
"version-info.xml" xpointer=
"v243"/></listitem>
1307 <term><varname>NUMAMask=
</varname></term>
1309 <listitem><para>Controls the NUMA node list which will be applied alongside with selected NUMA policy.
1310 Takes a list of NUMA nodes and has the same syntax as a list of CPUs for
<varname>CPUAffinity=
</varname>
1311 option or special
"all" value which will include all available NUMA nodes in the mask. Note that the list
1312 of NUMA nodes is not required for
<option>default
</option> and
<option>local
</option>
1313 policies and for
<option>preferred
</option> policy we expect a single NUMA node.
</para>
1315 <xi:include href=
"version-info.xml" xpointer=
"v243"/></listitem>
1319 <term><varname>IOSchedulingClass=
</varname></term>
1321 <listitem><para>Sets the I/O scheduling class for executed processes. Takes one of the strings
1322 <option>realtime
</option>,
<option>best-effort
</option> or
<option>idle
</option>. The kernel's
1323 default scheduling class is
<option>best-effort
</option> at a priority of
4. If the empty string is
1324 assigned to this option, all prior assignments to both
<varname>IOSchedulingClass=
</varname> and
1325 <varname>IOSchedulingPriority=
</varname> have no effect. See
1326 <citerefentry><refentrytitle>ioprio_set
</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
1327 details.
</para></listitem>
1331 <term><varname>IOSchedulingPriority=
</varname></term>
1333 <listitem><para>Sets the I/O scheduling priority for executed processes. Takes an integer between
0
1334 (highest priority) and
7 (lowest priority). In case of I/O contention, smaller values mean more I/O
1335 bandwidth is made available to the unit's processes, larger values mean less bandwidth. The available
1336 priorities depend on the selected I/O scheduling class (see above). If the empty string is assigned
1337 to this option, all prior assignments to both
<varname>IOSchedulingClass=
</varname> and
1338 <varname>IOSchedulingPriority=
</varname> have no effect. For the kernel's default scheduling class
1339 (
<option>best-effort
</option>) this defaults to
4. See
1340 <citerefentry><refentrytitle>ioprio_set
</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
1341 details.
</para></listitem>
1348 <title>Sandboxing
</title>
1350 <para>The following sandboxing options are an effective way to limit the exposure of the system towards the unit's
1351 processes. It is recommended to turn on as many of these options for each unit as is possible without negatively
1352 affecting the process' ability to operate. Note that many of these sandboxing features are gracefully turned off on
1353 systems where the underlying security mechanism is not available. For example,
<varname>ProtectSystem=
</varname>
1354 has no effect if the kernel is built without file system namespacing or if the service manager runs in a container
1355 manager that makes file system namespacing unavailable to its payload. Similarly,
1356 <varname>RestrictRealtime=
</varname> has no effect on systems that lack support for SECCOMP system call filtering,
1357 or in containers where support for this is turned off.
</para>
1359 <para>Also note that some sandboxing functionality is generally not available in user services (i.e. services run
1360 by the per-user service manager). Specifically, the various settings requiring file system namespacing support
1361 (such as
<varname>ProtectSystem=
</varname>) are not available, as the underlying kernel functionality is only
1362 accessible to privileged processes. However, most namespacing settings, that will not work on their own in user
1363 services, will work when used in conjunction with
<varname>PrivateUsers=
</varname><option>true
</option>.
</para>
1365 <variablelist class='unit-directives'
>
1368 <term><varname>ProtectSystem=
</varname></term>
1370 <listitem><para>Takes a boolean argument or the special values
<literal>full
</literal> or
1371 <literal>strict
</literal>. If true, mounts the
<filename>/usr/
</filename> and the boot loader
1372 directories (
<filename>/boot
</filename> and
<filename>/efi
</filename>) read-only for processes
1373 invoked by this unit. If set to
<literal>full
</literal>, the
<filename>/etc/
</filename> directory is
1374 mounted read-only, too. If set to
<literal>strict
</literal> the entire file system hierarchy is
1375 mounted read-only, except for the API file system subtrees
<filename>/dev/
</filename>,
1376 <filename>/proc/
</filename> and
<filename>/sys/
</filename> (protect these directories using
1377 <varname>PrivateDevices=
</varname>,
<varname>ProtectKernelTunables=
</varname>,
1378 <varname>ProtectControlGroups=
</varname>). This setting ensures that any modification of the vendor-supplied
1379 operating system (and optionally its configuration, and local mounts) is prohibited for the service. It is
1380 recommended to enable this setting for all long-running services, unless they are involved with system updates
1381 or need to modify the operating system in other ways. If this option is used,
1382 <varname>ReadWritePaths=
</varname> may be used to exclude specific directories from being made read-only. This
1383 setting is implied if
<varname>DynamicUser=
</varname> is set. This setting cannot ensure protection in all
1384 cases. In general it has the same limitations as
<varname>ReadOnlyPaths=
</varname>, see below. Defaults to
1387 <xi:include href=
"version-info.xml" xpointer=
"v214"/></listitem>
1391 <term><varname>ProtectHome=
</varname></term>
1393 <listitem><para>Takes a boolean argument or the special values
<literal>read-only
</literal> or
1394 <literal>tmpfs
</literal>. If true, the directories
<filename>/home/
</filename>,
1395 <filename>/root
</filename>, and
<filename>/run/user
</filename> are made inaccessible and empty for
1396 processes invoked by this unit. If set to
<literal>read-only
</literal>, the three directories are
1397 made read-only instead. If set to
<literal>tmpfs
</literal>, temporary file systems are mounted on the
1398 three directories in read-only mode. The value
<literal>tmpfs
</literal> is useful to hide home
1399 directories not relevant to the processes invoked by the unit, while still allowing necessary
1400 directories to be made visible when listed in
<varname>BindPaths=
</varname> or
1401 <varname>BindReadOnlyPaths=
</varname>.
</para>
1403 <para>Setting this to
<literal>yes
</literal> is mostly equivalent to setting the three directories in
1404 <varname>InaccessiblePaths=
</varname>. Similarly,
<literal>read-only
</literal> is mostly equivalent to
1405 <varname>ReadOnlyPaths=
</varname>, and
<literal>tmpfs
</literal> is mostly equivalent to
1406 <varname>TemporaryFileSystem=
</varname> with
<literal>:ro
</literal>.
</para>
1408 <para>It is recommended to enable this setting for all long-running services (in particular
1409 network-facing ones), to ensure they cannot get access to private user data, unless the services
1410 actually require access to the user's private data. This setting is implied if
1411 <varname>DynamicUser=
</varname> is set. This setting cannot ensure protection in all cases. In
1412 general it has the same limitations as
<varname>ReadOnlyPaths=
</varname>, see below.
</para>
1414 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
1416 <xi:include href=
"version-info.xml" xpointer=
"v214"/></listitem>
1420 <term><varname>RuntimeDirectory=
</varname></term>
1421 <term><varname>StateDirectory=
</varname></term>
1422 <term><varname>CacheDirectory=
</varname></term>
1423 <term><varname>LogsDirectory=
</varname></term>
1424 <term><varname>ConfigurationDirectory=
</varname></term>
1426 <listitem><para>These options take a whitespace-separated list of directory names. The specified
1427 directory names must be relative, and may not include
<literal>..
</literal>. If set, when the unit is
1428 started, one or more directories by the specified names will be created (including their parents)
1429 below the locations defined in the following table. Also, the corresponding environment variable will
1430 be defined with the full paths of the directories. If multiple directories are set, then in the
1431 environment variable the paths are concatenated with colon (
<literal>:
</literal>).
</para>
1433 <title>Automatic directory creation and environment variables
</title>
1437 <entry>Directory
</entry>
1438 <entry>Below path for system units
</entry>
1439 <entry>Below path for user units
</entry>
1440 <entry>Environment variable set
</entry>
1445 <entry><varname>RuntimeDirectory=
</varname></entry>
1446 <entry><filename>/run/
</filename></entry>
1447 <entry><varname>$XDG_RUNTIME_DIR
</varname></entry>
1448 <entry><varname>$RUNTIME_DIRECTORY
</varname></entry>
1451 <entry><varname>StateDirectory=
</varname></entry>
1452 <entry><filename>/var/lib/
</filename></entry>
1453 <entry><varname>$XDG_STATE_HOME
</varname></entry>
1454 <entry><varname>$STATE_DIRECTORY
</varname></entry>
1457 <entry><varname>CacheDirectory=
</varname></entry>
1458 <entry><filename>/var/cache/
</filename></entry>
1459 <entry><varname>$XDG_CACHE_HOME
</varname></entry>
1460 <entry><varname>$CACHE_DIRECTORY
</varname></entry>
1463 <entry><varname>LogsDirectory=
</varname></entry>
1464 <entry><filename>/var/log/
</filename></entry>
1465 <entry><varname>$XDG_STATE_HOME
</varname><filename>/log/
</filename></entry>
1466 <entry><varname>$LOGS_DIRECTORY
</varname></entry>
1469 <entry><varname>ConfigurationDirectory=
</varname></entry>
1470 <entry><filename>/etc/
</filename></entry>
1471 <entry><varname>$XDG_CONFIG_HOME
</varname></entry>
1472 <entry><varname>$CONFIGURATION_DIRECTORY
</varname></entry>
1478 <para>In case of
<varname>RuntimeDirectory=
</varname> the innermost subdirectories are removed when
1479 the unit is stopped. It is possible to preserve the specified directories in this case if
1480 <varname>RuntimeDirectoryPreserve=
</varname> is configured to
<option>restart
</option> or
1481 <option>yes
</option> (see below). The directories specified with
<varname>StateDirectory=
</varname>,
1482 <varname>CacheDirectory=
</varname>,
<varname>LogsDirectory=
</varname>,
1483 <varname>ConfigurationDirectory=
</varname> are not removed when the unit is stopped.
</para>
1485 <para>Except in case of
<varname>ConfigurationDirectory=
</varname>, the innermost specified directories will be
1486 owned by the user and group specified in
<varname>User=
</varname> and
<varname>Group=
</varname>. If the
1487 specified directories already exist and their owning user or group do not match the configured ones, all files
1488 and directories below the specified directories as well as the directories themselves will have their file
1489 ownership recursively changed to match what is configured. As an optimization, if the specified directories are
1490 already owned by the right user and group, files and directories below of them are left as-is, even if they do
1491 not match what is requested. The innermost specified directories will have their access mode adjusted to the
1492 what is specified in
<varname>RuntimeDirectoryMode=
</varname>,
<varname>StateDirectoryMode=
</varname>,
1493 <varname>CacheDirectoryMode=
</varname>,
<varname>LogsDirectoryMode=
</varname> and
1494 <varname>ConfigurationDirectoryMode=
</varname>.
</para>
1496 <para>These options imply
<varname>BindPaths=
</varname> for the specified paths. When combined with
1497 <varname>RootDirectory=
</varname> or
<varname>RootImage=
</varname> these paths always reside on the host and
1498 are mounted from there into the unit's file system namespace.
</para>
1500 <para>If
<varname>DynamicUser=
</varname> is used, the logic for
<varname>CacheDirectory=
</varname>,
1501 <varname>LogsDirectory=
</varname> and
<varname>StateDirectory=
</varname> is slightly altered: the directories are created below
1502 <filename>/var/cache/private
</filename>,
<filename>/var/log/private
</filename> and
<filename>/var/lib/private
</filename>,
1503 respectively, which are host directories made inaccessible to
1504 unprivileged users, which ensures that access to these directories cannot be gained through dynamic
1505 user ID recycling. Symbolic links are created to hide this difference in behaviour. Both from
1506 perspective of the host and from inside the unit, the relevant directories hence always appear
1507 directly below
<filename>/var/cache
</filename>,
<filename>/var/log
</filename> and
1508 <filename>/var/lib
</filename>.
</para>
1510 <para>Use
<varname>RuntimeDirectory=
</varname> to manage one or more runtime directories for the unit and bind
1511 their lifetime to the daemon runtime. This is particularly useful for unprivileged daemons that cannot create
1512 runtime directories in
<filename>/run/
</filename> due to lack of privileges, and to make sure the runtime
1513 directory is cleaned up automatically after use. For runtime directories that require more complex or different
1514 configuration or lifetime guarantees, please consider using
1515 <citerefentry><refentrytitle>tmpfiles.d
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
</para>
1517 <para><varname>RuntimeDirectory=
</varname>,
<varname>StateDirectory=
</varname>,
<varname>CacheDirectory=
</varname>
1518 and
<varname>LogsDirectory=
</varname> optionally support a second parameter, separated by
<literal>:
</literal>.
1519 The second parameter will be interpreted as a destination path that will be created as a symlink to the directory.
1520 The symlinks will be created after any
<varname>BindPaths=
</varname> or
<varname>TemporaryFileSystem=
</varname>
1521 options have been set up, to make ephemeral symlinking possible. The same source can have multiple symlinks, by
1522 using the same first parameter, but a different second parameter.
</para>
1524 <para>The directories defined by these options are always created under the standard paths used by systemd
1525 (
<filename>/var/
</filename>,
<filename>/run/
</filename>,
<filename>/etc/
</filename>, …). If the service needs
1526 directories in a different location, a different mechanism has to be used to create them.
</para>
1528 <para><citerefentry><refentrytitle>tmpfiles.d
</refentrytitle><manvolnum>5</manvolnum></citerefentry> provides
1529 functionality that overlaps with these options. Using these options is recommended, because the lifetime of
1530 the directories is tied directly to the lifetime of the unit, and it is not necessary to ensure that the
1531 <filename>tmpfiles.d
</filename> configuration is executed before the unit is started.
</para>
1533 <para>To remove any of the directories created by these settings, use the
<command>systemctl clean
1534 …
</command> command on the relevant units, see
1535 <citerefentry><refentrytitle>systemctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
1538 <para>Example: if a system service unit has the following,
1539 <programlisting>RuntimeDirectory=foo/bar baz
</programlisting>
1540 the service manager creates
<filename index='false'
>/run/foo
</filename> (if it does not exist),
1542 <filename index='false'
>/run/foo/bar
</filename>, and
<filename index='false'
>/run/baz
</filename>. The
1543 directories
<filename index='false'
>/run/foo/bar
</filename> and
1544 <filename index='false'
>/run/baz
</filename> except
<filename index='false'
>/run/foo
</filename> are
1545 owned by the user and group specified in
<varname>User=
</varname> and
<varname>Group=
</varname>, and removed
1546 when the service is stopped.
</para>
1548 <para>Example: if a system service unit has the following,
1549 <programlisting>RuntimeDirectory=foo/bar
1550 StateDirectory=aaa/bbb ccc
</programlisting>
1551 then the environment variable
<literal>RUNTIME_DIRECTORY
</literal> is set with
<literal>/run/foo/bar
</literal>, and
1552 <literal>STATE_DIRECTORY
</literal> is set with
<literal>/var/lib/aaa/bbb:/var/lib/ccc
</literal>.
</para>
1554 <para>Example: if a system service unit has the following,
1555 <programlisting>RuntimeDirectory=foo:bar foo:baz
</programlisting>
1556 the service manager creates
<filename index='false'
>/run/foo
</filename> (if it does not exist), and
1557 <filename index='false'
>/run/bar
</filename> plus
<filename index='false'
>/run/baz
</filename> as symlinks to
1558 <filename index='false'
>/run/foo
</filename>.
</para>
1560 <xi:include href=
"version-info.xml" xpointer=
"v211"/></listitem>
1564 <term><varname>RuntimeDirectoryMode=
</varname></term>
1565 <term><varname>StateDirectoryMode=
</varname></term>
1566 <term><varname>CacheDirectoryMode=
</varname></term>
1567 <term><varname>LogsDirectoryMode=
</varname></term>
1568 <term><varname>ConfigurationDirectoryMode=
</varname></term>
1570 <listitem><para>Specifies the access mode of the directories specified in
<varname>RuntimeDirectory=
</varname>,
1571 <varname>StateDirectory=
</varname>,
<varname>CacheDirectory=
</varname>,
<varname>LogsDirectory=
</varname>, or
1572 <varname>ConfigurationDirectory=
</varname>, respectively, as an octal number. Defaults to
1573 <constant>0755</constant>. See
"Permissions" in
<citerefentry
1574 project='man-pages'
><refentrytitle>path_resolution
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for a
1575 discussion of the meaning of permission bits.
</para>
1577 <xi:include href=
"version-info.xml" xpointer=
"v234"/></listitem>
1581 <term><varname>RuntimeDirectoryPreserve=
</varname></term>
1583 <listitem><para>Takes a boolean argument or
<option>restart
</option>. If set to
<option>no
</option> (the
1584 default), the directories specified in
<varname>RuntimeDirectory=
</varname> are always removed when the service
1585 stops. If set to
<option>restart
</option> the directories are preserved when the service is both automatically
1586 and manually restarted. Here, the automatic restart means the operation specified in
1587 <varname>Restart=
</varname>, and manual restart means the one triggered by
<command>systemctl restart
1588 foo.service
</command>. If set to
<option>yes
</option>, then the directories are not removed when the service is
1589 stopped. Note that since the runtime directory
<filename>/run/
</filename> is a mount point of
1590 <literal>tmpfs
</literal>, then for system services the directories specified in
1591 <varname>RuntimeDirectory=
</varname> are removed when the system is rebooted.
</para>
1593 <xi:include href=
"version-info.xml" xpointer=
"v235"/></listitem>
1597 <term><varname>TimeoutCleanSec=
</varname></term>
1598 <listitem><para>Configures a timeout on the clean-up operation requested through
<command>systemctl
1599 clean …
</command>, see
1600 <citerefentry><refentrytitle>systemctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
1601 details. Takes the usual time values and defaults to
<constant>infinity
</constant>, i.e. by default
1602 no timeout is applied. If a timeout is configured the clean operation will be aborted forcibly when
1603 the timeout is reached, potentially leaving resources on disk.
</para>
1605 <xi:include href=
"version-info.xml" xpointer=
"v244"/></listitem>
1609 <term><varname>ReadWritePaths=
</varname></term>
1610 <term><varname>ReadOnlyPaths=
</varname></term>
1611 <term><varname>InaccessiblePaths=
</varname></term>
1612 <term><varname>ExecPaths=
</varname></term>
1613 <term><varname>NoExecPaths=
</varname></term>
1615 <listitem><para>Sets up a new file system namespace for executed processes. These options may be used
1616 to limit access a process has to the file system. Each setting takes a space-separated list of paths
1617 relative to the host's root directory (i.e. the system running the service manager). Note that if
1618 paths contain symlinks, they are resolved relative to the root directory set with
1619 <varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname>.
</para>
1621 <para>Paths listed in
<varname>ReadWritePaths=
</varname> are accessible from within the namespace
1622 with the same access modes as from outside of it. Paths listed in
<varname>ReadOnlyPaths=
</varname>
1623 are accessible for reading only, writing will be refused even if the usual file access controls would
1624 permit this. Nest
<varname>ReadWritePaths=
</varname> inside of
<varname>ReadOnlyPaths=
</varname> in
1625 order to provide writable subdirectories within read-only directories. Use
1626 <varname>ReadWritePaths=
</varname> in order to allow-list specific paths for write access if
1627 <varname>ProtectSystem=strict
</varname> is used.
</para>
1629 <para>Paths listed in
<varname>InaccessiblePaths=
</varname> will be made inaccessible for processes inside
1630 the namespace along with everything below them in the file system hierarchy. This may be more restrictive than
1631 desired, because it is not possible to nest
<varname>ReadWritePaths=
</varname>,
<varname>ReadOnlyPaths=
</varname>,
1632 <varname>BindPaths=
</varname>, or
<varname>BindReadOnlyPaths=
</varname> inside it. For a more flexible option,
1633 see
<varname>TemporaryFileSystem=
</varname>.
</para>
1635 <para>Content in paths listed in
<varname>NoExecPaths=
</varname> are not executable even if the usual
1636 file access controls would permit this. Nest
<varname>ExecPaths=
</varname> inside of
1637 <varname>NoExecPaths=
</varname> in order to provide executable content within non-executable
1640 <para>Non-directory paths may be specified as well. These options may be specified more than once,
1641 in which case all paths listed will have limited access from within the namespace. If the empty string is
1642 assigned to this option, the specific list is reset, and all prior assignments have no effect.
</para>
1644 <para>Paths in
<varname>ReadWritePaths=
</varname>,
<varname>ReadOnlyPaths=
</varname>,
1645 <varname>InaccessiblePaths=
</varname>,
<varname>ExecPaths=
</varname> and
1646 <varname>NoExecPaths=
</varname> may be prefixed with
<literal>-
</literal>, in which case they will be
1647 ignored when they do not exist. If prefixed with
<literal>+
</literal> the paths are taken relative to the root
1648 directory of the unit, as configured with
<varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname>,
1649 instead of relative to the root directory of the host (see above). When combining
<literal>-
</literal> and
1650 <literal>+
</literal> on the same path make sure to specify
<literal>-
</literal> first, and
<literal>+
</literal>
1653 <para>Note that these settings will disconnect propagation of mounts from the unit's processes to the
1654 host. This means that this setting may not be used for services which shall be able to install mount points in
1655 the main mount namespace. For
<varname>ReadWritePaths=
</varname> and
<varname>ReadOnlyPaths=
</varname>,
1656 propagation in the other direction is not affected, i.e. mounts created on the host generally appear in the
1657 unit processes' namespace, and mounts removed on the host also disappear there too. In particular, note that
1658 mount propagation from host to unit will result in unmodified mounts to be created in the unit's namespace,
1659 i.e. writable mounts appearing on the host will be writable in the unit's namespace too, even when propagated
1660 below a path marked with
<varname>ReadOnlyPaths=
</varname>! Restricting access with these options hence does
1661 not extend to submounts of a directory that are created later on. This means the lock-down offered by that
1662 setting is not complete, and does not offer full protection.
</para>
1664 <para>Note that the effect of these settings may be undone by privileged processes. In order to set up an
1665 effective sandboxed environment for a unit it is thus recommended to combine these settings with either
1666 <varname>CapabilityBoundingSet=~CAP_SYS_ADMIN
</varname> or
<varname>SystemCallFilter=~@mount
</varname>.
</para>
1668 <para>Please be extra careful when applying these options to API file systems (a list of them could be
1669 found in
<varname>MountAPIVPS=
</varname>), since they may be required for basic system functionalities.
1670 Moreover,
<filename>/run/
</filename> needs to be writable for setting up mount namespace and propagation.
</para>
1672 <para>Simple allow-list example using these directives:
1673 <programlisting>[Service]
1675 ReadWritePaths=/var /run
1676 InaccessiblePaths=-/lost+found
1678 ExecPaths=/usr/sbin/my_daemon /usr/lib /usr/lib64
1679 </programlisting></para>
1681 <xi:include href=
"system-or-user-ns.xml" xpointer=
"plural"/>
1683 <xi:include href=
"version-info.xml" xpointer=
"v231"/></listitem>
1687 <term><varname>TemporaryFileSystem=
</varname></term>
1689 <listitem><para>Takes a space-separated list of mount points for temporary file systems (tmpfs). If set, a new file
1690 system namespace is set up for executed processes, and a temporary file system is mounted on each mount point.
1691 This option may be specified more than once, in which case temporary file systems are mounted on all listed mount
1692 points. If the empty string is assigned to this option, the list is reset, and all prior assignments have no effect.
1693 Each mount point may optionally be suffixed with a colon (
<literal>:
</literal>) and mount options such as
1694 <literal>size=
10%
</literal> or
<literal>ro
</literal>. By default, each temporary file system is mounted
1695 with
<literal>nodev,strictatime,mode=
0755</literal>. These can be disabled by explicitly specifying the corresponding
1696 mount options, e.g.,
<literal>dev
</literal> or
<literal>nostrictatime
</literal>.
</para>
1698 <para>This is useful to hide files or directories not relevant to the processes invoked by the unit, while necessary
1699 files or directories can be still accessed by combining with
<varname>BindPaths=
</varname> or
1700 <varname>BindReadOnlyPaths=
</varname>:
</para>
1702 <para>Example: if a unit has the following,
1703 <programlisting>TemporaryFileSystem=/var:ro
1704 BindReadOnlyPaths=/var/lib/systemd
</programlisting>
1705 then the invoked processes by the unit cannot see any files or directories under
<filename>/var/
</filename> except for
1706 <filename>/var/lib/systemd
</filename> or its contents.
</para>
1708 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
1710 <xi:include href=
"version-info.xml" xpointer=
"v238"/></listitem>
1714 <term><varname>PrivateTmp=
</varname></term>
1716 <listitem><para>Takes a boolean argument. If true, sets up a new file system namespace for the
1717 executed processes and mounts private
<filename>/tmp/
</filename> and
<filename>/var/tmp/
</filename>
1718 directories inside it that are not shared by processes outside of the namespace. This is useful to
1719 secure access to temporary files of the process, but makes sharing between processes via
1720 <filename>/tmp/
</filename> or
<filename>/var/tmp/
</filename> impossible. If true, all temporary files
1721 created by a service in these directories will be removed after the service is stopped. Defaults to
1722 false. It is possible to run two or more units within the same private
<filename>/tmp/
</filename> and
1723 <filename>/var/tmp/
</filename> namespace by using the
<varname>JoinsNamespaceOf=
</varname> directive,
1724 see
<citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1725 for details. This setting is implied if
<varname>DynamicUser=
</varname> is set. For this setting, the
1726 same restrictions regarding mount propagation and privileges apply as for
1727 <varname>ReadOnlyPaths=
</varname> and related calls, see above. Enabling this setting has the side
1728 effect of adding
<varname>Requires=
</varname> and
<varname>After=
</varname> dependencies on all mount
1729 units necessary to access
<filename>/tmp/
</filename> and
<filename>/var/tmp/
</filename>. Moreover an
1730 implicitly
<varname>After=
</varname> ordering on
1731 <citerefentry><refentrytitle>systemd-tmpfiles-setup.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry>
1734 <para>Note that the implementation of this setting might be impossible (for example if mount namespaces are not
1735 available), and the unit should be written in a way that does not solely rely on this setting for
1738 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/></listitem>
1742 <term><varname>PrivateDevices=
</varname></term>
1744 <listitem><para>Takes a boolean argument. If true, sets up a new
<filename>/dev/
</filename> mount for
1745 the executed processes and only adds API pseudo devices such as
<filename>/dev/null
</filename>,
1746 <filename>/dev/zero
</filename> or
<filename>/dev/random
</filename> (as well as the pseudo TTY
1747 subsystem) to it, but no physical devices such as
<filename>/dev/sda
</filename>, system memory
1748 <filename>/dev/mem
</filename>, system ports
<filename>/dev/port
</filename> and others. This is useful
1749 to turn off physical device access by the executed process. Defaults to false.
</para>
1751 <para>Enabling this option will install a system call filter to block low-level I/O system calls that
1752 are grouped in the
<varname>@raw-io
</varname> set, remove
<constant>CAP_MKNOD
</constant> and
1753 <constant>CAP_SYS_RAWIO
</constant> from the capability bounding set for the unit, and set
1754 <varname>DevicePolicy=closed
</varname> (see
1755 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1756 for details). Note that using this setting will disconnect propagation of mounts from the service to
1757 the host (propagation in the opposite direction continues to work). This means that this setting may
1758 not be used for services which shall be able to install mount points in the main mount namespace. The
1759 new
<filename>/dev/
</filename> will be mounted read-only and 'noexec'. The latter may break old
1760 programs which try to set up executable memory by using
1761 <citerefentry><refentrytitle>mmap
</refentrytitle><manvolnum>2</manvolnum></citerefentry> of
1762 <filename>/dev/zero
</filename> instead of using
<constant>MAP_ANON
</constant>. For this setting the
1763 same restrictions regarding mount propagation and privileges apply as for
1764 <varname>ReadOnlyPaths=
</varname> and related calls, see above. If turned on and if running in user
1765 mode, or in system mode, but without the
<constant>CAP_SYS_ADMIN
</constant> capability (e.g. setting
1766 <varname>User=
</varname>),
<varname>NoNewPrivileges=yes
</varname> is implied.
</para>
1768 <para>Note that the implementation of this setting might be impossible (for example if mount
1769 namespaces are not available), and the unit should be written in a way that does not solely rely on
1770 this setting for security.
</para>
1772 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
1774 <para>When access to some but not all devices must be possible, the
<varname>DeviceAllow=
</varname>
1775 setting might be used instead. See
1776 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
1779 <xi:include href=
"version-info.xml" xpointer=
"v209"/></listitem>
1783 <term><varname>PrivateNetwork=
</varname></term>
1785 <listitem><para>Takes a boolean argument. If true, sets up a new network namespace for the executed processes
1786 and configures only the loopback network device
<literal>lo
</literal> inside it. No other network devices will
1787 be available to the executed process. This is useful to turn off network access by the executed process.
1788 Defaults to false. It is possible to run two or more units within the same private network namespace by using
1789 the
<varname>JoinsNamespaceOf=
</varname> directive, see
1790 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
1791 details. Note that this option will disconnect all socket families from the host, including
1792 <constant>AF_NETLINK
</constant> and
<constant>AF_UNIX
</constant>. Effectively, for
1793 <constant>AF_NETLINK
</constant> this means that device configuration events received from
1794 <citerefentry><refentrytitle>systemd-udevd.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry> are
1795 not delivered to the unit's processes. And for
<constant>AF_UNIX
</constant> this has the effect that
1796 <constant>AF_UNIX
</constant> sockets in the abstract socket namespace of the host will become unavailable to
1797 the unit's processes (however, those located in the file system will continue to be accessible).
</para>
1799 <para>Note that the implementation of this setting might be impossible (for example if network namespaces are
1800 not available), and the unit should be written in a way that does not solely rely on this setting for
1803 <para>When this option is enabled,
<varname>PrivateMounts=
</varname> is implied unless it is
1804 explicitly disabled, and
<filename>/sys
</filename> will be remounted to associate it with the new
1805 network namespace.
</para>
1807 <para>When this option is used on a socket unit any sockets bound on behalf of this unit will be
1808 bound within a private network namespace. This may be combined with
1809 <varname>JoinsNamespaceOf=
</varname> to listen on sockets inside of network namespaces of other
1812 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/></listitem>
1816 <term><varname>NetworkNamespacePath=
</varname></term>
1818 <listitem><para>Takes an absolute file system path referring to a Linux network namespace
1819 pseudo-file (i.e. a file like
<filename>/proc/$PID/ns/net
</filename> or a bind mount or symlink to
1820 one). When set the invoked processes are added to the network namespace referenced by that path. The
1821 path has to point to a valid namespace file at the moment the processes are forked off. If this
1822 option is used
<varname>PrivateNetwork=
</varname> has no effect. If this option is used together with
1823 <varname>JoinsNamespaceOf=
</varname> then it only has an effect if this unit is started before any of
1824 the listed units that have
<varname>PrivateNetwork=
</varname> or
1825 <varname>NetworkNamespacePath=
</varname> configured, as otherwise the network namespace of those
1826 units is reused.
</para>
1828 <para>When this option is enabled,
<varname>PrivateMounts=
</varname> is implied unless it is
1829 explicitly disabled, and
<filename>/sys
</filename> will be remounted to associate it with the new
1830 network namespace.
</para>
1832 <para>When this option is used on a socket unit any sockets bound on behalf of this unit will be
1833 bound within the specified network namespace.
</para>
1835 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
1837 <xi:include href=
"version-info.xml" xpointer=
"v242"/></listitem>
1841 <term><varname>PrivateIPC=
</varname></term>
1843 <listitem><para>Takes a boolean argument. If true, sets up a new IPC namespace for the executed processes.
1844 Each IPC namespace has its own set of System V IPC identifiers and its own POSIX message queue file system.
1845 This is useful to avoid name clash of IPC identifiers. Defaults to false. It is possible to run two or
1846 more units within the same private IPC namespace by using the
<varname>JoinsNamespaceOf=
</varname> directive,
1847 see
<citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
1850 <para>Note that IPC namespacing does not have an effect on
1851 <constant>AF_UNIX
</constant> sockets, which are the most common
1852 form of IPC used on Linux. Instead,
<constant>AF_UNIX
</constant>
1853 sockets in the file system are subject to mount namespacing, and
1854 those in the abstract namespace are subject to network namespacing.
1855 IPC namespacing only has an effect on SysV IPC (which is mostly
1856 legacy) as well as POSIX message queues (for which
1857 <constant>AF_UNIX
</constant>/
<constant>SOCK_SEQPACKET
</constant>
1858 sockets are typically a better replacement). IPC namespacing also
1859 has no effect on POSIX shared memory (which is subject to mount
1860 namespacing) either. See
1861 <citerefentry project='man-pages'
><refentrytitle>ipc_namespaces
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
1864 <para>Note that the implementation of this setting might be impossible (for example if IPC namespaces are
1865 not available), and the unit should be written in a way that does not solely rely on this setting for
1868 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
1870 <xi:include href=
"version-info.xml" xpointer=
"v248"/></listitem>
1874 <term><varname>IPCNamespacePath=
</varname></term>
1876 <listitem><para>Takes an absolute file system path referring to a Linux IPC namespace
1877 pseudo-file (i.e. a file like
<filename>/proc/$PID/ns/ipc
</filename> or a bind mount or symlink to
1878 one). When set the invoked processes are added to the network namespace referenced by that path. The
1879 path has to point to a valid namespace file at the moment the processes are forked off. If this
1880 option is used
<varname>PrivateIPC=
</varname> has no effect. If this option is used together with
1881 <varname>JoinsNamespaceOf=
</varname> then it only has an effect if this unit is started before any of
1882 the listed units that have
<varname>PrivateIPC=
</varname> or
1883 <varname>IPCNamespacePath=
</varname> configured, as otherwise the network namespace of those
1884 units is reused.
</para>
1886 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
1888 <xi:include href=
"version-info.xml" xpointer=
"v248"/></listitem>
1892 <term><varname>MemoryKSM=
</varname></term>
1894 <listitem><para>Takes a boolean argument. When set, it enables KSM (kernel samepage merging) for
1895 the processes. KSM is a memory-saving de-duplication feature. Anonymous memory pages with identical
1896 content can be replaced by a single write-protected page. This feature should only be enabled for
1897 jobs that share the same security domain. For details, see
1898 <ulink url=
"https://docs.kernel.org/admin-guide/mm/ksm.html">Kernel Samepage Merging
</ulink> in the
1899 kernel documentation.
</para>
1901 <para>Note that this functionality might not be available, for example if KSM is disabled in the
1902 kernel, or the kernel doesn't support controlling KSM at the process level through
1903 <function>prctl()
</function>.
</para>
1905 <xi:include href=
"version-info.xml" xpointer=
"v254"/>
1910 <term><varname>PrivateUsers=
</varname></term>
1912 <listitem><para>Takes a boolean argument. If true, sets up a new user namespace for the executed processes and
1913 configures a minimal user and group mapping, that maps the
<literal>root
</literal> user and group as well as
1914 the unit's own user and group to themselves and everything else to the
<literal>nobody
</literal> user and
1915 group. This is useful to securely detach the user and group databases used by the unit from the rest of the
1916 system, and thus to create an effective sandbox environment. All files, directories, processes, IPC objects and
1917 other resources owned by users/groups not equaling
<literal>root
</literal> or the unit's own will stay visible
1918 from within the unit but appear owned by the
<literal>nobody
</literal> user and group. If this mode is enabled,
1919 all unit processes are run without privileges in the host user namespace (regardless if the unit's own
1920 user/group is
<literal>root
</literal> or not). Specifically this means that the process will have zero process
1921 capabilities on the host's user namespace, but full capabilities within the service's user namespace. Settings
1922 such as
<varname>CapabilityBoundingSet=
</varname> will affect only the latter, and there's no way to acquire
1923 additional capabilities in the host's user namespace. Defaults to off.
</para>
1925 <para>When this setting is set up by a per-user instance of the service manager, the mapping of the
1926 <literal>root
</literal> user and group to itself is omitted (unless the user manager is root).
1927 Additionally, in the per-user instance manager case, the
1928 user namespace will be set up before most other namespaces. This means that combining
1929 <varname>PrivateUsers=
</varname><option>true
</option> with other namespaces will enable use of features not
1930 normally supported by the per-user instances of the service manager.
</para>
1932 <para>This setting is particularly useful in conjunction with
1933 <varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname>, as the need to synchronize the user and group
1934 databases in the root directory and on the host is reduced, as the only users and groups who need to be matched
1935 are
<literal>root
</literal>,
<literal>nobody
</literal> and the unit's own user and group.
</para>
1937 <para>Note that the implementation of this setting might be impossible (for example if user namespaces are not
1938 available), and the unit should be written in a way that does not solely rely on this setting for
1941 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
1945 <term><varname>ProtectHostname=
</varname></term>
1947 <listitem><para>Takes a boolean argument. When set, sets up a new UTS namespace for the executed
1948 processes. In addition, changing hostname or domainname is prevented. Defaults to off.
</para>
1950 <para>Note that the implementation of this setting might be impossible (for example if UTS namespaces
1951 are not available), and the unit should be written in a way that does not solely rely on this setting
1952 for security.
</para>
1954 <para>Note that when this option is enabled for a service hostname changes no longer propagate from
1955 the system into the service, it is hence not suitable for services that need to take notice of system
1956 hostname changes dynamically.
</para>
1958 <para>If this setting is on, but the unit doesn't have the
<constant>CAP_SYS_ADMIN
</constant>
1959 capability (e.g. services for which
<varname>User=
</varname> is set),
1960 <varname>NoNewPrivileges=yes
</varname> is implied.
</para>
1962 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
1964 <xi:include href=
"version-info.xml" xpointer=
"v242"/></listitem>
1968 <term><varname>ProtectClock=
</varname></term>
1970 <listitem><para>Takes a boolean argument. If set, writes to the hardware clock or system clock will
1971 be denied. Defaults to off. Enabling this option removes
<constant>CAP_SYS_TIME
</constant> and
1972 <constant>CAP_WAKE_ALARM
</constant> from the capability bounding set for this unit, installs a system
1973 call filter to block calls that can set the clock, and
<varname>DeviceAllow=char-rtc r
</varname> is
1974 implied. Note that the system calls are blocked altogether, the filter does not take into account
1975 that some of the calls can be used to read the clock state with some parameter combinations.
1976 Effectively,
<filename>/dev/rtc0
</filename>,
<filename>/dev/rtc1
</filename>, etc. are made read-only
1978 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1979 for the details about
<varname>DeviceAllow=
</varname>. If this setting is on, but the unit doesn't
1980 have the
<constant>CAP_SYS_ADMIN
</constant> capability (e.g. services for which
1981 <varname>User=
</varname> is set),
<varname>NoNewPrivileges=yes
</varname> is implied.
</para>
1983 <para>It is recommended to turn this on for most services that do not need modify the clock or check
1986 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
1988 <xi:include href=
"version-info.xml" xpointer=
"v245"/></listitem>
1992 <term><varname>ProtectKernelTunables=
</varname></term>
1994 <listitem><para>Takes a boolean argument. If true, kernel variables accessible through
1995 <filename>/proc/sys/
</filename>,
<filename>/sys/
</filename>,
<filename>/proc/sysrq-trigger
</filename>,
1996 <filename>/proc/latency_stats
</filename>,
<filename>/proc/acpi
</filename>,
1997 <filename>/proc/timer_stats
</filename>,
<filename>/proc/fs
</filename> and
<filename>/proc/irq
</filename> will
1998 be made read-only to all processes of the unit. Usually, tunable kernel variables should be initialized only at
1999 boot-time, for example with the
2000 <citerefentry><refentrytitle>sysctl.d
</refentrytitle><manvolnum>5</manvolnum></citerefentry> mechanism. Few
2001 services need to write to these at runtime; it is hence recommended to turn this on for most services. For this
2002 setting the same restrictions regarding mount propagation and privileges apply as for
2003 <varname>ReadOnlyPaths=
</varname> and related calls, see above. Defaults to off. If this
2004 setting is on, but the unit doesn't have the
<constant>CAP_SYS_ADMIN
</constant> capability
2005 (e.g. services for which
<varname>User=
</varname> is set),
2006 <varname>NoNewPrivileges=yes
</varname> is implied. Note that this option does not prevent
2007 indirect changes to kernel tunables effected by IPC calls to other processes. However,
2008 <varname>InaccessiblePaths=
</varname> may be used to make relevant IPC file system objects
2009 inaccessible. If
<varname>ProtectKernelTunables=
</varname> is set,
2010 <varname>MountAPIVFS=yes
</varname> is implied.
</para>
2012 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
2014 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
2018 <term><varname>ProtectKernelModules=
</varname></term>
2020 <listitem><para>Takes a boolean argument. If true, explicit module loading will be denied. This allows
2021 module load and unload operations to be turned off on modular kernels. It is recommended to turn this on for most services
2022 that do not need special file systems or extra kernel modules to work. Defaults to off. Enabling this option
2023 removes
<constant>CAP_SYS_MODULE
</constant> from the capability bounding set for the unit, and installs a
2024 system call filter to block module system calls, also
<filename>/usr/lib/modules
</filename> is made
2025 inaccessible. For this setting the same restrictions regarding mount propagation and privileges apply as for
2026 <varname>ReadOnlyPaths=
</varname> and related calls, see above. Note that limited automatic module loading due
2027 to user configuration or kernel mapping tables might still happen as side effect of requested user operations,
2028 both privileged and unprivileged. To disable module auto-load feature please see
2029 <citerefentry><refentrytitle>sysctl.d
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
2030 <constant>kernel.modules_disabled
</constant> mechanism and
2031 <filename>/proc/sys/kernel/modules_disabled
</filename> documentation. If this setting is on,
2032 but the unit doesn't have the
<constant>CAP_SYS_ADMIN
</constant> capability (e.g. services for
2033 which
<varname>User=
</varname> is set),
<varname>NoNewPrivileges=yes
</varname> is implied.
</para>
2035 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
2037 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
2041 <term><varname>ProtectKernelLogs=
</varname></term>
2043 <listitem><para>Takes a boolean argument. If true, access to the kernel log ring buffer will be denied. It is
2044 recommended to turn this on for most services that do not need to read from or write to the kernel log ring
2045 buffer. Enabling this option removes
<constant>CAP_SYSLOG
</constant> from the capability bounding set for this
2046 unit, and installs a system call filter to block the
2047 <citerefentry project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
2048 system call (not to be confused with the libc API
2049 <citerefentry project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
2050 for userspace logging). The kernel exposes its log buffer to userspace via
<filename>/dev/kmsg
</filename> and
2051 <filename>/proc/kmsg
</filename>. If enabled, these are made inaccessible to all the processes in the unit.
2052 If this setting is on, but the unit doesn't have the
<constant>CAP_SYS_ADMIN
</constant>
2053 capability (e.g. services for which
<varname>User=
</varname> is set),
2054 <varname>NoNewPrivileges=yes
</varname> is implied.
</para>
2056 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
2058 <xi:include href=
"version-info.xml" xpointer=
"v244"/></listitem>
2062 <term><varname>ProtectControlGroups=
</varname></term>
2064 <listitem><para>Takes a boolean argument. If true, the Linux Control Groups (
<citerefentry
2065 project='man-pages'
><refentrytitle>cgroups
</refentrytitle><manvolnum>7</manvolnum></citerefentry>) hierarchies
2066 accessible through
<filename>/sys/fs/cgroup/
</filename> will be made read-only to all processes of the
2067 unit. Except for container managers no services should require write access to the control groups hierarchies;
2068 it is hence recommended to turn this on for most services. For this setting the same restrictions regarding
2069 mount propagation and privileges apply as for
<varname>ReadOnlyPaths=
</varname> and related calls, see
2070 above. Defaults to off. If
<varname>ProtectControlGroups=
</varname> is set,
<varname>MountAPIVFS=yes
</varname>
2073 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
2075 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
2079 <term><varname>RestrictAddressFamilies=
</varname></term>
2081 <listitem><para>Restricts the set of socket address families accessible to the processes of this
2082 unit. Takes
<literal>none
</literal>, or a space-separated list of address family names to
2083 allow-list, such as
<constant>AF_UNIX
</constant>,
<constant>AF_INET
</constant> or
2084 <constant>AF_INET6
</constant>. When
<literal>none
</literal> is specified, then all address
2085 families will be denied. When prefixed with
<literal>~
</literal> the listed address
2086 families will be applied as deny list, otherwise as allow list. Note that this restricts access
2088 <citerefentry project='man-pages'
><refentrytitle>socket
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
2089 system call only. Sockets passed into the process by other means (for example, by using socket
2090 activation with socket units, see
2091 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry>)
2092 are unaffected. Also, sockets created with
<function>socketpair()
</function> (which creates connected
2093 AF_UNIX sockets only) are unaffected. Note that this option has no effect on
32-bit x86, s390, s390x,
2094 mips, mips-le, ppc, ppc-le, ppc64, ppc64-le and is ignored (but works correctly on other ABIs,
2095 including x86-
64). Note that on systems supporting multiple ABIs (such as x86/x86-
64) it is
2096 recommended to turn off alternative ABIs for services, so that they cannot be used to circumvent the
2097 restrictions of this option. Specifically, it is recommended to combine this option with
2098 <varname>SystemCallArchitectures=native
</varname> or similar. If running in user mode, or in system
2099 mode, but without the
<constant>CAP_SYS_ADMIN
</constant> capability (e.g. setting
2100 <varname>User=
</varname>),
<varname>NoNewPrivileges=yes
</varname> is implied. By default, no
2101 restrictions apply, all address families are accessible to processes. If assigned the empty string,
2102 any previous address family restriction changes are undone. This setting does not affect commands
2103 prefixed with
<literal>+
</literal>.
</para>
2105 <para>Use this option to limit exposure of processes to remote access, in particular via exotic and sensitive
2106 network protocols, such as
<constant>AF_PACKET
</constant>. Note that in most cases, the local
2107 <constant>AF_UNIX
</constant> address family should be included in the configured allow list as it is frequently
2108 used for local communication, including for
2109 <citerefentry><refentrytitle>syslog
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
2112 <xi:include href=
"version-info.xml" xpointer=
"v211"/></listitem>
2116 <term><varname>RestrictFileSystems=
</varname></term>
2118 <listitem><para>Restricts the set of filesystems processes of this unit can open files on. Takes a space-separated
2119 list of filesystem names. Any filesystem listed is made accessible to the unit's processes, access to filesystem
2120 types not listed is prohibited (allow-listing). If the first character of the list is
<literal>~
</literal>, the
2121 effect is inverted: access to the filesystems listed is prohibited (deny-listing). If the empty string is assigned,
2122 access to filesystems is not restricted.
</para>
2124 <para>If you specify both types of this option (i.e. allow-listing and deny-listing), the first encountered will take
2125 precedence and will dictate the default action (allow access to the filesystem or deny it). Then the next occurrences
2126 of this option will add or delete the listed filesystems from the set of the restricted filesystems, depending on its
2127 type and the default action.
</para>
2129 <para>Example: if a unit has the following,
2130 <programlisting>RestrictFileSystems=ext4 tmpfs
2131 RestrictFileSystems=ext2 ext4
</programlisting>
2132 then access to
<constant>ext4
</constant>,
<constant>tmpfs
</constant>, and
<constant>ext2
</constant> is allowed
2133 and access to other filesystems is denied.
</para>
2135 <para>Example: if a unit has the following,
2136 <programlisting>RestrictFileSystems=ext4 tmpfs
2137 RestrictFileSystems=~ext4
</programlisting>
2138 then only access
<constant>tmpfs
</constant> is allowed.
</para>
2140 <para>Example: if a unit has the following,
2141 <programlisting>RestrictFileSystems=~ext4 tmpfs
2142 RestrictFileSystems=ext4
</programlisting>
2143 then only access to
<constant>tmpfs
</constant> is denied.
</para>
2145 <para>As the number of possible filesystems is large, predefined sets of filesystems are provided. A set
2146 starts with
<literal>@
</literal> character, followed by name of the set.
</para>
2149 <title>Currently predefined filesystem sets
</title>
2152 <colspec colname='set'
/>
2153 <colspec colname='description'
/>
2157 <entry>Description
</entry>
2162 <entry>@basic-api
</entry>
2163 <entry>Basic filesystem API.
</entry>
2166 <entry>@auxiliary-api
</entry>
2167 <entry>Auxiliary filesystem API.
</entry>
2170 <entry>@common-block
</entry>
2171 <entry>Common block device filesystems.
</entry>
2174 <entry>@historical-block
</entry>
2175 <entry>Historical block device filesystems.
</entry>
2178 <entry>@network
</entry>
2179 <entry>Well-known network filesystems.
</entry>
2182 <entry>@privileged-api
</entry>
2183 <entry>Privileged filesystem API.
</entry>
2186 <entry>@temporary
</entry>
2187 <entry>Temporary filesystems: tmpfs, ramfs.
</entry>
2190 <entry>@known
</entry>
2191 <entry>All known filesystems defined by the kernel. This list is defined statically in systemd based on a kernel version that was available when this systemd version was released. It will become progressively more out-of-date as the kernel is updated.
</entry>
2198 <citerefentry><refentrytitle>systemd-analyze
</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s
2199 <command>filesystems
</command> command to retrieve a list of filesystems defined on the local
2202 <para>Note that this setting might not be supported on some systems (for example if the LSM eBPF hook is
2203 not enabled in the underlying kernel or if not using the unified control group hierarchy). In that case this setting
2204 has no effect.
</para>
2206 <xi:include href=
"cgroup-sandboxing.xml" xpointer=
"singular"/>
2208 <xi:include href=
"version-info.xml" xpointer=
"v250"/></listitem>
2212 <term><varname>RestrictNamespaces=
</varname></term>
2214 <listitem><para>Restricts access to Linux namespace functionality for the processes of this unit. For details
2215 about Linux namespaces, see
<citerefentry
2216 project='man-pages'
><refentrytitle>namespaces
</refentrytitle><manvolnum>7</manvolnum></citerefentry>. Either
2217 takes a boolean argument, or a space-separated list of namespace type identifiers. If false (the default), no
2218 restrictions on namespace creation and switching are made. If true, access to any kind of namespacing is
2219 prohibited. Otherwise, a space-separated list of namespace type identifiers must be specified, consisting of
2220 any combination of:
<constant>cgroup
</constant>,
<constant>ipc
</constant>,
<constant>net
</constant>,
2221 <constant>mnt
</constant>,
<constant>pid
</constant>,
<constant>user
</constant> and
<constant>uts
</constant>. Any
2222 namespace type listed is made accessible to the unit's processes, access to namespace types not listed is
2223 prohibited (allow-listing). By prepending the list with a single tilde character (
<literal>~
</literal>) the
2224 effect may be inverted: only the listed namespace types will be made inaccessible, all unlisted ones are
2225 permitted (deny-listing). If the empty string is assigned, the default namespace restrictions are applied,
2226 which is equivalent to false. This option may appear more than once, in which case the namespace types are
2227 merged by
<constant>OR
</constant>, or by
<constant>AND
</constant> if the lines are prefixed with
2228 <literal>~
</literal> (see examples below). Internally, this setting limits access to the
2229 <citerefentry><refentrytitle>unshare
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
2230 <citerefentry><refentrytitle>clone
</refentrytitle><manvolnum>2</manvolnum></citerefentry> and
2231 <citerefentry><refentrytitle>setns
</refentrytitle><manvolnum>2</manvolnum></citerefentry> system calls, taking
2232 the specified flags parameters into account. Note that — if this option is used — in addition to restricting
2233 creation and switching of the specified types of namespaces (or all of them, if true) access to the
2234 <function>setns()
</function> system call with a zero flags parameter is prohibited. This setting is only
2235 supported on x86, x86-
64, mips, mips-le, mips64, mips64-le, mips64-n32, mips64-le-n32, ppc64, ppc64-le, s390
2236 and s390x, and enforces no restrictions on other architectures. If running in user mode, or in system mode, but
2237 without the
<constant>CAP_SYS_ADMIN
</constant> capability (e.g. setting
<varname>User=
</varname>),
2238 <varname>NoNewPrivileges=yes
</varname> is implied.
</para>
2240 <para>Example: if a unit has the following,
2241 <programlisting>RestrictNamespaces=cgroup ipc
2242 RestrictNamespaces=cgroup net
</programlisting>
2243 then
<constant>cgroup
</constant>,
<constant>ipc
</constant>, and
<constant>net
</constant> are set.
2244 If the second line is prefixed with
<literal>~
</literal>, e.g.,
2245 <programlisting>RestrictNamespaces=cgroup ipc
2246 RestrictNamespaces=~cgroup net
</programlisting>
2247 then, only
<constant>ipc
</constant> is set.
</para>
2249 <xi:include href=
"version-info.xml" xpointer=
"v233"/></listitem>
2253 <term><varname>LockPersonality=
</varname></term>
2255 <listitem><para>Takes a boolean argument. If set, locks down the
<citerefentry
2256 project='man-pages'
><refentrytitle>personality
</refentrytitle><manvolnum>2</manvolnum></citerefentry> system
2257 call so that the kernel execution domain may not be changed from the default or the personality selected with
2258 <varname>Personality=
</varname> directive. This may be useful to improve security, because odd personality
2259 emulations may be poorly tested and source of vulnerabilities. If running in user mode, or in system mode, but
2260 without the
<constant>CAP_SYS_ADMIN
</constant> capability (e.g. setting
<varname>User=
</varname>),
2261 <varname>NoNewPrivileges=yes
</varname> is implied.
</para>
2263 <xi:include href=
"version-info.xml" xpointer=
"v235"/></listitem>
2267 <term><varname>MemoryDenyWriteExecute=
</varname></term>
2269 <listitem><para>Takes a boolean argument. If set, attempts to create memory mappings that are writable and
2270 executable at the same time, or to change existing memory mappings to become executable, or mapping shared
2271 memory segments as executable, are prohibited. Specifically, a system call filter is added (or
2272 preferably, an equivalent kernel check is enabled with
2273 <citerefentry><refentrytitle>prctl
</refentrytitle><manvolnum>2</manvolnum></citerefentry>) that
2274 rejects
<citerefentry><refentrytitle>mmap
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
2275 system calls with both
<constant>PROT_EXEC
</constant> and
<constant>PROT_WRITE
</constant> set,
2276 <citerefentry><refentrytitle>mprotect
</refentrytitle><manvolnum>2</manvolnum></citerefentry> or
2277 <citerefentry><refentrytitle>pkey_mprotect
</refentrytitle><manvolnum>2</manvolnum></citerefentry> system calls
2278 with
<constant>PROT_EXEC
</constant> set and
2279 <citerefentry><refentrytitle>shmat
</refentrytitle><manvolnum>2</manvolnum></citerefentry> system calls with
2280 <constant>SHM_EXEC
</constant> set. Note that this option is incompatible with programs and libraries that
2281 generate program code dynamically at runtime, including JIT execution engines, executable stacks, and code
2282 "trampoline" feature of various C compilers. This option improves service security, as it makes harder for
2283 software exploits to change running code dynamically. However, the protection can be circumvented, if
2284 the service can write to a filesystem, which is not mounted with
<constant>noexec
</constant> (such as
2285 <filename>/dev/shm
</filename>), or it can use
<function>memfd_create()
</function>. This can be
2286 prevented by making such file systems inaccessible to the service
2287 (e.g.
<varname>InaccessiblePaths=/dev/shm
</varname>) and installing further system call filters
2288 (
<varname>SystemCallFilter=~memfd_create
</varname>). Note that this feature is fully available on
2289 x86-
64, and partially on x86. Specifically, the
<function>shmat()
</function> protection is not
2290 available on x86. Note that on systems supporting multiple ABIs (such as x86/x86-
64) it is
2291 recommended to turn off alternative ABIs for services, so that they cannot be used to circumvent the
2292 restrictions of this option. Specifically, it is recommended to combine this option with
2293 <varname>SystemCallArchitectures=native
</varname> or similar. If running in user mode, or in system
2294 mode, but without the
<constant>CAP_SYS_ADMIN
</constant> capability (e.g. setting
2295 <varname>User=
</varname>),
<varname>NoNewPrivileges=yes
</varname> is implied.
</para>
2297 <xi:include href=
"version-info.xml" xpointer=
"v231"/></listitem>
2301 <term><varname>RestrictRealtime=
</varname></term>
2303 <listitem><para>Takes a boolean argument. If set, any attempts to enable realtime scheduling in a process of
2304 the unit are refused. This restricts access to realtime task scheduling policies such as
2305 <constant>SCHED_FIFO
</constant>,
<constant>SCHED_RR
</constant> or
<constant>SCHED_DEADLINE
</constant>. See
2306 <citerefentry project='man-pages'
><refentrytitle>sched
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
2307 for details about these scheduling policies. If running in user mode, or in system mode, but without the
2308 <constant>CAP_SYS_ADMIN
</constant> capability (e.g. setting
<varname>User=
</varname>),
2309 <varname>NoNewPrivileges=yes
</varname> is implied. Realtime scheduling policies may be used to monopolize CPU
2310 time for longer periods of time, and may hence be used to lock up or otherwise trigger Denial-of-Service
2311 situations on the system. It is hence recommended to restrict access to realtime scheduling to the few programs
2312 that actually require them. Defaults to off.
</para>
2314 <xi:include href=
"version-info.xml" xpointer=
"v231"/></listitem>
2318 <term><varname>RestrictSUIDSGID=
</varname></term>
2320 <listitem><para>Takes a boolean argument. If set, any attempts to set the set-user-ID (SUID) or
2321 set-group-ID (SGID) bits on files or directories will be denied (for details on these bits see
2323 project='man-pages'
><refentrytitle>inode
</refentrytitle><manvolnum>7</manvolnum></citerefentry>). If
2324 running in user mode, or in system mode, but without the
<constant>CAP_SYS_ADMIN
</constant>
2325 capability (e.g. setting
<varname>User=
</varname>),
<varname>NoNewPrivileges=yes
</varname> is
2326 implied. As the SUID/SGID bits are mechanisms to elevate privileges, and allow users to acquire the
2327 identity of other users, it is recommended to restrict creation of SUID/SGID files to the few
2328 programs that actually require them. Note that this restricts marking of any type of file system
2329 object with these bits, including both regular files and directories (where the SGID is a different
2330 meaning than for files, see documentation). This option is implied if
<varname>DynamicUser=
</varname>
2331 is enabled. Defaults to off.
</para>
2333 <xi:include href=
"version-info.xml" xpointer=
"v242"/></listitem>
2337 <term><varname>RemoveIPC=
</varname></term>
2339 <listitem><para>Takes a boolean parameter. If set, all System V and POSIX IPC objects owned by the user and
2340 group the processes of this unit are run as are removed when the unit is stopped. This setting only has an
2341 effect if at least one of
<varname>User=
</varname>,
<varname>Group=
</varname> and
2342 <varname>DynamicUser=
</varname> are used. It has no effect on IPC objects owned by the root user. Specifically,
2343 this removes System V semaphores, as well as System V and POSIX shared memory segments and message queues. If
2344 multiple units use the same user or group the IPC objects are removed when the last of these units is
2345 stopped. This setting is implied if
<varname>DynamicUser=
</varname> is set.
</para>
2347 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
2349 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
2353 <term><varname>PrivateMounts=
</varname></term>
2355 <listitem><para>Takes a boolean parameter. If set, the processes of this unit will be run in their own private
2356 file system (mount) namespace with all mount propagation from the processes towards the host's main file system
2357 namespace turned off. This means any file system mount points established or removed by the unit's processes
2358 will be private to them and not be visible to the host. However, file system mount points established or
2359 removed on the host will be propagated to the unit's processes. See
<citerefentry
2360 project='man-pages'
><refentrytitle>mount_namespaces
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
2361 details on file system namespaces. Defaults to off.
</para>
2363 <para>When turned on, this executes three operations for each invoked process: a new
2364 <constant>CLONE_NEWNS
</constant> namespace is created, after which all existing mounts are remounted to
2365 <constant>MS_SLAVE
</constant> to disable propagation from the unit's processes to the host (but leaving
2366 propagation in the opposite direction in effect). Finally, the mounts are remounted again to the propagation
2367 mode configured with
<varname>MountFlags=
</varname>, see below.
</para>
2369 <para>File system namespaces are set up individually for each process forked off by the service manager. Mounts
2370 established in the namespace of the process created by
<varname>ExecStartPre=
</varname> will hence be cleaned
2371 up automatically as soon as that process exits and will not be available to subsequent processes forked off for
2372 <varname>ExecStart=
</varname> (and similar applies to the various other commands configured for
2373 units). Similarly,
<varname>JoinsNamespaceOf=
</varname> does not permit sharing kernel mount namespaces between
2374 units, it only enables sharing of the
<filename>/tmp/
</filename> and
<filename>/var/tmp/
</filename>
2377 <para>Other file system namespace unit settings —
<varname>PrivateMounts=
</varname>,
2378 <varname>PrivateTmp=
</varname>,
<varname>PrivateDevices=
</varname>,
<varname>ProtectSystem=
</varname>,
2379 <varname>ProtectHome=
</varname>,
<varname>ReadOnlyPaths=
</varname>,
<varname>InaccessiblePaths=
</varname>,
2380 <varname>ReadWritePaths=
</varname>, … — also enable file system namespacing in a fashion equivalent to this
2381 option. Hence it is primarily useful to explicitly request this behaviour if none of the other settings are
2384 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
2386 <xi:include href=
"version-info.xml" xpointer=
"v239"/></listitem>
2390 <term><varname>MountFlags=
</varname></term>
2392 <listitem><para>Takes a mount propagation setting:
<option>shared
</option>,
<option>slave
</option> or
2393 <option>private
</option>, which controls whether file system mount points in the file system namespaces set up
2394 for this unit's processes will receive or propagate mounts and unmounts from other file system namespaces. See
2395 <citerefentry project='man-pages'
><refentrytitle>mount
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
2396 for details on mount propagation, and the three propagation flags in particular.
</para>
2398 <para>This setting only controls the
<emphasis>final
</emphasis> propagation setting in effect on all mount
2399 points of the file system namespace created for each process of this unit. Other file system namespacing unit
2400 settings (see the discussion in
<varname>PrivateMounts=
</varname> above) will implicitly disable mount and
2401 unmount propagation from the unit's processes towards the host by changing the propagation setting of all mount
2402 points in the unit's file system namespace to
<option>slave
</option> first. Setting this option to
2403 <option>shared
</option> does not reestablish propagation in that case.
</para>
2405 <para>If not set – but file system namespaces are enabled through another file system namespace unit setting –
2406 <option>shared
</option> mount propagation is used, but — as mentioned — as
<option>slave
</option> is applied
2407 first, propagation from the unit's processes to the host is still turned off.
</para>
2409 <para>It is not recommended to use
<option>private
</option> mount propagation for units, as this means
2410 temporary mounts (such as removable media) of the host will stay mounted and thus indefinitely busy in forked
2411 off processes, as unmount propagation events won't be received by the file system namespace of the unit.
</para>
2413 <para>Usually, it is best to leave this setting unmodified, and use higher level file system namespacing
2414 options instead, in particular
<varname>PrivateMounts=
</varname>, see above.
</para>
2416 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/></listitem>
2423 <title>System Call Filtering
</title>
2424 <variablelist class='unit-directives'
>
2427 <term><varname>SystemCallFilter=
</varname></term>
2429 <listitem><para>Takes a space-separated list of system call names. If this setting is used, all
2430 system calls executed by the unit processes except for the listed ones will result in immediate
2431 process termination with the
<constant>SIGSYS
</constant> signal (allow-listing). (See
2432 <varname>SystemCallErrorNumber=
</varname> below for changing the default action). If the first
2433 character of the list is
<literal>~
</literal>, the effect is inverted: only the listed system calls
2434 will result in immediate process termination (deny-listing). Deny-listed system calls and system call
2435 groups may optionally be suffixed with a colon (
<literal>:
</literal>) and
<literal>errno
</literal>
2436 error number (between
0 and
4095) or errno name such as
<constant>EPERM
</constant>,
2437 <constant>EACCES
</constant> or
<constant>EUCLEAN
</constant> (see
<citerefentry
2438 project='man-pages'
><refentrytitle>errno
</refentrytitle><manvolnum>3</manvolnum></citerefentry> for a
2439 full list). This value will be returned when a deny-listed system call is triggered, instead of
2440 terminating the processes immediately. Special setting
<literal>kill
</literal> can be used to
2441 explicitly specify killing. This value takes precedence over the one given in
2442 <varname>SystemCallErrorNumber=
</varname>, see below. If running in user mode, or in system mode,
2443 but without the
<constant>CAP_SYS_ADMIN
</constant> capability (e.g. setting
2444 <varname>User=
</varname>),
<varname>NoNewPrivileges=yes
</varname> is implied. This feature
2445 makes use of the Secure Computing Mode
2 interfaces of the kernel ('seccomp filtering') and is useful
2446 for enforcing a minimal sandboxing environment. Note that the
<function>execve()
</function>,
2447 <function>exit()
</function>,
<function>exit_group()
</function>,
<function>getrlimit()
</function>,
2448 <function>rt_sigreturn()
</function>,
<function>sigreturn()
</function> system calls and the system calls
2449 for querying time and sleeping are implicitly allow-listed and do not need to be listed
2450 explicitly. This option may be specified more than once, in which case the filter masks are
2451 merged. If the empty string is assigned, the filter is reset, all prior assignments will have no
2452 effect. This does not affect commands prefixed with
<literal>+
</literal>.
</para>
2454 <para>Note that on systems supporting multiple ABIs (such as x86/x86-
64) it is recommended to turn off
2455 alternative ABIs for services, so that they cannot be used to circumvent the restrictions of this
2456 option. Specifically, it is recommended to combine this option with
2457 <varname>SystemCallArchitectures=native
</varname> or similar.
</para>
2459 <para>Note that strict system call filters may impact execution and error handling code paths of the service
2460 invocation. Specifically, access to the
<function>execve()
</function> system call is required for the execution
2461 of the service binary — if it is blocked service invocation will necessarily fail. Also, if execution of the
2462 service binary fails for some reason (for example: missing service executable), the error handling logic might
2463 require access to an additional set of system calls in order to process and log this failure correctly. It
2464 might be necessary to temporarily disable system call filters in order to simplify debugging of such
2467 <para>If you specify both types of this option (i.e. allow-listing and deny-listing), the first
2468 encountered will take precedence and will dictate the default action (termination or approval of a
2469 system call). Then the next occurrences of this option will add or delete the listed system calls
2470 from the set of the filtered system calls, depending of its type and the default action. (For
2471 example, if you have started with an allow list rule for
<function>read()
</function> and
2472 <function>write()
</function>, and right after it add a deny list rule for
<function>write()
</function>,
2473 then
<function>write()
</function> will be removed from the set.)
</para>
2475 <para>As the number of possible system calls is large, predefined sets of system calls are provided. A set
2476 starts with
<literal>@
</literal> character, followed by name of the set.
2479 <title>Currently predefined system call sets
</title>
2482 <colspec colname='set'
/>
2483 <colspec colname='description'
/>
2487 <entry>Description
</entry>
2493 <entry>Asynchronous I/O (
<citerefentry project='man-pages'
><refentrytitle>io_setup
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>io_submit
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)
</entry>
2496 <entry>@basic-io
</entry>
2497 <entry>System calls for basic I/O: reading, writing, seeking, file descriptor duplication and closing (
<citerefentry project='man-pages'
><refentrytitle>read
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>write
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)
</entry>
2500 <entry>@chown
</entry>
2501 <entry>Changing file ownership (
<citerefentry project='man-pages'
><refentrytitle>chown
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>fchownat
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)
</entry>
2504 <entry>@clock
</entry>
2505 <entry>System calls for changing the system clock (
<citerefentry project='man-pages'
><refentrytitle>adjtimex
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>settimeofday
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)
</entry>
2508 <entry>@cpu-emulation
</entry>
2509 <entry>System calls for CPU emulation functionality (
<citerefentry project='man-pages'
><refentrytitle>vm86
</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)
</entry>
2512 <entry>@debug
</entry>
2513 <entry>Debugging, performance monitoring and tracing functionality (
<citerefentry project='man-pages'
><refentrytitle>ptrace
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>perf_event_open
</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)
</entry>
2516 <entry>@file-system
</entry>
2517 <entry>File system operations: opening, creating files and directories for read and write, renaming and removing them, reading file properties, or creating hard and symbolic links
</entry>
2520 <entry>@io-event
</entry>
2521 <entry>Event loop system calls (
<citerefentry project='man-pages'
><refentrytitle>poll
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>select
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>epoll
</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>eventfd
</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)
</entry>
2525 <entry>Pipes, SysV IPC, POSIX Message Queues and other IPC (
<citerefentry project='man-pages'
><refentrytitle>mq_overview
</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>svipc
</refentrytitle><manvolnum>7</manvolnum></citerefentry>)
</entry>
2528 <entry>@keyring
</entry>
2529 <entry>Kernel keyring access (
<citerefentry project='man-pages'
><refentrytitle>keyctl
</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)
</entry>
2532 <entry>@memlock
</entry>
2533 <entry>Locking of memory in RAM (
<citerefentry project='man-pages'
><refentrytitle>mlock
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>mlockall
</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)
</entry>
2536 <entry>@module
</entry>
2537 <entry>Loading and unloading of kernel modules (
<citerefentry project='man-pages'
><refentrytitle>init_module
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>delete_module
</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)
</entry>
2540 <entry>@mount
</entry>
2541 <entry>Mounting and unmounting of file systems (
<citerefentry project='man-pages'
><refentrytitle>mount
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>chroot
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)
</entry>
2544 <entry>@network-io
</entry>
2545 <entry>Socket I/O (including local AF_UNIX):
<citerefentry project='man-pages'
><refentrytitle>socket
</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>unix
</refentrytitle><manvolnum>7</manvolnum></citerefentry></entry>
2548 <entry>@obsolete
</entry>
2549 <entry>Unusual, obsolete or unimplemented (
<citerefentry project='man-pages'
><refentrytitle>create_module
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>gtty
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, …)
</entry>
2552 <entry>@pkey
</entry>
2553 <entry>System calls that deal with memory protection keys (
<citerefentry project='man-pages'
><refentrytitle>pkeys
</refentrytitle><manvolnum>7</manvolnum></citerefentry>)
</entry>
2556 <entry>@privileged
</entry>
2557 <entry>All system calls which need super-user capabilities (
<citerefentry project='man-pages'
><refentrytitle>capabilities
</refentrytitle><manvolnum>7</manvolnum></citerefentry>)
</entry>
2560 <entry>@process
</entry>
2561 <entry>Process control, execution, namespacing operations (
<citerefentry project='man-pages'
><refentrytitle>clone
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>kill
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>namespaces
</refentrytitle><manvolnum>7</manvolnum></citerefentry>, …)
</entry>
2564 <entry>@raw-io
</entry>
2565 <entry>Raw I/O port access (
<citerefentry project='man-pages'
><refentrytitle>ioperm
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>iopl
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<function>pciconfig_read()
</function>, …)
</entry>
2568 <entry>@reboot
</entry>
2569 <entry>System calls for rebooting and reboot preparation (
<citerefentry project='man-pages'
><refentrytitle>reboot
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<function>kexec()
</function>, …)
</entry>
2572 <entry>@resources
</entry>
2573 <entry>System calls for changing resource limits, memory and scheduling parameters (
<citerefentry project='man-pages'
><refentrytitle>setrlimit
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>setpriority
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, …)
</entry>
2576 <entry>@sandbox
</entry>
2577 <entry>System calls for sandboxing programs (
<citerefentry project='man-pages'
><refentrytitle>seccomp
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, Landlock system calls, …)
</entry>
2580 <entry>@setuid
</entry>
2581 <entry>System calls for changing user ID and group ID credentials, (
<citerefentry project='man-pages'
><refentrytitle>setuid
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>setgid
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>setresuid
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, …)
</entry>
2584 <entry>@signal
</entry>
2585 <entry>System calls for manipulating and handling process signals (
<citerefentry project='man-pages'
><refentrytitle>signal
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>sigprocmask
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, …)
</entry>
2588 <entry>@swap
</entry>
2589 <entry>System calls for enabling/disabling swap devices (
<citerefentry project='man-pages'
><refentrytitle>swapon
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>swapoff
</refentrytitle><manvolnum>2</manvolnum></citerefentry>)
</entry>
2592 <entry>@sync
</entry>
2593 <entry>Synchronizing files and memory to disk (
<citerefentry project='man-pages'
><refentrytitle>fsync
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>msync
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)
</entry>
2596 <entry>@system-service
</entry>
2597 <entry>A reasonable set of system calls used by common system services, excluding any special purpose calls. This is the recommended starting point for allow-listing system calls for system services, as it contains what is typically needed by system services, but excludes overly specific interfaces. For example, the following APIs are excluded:
<literal>@clock
</literal>,
<literal>@mount
</literal>,
<literal>@swap
</literal>,
<literal>@reboot
</literal>.
</entry>
2600 <entry>@timer
</entry>
2601 <entry>System calls for scheduling operations by time (
<citerefentry project='man-pages'
><refentrytitle>alarm
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>timer_create
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, …)
</entry>
2604 <entry>@known
</entry>
2605 <entry>All system calls defined by the kernel. This list is defined statically in systemd based on a kernel version that was available when this systemd version was released. It will become progressively more out-of-date as the kernel is updated.
</entry>
2611 Note, that as new system calls are added to the kernel, additional system calls might be added to the groups
2612 above. Contents of the sets may also change between systemd versions. In addition, the list of system calls
2613 depends on the kernel version and architecture for which systemd was compiled. Use
2614 <command>systemd-analyze syscall-filter
</command> to list the actual list of system calls in each
2617 <para>Generally, allow-listing system calls (rather than deny-listing) is the safer mode of
2618 operation. It is recommended to enforce system call allow lists for all long-running system
2619 services. Specifically, the following lines are a relatively safe basic choice for the majority of
2620 system services:
</para>
2622 <programlisting>[Service]
2623 SystemCallFilter=@system-service
2624 SystemCallErrorNumber=EPERM
</programlisting>
2626 <para>Note that various kernel system calls are defined redundantly: there are multiple system calls
2627 for executing the same operation. For example, the
<function>pidfd_send_signal()
</function> system
2628 call may be used to execute operations similar to what can be done with the older
2629 <function>kill()
</function> system call, hence blocking the latter without the former only provides
2630 weak protection. Since new system calls are added regularly to the kernel as development progresses,
2631 keeping system call deny lists comprehensive requires constant work. It is thus recommended to use
2632 allow-listing instead, which offers the benefit that new system calls are by default implicitly
2633 blocked until the allow list is updated.
</para>
2635 <para>Also note that a number of system calls are required to be accessible for the dynamic linker to
2636 work. The dynamic linker is required for running most regular programs (specifically: all dynamic ELF
2637 binaries, which is how most distributions build packaged programs). This means that blocking these
2638 system calls (which include
<function>open()
</function>,
<function>openat()
</function> or
2639 <function>mmap()
</function>) will make most programs typically shipped with generic distributions
2642 <para>It is recommended to combine the file system namespacing related options with
2643 <varname>SystemCallFilter=~@mount
</varname>, in order to prohibit the unit's processes to undo the
2644 mappings. Specifically these are the options
<varname>PrivateTmp=
</varname>,
2645 <varname>PrivateDevices=
</varname>,
<varname>ProtectSystem=
</varname>,
<varname>ProtectHome=
</varname>,
2646 <varname>ProtectKernelTunables=
</varname>,
<varname>ProtectControlGroups=
</varname>,
2647 <varname>ProtectKernelLogs=
</varname>,
<varname>ProtectClock=
</varname>,
<varname>ReadOnlyPaths=
</varname>,
2648 <varname>InaccessiblePaths=
</varname> and
<varname>ReadWritePaths=
</varname>.
</para>
2650 <xi:include href=
"version-info.xml" xpointer=
"v187"/></listitem>
2654 <term><varname>SystemCallErrorNumber=
</varname></term>
2656 <listitem><para>Takes an
<literal>errno
</literal> error number (between
1 and
4095) or errno name
2657 such as
<constant>EPERM
</constant>,
<constant>EACCES
</constant> or
<constant>EUCLEAN
</constant>, to
2658 return when the system call filter configured with
<varname>SystemCallFilter=
</varname> is triggered,
2659 instead of terminating the process immediately. See
<citerefentry
2660 project='man-pages'
><refentrytitle>errno
</refentrytitle><manvolnum>3</manvolnum></citerefentry> for a
2661 full list of error codes. When this setting is not used, or when the empty string or the special
2662 setting
<literal>kill
</literal> is assigned, the process will be terminated immediately when the
2663 filter is triggered.
</para>
2665 <xi:include href=
"version-info.xml" xpointer=
"v209"/></listitem>
2669 <term><varname>SystemCallArchitectures=
</varname></term>
2671 <listitem><para>Takes a space-separated list of architecture identifiers to include in the system call
2672 filter. The known architecture identifiers are the same as for
<varname>ConditionArchitecture=
</varname>
2673 described in
<citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
2674 as well as
<constant>x32
</constant>,
<constant>mips64-n32
</constant>,
<constant>mips64-le-n32
</constant>, and
2675 the special identifier
<constant>native
</constant>. The special identifier
<constant>native
</constant>
2676 implicitly maps to the native architecture of the system (or more precisely: to the architecture the system
2677 manager is compiled for). If running in user mode, or in system mode, but without the
2678 <constant>CAP_SYS_ADMIN
</constant> capability (e.g. setting
<varname>User=
</varname>),
2679 <varname>NoNewPrivileges=yes
</varname> is implied. By default, this option is set to the empty list, i.e. no
2680 filtering is applied.
</para>
2682 <para>If this setting is used, processes of this unit will only be permitted to call native system calls, and
2683 system calls of the specified architectures. For the purposes of this option, the x32 architecture is treated
2684 as including x86-
64 system calls. However, this setting still fulfills its purpose, as explained below, on
2687 <para>System call filtering is not equally effective on all architectures. For example, on x86
2688 filtering of network socket-related calls is not possible, due to ABI limitations — a limitation that x86-
64
2689 does not have, however. On systems supporting multiple ABIs at the same time — such as x86/x86-
64 — it is hence
2690 recommended to limit the set of permitted system call architectures so that secondary ABIs may not be used to
2691 circumvent the restrictions applied to the native ABI of the system. In particular, setting
2692 <varname>SystemCallArchitectures=native
</varname> is a good choice for disabling non-native ABIs.
</para>
2694 <para>System call architectures may also be restricted system-wide via the
2695 <varname>SystemCallArchitectures=
</varname> option in the global configuration. See
2696 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
2699 <xi:include href=
"version-info.xml" xpointer=
"v209"/></listitem>
2703 <term><varname>SystemCallLog=
</varname></term>
2705 <listitem><para>Takes a space-separated list of system call names. If this setting is used, all
2706 system calls executed by the unit processes for the listed ones will be logged. If the first
2707 character of the list is
<literal>~
</literal>, the effect is inverted: all system calls except the
2708 listed system calls will be logged. If running in user mode, or in system mode, but without the
2709 <constant>CAP_SYS_ADMIN
</constant> capability (e.g. setting
<varname>User=
</varname>),
2710 <varname>NoNewPrivileges=yes
</varname> is implied. This feature makes use of the Secure Computing
2711 Mode
2 interfaces of the kernel ('seccomp filtering') and is useful for auditing or setting up a
2712 minimal sandboxing environment. This option may be specified more than once, in which case the filter
2713 masks are merged. If the empty string is assigned, the filter is reset, all prior assignments will
2714 have no effect. This does not affect commands prefixed with
<literal>+
</literal>.
</para>
2716 <xi:include href=
"version-info.xml" xpointer=
"v247"/></listitem>
2723 <title>Environment
</title>
2725 <variablelist class='unit-directives'
>
2728 <term><varname>Environment=
</varname></term>
2730 <listitem><para>Sets environment variables for executed processes. Each line is unquoted using the
2731 rules described in
"Quoting" section in
2732 <citerefentry><refentrytitle>systemd.syntax
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
2733 and becomes a list of variable assignments. If you need to assign a value containing spaces or the
2734 equals sign to a variable, put quotes around the whole assignment. Variable expansion is not
2735 performed inside the strings and the
<literal>$
</literal> character has no special meaning. Specifier
2736 expansion is performed, see the
"Specifiers" section in
2737 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
2740 <para>This option may be specified more than once, in which case all listed variables will be set. If
2741 the same variable is listed twice, the later setting will override the earlier setting. If the empty
2742 string is assigned to this option, the list of environment variables is reset, all prior assignments
2743 have no effect.
</para>
2745 <para>The names of the variables can contain ASCII letters, digits, and the underscore character.
2746 Variable names cannot be empty or start with a digit. In variable values, most characters are
2747 allowed, but non-printable characters are currently rejected.
</para>
2750 <programlisting>Environment=
"VAR1=word1 word2" VAR2=word3
"VAR3=$word 5 6"</programlisting>
2751 gives three variables
<literal>VAR1
</literal>,
2752 <literal>VAR2
</literal>,
<literal>VAR3
</literal>
2753 with the values
<literal>word1 word2
</literal>,
2754 <literal>word3
</literal>,
<literal>$word
5 6</literal>.
2757 <para>See
<citerefentry
2758 project='man-pages'
><refentrytitle>environ
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
2759 details about environment variables.
</para>
2761 <para>Note that environment variables are not suitable for passing secrets (such as passwords, key
2762 material, …) to service processes. Environment variables set for a unit are exposed to unprivileged
2763 clients via D-Bus IPC, and generally not understood as being data that requires protection. Moreover,
2764 environment variables are propagated down the process tree, including across security boundaries
2765 (such as setuid/setgid executables), and hence might leak to processes that should not have access to
2766 the secret data. Use
<varname>LoadCredential=
</varname>,
<varname>LoadCredentialEncrypted=
</varname>
2767 or
<varname>SetCredentialEncrypted=
</varname> (see below) to pass data to unit processes
2768 securely.
</para></listitem>
2772 <term><varname>EnvironmentFile=
</varname></term>
2774 <listitem><para>Similar to
<varname>Environment=
</varname>, but reads the environment variables from
2775 a text file. The text file should contain newline-separated variable assignments. Empty lines, lines
2776 without an
<literal>=
</literal> separator, or lines starting with
<literal>;
</literal> or
2777 <literal>#
</literal> will be ignored, which may be used for commenting. The file must be UTF-
8
2778 encoded. Valid characters are
<ulink
2779 url=
"https://www.unicode.org/glossary/#unicode_scalar_value">unicode scalar values
</ulink> other than
2780 <ulink url=
"https://www.unicode.org/glossary/#noncharacter">noncharacters
</ulink>, U+
0000 NUL, and
2781 U+FEFF
<ulink url=
"https://www.unicode.org/glossary/#byte_order_mark">byte order mark
</ulink>.
2782 Control codes other than NUL are allowed.
</para>
2784 <para>In the file, an unquoted value after the
<literal>=
</literal> is parsed with the same backslash-escape
2786 url=
"https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_02_01">unquoted
2787 text
</ulink> in a POSIX shell, but unlike in a shell, interior whitespace is preserved and quotes after the
2788 first non-whitespace character are preserved. Leading and trailing whitespace (space, tab, carriage return) is
2789 discarded, but interior whitespace within the line is preserved verbatim. A line ending with a backslash will be
2790 continued to the following one, with the newline itself discarded. A backslash
2791 <literal>\
</literal> followed by any character other than newline will preserve the following character, so that
2792 <literal>\\
</literal> will become the value
<literal>\
</literal>.
</para>
2794 <para>In the file, a
<literal>'
</literal>-quoted value after the
<literal>=
</literal> can span multiple lines
2795 and contain any character verbatim other than single quote, like
<ulink
2796 url=
"https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_02_02">single-quoted
2797 text
</ulink> in a POSIX shell. No backslash-escape sequences are recognized. Leading and trailing whitespace
2798 outside of the single quotes is discarded.
</para>
2800 <para>In the file, a
<literal>"</literal>-quoted value after the <literal>=</literal> can span multiple lines,
2801 and the same escape sequences are recognized as in <ulink
2802 url="https://pubs.opengroup.org/onlinepubs/
9699919799/utilities/V3_chap02.html#tag_18_02_03
">double-quoted
2803 text</ulink> of a POSIX shell. Backslash (<literal>\</literal>) followed by any of <literal>"\`$
</literal> will
2804 preserve that character. A backslash followed by newline is a line continuation, and the newline itself is
2805 discarded. A backslash followed by any other character is ignored; both the backslash and the following
2806 character are preserved verbatim. Leading and trailing whitespace outside of the double quotes is
2809 <para>The argument passed should be an absolute filename or wildcard expression, optionally prefixed with
2810 <literal>-
</literal>, which indicates that if the file does not exist, it will not be read and no error or
2811 warning message is logged. This option may be specified more than once in which case all specified files are
2812 read. If the empty string is assigned to this option, the list of file to read is reset, all prior assignments
2813 have no effect.
</para>
2815 <para>The files listed with this directive will be read shortly before the process is executed (more
2816 specifically, after all processes from a previous unit state terminated. This means you can generate these
2817 files in one unit state, and read it with this option in the next. The files are read from the file
2818 system of the service manager, before any file system changes like bind mounts take place).
</para>
2820 <para>Settings from these files override settings made with
<varname>Environment=
</varname>. If the same
2821 variable is set twice from these files, the files will be read in the order they are specified and the later
2822 setting will override the earlier setting.
</para></listitem>
2826 <term><varname>PassEnvironment=
</varname></term>
2828 <listitem><para>Pass environment variables set for the system service manager to executed processes. Takes a
2829 space-separated list of variable names. This option may be specified more than once, in which case all listed
2830 variables will be passed. If the empty string is assigned to this option, the list of environment variables to
2831 pass is reset, all prior assignments have no effect. Variables specified that are not set for the system
2832 manager will not be passed and will be silently ignored. Note that this option is only relevant for the system
2833 service manager, as system services by default do not automatically inherit any environment variables set for
2834 the service manager itself. However, in case of the user service manager all environment variables are passed
2835 to the executed processes anyway, hence this option is without effect for the user service manager.
</para>
2837 <para>Variables set for invoked processes due to this setting are subject to being overridden by those
2838 configured with
<varname>Environment=
</varname> or
<varname>EnvironmentFile=
</varname>.
</para>
2841 <programlisting>PassEnvironment=VAR1 VAR2 VAR3
</programlisting>
2842 passes three variables
<literal>VAR1
</literal>,
2843 <literal>VAR2
</literal>,
<literal>VAR3
</literal>
2844 with the values set for those variables in PID1.
</para>
2848 project='man-pages'
><refentrytitle>environ
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for details
2849 about environment variables.
</para>
2851 <xi:include href=
"version-info.xml" xpointer=
"v228"/></listitem>
2855 <term><varname>UnsetEnvironment=
</varname></term>
2857 <listitem><para>Explicitly unset environment variable assignments that would normally be passed from the
2858 service manager to invoked processes of this unit. Takes a space-separated list of variable names or variable
2859 assignments. This option may be specified more than once, in which case all listed variables/assignments will
2860 be unset. If the empty string is assigned to this option, the list of environment variables/assignments to
2861 unset is reset. If a variable assignment is specified (that is: a variable name, followed by
2862 <literal>=
</literal>, followed by its value), then any environment variable matching this precise assignment is
2863 removed. If a variable name is specified (that is a variable name without any following
<literal>=
</literal> or
2864 value), then any assignment matching the variable name, regardless of its value is removed. Note that the
2865 effect of
<varname>UnsetEnvironment=
</varname> is applied as final step when the environment list passed to
2866 executed processes is compiled. That means it may undo assignments from any configuration source, including
2867 assignments made through
<varname>Environment=
</varname> or
<varname>EnvironmentFile=
</varname>, inherited from
2868 the system manager's global set of environment variables, inherited via
<varname>PassEnvironment=
</varname>,
2869 set by the service manager itself (such as
<varname>$NOTIFY_SOCKET
</varname> and such), or set by a PAM module
2870 (in case
<varname>PAMName=
</varname> is used).
</para>
2872 <para>See
"Environment Variables in Spawned Processes" below for a description of how those
2873 settings combine to form the inherited environment. See
<citerefentry
2874 project='man-pages'
><refentrytitle>environ
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for general
2875 information about environment variables.
</para>
2877 <xi:include href=
"version-info.xml" xpointer=
"v235"/></listitem>
2884 <title>Logging and Standard Input/Output
</title>
2886 <variablelist class='unit-directives'
>
2889 <term><varname>StandardInput=
</varname></term>
2891 <listitem><para>Controls where file descriptor
0 (STDIN) of the executed processes is connected to. Takes one
2892 of
<option>null
</option>,
<option>tty
</option>,
<option>tty-force
</option>,
<option>tty-fail
</option>,
2893 <option>data
</option>,
<option>file:
<replaceable>path
</replaceable></option>,
<option>socket
</option> or
2894 <option>fd:
<replaceable>name
</replaceable></option>.
</para>
2896 <para>If
<option>null
</option> is selected, standard input will be connected to
<filename>/dev/null
</filename>,
2897 i.e. all read attempts by the process will result in immediate EOF.
</para>
2899 <para>If
<option>tty
</option> is selected, standard input is connected to a TTY (as configured by
2900 <varname>TTYPath=
</varname>, see below) and the executed process becomes the controlling process of the
2901 terminal. If the terminal is already being controlled by another process, the executed process waits until the
2902 current controlling process releases the terminal.
</para>
2904 <para><option>tty-force
</option> is similar to
<option>tty
</option>, but the executed process is forcefully and
2905 immediately made the controlling process of the terminal, potentially removing previous controlling processes
2906 from the terminal.
</para>
2908 <para><option>tty-fail
</option> is similar to
<option>tty
</option>, but if the terminal already has a
2909 controlling process start-up of the executed process fails.
</para>
2911 <para>The
<option>data
</option> option may be used to configure arbitrary textual or binary data to pass via
2912 standard input to the executed process. The data to pass is configured via
2913 <varname>StandardInputText=
</varname>/
<varname>StandardInputData=
</varname> (see below). Note that the actual
2914 file descriptor type passed (memory file, regular file, UNIX pipe, …) might depend on the kernel and available
2915 privileges. In any case, the file descriptor is read-only, and when read returns the specified data followed by
2918 <para>The
<option>file:
<replaceable>path
</replaceable></option> option may be used to connect a specific file
2919 system object to standard input. An absolute path following the
<literal>:
</literal> character is expected,
2920 which may refer to a regular file, a FIFO or special file. If an
<constant>AF_UNIX
</constant> socket in the
2921 file system is specified, a stream socket is connected to it. The latter is useful for connecting standard
2922 input of processes to arbitrary system services.
</para>
2924 <para>The
<option>socket
</option> option is valid in socket-activated services only, and requires the relevant
2925 socket unit file (see
2926 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details)
2927 to have
<varname>Accept=yes
</varname> set, or to specify a single socket only. If this option is set, standard
2928 input will be connected to the socket the service was activated from, which is primarily useful for
2929 compatibility with daemons designed for use with the traditional
<citerefentry
2930 project='freebsd'
><refentrytitle>inetd
</refentrytitle><manvolnum>8</manvolnum></citerefentry> socket activation
2933 <para>The
<option>fd:
<replaceable>name
</replaceable></option> option connects standard input to a specific,
2934 named file descriptor provided by a socket unit. The name may be specified as part of this option, following a
2935 <literal>:
</literal> character (e.g.
<literal>fd:foobar
</literal>). If no name is specified, the name
2936 <literal>stdin
</literal> is implied (i.e.
<literal>fd
</literal> is equivalent to
<literal>fd:stdin
</literal>).
2937 At least one socket unit defining the specified name must be provided via the
<varname>Sockets=
</varname>
2938 option, and the file descriptor name may differ from the name of its containing socket unit. If multiple
2939 matches are found, the first one will be used. See
<varname>FileDescriptorName=
</varname> in
2940 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry> for more
2941 details about named file descriptors and their ordering.
</para>
2943 <para>This setting defaults to
<option>null
</option>, unless
2944 <varname>StandardInputText=
</varname>/
<varname>StandardInputData=
</varname> are set, in which case it
2945 defaults to
<option>data
</option>.
</para></listitem>
2949 <term><varname>StandardOutput=
</varname></term>
2951 <listitem><para>Controls where file descriptor
1 (stdout) of the executed processes is connected
2952 to. Takes one of
<option>inherit
</option>,
<option>null
</option>,
<option>tty
</option>,
2953 <option>journal
</option>,
<option>kmsg
</option>,
<option>journal+console
</option>,
2954 <option>kmsg+console
</option>,
<option>file:
<replaceable>path
</replaceable></option>,
2955 <option>append:
<replaceable>path
</replaceable></option>,
<option>truncate:
<replaceable>path
</replaceable></option>,
2956 <option>socket
</option> or
<option>fd:
<replaceable>name
</replaceable></option>.
</para>
2958 <para><option>inherit
</option> duplicates the file descriptor of standard input for standard output.
</para>
2960 <para><option>null
</option> connects standard output to
<filename>/dev/null
</filename>, i.e. everything written
2961 to it will be lost.
</para>
2963 <para><option>tty
</option> connects standard output to a tty (as configured via
<varname>TTYPath=
</varname>,
2964 see below). If the TTY is used for output only, the executed process will not become the controlling process of
2965 the terminal, and will not fail or wait for other processes to release the terminal.
</para>
2967 <para><option>journal
</option> connects standard output with the journal, which is accessible via
2968 <citerefentry><refentrytitle>journalctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry>. Note
2969 that everything that is written to kmsg (see below) is implicitly stored in the journal as well, the
2970 specific option listed below is hence a superset of this one. (Also note that any external,
2971 additional syslog daemons receive their log data from the journal, too, hence this is the option to
2972 use when logging shall be processed with such a daemon.)
</para>
2974 <para><option>kmsg
</option> connects standard output with the kernel log buffer which is accessible via
2975 <citerefentry project='man-pages'
><refentrytitle>dmesg
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
2976 in addition to the journal. The journal daemon might be configured to send all logs to kmsg anyway, in which
2977 case this option is no different from
<option>journal
</option>.
</para>
2979 <para><option>journal+console
</option> and
<option>kmsg+console
</option> work in a similar way as the
2980 two options above but copy the output to the system console as well.
</para>
2982 <para>The
<option>file:
<replaceable>path
</replaceable></option> option may be used to connect a specific file
2983 system object to standard output. The semantics are similar to the same option of
2984 <varname>StandardInput=
</varname>, see above. If
<replaceable>path
</replaceable> refers to a regular file
2985 on the filesystem, it is opened (created if it doesn't exist yet) for writing at the beginning of the file,
2986 but without truncating it.
2987 If standard input and output are directed to the same file path, it is opened only once — for reading as well
2988 as writing — and duplicated. This is particularly useful when the specified path refers to an
2989 <constant>AF_UNIX
</constant> socket in the file system, as in that case only a
2990 single stream connection is created for both input and output.
</para>
2992 <para><option>append:
<replaceable>path
</replaceable></option> is similar to
2993 <option>file:
<replaceable>path
</replaceable></option> above, but it opens the file in append mode.
2996 <para><option>truncate:
<replaceable>path
</replaceable></option> is similar to
2997 <option>file:
<replaceable>path
</replaceable></option> above, but it truncates the file when opening
2998 it. For units with multiple command lines, e.g.
<varname>Type=oneshot
</varname> services with
2999 multiple
<varname>ExecStart=
</varname>, or services with
<varname>ExecCondition=
</varname>,
3000 <varname>ExecStartPre=
</varname> or
<varname>ExecStartPost=
</varname>, the output file is reopened
3001 and therefore re-truncated for each command line. If the output file is truncated while another
3002 process still has the file open, e.g. by an
<varname>ExecReload=
</varname> running concurrently with
3003 an
<varname>ExecStart=
</varname>, and the other process continues writing to the file without
3004 adjusting its offset, then the space between the file pointers of the two processes may be filled
3005 with
<constant>NUL
</constant> bytes, producing a sparse file. Thus,
3006 <option>truncate:
<replaceable>path
</replaceable></option> is typically only useful for units where
3007 only one process runs at a time, such as services with a single
<varname>ExecStart=
</varname> and no
3008 <varname>ExecStartPost=
</varname>,
<varname>ExecReload=
</varname>,
<varname>ExecStop=
</varname> or
3011 <para><option>socket
</option> connects standard output to a socket acquired via socket activation. The
3012 semantics are similar to the same option of
<varname>StandardInput=
</varname>, see above.
</para>
3014 <para>The
<option>fd:
<replaceable>name
</replaceable></option> option connects standard output to a
3015 specific, named file descriptor provided by a socket unit. A name may be specified as part of this
3016 option, following a
<literal>:
</literal> character
3017 (e.g.
<literal>fd:
<replaceable>foobar
</replaceable></literal>). If no name is specified, the name
3018 <literal>stdout
</literal> is implied (i.e.
<literal>fd
</literal> is equivalent to
3019 <literal>fd:stdout
</literal>). At least one socket unit defining the specified name must be provided
3020 via the
<varname>Sockets=
</varname> option, and the file descriptor name may differ from the name of
3021 its containing socket unit. If multiple matches are found, the first one will be used. See
3022 <varname>FileDescriptorName=
</varname> in
3023 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
3024 for more details about named descriptors and their ordering.
</para>
3026 <para>If the standard output (or error output, see below) of a unit is connected to the journal or
3027 the kernel log buffer, the unit will implicitly gain a dependency of type
<varname>After=
</varname>
3028 on
<filename>systemd-journald.socket
</filename> (also see the
"Implicit Dependencies" section
3029 above). Also note that in this case stdout (or stderr, see below) will be an
3030 <constant>AF_UNIX
</constant> stream socket, and not a pipe or FIFO that can be re-opened. This means
3031 when executing shell scripts the construct
<command>echo
"hello" > /dev/stderr
</command> for
3032 writing text to stderr will not work. To mitigate this use the construct
<command>echo
"hello"
3033 >&2</command> instead, which is mostly equivalent and avoids this pitfall.
</para>
3035 <para>If
<varname>StandardInput=
</varname> is set to one of
<option>tty
</option>,
<option>tty-force
</option>,
3036 <option>tty-fail
</option>,
<option>socket
</option>, or
<option>fd:
<replaceable>name
</replaceable></option>, this
3037 setting defaults to
<option>inherit
</option>.
</para>
3039 <para>In other cases, this setting defaults to the value set with
<varname>DefaultStandardOutput=
</varname> in
3040 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>, which
3041 defaults to
<option>journal
</option>. Note that setting this parameter might result in additional dependencies
3042 to be added to the unit (see above).
</para></listitem>
3046 <term><varname>StandardError=
</varname></term>
3048 <listitem><para>Controls where file descriptor
2 (stderr) of the executed processes is connected to. The
3049 available options are identical to those of
<varname>StandardOutput=
</varname>, with some exceptions: if set to
3050 <option>inherit
</option> the file descriptor used for standard output is duplicated for standard error, while
3051 <option>fd:
<replaceable>name
</replaceable></option> will use a default file descriptor name of
3052 <literal>stderr
</literal>.
</para>
3054 <para>This setting defaults to the value set with
<varname>DefaultStandardError=
</varname> in
3055 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>, which
3056 defaults to
<option>inherit
</option>. Note that setting this parameter might result in additional dependencies
3057 to be added to the unit (see above).
</para></listitem>
3061 <term><varname>StandardInputText=
</varname></term>
3062 <term><varname>StandardInputData=
</varname></term>
3064 <listitem><para>Configures arbitrary textual or binary data to pass via file descriptor
0 (STDIN) to
3065 the executed processes. These settings have no effect unless
<varname>StandardInput=
</varname> is set
3066 to
<option>data
</option> (which is the default if
<varname>StandardInput=
</varname> is not set
3067 otherwise, but
<varname>StandardInputText=
</varname>/
<varname>StandardInputData=
</varname> is). Use
3068 this option to embed process input data directly in the unit file.
</para>
3070 <para><varname>StandardInputText=
</varname> accepts arbitrary textual data. C-style escapes for special
3071 characters as well as the usual
<literal>%
</literal>-specifiers are resolved. Each time this setting is used
3072 the specified text is appended to the per-unit data buffer, followed by a newline character (thus every use
3073 appends a new line to the end of the buffer). Note that leading and trailing whitespace of lines configured
3074 with this option is removed. If an empty line is specified the buffer is cleared (hence, in order to insert an
3075 empty line, add an additional
<literal>\n
</literal> to the end or beginning of a line).
</para>
3077 <para><varname>StandardInputData=
</varname> accepts arbitrary binary data, encoded in
<ulink
3078 url=
"https://tools.ietf.org/html/rfc2045#section-6.8">Base64
</ulink>. No escape sequences or specifiers are
3079 resolved. Any whitespace in the encoded version is ignored during decoding.
</para>
3081 <para>Note that
<varname>StandardInputText=
</varname> and
<varname>StandardInputData=
</varname> operate on the
3082 same data buffer, and may be mixed in order to configure both binary and textual data for the same input
3083 stream. The textual or binary data is joined strictly in the order the settings appear in the unit
3084 file. Assigning an empty string to either will reset the data buffer.
</para>
3086 <para>Please keep in mind that in order to maintain readability long unit file settings may be split into
3087 multiple lines, by suffixing each line (except for the last) with a
<literal>\
</literal> character (see
3088 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
3089 details). This is particularly useful for large data configured with these two options. Example:
</para>
3093 StandardInputData=V2XigLJyZSBubyBzdHJhbmdlcnMgdG8gbG92ZQpZb3Uga25vdyB0aGUgcnVsZXMgYW5kIHNvIGRv \
3094 IEkKQSBmdWxsIGNvbW1pdG1lbnQncyB3aGF0IEnigLJtIHRoaW5raW5nIG9mCllvdSB3b3VsZG4n \
3095 dCBnZXQgdGhpcyBmcm9tIGFueSBvdGhlciBndXkKSSBqdXN0IHdhbm5hIHRlbGwgeW91IGhvdyBJ \
3096 J20gZmVlbGluZwpHb3R0YSBtYWtlIHlvdSB1bmRlcnN0YW5kCgpOZXZlciBnb25uYSBnaXZlIHlv \
3097 dSB1cApOZXZlciBnb25uYSBsZXQgeW91IGRvd24KTmV2ZXIgZ29ubmEgcnVuIGFyb3VuZCBhbmQg \
3098 ZGVzZXJ0IHlvdQpOZXZlciBnb25uYSBtYWtlIHlvdSBjcnkKTmV2ZXIgZ29ubmEgc2F5IGdvb2Ri \
3099 eWUKTmV2ZXIgZ29ubmEgdGVsbCBhIGxpZSBhbmQgaHVydCB5b3UK
3100 …
</programlisting>
3102 <xi:include href=
"version-info.xml" xpointer=
"v236"/></listitem>
3106 <term><varname>LogLevelMax=
</varname></term>
3108 <listitem><para>Configures filtering by log level of log messages generated by this unit. Takes a
3109 <command>syslog
</command> log level, one of
<option>emerg
</option> (lowest log level, only highest priority
3110 messages),
<option>alert
</option>,
<option>crit
</option>,
<option>err
</option>,
<option>warning
</option>,
3111 <option>notice
</option>,
<option>info
</option>,
<option>debug
</option> (highest log level, also lowest priority
3112 messages). See
<citerefentry
3113 project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>3</manvolnum></citerefentry> for
3114 details. By default no filtering is applied (i.e. the default maximum log level is
<option>debug
</option>). Use
3115 this option to configure the logging system to drop log messages of a specific service above the specified
3116 level. For example, set
<varname>LogLevelMax=
</varname><option>info
</option> in order to turn off debug logging
3117 of a particularly chatty unit. Note that the configured level is applied to any log messages written by any
3118 of the processes belonging to this unit, as well as any log messages written by the system manager process
3119 (PID
1) in reference to this unit, sent via any supported logging protocol. The filtering is applied
3120 early in the logging pipeline, before any kind of further processing is done. Moreover, messages which pass
3121 through this filter successfully might still be dropped by filters applied at a later stage in the logging
3122 subsystem. For example,
<varname>MaxLevelStore=
</varname> configured in
3123 <citerefentry><refentrytitle>journald.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry> might
3124 prohibit messages of higher log levels to be stored on disk, even though the per-unit
3125 <varname>LogLevelMax=
</varname> permitted it to be processed.
</para>
3127 <xi:include href=
"version-info.xml" xpointer=
"v236"/></listitem>
3131 <term><varname>LogExtraFields=
</varname></term>
3133 <listitem><para>Configures additional log metadata fields to include in all log records generated by
3134 processes associated with this unit, including systemd. This setting takes one or more journal field
3135 assignments in the format
<literal>FIELD=VALUE
</literal> separated by whitespace. See
3136 <citerefentry><refentrytitle>systemd.journal-fields
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
3137 for details on the journal field concept. Even though the underlying journal implementation permits
3138 binary field values, this setting accepts only valid UTF-
8 values. To include space characters in a
3139 journal field value, enclose the assignment in double quotes (
"). <!-- " fake closing quote for emacs-->
3140 The usual specifiers are expanded in all assignments (see below). Note that this setting is not only
3141 useful for attaching additional metadata to log records of a unit, but given that all fields and
3142 values are indexed may also be used to implement cross-unit log record matching. Assign an empty
3143 string to reset the list.
</para>
3145 <xi:include href=
"version-info.xml" xpointer=
"v236"/></listitem>
3149 <term><varname>LogRateLimitIntervalSec=
</varname></term>
3150 <term><varname>LogRateLimitBurst=
</varname></term>
3152 <listitem><para>Configures the rate limiting that is applied to log messages generated by this unit.
3153 If, in the time interval defined by
<varname>LogRateLimitIntervalSec=
</varname>, more messages than
3154 specified in
<varname>LogRateLimitBurst=
</varname> are logged by a service, all further messages
3155 within the interval are dropped until the interval is over. A message about the number of dropped
3156 messages is generated. The time specification for
<varname>LogRateLimitIntervalSec=
</varname> may be
3157 specified in the following units:
"s",
"min",
"h",
"ms",
"us". See
3158 <citerefentry><refentrytitle>systemd.time
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
3159 details. The default settings are set by
<varname>RateLimitIntervalSec=
</varname> and
3160 <varname>RateLimitBurst=
</varname> configured in
3161 <citerefentry><refentrytitle>journald.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
3162 Note that this only applies to log messages that are processed by the logging subsystem, i.e. by
3163 <citerefentry><refentrytitle>systemd-journald.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry>
3164 This means that if you connect a service's stderr directly to a file via
3165 <varname>StandardOutput=file:…
</varname> or a similar setting, the rate limiting will not be applied
3166 to messages written that way (but it will be enforced for messages generated via
3167 <citerefentry project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
3168 and similar functions).
</para>
3170 <xi:include href=
"version-info.xml" xpointer=
"v240"/></listitem>
3174 <term><varname>LogFilterPatterns=
</varname></term>
3176 <listitem><para>Define an extended regular expression to filter log messages based on the
3177 <varname>MESSAGE=
</varname> field of the structured message. If the first character of the pattern is
3178 <literal>~
</literal>, log entries matching the pattern should be discarded. This option takes a single
3179 pattern as an argument but can be used multiple times to create a list of allowed and denied patterns.
3180 If the empty string is assigned, the filter is reset, and all prior assignments will have no effect.
</para>
3182 <para>Because the
<literal>~
</literal> character is used to define denied patterns, it must be replaced
3183 with
<literal>\x7e
</literal> to allow a message starting with
<literal>~
</literal>. For example,
3184 <literal>~foobar
</literal> would add a pattern matching
<literal>foobar
</literal> to the deny list, while
3185 <literal>\x7efoobar
</literal> would add a pattern matching
<literal>~foobar
</literal> to the allow list.
</para>
3187 <para>Log messages are tested against denied patterns (if any), then against allowed patterns
3188 (if any). If a log message matches any of the denied patterns, it will be discarded, whatever the
3189 allowed patterns. Then, remaining log messages are tested against allowed patterns. Messages matching
3190 against none of the allowed pattern are discarded. If no allowed patterns are defined, then all
3191 messages are processed directly after going through denied filters.
</para>
3193 <para>Filtering is based on the unit for which
<varname>LogFilterPatterns=
</varname> is defined, meaning log
3194 messages coming from
3195 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry> about the
3196 unit are not taken into account. Filtered log messages won't be forwarded to traditional syslog daemons,
3197 the kernel log buffer (kmsg), the systemd console, or sent as wall messages to all logged-in
3200 <xi:include href=
"version-info.xml" xpointer=
"v253"/></listitem>
3204 <term><varname>LogNamespace=
</varname></term>
3206 <listitem><para>Run the unit's processes in the specified journal namespace. Expects a short
3207 user-defined string identifying the namespace. If not used the processes of the service are run in
3208 the default journal namespace, i.e. their log stream is collected and processed by
3209 <filename>systemd-journald.service
</filename>. If this option is used any log data generated by
3210 processes of this unit (regardless if via the
<function>syslog()
</function>, journal native logging
3211 or stdout/stderr logging) is collected and processed by an instance of the
3212 <filename>systemd-journald@.service
</filename> template unit, which manages the specified
3213 namespace. The log data is stored in a data store independent from the default log namespace's data
3215 <citerefentry><refentrytitle>systemd-journald.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry>
3216 for details about journal namespaces.
</para>
3218 <para>Internally, journal namespaces are implemented through Linux mount namespacing and
3219 over-mounting the directory that contains the relevant
<constant>AF_UNIX
</constant> sockets used for
3220 logging in the unit's mount namespace. Since mount namespaces are used this setting disconnects
3221 propagation of mounts from the unit's processes to the host, similarly to how
3222 <varname>ReadOnlyPaths=
</varname> and similar settings describe above work. Journal namespaces may hence
3223 not be used for services that need to establish mount points on the host.
</para>
3225 <para>When this option is used the unit will automatically gain ordering and requirement dependencies
3226 on the two socket units associated with the
<filename>systemd-journald@.service
</filename> instance
3227 so that they are automatically established prior to the unit starting up. Note that when this option
3228 is used log output of this service does not appear in the regular
3229 <citerefentry><refentrytitle>journalctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry>
3230 output, unless the
<option>--namespace=
</option> option is used.
</para>
3232 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
3234 <xi:include href=
"version-info.xml" xpointer=
"v245"/></listitem>
3238 <term><varname>SyslogIdentifier=
</varname></term>
3240 <listitem><para>Sets the process name (
"<command>syslog</command> tag") to prefix log lines sent to
3241 the logging system or the kernel log buffer with. If not set, defaults to the process name of the
3242 executed process. This option is only useful when
<varname>StandardOutput=
</varname> or
3243 <varname>StandardError=
</varname> are set to
<option>journal
</option> or
<option>kmsg
</option> (or to
3244 the same settings in combination with
<option>+console
</option>) and only applies to log messages
3245 written to stdout or stderr.
</para></listitem>
3249 <term><varname>SyslogFacility=
</varname></term>
3251 <listitem><para>Sets the
<command>syslog
</command> facility identifier to use when logging. One of
3252 <option>kern
</option>,
<option>user
</option>,
<option>mail
</option>,
<option>daemon
</option>,
3253 <option>auth
</option>,
<option>syslog
</option>,
<option>lpr
</option>,
<option>news
</option>,
3254 <option>uucp
</option>,
<option>cron
</option>,
<option>authpriv
</option>,
<option>ftp
</option>,
3255 <option>local0
</option>,
<option>local1
</option>,
<option>local2
</option>,
<option>local3
</option>,
3256 <option>local4
</option>,
<option>local5
</option>,
<option>local6
</option> or
3257 <option>local7
</option>. See
<citerefentry
3258 project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>3</manvolnum></citerefentry> for
3259 details. This option is only useful when
<varname>StandardOutput=
</varname> or
3260 <varname>StandardError=
</varname> are set to
<option>journal
</option> or
<option>kmsg
</option> (or to
3261 the same settings in combination with
<option>+console
</option>), and only applies to log messages
3262 written to stdout or stderr. Defaults to
<option>daemon
</option>.
</para></listitem>
3266 <term><varname>SyslogLevel=
</varname></term>
3268 <listitem><para>The default
<command>syslog
</command> log level to use when logging to the logging system or
3269 the kernel log buffer. One of
<option>emerg
</option>,
<option>alert
</option>,
<option>crit
</option>,
3270 <option>err
</option>,
<option>warning
</option>,
<option>notice
</option>,
<option>info
</option>,
3271 <option>debug
</option>. See
<citerefentry
3272 project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>3</manvolnum></citerefentry> for
3273 details. This option is only useful when
<varname>StandardOutput=
</varname> or
3274 <varname>StandardError=
</varname> are set to
<option>journal
</option> or
3275 <option>kmsg
</option> (or to the same settings in combination with
<option>+console
</option>), and only applies
3276 to log messages written to stdout or stderr. Note that individual lines output by executed processes may be
3277 prefixed with a different log level which can be used to override the default log level specified here. The
3278 interpretation of these prefixes may be disabled with
<varname>SyslogLevelPrefix=
</varname>, see below. For
3279 details, see
<citerefentry><refentrytitle>sd-daemon
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
3280 Defaults to
<option>info
</option>.
</para></listitem>
3284 <term><varname>SyslogLevelPrefix=
</varname></term>
3286 <listitem><para>Takes a boolean argument. If true and
<varname>StandardOutput=
</varname> or
3287 <varname>StandardError=
</varname> are set to
<option>journal
</option> or
<option>kmsg
</option> (or to
3288 the same settings in combination with
<option>+console
</option>), log lines written by the executed
3289 process that are prefixed with a log level will be processed with this log level set but the prefix
3290 removed. If set to false, the interpretation of these prefixes is disabled and the logged lines are
3291 passed on as-is. This only applies to log messages written to stdout or stderr. For details about
3293 <citerefentry><refentrytitle>sd-daemon
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
3294 Defaults to true.
</para></listitem>
3298 <term><varname>TTYPath=
</varname></term>
3300 <listitem><para>Sets the terminal device node to use if standard input, output, or error are connected to a TTY
3301 (see above). Defaults to
<filename>/dev/console
</filename>.
</para></listitem>
3305 <term><varname>TTYReset=
</varname></term>
3307 <listitem><para>Reset the terminal device specified with
<varname>TTYPath=
</varname> before and after
3308 execution. Defaults to
<literal>no
</literal>.
</para></listitem>
3312 <term><varname>TTYVHangup=
</varname></term>
3314 <listitem><para>Disconnect all clients which have opened the terminal device specified with
3315 <varname>TTYPath=
</varname> before and after execution. Defaults to
<literal>no
</literal>.
</para></listitem>
3319 <term><varname>TTYRows=
</varname></term>
3320 <term><varname>TTYColumns=
</varname></term>
3322 <listitem><para>Configure the size of the TTY specified with
<varname>TTYPath=
</varname>. If unset or
3323 set to the empty string, the kernel default is used.
</para>
3325 <xi:include href=
"version-info.xml" xpointer=
"v250"/></listitem>
3329 <term><varname>TTYVTDisallocate=
</varname></term>
3331 <listitem><para>If the terminal device specified with
<varname>TTYPath=
</varname> is a virtual console
3332 terminal, try to deallocate the TTY before and after execution. This ensures that the screen and scrollback
3333 buffer is cleared. Defaults to
<literal>no
</literal>.
</para></listitem>
3339 <title>Credentials
</title>
3341 <variablelist class='unit-directives'
>
3344 <term><varname>LoadCredential=
</varname><replaceable>ID
</replaceable><optional>:
<replaceable>PATH
</replaceable></optional></term>
3345 <term><varname>LoadCredentialEncrypted=
</varname><replaceable>ID
</replaceable><optional>:
<replaceable>PATH
</replaceable></optional></term>
3347 <listitem><para>Pass a credential to the unit. Credentials are limited-size binary or textual objects
3348 that may be passed to unit processes. They are primarily used for passing cryptographic keys (both
3349 public and private) or certificates, user account information or identity information from host to
3350 services. The data is accessible from the unit's processes via the file system, at a read-only
3351 location that (if possible and permitted) is backed by non-swappable memory. The data is only
3352 accessible to the user associated with the unit, via the
3353 <varname>User=
</varname>/
<varname>DynamicUser=
</varname> settings (as well as the superuser). When
3354 available, the location of credentials is exported as the
<varname>$CREDENTIALS_DIRECTORY
</varname>
3355 environment variable to the unit's processes.
</para>
3357 <para>The
<varname>LoadCredential=
</varname> setting takes a textual ID to use as name for a
3358 credential plus a file system path, separated by a colon. The ID must be a short ASCII string
3359 suitable as filename in the filesystem, and may be chosen freely by the user. If the specified path
3360 is absolute it is opened as regular file and the credential data is read from it. If the absolute
3361 path refers to an
<constant>AF_UNIX
</constant> stream socket in the file system a connection is made
3362 to it (only once at unit start-up) and the credential data read from the connection, providing an
3363 easy IPC integration point for dynamically transferring credentials from other services.
</para>
3365 <para>If the specified path is not absolute and itself qualifies as valid credential identifier it is
3366 attempted to find a credential that the service manager itself received under the specified name —
3367 which may be used to propagate credentials from an invoking environment (e.g. a container manager
3368 that invoked the service manager) into a service. If no matching system credential is found, the
3369 directories
<filename>/etc/credstore/
</filename>,
<filename>/run/credstore/
</filename> and
3370 <filename>/usr/lib/credstore/
</filename> are searched for files under the credential's name — which
3371 hence are recommended locations for credential data on disk. If
3372 <varname>LoadCredentialEncrypted=
</varname> is used
<filename>/run/credstore.encrypted/
</filename>,
3373 <filename>/etc/credstore.encrypted/
</filename>, and
3374 <filename>/usr/lib/credstore.encrypted/
</filename> are searched as well.
</para>
3376 <para>If the file system path is omitted it is chosen identical to the credential name, i.e. this is
3377 a terse way to declare credentials to inherit from the service manager into a service. This option
3378 may be used multiple times, each time defining an additional credential to pass to the unit.
</para>
3380 <para>If an absolute path referring to a directory is specified, every file in that directory
3381 (recursively) will be loaded as a separate credential. The ID for each credential will be the
3382 provided ID suffixed with
<literal>_$FILENAME
</literal> (e.g.,
<literal>Key_file1
</literal>). When
3383 loading from a directory, symlinks will be ignored.
</para>
3385 <para>The contents of the file/socket may be arbitrary binary or textual data, including newline
3386 characters and
<constant>NUL
</constant> bytes.
</para>
3388 <para>The
<varname>LoadCredentialEncrypted=
</varname> setting is identical to
3389 <varname>LoadCredential=
</varname>, except that the credential data is decrypted and authenticated
3390 before being passed on to the executed processes. Specifically, the referenced path should refer to a
3391 file or socket with an encrypted credential, as implemented by
3392 <citerefentry><refentrytitle>systemd-creds
</refentrytitle><manvolnum>1</manvolnum></citerefentry>. This
3393 credential is loaded, decrypted, authenticated and then passed to the application in plaintext form,
3394 in the same way a regular credential specified via
<varname>LoadCredential=
</varname> would be. A
3395 credential configured this way may be symmetrically encrypted/authenticated with a secret key derived
3396 from the system's TPM2 security chip, or with a secret key stored in
3397 <filename>/var/lib/systemd/credentials.secret
</filename>, or with both. Using encrypted and
3398 authenticated credentials improves security as credentials are not stored in plaintext and only
3399 authenticated and decrypted into plaintext the moment a service requiring them is started. Moreover,
3400 credentials may be bound to the local hardware and installations, so that they cannot easily be
3401 analyzed offline, or be generated externally. When
<varname>DevicePolicy=
</varname> is set to
3402 <literal>closed
</literal> or
<literal>strict
</literal>, or set to
<literal>auto
</literal> and
3403 <varname>DeviceAllow=
</varname> is set, or
<varname>PrivateDevices=
</varname> is set, then this
3404 setting adds
<filename>/dev/tpmrm0
</filename> with
<constant>rw
</constant> mode to
3405 <varname>DeviceAllow=
</varname>. See
3406 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
3407 for the details about
<varname>DevicePolicy=
</varname> or
<varname>DeviceAllow=
</varname>.
</para>
3409 <para>The credential files/IPC sockets must be accessible to the service manager, but don't have to
3410 be directly accessible to the unit's processes: the credential data is read and copied into separate,
3411 read-only copies for the unit that are accessible to appropriately privileged processes. This is
3412 particularly useful in combination with
<varname>DynamicUser=
</varname> as this way privileged data
3413 can be made available to processes running under a dynamic UID (i.e. not a previously known one)
3414 without having to open up access to all users.
</para>
3416 <para>In order to reference the path a credential may be read from within a
3417 <varname>ExecStart=
</varname> command line use
<literal>${CREDENTIALS_DIRECTORY}/mycred
</literal>,
3418 e.g.
<literal>ExecStart=cat ${CREDENTIALS_DIRECTORY}/mycred
</literal>. In order to reference the path
3419 a credential may be read from within a
<varname>Environment=
</varname> line use
3420 <literal>%d/mycred
</literal>, e.g.
<literal>Environment=MYCREDPATH=%d/mycred
</literal>.
</para>
3422 <para>Currently, an accumulated credential size limit of
1 MB per unit is enforced.
</para>
3424 <para>The service manager itself may receive system credentials that can be propagated to services
3425 from a hosting container manager or VM hypervisor. See the
<ulink
3426 url=
"https://systemd.io/CONTAINER_INTERFACE">Container Interface
</ulink> documentation for details
3427 about the former. For the latter, pass
<ulink
3428 url=
"https://www.dmtf.org/standards/smbios">DMI/SMBIOS
</ulink> OEM string table entries (field type
3429 11) with a prefix of
<literal>io.systemd.credential:
</literal> or
3430 <literal>io.systemd.credential.binary:
</literal>. In both cases a key/value pair separated by
3431 <literal>=
</literal> is expected, in the latter case the right-hand side is Base64 decoded when
3432 parsed (thus permitting binary data to be passed in). Example
<ulink
3433 url=
"https://www.qemu.org/docs/master/system/index.html">qemu
</ulink> switch:
<literal>-smbios
3434 type=
11,value=io.systemd.credential:xx=yy
</literal>, or
<literal>-smbios
3435 type=
11,value=io.systemd.credential.binary:rick=TmV2ZXIgR29ubmEgR2l2ZSBZb3UgVXA=
</literal>. Alternatively,
3436 use the
<command>qemu
</command> <literal>fw_cfg
</literal> node
3437 <literal>opt/io.systemd.credentials/
</literal>. Example
<command>qemu
</command> switch:
3438 <literal>-fw_cfg name=opt/io.systemd.credentials/mycred,string=supersecret
</literal>. They may also
3439 be passed from the UEFI firmware environment via
3440 <citerefentry><refentrytitle>systemd-stub
</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
3441 from the initrd (see
3442 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry>), or be
3443 specified on the kernel command line using the
<literal>systemd.set_credential=
</literal> and
3444 <literal>systemd.set_credential_binary=
</literal> switches (see
3445 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry> – this is
3446 not recommended since unprivileged userspace can read the kernel command line).
</para>
3448 <para>If referencing an
<constant>AF_UNIX
</constant> stream socket to connect to, the connection will
3449 originate from an abstract namespace socket, that includes information about the unit and the
3450 credential ID in its socket name. Use
<citerefentry
3451 project='man-pages'
><refentrytitle>getpeername
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
3452 to query this information. The returned socket name is formatted as
<constant>NUL
</constant>
3453 <replaceable>RANDOM
</replaceable> <literal>/unit/
</literal> <replaceable>UNIT
</replaceable>
3454 <literal>/
</literal> <replaceable>ID
</replaceable>, i.e. a
<constant>NUL
</constant> byte (as required
3455 for abstract namespace socket names), followed by a random string (consisting of alphadecimal
3456 characters), followed by the literal string
<literal>/unit/
</literal>, followed by the requesting
3457 unit name, followed by the literal character
<literal>/
</literal>, followed by the textual credential
3458 ID requested. Example:
<literal>\
0adf9d86b6eda275e/unit/foobar.service/credx
</literal> in case the
3459 credential
<literal>credx
</literal> is requested for a unit
<literal>foobar.service
</literal>. This
3460 functionality is useful for using a single listening socket to serve credentials to multiple
3463 <para>For further information see
<ulink url=
"https://systemd.io/CREDENTIALS">System and Service
3464 Credentials
</ulink> documentation.
</para>
3466 <xi:include href=
"version-info.xml" xpointer=
"v247"/></listitem>
3470 <term><varname>ImportCredential=
</varname><replaceable>GLOB
</replaceable></term>
3472 <listitem><para>Pass one or more credentials to the unit. Takes a credential name for which we'll
3473 attempt to find a credential that the service manager itself received under the specified name —
3474 which may be used to propagate credentials from an invoking environment (e.g. a container manager
3475 that invoked the service manager) into a service. If the credential name is a glob, all credentials
3476 matching the glob are passed to the unit. Matching credentials are searched for in the system
3477 credentials, the encrypted system credentials, and under
<filename>/etc/credstore/
</filename>,
3478 <filename>/run/credstore/
</filename>,
<filename>/usr/lib/credstore/
</filename>,
3479 <filename>/run/credstore.encrypted/
</filename>,
<filename>/etc/credstore.encrypted/
</filename>, and
3480 <filename>/usr/lib/credstore.encrypted/
</filename> in that order. When multiple credentials of the
3481 same name are found, the first one found is used.
</para>
3483 <para>The globbing expression implements a restrictive subset of
<citerefentry
3484 project='man-pages'
><refentrytitle>glob
</refentrytitle><manvolnum>7</manvolnum></citerefentry>: only
3485 a single trailing
<literal>*
</literal> wildcard may be specified. Both
<literal>?
</literal> and
3486 <literal>[]
</literal> wildcards are not permitted, nor are
<literal>*
</literal> wildcards anywhere
3487 except at the end of the glob expression.
</para>
3489 <para>When multiple credentials of the same name are found, credentials found by
3490 <varname>LoadCredential=
</varname> and
<varname>LoadCredentialEncrypted=
</varname> take priority over
3491 credentials found by
<varname>ImportCredential=
</varname>.
</para>
3493 <xi:include href=
"version-info.xml" xpointer=
"v254"/></listitem>
3497 <term><varname>SetCredential=
</varname><replaceable>ID
</replaceable>:
<replaceable>VALUE
</replaceable></term>
3498 <term><varname>SetCredentialEncrypted=
</varname><replaceable>ID
</replaceable>:
<replaceable>VALUE
</replaceable></term>
3500 <listitem><para>The
<varname>SetCredential=
</varname> setting is similar to
3501 <varname>LoadCredential=
</varname> but accepts a literal value to use as data for the credential,
3502 instead of a file system path to read the data from. Do not use this option for data that is supposed
3503 to be secret, as it is accessible to unprivileged processes via IPC. It's only safe to use this for
3504 user IDs, public key material and similar non-sensitive data. For everything else use
3505 <varname>LoadCredential=
</varname>. In order to embed binary data into the credential data use
3506 C-style escaping (i.e.
<literal>\n
</literal> to embed a newline, or
<literal>\x00
</literal> to embed
3507 a
<constant>NUL
</constant> byte).
</para>
3509 <para>The
<varname>SetCredentialEncrypted=
</varname> setting is identical to
3510 <varname>SetCredential=
</varname> but expects an encrypted credential in literal form as value. This
3511 allows embedding confidential credentials securely directly in unit files. Use
3512 <citerefentry><refentrytitle>systemd-creds
</refentrytitle><manvolnum>1</manvolnum></citerefentry>'
3513 <option>-p
</option> switch to generate suitable
<varname>SetCredentialEncrypted=
</varname> lines
3514 directly from plaintext credentials. For further details see
3515 <varname>LoadCredentialEncrypted=
</varname> above.
</para>
3517 <para>When multiple credentials of the same name are found, credentials found by
3518 <varname>LoadCredential=
</varname>,
<varname>LoadCredentialEncrypted=
</varname> and
3519 <varname>ImportCredential=
</varname> take priority over credentials found by
3520 <varname>SetCredential=
</varname>. As such,
<varname>SetCredential=
</varname> will act as default if
3521 no credentials are found by any of the former. In this case not being able to retrieve the credential
3522 from the path specified in
<varname>LoadCredential=
</varname> or
3523 <varname>LoadCredentialEncrypted=
</varname> is not considered fatal.
</para>
3525 <xi:include href=
"version-info.xml" xpointer=
"v247"/></listitem>
3531 <title>System V Compatibility
</title>
3532 <variablelist class='unit-directives'
>
3535 <term><varname>UtmpIdentifier=
</varname></term>
3537 <listitem><para>Takes a four character identifier string for an
<citerefentry
3538 project='man-pages'
><refentrytitle>utmp
</refentrytitle><manvolnum>5</manvolnum></citerefentry> and wtmp entry
3539 for this service. This should only be set for services such as
<command>getty
</command> implementations (such
3541 project='die-net'
><refentrytitle>agetty
</refentrytitle><manvolnum>8</manvolnum></citerefentry>) where utmp/wtmp
3542 entries must be created and cleared before and after execution, or for services that shall be executed as if
3543 they were run by a
<command>getty
</command> process (see below). If the configured string is longer than four
3544 characters, it is truncated and the terminal four characters are used. This setting interprets %I style string
3545 replacements. This setting is unset by default, i.e. no utmp/wtmp entries are created or cleaned up for this
3546 service.
</para></listitem>
3550 <term><varname>UtmpMode=
</varname></term>
3552 <listitem><para>Takes one of
<literal>init
</literal>,
<literal>login
</literal> or
<literal>user
</literal>. If
3553 <varname>UtmpIdentifier=
</varname> is set, controls which type of
<citerefentry
3554 project='man-pages'
><refentrytitle>utmp
</refentrytitle><manvolnum>5</manvolnum></citerefentry>/wtmp entries
3555 for this service are generated. This setting has no effect unless
<varname>UtmpIdentifier=
</varname> is set
3556 too. If
<literal>init
</literal> is set, only an
<constant>INIT_PROCESS
</constant> entry is generated and the
3557 invoked process must implement a
<command>getty
</command>-compatible utmp/wtmp logic. If
3558 <literal>login
</literal> is set, first an
<constant>INIT_PROCESS
</constant> entry, followed by a
3559 <constant>LOGIN_PROCESS
</constant> entry is generated. In this case, the invoked process must implement a
3561 project='die-net'
><refentrytitle>login
</refentrytitle><manvolnum>1</manvolnum></citerefentry>-compatible
3562 utmp/wtmp logic. If
<literal>user
</literal> is set, first an
<constant>INIT_PROCESS
</constant> entry, then a
3563 <constant>LOGIN_PROCESS
</constant> entry and finally a
<constant>USER_PROCESS
</constant> entry is
3564 generated. In this case, the invoked process may be any process that is suitable to be run as session
3565 leader. Defaults to
<literal>init
</literal>.
</para>
3567 <xi:include href=
"version-info.xml" xpointer=
"v225"/></listitem>
3574 <title>Environment Variables in Spawned Processes
</title>
3576 <para>Processes started by the service manager are executed with an environment variable block assembled from
3577 multiple sources. Processes started by the system service manager generally do not inherit environment variables
3578 set for the service manager itself (but this may be altered via
<varname>PassEnvironment=
</varname>), but processes
3579 started by the user service manager instances generally do inherit all environment variables set for the service
3580 manager itself.
</para>
3582 <para>For each invoked process the list of environment variables set is compiled from the following sources:
</para>
3585 <listitem><para>Variables globally configured for the service manager, using the
3586 <varname>DefaultEnvironment=
</varname> setting in
3587 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
3588 the kernel command line option
<varname>systemd.setenv=
</varname> understood by
3589 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry>, or via
3590 <citerefentry><refentrytitle>systemctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry>
3591 <command>set-environment
</command> verb.
</para></listitem>
3593 <listitem><para>Variables defined by the service manager itself (see the list below).
</para></listitem>
3595 <listitem><para>Variables set in the service manager's own environment variable block (subject to
3596 <varname>PassEnvironment=
</varname> for the system service manager).
</para></listitem>
3598 <listitem><para>Variables set via
<varname>Environment=
</varname> in the unit file.
</para></listitem>
3600 <listitem><para>Variables read from files specified via
<varname>EnvironmentFile=
</varname> in the unit
3601 file.
</para></listitem>
3603 <listitem><para>Variables set by any PAM modules in case
<varname>PAMName=
</varname> is in effect,
3605 project='man-pages'
><refentrytitle>pam_env
</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
3609 <para>If the same environment variable is set by multiple of these sources, the later source — according
3610 to the order of the list above — wins. Note that as the final step all variables listed in
3611 <varname>UnsetEnvironment=
</varname> are removed from the compiled environment variable list, immediately
3612 before it is passed to the executed process.
</para>
3614 <para>The general philosophy is to expose a small curated list of environment variables to processes.
3615 Services started by the system manager (PID
1) will be started, without additional service-specific
3616 configuration, with just a few environment variables. The user manager inherits environment variables as
3617 any other system service, but in addition may receive additional environment variables from PAM, and,
3618 typically, additional imported variables when the user starts a graphical session. It is recommended to
3619 keep the environment blocks in both the system and user managers lean. Importing all variables
3620 inherited by the graphical session or by one of the user shells is strongly discouraged.
</para>
3622 <para>Hint:
<command>systemd-run -P env
</command> and
<command>systemd-run --user -P env
</command> print
3623 the effective system and user service environment blocks.
</para>
3626 <title>Environment Variables Set or Propagated by the Service Manager
</title>
3628 <para>The following environment variables are propagated by the service manager or generated internally
3629 for each invoked process:
</para>
3631 <variablelist class='environment-variables'
>
3633 <term><varname>$PATH
</varname></term>
3635 <listitem><para>Colon-separated list of directories to use when launching
3636 executables.
<command>systemd
</command> uses a fixed value of
3637 <literal><filename>/usr/local/sbin
</filename>:
<filename>/usr/local/bin
</filename>:
<filename>/usr/sbin
</filename>:
<filename>/usr/bin
</filename></literal>
3638 in the system manager. In case of the user manager, a different path may be configured by the
3639 distribution. It is recommended to not rely on the order of entries, and have only one program
3640 with a given name in
<varname>$PATH
</varname>.
</para>
3642 <xi:include href=
"version-info.xml" xpointer=
"v208"/></listitem>
3646 <term><varname>$LANG
</varname></term>
3648 <listitem><para>Locale. Can be set in
<citerefentry
3649 project='man-pages'
><refentrytitle>locale.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
3650 or on the kernel command line (see
3651 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry> and
3652 <citerefentry><refentrytitle>kernel-command-line
</refentrytitle><manvolnum>7</manvolnum></citerefentry>).
3655 <xi:include href=
"version-info.xml" xpointer=
"v208"/></listitem>
3659 <term><varname>$USER
</varname></term>
3660 <term><varname>$LOGNAME
</varname></term>
3661 <term><varname>$HOME
</varname></term>
3662 <term><varname>$SHELL
</varname></term>
3664 <listitem><para>User name (twice), home directory, and the
3665 login shell. The variables are set for the units that have
3666 <varname>User=
</varname> set, which includes user
3667 <command>systemd
</command> instances. See
3668 <citerefentry project='die-net'
><refentrytitle>passwd
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
3671 <xi:include href=
"version-info.xml" xpointer=
"v208"/></listitem>
3675 <term><varname>$INVOCATION_ID
</varname></term>
3677 <listitem><para>Contains a randomized, unique
128-bit ID identifying each runtime cycle of the unit, formatted
3678 as
32 character hexadecimal string. A new ID is assigned each time the unit changes from an inactive state into
3679 an activating or active state, and may be used to identify this specific runtime cycle, in particular in data
3680 stored offline, such as the journal. The same ID is passed to all processes run as part of the
3683 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
3687 <term><varname>$XDG_RUNTIME_DIR
</varname></term>
3689 <listitem><para>The directory to use for runtime objects (such as IPC objects) and volatile state. Set for all
3690 services run by the user
<command>systemd
</command> instance, as well as any system services that use
3691 <varname>PAMName=
</varname> with a PAM stack that includes
<command>pam_systemd
</command>. See below and
3692 <citerefentry><refentrytitle>pam_systemd
</refentrytitle><manvolnum>8</manvolnum></citerefentry> for more
3695 <xi:include href=
"version-info.xml" xpointer=
"v208"/></listitem>
3699 <term><varname>$RUNTIME_DIRECTORY
</varname></term>
3700 <term><varname>$STATE_DIRECTORY
</varname></term>
3701 <term><varname>$CACHE_DIRECTORY
</varname></term>
3702 <term><varname>$LOGS_DIRECTORY
</varname></term>
3703 <term><varname>$CONFIGURATION_DIRECTORY
</varname></term>
3705 <listitem><para>Absolute paths to the directories defined with
3706 <varname>RuntimeDirectory=
</varname>,
<varname>StateDirectory=
</varname>,
3707 <varname>CacheDirectory=
</varname>,
<varname>LogsDirectory=
</varname>, and
3708 <varname>ConfigurationDirectory=
</varname> when those settings are used.
</para>
3710 <xi:include href=
"version-info.xml" xpointer=
"v244"/>
3715 <term><varname>$CREDENTIALS_DIRECTORY
</varname></term>
3717 <listitem><para>An absolute path to the per-unit directory with credentials configured via
3718 <varname>ImportCredential=
</varname>/
<varname>LoadCredential=
</varname>/
<varname>SetCredential=
</varname>.
3719 The directory is marked read-only and is placed in unswappable memory (if supported and permitted),
3720 and is only accessible to the UID associated with the unit via
<varname>User=
</varname> or
3721 <varname>DynamicUser=
</varname> (and the superuser).
</para>
3723 <xi:include href=
"version-info.xml" xpointer=
"v247"/></listitem>
3727 <term><varname>$MAINPID
</varname></term>
3729 <listitem><para>The PID of the unit's main process if it is
3730 known. This is only set for control processes as invoked by
3731 <varname>ExecReload=
</varname> and similar.
</para>
3733 <xi:include href=
"version-info.xml" xpointer=
"v209"/></listitem>
3737 <term><varname>$MANAGERPID
</varname></term>
3739 <listitem><para>The PID of the user
<command>systemd
</command>
3740 instance, set for processes spawned by it.
</para>
3742 <xi:include href=
"version-info.xml" xpointer=
"v208"/></listitem>
3746 <term><varname>$LISTEN_FDS
</varname></term>
3747 <term><varname>$LISTEN_PID
</varname></term>
3748 <term><varname>$LISTEN_FDNAMES
</varname></term>
3750 <listitem><para>Information about file descriptors passed to a
3751 service for socket activation. See
3752 <citerefentry><refentrytitle>sd_listen_fds
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
3755 <xi:include href=
"version-info.xml" xpointer=
"v208"/></listitem>
3759 <term><varname>$NOTIFY_SOCKET
</varname></term>
3761 <listitem><para>The socket
<function>sd_notify()
</function> talks to. See
3762 <citerefentry><refentrytitle>sd_notify
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
3765 <xi:include href=
"version-info.xml" xpointer=
"v229"/></listitem>
3769 <term><varname>$WATCHDOG_PID
</varname></term>
3770 <term><varname>$WATCHDOG_USEC
</varname></term>
3772 <listitem><para>Information about watchdog keep-alive notifications. See
3773 <citerefentry><refentrytitle>sd_watchdog_enabled
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
3776 <xi:include href=
"version-info.xml" xpointer=
"v229"/></listitem>
3780 <term><varname>$SYSTEMD_EXEC_PID
</varname></term>
3782 <listitem><para>The PID of the unit process (e.g. process invoked by
3783 <varname>ExecStart=
</varname>). The child process can use this information to determine
3784 whether the process is directly invoked by the service manager or indirectly as a child of
3785 another process by comparing this value with the current PID (similarly to the scheme used in
3786 <citerefentry><refentrytitle>sd_listen_fds
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
3787 with
<varname>$LISTEN_PID
</varname> and
<varname>$LISTEN_FDS
</varname>).
</para>
3789 <xi:include href=
"version-info.xml" xpointer=
"v248"/></listitem>
3793 <term><varname>$TERM
</varname></term>
3795 <listitem><para>Terminal type, set only for units connected to
3796 a terminal (
<varname>StandardInput=tty
</varname>,
3797 <varname>StandardOutput=tty
</varname>, or
3798 <varname>StandardError=tty
</varname>). See
3799 <citerefentry project='man-pages'
><refentrytitle>termcap
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
3802 <xi:include href=
"version-info.xml" xpointer=
"v209"/></listitem>
3806 <term><varname>$LOG_NAMESPACE
</varname></term>
3808 <listitem><para>Contains the name of the selected logging namespace when the
3809 <varname>LogNamespace=
</varname> service setting is used.
</para>
3811 <xi:include href=
"version-info.xml" xpointer=
"v246"/></listitem>
3815 <term><varname>$JOURNAL_STREAM
</varname></term>
3817 <listitem><para>If the standard output or standard error output of the executed processes are connected to the
3818 journal (for example, by setting
<varname>StandardError=journal
</varname>)
<varname>$JOURNAL_STREAM
</varname>
3819 contains the device and inode numbers of the connection file descriptor, formatted in decimal, separated by a
3820 colon (
<literal>:
</literal>). This permits invoked processes to safely detect whether their standard output or
3821 standard error output are connected to the journal. The device and inode numbers of the file descriptors should
3822 be compared with the values set in the environment variable to determine whether the process output is still
3823 connected to the journal. Note that it is generally not sufficient to only check whether
3824 <varname>$JOURNAL_STREAM
</varname> is set at all as services might invoke external processes replacing their
3825 standard output or standard error output, without unsetting the environment variable.
</para>
3827 <para>If both standard output and standard error of the executed processes are connected to the journal via a
3828 stream socket, this environment variable will contain information about the standard error stream, as that's
3829 usually the preferred destination for log data. (Note that typically the same stream is used for both standard
3830 output and standard error, hence very likely the environment variable contains device and inode information
3831 matching both stream file descriptors.)
</para>
3833 <para>This environment variable is primarily useful to allow services to optionally upgrade their used log
3834 protocol to the native journal protocol (using
3835 <citerefentry><refentrytitle>sd_journal_print
</refentrytitle><manvolnum>3</manvolnum></citerefentry> and other
3836 functions) if their standard output or standard error output is connected to the journal anyway, thus enabling
3837 delivery of structured metadata along with logged messages.
</para>
3839 <xi:include href=
"version-info.xml" xpointer=
"v231"/></listitem>
3843 <term><varname>$SERVICE_RESULT
</varname></term>
3845 <listitem><para>Only used for the service unit type. This environment variable is passed to all
3846 <varname>ExecStop=
</varname> and
<varname>ExecStopPost=
</varname> processes, and encodes the service
3847 "result". Currently, the following values are defined:
</para>
3850 <title>Defined
<varname>$SERVICE_RESULT
</varname> values
</title>
3852 <colspec colname='result'
/>
3853 <colspec colname='meaning'
/>
3856 <entry>Value
</entry>
3857 <entry>Meaning
</entry>
3863 <entry><literal>success
</literal></entry>
3864 <entry>The service ran successfully and exited cleanly.
</entry>
3867 <entry><literal>protocol
</literal></entry>
3868 <entry>A protocol violation occurred: the service did not take the steps required by its unit configuration (specifically what is configured in its
<varname>Type=
</varname> setting).
</entry>
3871 <entry><literal>timeout
</literal></entry>
3872 <entry>One of the steps timed out.
</entry>
3875 <entry><literal>exit-code
</literal></entry>
3876 <entry>Service process exited with a non-zero exit code; see
<varname>$EXIT_CODE
</varname> below for the actual exit code returned.
</entry>
3879 <entry><literal>signal
</literal></entry>
3880 <entry>A service process was terminated abnormally by a signal, without dumping core. See
<varname>$EXIT_CODE
</varname> below for the actual signal causing the termination.
</entry>
3883 <entry><literal>core-dump
</literal></entry>
3884 <entry>A service process terminated abnormally with a signal and dumped core. See
<varname>$EXIT_CODE
</varname> below for the signal causing the termination.
</entry>
3887 <entry><literal>watchdog
</literal></entry>
3888 <entry>Watchdog keep-alive ping was enabled for the service, but the deadline was missed.
</entry>
3891 <entry><literal>start-limit-hit
</literal></entry>
3892 <entry>A start limit was defined for the unit and it was hit, causing the unit to fail to start. See
<citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>'s
<varname>StartLimitIntervalSec=
</varname> and
<varname>StartLimitBurst=
</varname> for details.
</entry>
3895 <entry><literal>resources
</literal></entry>
3896 <entry>A catch-all condition in case a system operation failed.
</entry>
3902 <para>This environment variable is useful to monitor failure or successful termination of a service. Even
3903 though this variable is available in both
<varname>ExecStop=
</varname> and
<varname>ExecStopPost=
</varname>, it
3904 is usually a better choice to place monitoring tools in the latter, as the former is only invoked for services
3905 that managed to start up correctly, and the latter covers both services that failed during their start-up and
3906 those which failed during their runtime.
</para>
3908 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
3912 <term><varname>$EXIT_CODE
</varname></term>
3913 <term><varname>$EXIT_STATUS
</varname></term>
3915 <listitem><para>Only defined for the service unit type. These environment variables are passed to all
3916 <varname>ExecStop=
</varname>,
<varname>ExecStopPost=
</varname> processes and contain exit status/code
3917 information of the main process of the service. For the precise definition of the exit code and status, see
3918 <citerefentry><refentrytitle>wait
</refentrytitle><manvolnum>2</manvolnum></citerefentry>.
<varname>$EXIT_CODE
</varname>
3919 is one of
<literal>exited
</literal>,
<literal>killed
</literal>,
3920 <literal>dumped
</literal>.
<varname>$EXIT_STATUS
</varname> contains the numeric exit code formatted as string
3921 if
<varname>$EXIT_CODE
</varname> is
<literal>exited
</literal>, and the signal name in all other cases. Note
3922 that these environment variables are only set if the service manager succeeded to start and identify the main
3923 process of the service.
</para>
3926 <title>Summary of possible service result variable values
</title>
3928 <colspec colname='result'
/>
3929 <colspec colname='code'
/>
3930 <colspec colname='status'
/>
3933 <entry><varname>$SERVICE_RESULT
</varname></entry>
3934 <entry><varname>$EXIT_CODE
</varname></entry>
3935 <entry><varname>$EXIT_STATUS
</varname></entry>
3941 <entry morerows=
"1" valign=
"top"><literal>success
</literal></entry>
3942 <entry valign=
"top"><literal>killed
</literal></entry>
3943 <entry><literal>HUP
</literal>,
<literal>INT
</literal>,
<literal>TERM
</literal>,
<literal>PIPE
</literal></entry>
3946 <entry valign=
"top"><literal>exited
</literal></entry>
3947 <entry><literal>0</literal></entry>
3950 <entry morerows=
"1" valign=
"top"><literal>protocol
</literal></entry>
3951 <entry valign=
"top">not set
</entry>
3952 <entry>not set
</entry>
3955 <entry><literal>exited
</literal></entry>
3956 <entry><literal>0</literal></entry>
3959 <entry morerows=
"1" valign=
"top"><literal>timeout
</literal></entry>
3960 <entry valign=
"top"><literal>killed
</literal></entry>
3961 <entry><literal>TERM
</literal>,
<literal>KILL
</literal></entry>
3964 <entry valign=
"top"><literal>exited
</literal></entry>
3965 <entry><literal>0</literal>,
<literal>1</literal>,
<literal>2</literal>,
<literal
3966 >3</literal>, …,
<literal>255</literal></entry>
3969 <entry valign=
"top"><literal>exit-code
</literal></entry>
3970 <entry valign=
"top"><literal>exited
</literal></entry>
3971 <entry><literal>1</literal>,
<literal>2</literal>,
<literal
3972 >3</literal>, …,
<literal>255</literal></entry>
3975 <entry valign=
"top"><literal>signal
</literal></entry>
3976 <entry valign=
"top"><literal>killed
</literal></entry>
3977 <entry><literal>HUP
</literal>,
<literal>INT
</literal>,
<literal>KILL
</literal>, …
</entry>
3980 <entry valign=
"top"><literal>core-dump
</literal></entry>
3981 <entry valign=
"top"><literal>dumped
</literal></entry>
3982 <entry><literal>ABRT
</literal>,
<literal>SEGV
</literal>,
<literal>QUIT
</literal>, …
</entry>
3985 <entry morerows=
"2" valign=
"top"><literal>watchdog
</literal></entry>
3986 <entry><literal>dumped
</literal></entry>
3987 <entry><literal>ABRT
</literal></entry>
3990 <entry><literal>killed
</literal></entry>
3991 <entry><literal>TERM
</literal>,
<literal>KILL
</literal></entry>
3994 <entry><literal>exited
</literal></entry>
3995 <entry><literal>0</literal>,
<literal>1</literal>,
<literal>2</literal>,
<literal
3996 >3</literal>, …,
<literal>255</literal></entry>
3999 <entry valign=
"top"><literal>exec-condition
</literal></entry>
4000 <entry><literal>exited
</literal></entry>
4001 <entry><literal>1</literal>,
<literal>2</literal>,
<literal>3</literal>,
<literal
4002 >4</literal>, …,
<literal>254</literal></entry>
4005 <entry valign=
"top"><literal>oom-kill
</literal></entry>
4006 <entry valign=
"top"><literal>killed
</literal></entry>
4007 <entry><literal>TERM
</literal>,
<literal>KILL
</literal></entry>
4010 <entry><literal>start-limit-hit
</literal></entry>
4011 <entry>not set
</entry>
4012 <entry>not set
</entry>
4015 <entry><literal>resources
</literal></entry>
4016 <entry>any of the above
</entry>
4017 <entry>any of the above
</entry>
4020 <entry namest=
"results" nameend=
"status">Note: the process may be also terminated by a signal not sent by systemd. In particular the process may send an arbitrary signal to itself in a handler for any of the non-maskable signals. Nevertheless, in the
<literal>timeout
</literal> and
<literal>watchdog
</literal> rows above only the signals that systemd sends have been included. Moreover, using
<varname>SuccessExitStatus=
</varname> additional exit statuses may be declared to indicate clean termination, which is not reflected by this table.
</entry>
4026 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
4030 <term><varname>$MONITOR_SERVICE_RESULT
</varname></term>
4031 <term><varname>$MONITOR_EXIT_CODE
</varname></term>
4032 <term><varname>$MONITOR_EXIT_STATUS
</varname></term>
4033 <term><varname>$MONITOR_INVOCATION_ID
</varname></term>
4034 <term><varname>$MONITOR_UNIT
</varname></term>
4036 <listitem><para>Only defined for the service unit type. Those environment variables are passed to
4037 all
<varname>ExecStart=
</varname> and
<varname>ExecStartPre=
</varname> processes which run in
4038 services triggered by
<varname>OnFailure=
</varname> or
<varname>OnSuccess=
</varname> dependencies.
4041 <para>Variables
<varname>$MONITOR_SERVICE_RESULT
</varname>,
<varname>$MONITOR_EXIT_CODE
</varname>
4042 and
<varname>$MONITOR_EXIT_STATUS
</varname> take the same values as for
4043 <varname>ExecStop=
</varname> and
<varname>ExecStopPost=
</varname> processes. Variables
4044 <varname>$MONITOR_INVOCATION_ID
</varname> and
<varname>$MONITOR_UNIT
</varname> are set to the
4045 invocation id and unit name of the service which triggered the dependency.
</para>
4047 <para>Note that when multiple services trigger the same unit, those variables will be
4048 <emphasis>not
</emphasis> be passed. Consider using a template handler unit for that case instead:
4049 <literal>OnFailure=
<replaceable>handler
</replaceable>@%n.service
</literal> for non-templated units,
4050 or
<literal>OnFailure=
<replaceable>handler
</replaceable>@%p-%i.service
</literal> for templated
4053 <xi:include href=
"version-info.xml" xpointer=
"v251"/></listitem>
4057 <term><varname>$PIDFILE
</varname></term>
4059 <listitem><para>The path to the configured PID file, in case the process is forked off on behalf of
4060 a service that uses the
<varname>PIDFile=
</varname> setting, see
4061 <citerefentry><refentrytitle>systemd.service
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
4062 for details. Service code may use this environment variable to automatically generate a PID file at
4063 the location configured in the unit file. This field is set to an absolute path in the file
4066 <xi:include href=
"version-info.xml" xpointer=
"v242"/></listitem>
4070 <term><varname>$REMOTE_ADDR
</varname></term>
4071 <term><varname>$REMOTE_PORT
</varname></term>
4073 <listitem><para>If this is a unit started via per-connection socket activation (i.e. via a socket
4074 unit with
<varname>Accept=yes
</varname>), these environment variables contain the IP address and
4075 port number of the remote peer of the socket connection.
</para>
4077 <xi:include href=
"version-info.xml" xpointer=
"v254"/></listitem>
4081 <term><varname>$TRIGGER_UNIT
</varname></term>
4082 <term><varname>$TRIGGER_PATH
</varname></term>
4083 <term><varname>$TRIGGER_TIMER_REALTIME_USEC
</varname></term>
4084 <term><varname>$TRIGGER_TIMER_MONOTONIC_USEC
</varname></term>
4086 <listitem><para>If the unit was activated dynamically (e.g.: a corresponding path unit or timer unit), the
4087 unit that triggered it and other type-dependent information will be passed via these variables. Note that
4088 this information is provided in a best-effort way. For example, multiple triggers happening one after
4089 another will be coalesced and only one will be reported, with no guarantee as to which one it will be.
4090 Because of this, in most cases this variable will be primarily informational, i.e. useful for debugging
4091 purposes, is lossy, and should not be relied upon to propagate a comprehensive reason for activation.
4094 <xi:include href=
"version-info.xml" xpointer=
"v252"/></listitem>
4098 <term><varname>$MEMORY_PRESSURE_WATCH
</varname></term>
4099 <term><varname>$MEMORY_PRESSURE_WRITE
</varname></term>
4101 <listitem><para>If memory pressure monitoring is enabled for this service unit, the path to watch
4102 and the data to write into it. See
<ulink url=
"https://systemd.io/MEMORY_PRESSURE">Memory Pressure
4103 Handling
</ulink> for details about these variables and the service protocol data they
4106 <xi:include href=
"version-info.xml" xpointer=
"v254"/></listitem>
4110 <term><varname>$FDSTORE
</varname></term>
4112 <listitem><para>The maximum number of file descriptors that may be stored in the manager for the
4113 service. This variable is set when the file descriptor store is enabled for the service, i.e.
4114 <varname>FileDescriptorStoreMax=
</varname> is set to a non-zero value (see
4115 <citerefentry><refentrytitle>systemd.service
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
4116 for details). Applications may check this environment variable before sending file descriptors to
4117 the service manager via
<function>sd_pid_notify_with_fds()
</function> (see
4118 <citerefentry><refentrytitle>sd_notify
</refentrytitle><manvolnum>3</manvolnum></citerefentry> for
4121 <xi:include href=
"version-info.xml" xpointer=
"v254"/></listitem>
4126 <para>For system services, when
<varname>PAMName=
</varname> is enabled and
<command>pam_systemd
</command> is part
4127 of the selected PAM stack, additional environment variables defined by systemd may be set for
4128 services. Specifically, these are
<varname>$XDG_SEAT
</varname>,
<varname>$XDG_VTNR
</varname>, see
4129 <citerefentry><refentrytitle>pam_systemd
</refentrytitle><manvolnum>8</manvolnum></citerefentry> for details.
</para>
4135 <title>Process Exit Codes
</title>
4137 <para>When invoking a unit process the service manager possibly fails to apply the execution parameters configured
4138 with the settings above. In that case the already created service process will exit with a non-zero exit code
4139 before the configured command line is executed. (Or in other words, the child process possibly exits with these
4140 error codes, after having been created by the
<citerefentry
4141 project='man-pages'
><refentrytitle>fork
</refentrytitle><manvolnum>2</manvolnum></citerefentry> system call, but
4142 before the matching
<citerefentry
4143 project='man-pages'
><refentrytitle>execve
</refentrytitle><manvolnum>2</manvolnum></citerefentry> system call is
4144 called.) Specifically, exit codes defined by the C library, by the LSB specification and by the systemd service
4145 manager itself are used.
</para>
4147 <para>The following basic service exit codes are defined by the C library.
</para>
4150 <title>Basic C library exit codes
</title>
4154 <entry>Exit Code
</entry>
4155 <entry>Symbolic Name
</entry>
4156 <entry>Description
</entry>
4162 <entry><constant>EXIT_SUCCESS
</constant></entry>
4163 <entry>Generic success code.
</entry>
4167 <entry><constant>EXIT_FAILURE
</constant></entry>
4168 <entry>Generic failure or unspecified error.
</entry>
4174 <para>The following service exit codes are defined by the
<ulink
4175 url=
"https://refspecs.linuxbase.org/LSB_5.0.0/LSB-Core-generic/LSB-Core-generic/iniscrptact.html">LSB specification
</ulink>.
4179 <title>LSB service exit codes
</title>
4183 <entry>Exit Code
</entry>
4184 <entry>Symbolic Name
</entry>
4185 <entry>Description
</entry>
4191 <entry><constant>EXIT_INVALIDARGUMENT
</constant></entry>
4192 <entry>Invalid or excess arguments.
</entry>
4196 <entry><constant>EXIT_NOTIMPLEMENTED
</constant></entry>
4197 <entry>Unimplemented feature.
</entry>
4201 <entry><constant>EXIT_NOPERMISSION
</constant></entry>
4202 <entry>The user has insufficient privileges.
</entry>
4206 <entry><constant>EXIT_NOTINSTALLED
</constant></entry>
4207 <entry>The program is not installed.
</entry>
4211 <entry><constant>EXIT_NOTCONFIGURED
</constant></entry>
4212 <entry>The program is not configured.
</entry>
4216 <entry><constant>EXIT_NOTRUNNING
</constant></entry>
4217 <entry>The program is not running.
</entry>
4224 The LSB specification suggests that error codes
200 and above are reserved for implementations. Some of them are
4225 used by the service manager to indicate problems during process invocation:
4228 <title>systemd-specific exit codes
</title>
4232 <entry>Exit Code
</entry>
4233 <entry>Symbolic Name
</entry>
4234 <entry>Description
</entry>
4240 <entry><constant>EXIT_CHDIR
</constant></entry>
4241 <entry>Changing to the requested working directory failed. See
<varname>WorkingDirectory=
</varname> above.
</entry>
4245 <entry><constant>EXIT_NICE
</constant></entry>
4246 <entry>Failed to set up process scheduling priority (nice level). See
<varname>Nice=
</varname> above.
</entry>
4250 <entry><constant>EXIT_FDS
</constant></entry>
4251 <entry>Failed to close unwanted file descriptors, or to adjust passed file descriptors.
</entry>
4255 <entry><constant>EXIT_EXEC
</constant></entry>
4256 <entry>The actual process execution failed (specifically, the
<citerefentry project='man-pages'
><refentrytitle>execve
</refentrytitle><manvolnum>2</manvolnum></citerefentry> system call). Most likely this is caused by a missing or non-accessible executable file.
</entry>
4260 <entry><constant>EXIT_MEMORY
</constant></entry>
4261 <entry>Failed to perform an action due to memory shortage.
</entry>
4265 <entry><constant>EXIT_LIMITS
</constant></entry>
4266 <entry>Failed to adjust resource limits. See
<varname>LimitCPU=
</varname> and related settings above.
</entry>
4270 <entry><constant>EXIT_OOM_ADJUST
</constant></entry>
4271 <entry>Failed to adjust the OOM setting. See
<varname>OOMScoreAdjust=
</varname> above.
</entry>
4275 <entry><constant>EXIT_SIGNAL_MASK
</constant></entry>
4276 <entry>Failed to set process signal mask.
</entry>
4280 <entry><constant>EXIT_STDIN
</constant></entry>
4281 <entry>Failed to set up standard input. See
<varname>StandardInput=
</varname> above.
</entry>
4285 <entry><constant>EXIT_STDOUT
</constant></entry>
4286 <entry>Failed to set up standard output. See
<varname>StandardOutput=
</varname> above.
</entry>
4290 <entry><constant>EXIT_CHROOT
</constant></entry>
4291 <entry>Failed to change root directory (
<citerefentry project='man-pages'
><refentrytitle>chroot
</refentrytitle><manvolnum>2</manvolnum></citerefentry>). See
<varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname> above.
</entry>
4295 <entry><constant>EXIT_IOPRIO
</constant></entry>
4296 <entry>Failed to set up IO scheduling priority. See
<varname>IOSchedulingClass=
</varname>/
<varname>IOSchedulingPriority=
</varname> above.
</entry>
4300 <entry><constant>EXIT_TIMERSLACK
</constant></entry>
4301 <entry>Failed to set up timer slack. See
<varname>TimerSlackNSec=
</varname> above.
</entry>
4305 <entry><constant>EXIT_SECUREBITS
</constant></entry>
4306 <entry>Failed to set process secure bits. See
<varname>SecureBits=
</varname> above.
</entry>
4310 <entry><constant>EXIT_SETSCHEDULER
</constant></entry>
4311 <entry>Failed to set up CPU scheduling. See
<varname>CPUSchedulingPolicy=
</varname>/
<varname>CPUSchedulingPriority=
</varname> above.
</entry>
4315 <entry><constant>EXIT_CPUAFFINITY
</constant></entry>
4316 <entry>Failed to set up CPU affinity. See
<varname>CPUAffinity=
</varname> above.
</entry>
4320 <entry><constant>EXIT_GROUP
</constant></entry>
4321 <entry>Failed to determine or change group credentials. See
<varname>Group=
</varname>/
<varname>SupplementaryGroups=
</varname> above.
</entry>
4325 <entry><constant>EXIT_USER
</constant></entry>
4326 <entry>Failed to determine or change user credentials, or to set up user namespacing. See
<varname>User=
</varname>/
<varname>PrivateUsers=
</varname> above.
</entry>
4330 <entry><constant>EXIT_CAPABILITIES
</constant></entry>
4331 <entry>Failed to drop capabilities, or apply ambient capabilities. See
<varname>CapabilityBoundingSet=
</varname>/
<varname>AmbientCapabilities=
</varname> above.
</entry>
4335 <entry><constant>EXIT_CGROUP
</constant></entry>
4336 <entry>Setting up the service control group failed.
</entry>
4340 <entry><constant>EXIT_SETSID
</constant></entry>
4341 <entry>Failed to create new process session.
</entry>
4345 <entry><constant>EXIT_CONFIRM
</constant></entry>
4346 <entry>Execution has been cancelled by the user. See the
<varname>systemd.confirm_spawn=
</varname> kernel command line setting on
<citerefentry><refentrytitle>kernel-command-line
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for details.
</entry>
4350 <entry><constant>EXIT_STDERR
</constant></entry>
4351 <entry>Failed to set up standard error output. See
<varname>StandardError=
</varname> above.
</entry>
4355 <entry><constant>EXIT_PAM
</constant></entry>
4356 <entry>Failed to set up PAM session. See
<varname>PAMName=
</varname> above.
</entry>
4360 <entry><constant>EXIT_NETWORK
</constant></entry>
4361 <entry>Failed to set up network namespacing. See
<varname>PrivateNetwork=
</varname> above.
</entry>
4365 <entry><constant>EXIT_NAMESPACE
</constant></entry>
4366 <entry>Failed to set up mount, UTS, or IPC namespacing. See
<varname>ReadOnlyPaths=
</varname>,
<varname>ProtectHostname=
</varname>,
<varname>PrivateIPC=
</varname>, and related settings above.
</entry>
4370 <entry><constant>EXIT_NO_NEW_PRIVILEGES
</constant></entry>
4371 <entry>Failed to disable new privileges. See
<varname>NoNewPrivileges=yes
</varname> above.
</entry>
4375 <entry><constant>EXIT_SECCOMP
</constant></entry>
4376 <entry>Failed to apply system call filters. See
<varname>SystemCallFilter=
</varname> and related settings above.
</entry>
4380 <entry><constant>EXIT_SELINUX_CONTEXT
</constant></entry>
4381 <entry>Determining or changing SELinux context failed. See
<varname>SELinuxContext=
</varname> above.
</entry>
4385 <entry><constant>EXIT_PERSONALITY
</constant></entry>
4386 <entry>Failed to set up an execution domain (personality). See
<varname>Personality=
</varname> above.
</entry>
4390 <entry><constant>EXIT_APPARMOR_PROFILE
</constant></entry>
4391 <entry>Failed to prepare changing AppArmor profile. See
<varname>AppArmorProfile=
</varname> above.
</entry>
4395 <entry><constant>EXIT_ADDRESS_FAMILIES
</constant></entry>
4396 <entry>Failed to restrict address families. See
<varname>RestrictAddressFamilies=
</varname> above.
</entry>
4400 <entry><constant>EXIT_RUNTIME_DIRECTORY
</constant></entry>
4401 <entry>Setting up runtime directory failed. See
<varname>RuntimeDirectory=
</varname> and related settings above.
</entry>
4405 <entry><constant>EXIT_CHOWN
</constant></entry>
4406 <entry>Failed to adjust socket ownership. Used for socket units only.
</entry>
4410 <entry><constant>EXIT_SMACK_PROCESS_LABEL
</constant></entry>
4411 <entry>Failed to set SMACK label. See
<varname>SmackProcessLabel=
</varname> above.
</entry>
4415 <entry><constant>EXIT_KEYRING
</constant></entry>
4416 <entry>Failed to set up kernel keyring.
</entry>
4420 <entry><constant>EXIT_STATE_DIRECTORY
</constant></entry>
4421 <entry>Failed to set up unit's state directory. See
<varname>StateDirectory=
</varname> above.
</entry>
4425 <entry><constant>EXIT_CACHE_DIRECTORY
</constant></entry>
4426 <entry>Failed to set up unit's cache directory. See
<varname>CacheDirectory=
</varname> above.
</entry>
4430 <entry><constant>EXIT_LOGS_DIRECTORY
</constant></entry>
4431 <entry>Failed to set up unit's logging directory. See
<varname>LogsDirectory=
</varname> above.
</entry>
4435 <entry><constant>EXIT_CONFIGURATION_DIRECTORY
</constant></entry>
4436 <entry>Failed to set up unit's configuration directory. See
<varname>ConfigurationDirectory=
</varname> above.
</entry>
4440 <entry><constant>EXIT_NUMA_POLICY
</constant></entry>
4441 <entry>Failed to set up unit's NUMA memory policy. See
<varname>NUMAPolicy=
</varname> and
<varname>NUMAMask=
</varname> above.
</entry>
4445 <entry><constant>EXIT_CREDENTIALS
</constant></entry>
4446 <entry>Failed to set up unit's credentials. See
<varname>ImportCredential=
</varname>,
<varname>LoadCredential=
</varname> and
<varname>SetCredential=
</varname> above.
</entry>
4450 <entry><constant>EXIT_BPF
</constant></entry>
4451 <entry>Failed to apply BPF restrictions. See
<varname>RestrictFileSystems=
</varname> above.
</entry>
4457 <para>Finally, the BSD operating systems define a set of exit codes, typically defined on Linux systems too:
</para>
4460 <title>BSD exit codes
</title>
4464 <entry>Exit Code
</entry>
4465 <entry>Symbolic Name
</entry>
4466 <entry>Description
</entry>
4472 <entry><constant>EX_USAGE
</constant></entry>
4473 <entry>Command line usage error
</entry>
4477 <entry><constant>EX_DATAERR
</constant></entry>
4478 <entry>Data format error
</entry>
4482 <entry><constant>EX_NOINPUT
</constant></entry>
4483 <entry>Cannot open input
</entry>
4487 <entry><constant>EX_NOUSER
</constant></entry>
4488 <entry>Addressee unknown
</entry>
4492 <entry><constant>EX_NOHOST
</constant></entry>
4493 <entry>Host name unknown
</entry>
4497 <entry><constant>EX_UNAVAILABLE
</constant></entry>
4498 <entry>Service unavailable
</entry>
4502 <entry><constant>EX_SOFTWARE
</constant></entry>
4503 <entry>internal software error
</entry>
4507 <entry><constant>EX_OSERR
</constant></entry>
4508 <entry>System error (e.g., can't fork)
</entry>
4512 <entry><constant>EX_OSFILE
</constant></entry>
4513 <entry>Critical OS file missing
</entry>
4517 <entry><constant>EX_CANTCREAT
</constant></entry>
4518 <entry>Can't create (user) output file
</entry>
4522 <entry><constant>EX_IOERR
</constant></entry>
4523 <entry>Input/output error
</entry>
4527 <entry><constant>EX_TEMPFAIL
</constant></entry>
4528 <entry>Temporary failure; user is invited to retry
</entry>
4532 <entry><constant>EX_PROTOCOL
</constant></entry>
4533 <entry>Remote error in protocol
</entry>
4537 <entry><constant>EX_NOPERM
</constant></entry>
4538 <entry>Permission denied
</entry>
4542 <entry><constant>EX_CONFIG
</constant></entry>
4543 <entry>Configuration error
</entry>
4551 <title>Examples
</title>
4554 <title><varname>$MONITOR_
<replaceable>*
</replaceable></varname> usage
</title>
4556 <para>A service
<filename index=
"false">myfailer.service
</filename> which can trigger an
4557 <varname>OnFailure=
</varname> dependency.
</para>
4561 Description=Service which can trigger an OnFailure= dependency
4562 OnFailure=myhandler.service
4565 ExecStart=/bin/myprogram
4568 <para>A service
<filename index=
"false">mysuccess.service
</filename> which can trigger an
4569 <varname>OnSuccess=
</varname> dependency.
</para>
4573 Description=Service which can trigger an OnSuccess= dependency
4574 OnSuccess=myhandler.service
4577 ExecStart=/bin/mysecondprogram
4580 <para>A service
<filename index=
"false">myhandler.service
</filename> which can be triggered
4581 by any of the above services.
</para>
4585 Description=Acts on service failing or succeeding
4588 ExecStart=/bin/bash -c
"echo $MONITOR_SERVICE_RESULT $MONITOR_EXIT_CODE $MONITOR_EXIT_STATUS $MONITOR_INVOCATION_ID $MONITOR_UNIT"
4591 <para>If
<filename index=
"false">myfailer.service
</filename> were to run and exit in failure,
4592 then
<filename index=
"false">myhandler.service
</filename> would be triggered and the
4593 monitor variables would be set as follows:
</para>
4596 MONITOR_SERVICE_RESULT=exit-code
4597 MONITOR_EXIT_CODE=exited
4598 MONITOR_EXIT_STATUS=
1
4599 MONITOR_INVOCATION_ID=cc8fdc149b2b4ca698d4f259f4054236
4600 MONITOR_UNIT=myfailer.service
4603 <para>If
<filename index=
"false">mysuccess.service
</filename> were to run and exit in success,
4604 then
<filename index=
"false">myhandler.service
</filename> would be triggered and the
4605 monitor variables would be set as follows:
</para>
4608 MONITOR_SERVICE_RESULT=success
4609 MONITOR_EXIT_CODE=exited
4610 MONITOR_EXIT_STATUS=
0
4611 MONITOR_INVOCATION_ID=
6ab9af147b8c4a3ebe36e7a5f8611697
4612 MONITOR_UNIT=mysuccess.service
4620 <title>See Also
</title>
4622 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
4623 <citerefentry><refentrytitle>systemctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
4624 <citerefentry><refentrytitle>systemd-analyze
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
4625 <citerefentry><refentrytitle>journalctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
4626 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
4627 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
4628 <citerefentry><refentrytitle>systemd.service
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
4629 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
4630 <citerefentry><refentrytitle>systemd.swap
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
4631 <citerefentry><refentrytitle>systemd.mount
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
4632 <citerefentry><refentrytitle>systemd.kill
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
4633 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
4634 <citerefentry><refentrytitle>systemd.time
</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
4635 <citerefentry><refentrytitle>systemd.directives
</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
4636 <citerefentry><refentrytitle>tmpfiles.d
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
4637 <citerefentry project='man-pages'
><refentrytitle>exec
</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
4638 <citerefentry project='man-pages'
><refentrytitle>fork
</refentrytitle><manvolnum>2</manvolnum></citerefentry>