]>
Commit | Line | Data |
---|---|---|
514094f9 | 1 | <?xml version='1.0'?> |
3a54a157 ZJS |
2 | <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" |
3 | "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"> | |
4149f86d | 4 | <!-- |
db9ecf05 | 5 | SPDX-License-Identifier: LGPL-2.1-or-later |
572eb058 | 6 | |
96b2fb93 | 7 | Copyright © 2010 Brandon Philips |
4149f86d | 8 | --> |
503298b7 LP |
9 | <refentry id="tmpfiles.d" |
10 | xmlns:xi="http://www.w3.org/2001/XInclude"> | |
4149f86d | 11 | |
302fbdf2 ZJS |
12 | <refentryinfo> |
13 | <title>tmpfiles.d</title> | |
14 | <productname>systemd</productname> | |
302fbdf2 ZJS |
15 | </refentryinfo> |
16 | ||
17 | <refmeta> | |
18 | <refentrytitle>tmpfiles.d</refentrytitle> | |
19 | <manvolnum>5</manvolnum> | |
20 | </refmeta> | |
21 | ||
22 | <refnamediv> | |
23 | <refname>tmpfiles.d</refname> | |
f36c796e | 24 | <refpurpose>Configuration for creation, deletion, and cleaning of files and directories</refpurpose> |
302fbdf2 ZJS |
25 | </refnamediv> |
26 | ||
27 | <refsynopsisdiv> | |
73e97bb0 ZJS |
28 | <para><simplelist> |
29 | <member><filename>/etc/tmpfiles.d/*.conf</filename></member> | |
30 | <member><filename>/run/tmpfiles.d/*.conf</filename></member> | |
31 | <member><filename>/usr/lib/tmpfiles.d/*.conf</filename></member> | |
32 | </simplelist></para> | |
f2b5ca0e | 33 | |
73e97bb0 ZJS |
34 | <para><simplelist> |
35 | <member><filename>~/.config/user-tmpfiles.d/*.conf</filename></member> | |
36 | <member><filename>$XDG_RUNTIME_DIR/user-tmpfiles.d/*.conf</filename></member> | |
37 | <member><filename>~/.local/share/user-tmpfiles.d/*.conf</filename></member> | |
38 | <member><filename index='false'>…</filename></member> | |
39 | <member><filename>/usr/share/user-tmpfiles.d/*.conf</filename></member> | |
40 | </simplelist></para> | |
b0458daf ZJS |
41 | |
42 | <programlisting>#Type Path Mode User Group Age Argument | |
43 | f /file/to/create mode user group - content | |
eccebf4b | 44 | f+ /file/to/create-or-truncate mode user group - content |
b0458daf | 45 | w /file/to/write-to - - - - content |
4b55952d | 46 | w+ /file/to/append-to - - - - content |
164297cd | 47 | d /directory/to/create-and-clean-up mode user group cleanup-age - |
b0458daf | 48 | D /directory/to/create-and-remove mode user group cleanup-age - |
164297cd | 49 | e /directory/to/clean-up mode user group cleanup-age - |
6f310287 KM |
50 | v /subvolume-or-directory/to/create mode user group cleanup-age - |
51 | q /subvolume-or-directory/to/create mode user group cleanup-age - | |
52 | Q /subvolume-or-directory/to/create mode user group cleanup-age - | |
b0458daf | 53 | p /fifo/to/create mode user group - - |
4b55952d | 54 | p+ /fifo/to/[re]create mode user group - - |
b0458daf | 55 | L /symlink/to/create - - - - symlink/target/path |
4b55952d | 56 | L+ /symlink/to/[re]create - - - - symlink/target/path |
f6bc26ee AB |
57 | c /dev/char-device-to-create mode user group - major:minor |
58 | c+ /dev/char-device-to-[re]create mode user group - major:minor | |
59 | b /dev/block-device-to-create mode user group - major:minor | |
60 | b+ /dev/block-device-to-[re]create mode user group - major:minor | |
6f310287 | 61 | C /target/to/create - - - cleanup-age /source/to/copy |
1fd5ec56 | 62 | C+ /target/to/create - - - cleanup-age /source/to/copy |
6f310287 KM |
63 | x /path-or-glob/to/ignore/recursively - - - cleanup-age - |
64 | X /path-or-glob/to/ignore - - - cleanup-age - | |
164297cd ZJS |
65 | r /path-or-glob/to/remove - - - - - |
66 | R /path-or-glob/to/remove/recursively - - - - - | |
d4ffda38 TM |
67 | z /path-or-glob/to/adjust/mode mode user group - - |
68 | Z /path-or-glob/to/adjust/mode/recursively mode user group - - | |
b0458daf ZJS |
69 | t /path-or-glob/to/set/xattrs - - - - xattrs |
70 | T /path-or-glob/to/set/xattrs/recursively - - - - xattrs | |
71 | h /path-or-glob/to/set/attrs - - - - file attrs | |
72 | H /path-or-glob/to/set/attrs/recursively - - - - file attrs | |
73 | a /path-or-glob/to/set/acls - - - - POSIX ACLs | |
4b55952d | 74 | a+ /path-or-glob/to/append/acls - - - - POSIX ACLs |
b0458daf | 75 | A /path-or-glob/to/set/acls/recursively - - - - POSIX ACLs |
4b55952d ZS |
76 | A+ /path-or-glob/to/append/acls/recursively - - - - POSIX ACLs |
77 | ||
b0458daf | 78 | </programlisting> |
302fbdf2 ZJS |
79 | </refsynopsisdiv> |
80 | ||
81 | <refsect1> | |
82 | <title>Description</title> | |
83 | ||
abcb67ce ZJS |
84 | <para><filename>tmpfiles.d</filename> configuration files provide a generic mechanism to define the |
85 | <emphasis>creation</emphasis> of regular files, directories, pipes, and device nodes, adjustments to | |
86 | their <emphasis>access mode, ownership, attributes, quota assignments, and contents</emphasis>, and | |
87 | finally their time-based <emphasis>removal</emphasis>. It is mostly commonly used for volatile and | |
3b121157 ZJS |
88 | temporary files and directories (such as those located under <filename>/run/</filename>, |
89 | <filename>/tmp/</filename>, <filename>/var/tmp/</filename>, the API file systems such as | |
90 | <filename>/sys/</filename> or <filename>/proc/</filename>, as well as some other directories below | |
91 | <filename>/var/</filename>).</para> | |
abcb67ce | 92 | |
359c1436 | 93 | <para><citerefentry><refentrytitle>systemd-tmpfiles</refentrytitle><manvolnum>8</manvolnum></citerefentry> |
8b9f0921 ZJS |
94 | uses this configuration to create volatile files and directories during boot and to do periodic cleanup |
95 | afterwards. See | |
359c1436 | 96 | <citerefentry><refentrytitle>systemd-tmpfiles</refentrytitle><manvolnum>8</manvolnum></citerefentry> for |
abcb67ce | 97 | the description of <filename>systemd-tmpfiles-setup.service</filename>, |
6457e889 | 98 | <filename>systemd-tmpfiles-clean.service</filename>, and associated units.</para> |
abcb67ce | 99 | |
3b121157 | 100 | <para>System daemons frequently require private runtime directories below <filename>/run/</filename> to |
1cee1c52 | 101 | store communication sockets and similar. For these, it is better to use |
abcb67ce ZJS |
102 | <varname>RuntimeDirectory=</varname> in their unit files (see |
103 | <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> for | |
104 | details), if the flexibility provided by <filename>tmpfiles.d</filename> is not required. The advantages | |
105 | are that the configuration required by the unit is centralized in one place, and that the lifetime of the | |
106 | directory is tied to the lifetime of the service itself. Similarly, <varname>StateDirectory=</varname>, | |
107 | <varname>CacheDirectory=</varname>, <varname>LogsDirectory=</varname>, and | |
108 | <varname>ConfigurationDirectory=</varname> should be used to create directories under | |
109 | <filename>/var/lib/</filename>, <filename>/var/cache/</filename>, <filename>/var/log/</filename>, and | |
110 | <filename>/etc/</filename>. <filename>tmpfiles.d</filename> should be used for files whose lifetime is | |
111 | independent of any service or requires more complicated configuration.</para> | |
302fbdf2 ZJS |
112 | </refsect1> |
113 | ||
114 | <refsect1> | |
8165be2e | 115 | <title>Configuration Directories and Precedence</title> |
302fbdf2 ZJS |
116 | |
117 | <para>Each configuration file shall be named in the style of | |
118 | <filename><replaceable>package</replaceable>.conf</filename> or | |
119 | <filename><replaceable>package</replaceable>-<replaceable>part</replaceable>.conf</filename>. | |
120 | The second variant should be used when it is desirable to make it | |
121 | easy to override just this part of configuration.</para> | |
122 | ||
ad19c578 LP |
123 | <para>Files in <filename>/etc/tmpfiles.d</filename> override files with the same name in |
124 | <filename>/usr/lib/tmpfiles.d</filename> and <filename>/run/tmpfiles.d</filename>. Files in | |
125 | <filename>/run/tmpfiles.d</filename> override files with the same name in | |
126 | <filename>/usr/lib/tmpfiles.d</filename>. Packages should install their configuration files in | |
ead2a4a2 LP |
127 | <filename>/usr/lib/tmpfiles.d</filename>. Files in <filename>/etc/tmpfiles.d</filename> are reserved for |
128 | the local administrator, who may use this logic to override the configuration files installed by vendor | |
129 | packages. All configuration files are sorted by their filename in lexicographic order, regardless of | |
130 | which of the directories they reside in. If multiple files specify the same path, the entry in the file | |
131 | with the lexicographically earliest name will be applied (note that lines suppressed due to the | |
132 | <literal>!</literal> are filtered before application, meaning that if an early line carries the | |
133 | exclamation mark and is suppressed because of that, a later line matching in path will be applied). All | |
134 | other conflicting entries will be logged as errors. When two lines are prefix path and suffix path of | |
135 | each other, then the prefix line is always created first, the suffix later (and if removal applies to the | |
136 | line, the order is reversed: the suffix is removed first, the prefix later). Lines that take globs are | |
137 | applied after those accepting no globs. If multiple operations shall be applied on the same file (such as | |
138 | ACL, xattr, file attribute adjustments), these are always done in the same fixed order. Except for those | |
139 | cases, the files/directories are processed in the order they are listed.</para> | |
302fbdf2 ZJS |
140 | |
141 | <para>If the administrator wants to disable a configuration file | |
142 | supplied by the vendor, the recommended way is to place a symlink | |
143 | to <filename>/dev/null</filename> in | |
144 | <filename>/etc/tmpfiles.d/</filename> bearing the same filename. | |
145 | </para> | |
8165be2e ZJS |
146 | </refsect1> |
147 | ||
148 | <refsect1> | |
149 | <title>Configuration File Format</title> | |
302fbdf2 | 150 | |
29271da5 LP |
151 | <para>The configuration format is one line per path, containing type, path, mode, ownership, age, and |
152 | argument fields. The lines are separated by newlines, the fields by whitespace:</para> | |
302fbdf2 | 153 | |
29271da5 | 154 | <programlisting>#Type Path Mode User Group Age Argument… |
488e4352 ZJS |
155 | d /run/user 0755 root root 10d - |
156 | L /tmp/foobar - - - - /dev/null</programlisting> | |
302fbdf2 | 157 | |
29271da5 LP |
158 | <para>Fields may contain C-style escapes. With the exception of the seventh field (the "argument") all |
159 | fields may be enclosed in quotes. Note that any whitespace found in the line after the beginning of the | |
160 | argument field will be considered part of the argument field. To begin the argument field with a | |
161 | whitespace character, use C-style escapes (e.g. <literal>\x20</literal>).</para> | |
657cf7f4 | 162 | |
302fbdf2 ZJS |
163 | <refsect2> |
164 | <title>Type</title> | |
165 | ||
6ebfecd0 | 166 | <para>The type consists of a single letter and optionally one or more modifier characters: a plus sign |
e52f6f63 LP |
167 | (<literal>+</literal>), exclamation mark (<literal>!</literal>), minus sign (<literal>-</literal>), |
168 | equals sign (<literal>=</literal>), tilde character (<literal>~</literal>) and/or caret | |
169 | (<literal>^</literal>).</para> | |
302fbdf2 ZJS |
170 | |
171 | <para>The following line types are understood:</para> | |
172 | ||
173 | <variablelist> | |
174 | <varlistentry> | |
175 | <term><varname>f</varname></term> | |
eccebf4b ZS |
176 | <term><varname>f+</varname></term> |
177 | <listitem><para><varname>f</varname> will create a file if it does not exist yet. If the argument | |
178 | parameter is given and the file did not exist yet, it will be written to the file. | |
179 | <varname>f+</varname> will create or truncate the file. If the argument parameter is given, it will | |
180 | be written to the file. Does not follow symlinks.</para></listitem> | |
302fbdf2 ZJS |
181 | </varlistentry> |
182 | ||
183 | <varlistentry> | |
eccebf4b ZS |
184 | <term><varname>w</varname></term> |
185 | <term><varname>w+</varname></term> | |
d0ea5c5e ZS |
186 | <listitem><para>Write the argument parameter to a file, if the file exists. |
187 | If suffixed with <varname>+</varname>, the line will be appended to the file. | |
188 | If your configuration writes multiple lines to the same file, use <varname>w+</varname>. | |
189 | Lines of this type accept shell-style globs in place of normal path names. | |
190 | The argument parameter will be written without a trailing newline. | |
191 | C-style backslash escapes are interpreted. Follows symlinks.</para></listitem> | |
302fbdf2 ZJS |
192 | </varlistentry> |
193 | ||
194 | <varlistentry> | |
195 | <term><varname>d</varname></term> | |
488e4352 | 196 | <listitem><para>Create a directory. The mode and ownership will be adjusted if specified. Contents |
164297cd | 197 | of this directory are subject to time-based cleanup if the age argument is specified. |
488e4352 | 198 | </para></listitem> |
302fbdf2 ZJS |
199 | </varlistentry> |
200 | ||
201 | <varlistentry> | |
202 | <term><varname>D</varname></term> | |
488e4352 ZJS |
203 | <listitem><para>Similar to <varname>d</varname>, but in addition the contents of the directory will |
204 | be removed when <option>--remove</option> is used.</para></listitem> | |
4b743d67 | 205 | </varlistentry> |
df8dee85 ZJS |
206 | |
207 | <varlistentry> | |
208 | <term><varname>e</varname></term> | |
488e4352 | 209 | <listitem><para>Adjust the mode and ownership of existing directories and remove their contents |
d2149f6c ZJS |
210 | based on age. Lines of this type accept shell-style globs in place of normal path names. Contents |
211 | of the directories are subject to time-based cleanup if the age argument is specified. If the age | |
212 | argument is <literal>0</literal>, contents will be unconditionally deleted every time | |
213 | <citerefentry><refentrytitle>systemd-tmpfiles</refentrytitle><manvolnum>8</manvolnum></citerefentry> | |
214 | <option>--clean</option> is run.</para> | |
488e4352 ZJS |
215 | |
216 | <para>For this entry to be useful, at least one of the mode, user, group, or age arguments must be | |
217 | specified, since otherwise this entry has no effect. As an exception, an entry with no effect may | |
aefdc112 AK |
218 | be useful when combined with <varname>!</varname>, see the examples.</para> |
219 | ||
220 | <xi:include href="version-info.xml" xpointer="v230"/></listitem> | |
302fbdf2 ZJS |
221 | </varlistentry> |
222 | ||
223 | <varlistentry> | |
224 | <term><varname>v</varname></term> | |
488e4352 ZJS |
225 | <listitem><para>Create a subvolume if the path does not exist yet, the file system supports |
226 | subvolumes (btrfs), and the system itself is installed into a subvolume (specifically: the root | |
227 | directory <filename>/</filename> is itself a subvolume). Otherwise, create a normal directory, in | |
228 | the same way as <varname>d</varname>.</para> | |
229 | ||
230 | <para>A subvolume created with this line type is not assigned to any higher-level quota group. For | |
231 | that, use <varname>q</varname> or <varname>Q</varname>, which allow creating simple quota group | |
aefdc112 AK |
232 | hierarchies, see below.</para> |
233 | ||
234 | <xi:include href="version-info.xml" xpointer="v219"/></listitem> | |
5fb13eb5 LP |
235 | </varlistentry> |
236 | ||
237 | <varlistentry> | |
238 | <term><varname>q</varname></term> | |
488e4352 ZJS |
239 | <listitem><para>Create a subvolume or directory the same as <varname>v</varname>, but assign the |
240 | subvolume to the same higher-level quota groups as the parent. This ensures that higher-level | |
241 | limits and accounting applied to the parent subvolume also include the specified subvolume. On | |
242 | non-btrfs file systems, this line type is identical to <varname>d</varname>.</para> | |
f17a8d61 FB |
243 | |
244 | <para>If the subvolume already exists, no change to the quota hierarchy is made, regardless of whether the | |
be57c176 ZJS |
245 | subvolume is already attached to a quota group or not. Also see <varname>Q</varname> below. See |
246 | <citerefentry project='url'><refentrytitle url='https://btrfs.readthedocs.io/en/latest/btrfs-qgroup.html'>btrfs-qgroup</refentrytitle><manvolnum>8</manvolnum></citerefentry> | |
247 | for details about the btrfs quota group concept.</para> | |
aefdc112 AK |
248 | |
249 | <xi:include href="version-info.xml" xpointer="v228"/></listitem> | |
5fb13eb5 LP |
250 | </varlistentry> |
251 | ||
252 | <varlistentry> | |
253 | <term><varname>Q</varname></term> | |
488e4352 ZJS |
254 | <listitem><para>Create the subvolume or directory the same as <varname>v</varname>, but assign the |
255 | new subvolume to a new leaf quota group. Instead of copying the higher-level quota group | |
256 | assignments from the parent as is done with <varname>q</varname>, the lowest quota group of the | |
257 | parent subvolume is determined that is not the leaf quota group. Then, an "intermediary" quota | |
258 | group is inserted that is one level below this level, and shares the same ID part as the specified | |
259 | subvolume. If no higher-level quota group exists for the parent subvolume, a new quota group at | |
260 | level 255 sharing the same ID as the specified subvolume is inserted instead. This new intermediary | |
261 | quota group is then assigned to the parent subvolume's higher-level quota groups, and the specified | |
262 | subvolume's leaf quota group is assigned to it.</para> | |
f17a8d61 FB |
263 | |
264 | <para>Effectively, this has a similar effect as <varname>q</varname>, however introduces a new higher-level | |
265 | quota group for the specified subvolume that may be used to enforce limits and accounting to the specified | |
266 | subvolume and children subvolume created within it. Thus, by creating subvolumes only via | |
267 | <varname>q</varname> and <varname>Q</varname>, a concept of "subtree quotas" is implemented. Each subvolume | |
268 | for which <varname>Q</varname> is set will get a "subtree" quota group created, and all child subvolumes | |
269 | created within it will be assigned to it. Each subvolume for which <varname>q</varname> is set will not get | |
270 | such a "subtree" quota group, but it is ensured that they are added to the same "subtree" quota group as | |
271 | their immediate parents.</para> | |
272 | ||
273 | <para>It is recommended to use <varname>Q</varname> for subvolumes that typically contain further subvolumes, | |
274 | and where it is desirable to have accounting and quota limits on all child subvolumes together. Examples for | |
3b121157 | 275 | <varname>Q</varname> are typically <filename>/home/</filename> or <filename>/var/lib/machines/</filename>. In |
f17a8d61 FB |
276 | contrast, <varname>q</varname> should be used for subvolumes that either usually do not include further |
277 | subvolumes or where no accounting and quota limits are needed that apply to all child subvolumes | |
3b121157 ZJS |
278 | together. Examples for <varname>q</varname> are typically <filename>/var/</filename> or |
279 | <filename>/var/tmp/</filename>. </para> | |
f17a8d61 FB |
280 | |
281 | <para>As with <varname>q</varname>, <varname>Q</varname> has no effect on the quota group hierarchy if the | |
488e4352 | 282 | subvolume already exists, regardless of whether the subvolume already belong to a quota group or not. |
aefdc112 AK |
283 | </para> |
284 | ||
285 | <xi:include href="version-info.xml" xpointer="v228"/></listitem> | |
302fbdf2 ZJS |
286 | </varlistentry> |
287 | ||
288 | <varlistentry> | |
289 | <term><varname>p</varname></term> | |
290 | <term><varname>p+</varname></term> | |
291 | <listitem><para>Create a named pipe (FIFO) if it does not | |
292 | exist yet. If suffixed with <varname>+</varname> and a file | |
293 | already exists where the pipe is to be created, it will be | |
294 | removed and be replaced by the pipe.</para></listitem> | |
295 | </varlistentry> | |
296 | ||
297 | <varlistentry> | |
298 | <term><varname>L</varname></term> | |
299 | <term><varname>L+</varname></term> | |
300 | <listitem><para>Create a symlink if it does not exist | |
b3f5897f WD |
301 | yet. If suffixed with <varname>+</varname> and a file or |
302 | directory already exists where the symlink is to be created, | |
303 | it will be removed and be replaced by the symlink. If the | |
304 | argument is omitted, symlinks to files with the same name | |
305 | residing in the directory | |
306 | <filename>/usr/share/factory/</filename> are created. Note | |
307 | that permissions and ownership on symlinks are ignored. | |
308 | </para></listitem> | |
302fbdf2 ZJS |
309 | </varlistentry> |
310 | ||
311 | <varlistentry> | |
312 | <term><varname>c</varname></term> | |
313 | <term><varname>c+</varname></term> | |
314 | <listitem><para>Create a character device node if it does | |
315 | not exist yet. If suffixed with <varname>+</varname> and a | |
316 | file already exists where the device node is to be created, | |
317 | it will be removed and be replaced by the device node. It is | |
318 | recommended to suffix this entry with an exclamation mark to | |
319 | only create static device nodes at boot, as udev will not | |
320 | manage static device nodes that are created at runtime. | |
321 | </para></listitem> | |
322 | </varlistentry> | |
323 | ||
324 | <varlistentry> | |
325 | <term><varname>b</varname></term> | |
326 | <term><varname>b+</varname></term> | |
327 | <listitem><para>Create a block device node if it does not | |
328 | exist yet. If suffixed with <varname>+</varname> and a file | |
329 | already exists where the device node is to be created, it | |
330 | will be removed and be replaced by the device node. It is | |
331 | recommended to suffix this entry with an exclamation mark to | |
332 | only create static device nodes at boot, as udev will not | |
333 | manage static device nodes that are created at runtime. | |
334 | </para></listitem> | |
335 | </varlistentry> | |
336 | ||
337 | <varlistentry> | |
338 | <term><varname>C</varname></term> | |
1fd5ec56 DDM |
339 | <term><varname>C+</varname></term> |
340 | <listitem><para>Recursively copy a file or directory, if the destination files or directories do | |
341 | not exist yet or the destination directory is empty. Note that this command will not descend into | |
342 | subdirectories if the destination directory already exists and is not empty, unless the action is | |
343 | suffixed with <varname>+</varname>. Instead, the entire copy operation is skipped. If the argument | |
344 | is omitted, files from the source directory <filename>/usr/share/factory/</filename> with the same | |
345 | name are copied. Does not follow symlinks. Contents of the directories are subject to time-based | |
346 | cleanup if the age argument is specified. | |
aefdc112 AK |
347 | </para> |
348 | ||
349 | <xi:include href="version-info.xml" xpointer="v214"/></listitem> | |
302fbdf2 ZJS |
350 | </varlistentry> |
351 | ||
352 | <varlistentry> | |
353 | <term><varname>x</varname></term> | |
354 | <listitem><para>Ignore a path during cleaning. Use this type | |
355 | to exclude paths from clean-up as controlled with the Age | |
356 | parameter. Note that lines of this type do not influence the | |
357 | effect of <varname>r</varname> or <varname>R</varname> | |
50d9e46d | 358 | lines. Lines of this type accept shell-style globs in place |
302fbdf2 ZJS |
359 | of normal path names. </para></listitem> |
360 | </varlistentry> | |
361 | ||
362 | <varlistentry> | |
363 | <term><varname>X</varname></term> | |
364 | <listitem><para>Ignore a path during cleaning. Use this type | |
365 | to exclude paths from clean-up as controlled with the Age | |
366 | parameter. Unlike <varname>x</varname>, this parameter will | |
367 | not exclude the content if path is a directory, but only | |
368 | directory itself. Note that lines of this type do not | |
369 | influence the effect of <varname>r</varname> or | |
50d9e46d | 370 | <varname>R</varname> lines. Lines of this type accept |
302fbdf2 | 371 | shell-style globs in place of normal path names. |
aefdc112 AK |
372 | </para> |
373 | ||
374 | <xi:include href="version-info.xml" xpointer="v198"/></listitem> | |
302fbdf2 ZJS |
375 | </varlistentry> |
376 | ||
377 | <varlistentry> | |
378 | <term><varname>r</varname></term> | |
379 | <listitem><para>Remove a file or directory if it exists. | |
380 | This may not be used to remove non-empty directories, use | |
381 | <varname>R</varname> for that. Lines of this type accept | |
382 | shell-style globs in place of normal path | |
6a9171d2 | 383 | names. Does not follow symlinks.</para></listitem> |
302fbdf2 ZJS |
384 | </varlistentry> |
385 | ||
386 | <varlistentry> | |
387 | <term><varname>R</varname></term> | |
388 | <listitem><para>Recursively remove a path and all its | |
389 | subdirectories (if it is a directory). Lines of this type | |
390 | accept shell-style globs in place of normal path | |
6a9171d2 | 391 | names. Does not follow symlinks.</para></listitem> |
302fbdf2 ZJS |
392 | </varlistentry> |
393 | ||
394 | <varlistentry> | |
395 | <term><varname>z</varname></term> | |
488e4352 ZJS |
396 | <listitem><para>Adjust the access mode, user and group ownership, and restore the SELinux security |
397 | context of a file or directory, if it exists. Lines of this type accept shell-style globs in place | |
398 | of normal path names. Does not follow symlinks.</para></listitem> | |
302fbdf2 ZJS |
399 | </varlistentry> |
400 | ||
401 | <varlistentry> | |
402 | <term><varname>Z</varname></term> | |
488e4352 ZJS |
403 | <listitem><para>Recursively set the access mode, user and group ownership, and restore the SELinux |
404 | security context of a file or directory if it exists, as well as of its subdirectories and the | |
405 | files contained therein (if applicable). Lines of this type accept shell-style globs in place of | |
406 | normal path names. Does not follow symlinks.</para></listitem> | |
302fbdf2 ZJS |
407 | </varlistentry> |
408 | ||
409 | <varlistentry> | |
410 | <term><varname>t</varname></term> | |
f3d3a9ca LP |
411 | <listitem><para>Set extended attributes, see <citerefentry |
412 | project='man-pages'><refentrytitle>attr</refentrytitle> | |
413 | <manvolnum>5</manvolnum></citerefentry> for details. The argument field should take one or more | |
414 | assignment expressions in the form | |
415 | <replaceable>namespace</replaceable>.<replaceable>attribute</replaceable>=<replaceable>value</replaceable>, | |
416 | for examples see below. Lines of this type accept shell-style globs in place of normal path | |
417 | names. This can be useful for setting SMACK labels. Does not follow symlinks.</para> | |
418 | ||
419 | <para>Please note that extended attributes settable with this line type are a different concept | |
420 | from the Linux file attributes settable with <varname>h</varname>/<varname>H</varname>, see | |
aefdc112 AK |
421 | below.</para> |
422 | ||
423 | <xi:include href="version-info.xml" xpointer="v218"/></listitem> | |
b705ab6a ZJS |
424 | </varlistentry> |
425 | ||
426 | <varlistentry> | |
427 | <term><varname>T</varname></term> | |
aefdc112 AK |
428 | <listitem><para>Same as <varname>t</varname>, but operates recursively.</para> |
429 | ||
430 | <xi:include href="version-info.xml" xpointer="v219"/></listitem> | |
302fbdf2 | 431 | </varlistentry> |
f8eeeaf9 | 432 | |
fa3f5fd2 GB |
433 | <varlistentry> |
434 | <term><varname>h</varname></term> | |
f3d3a9ca LP |
435 | <listitem><para>Set Linux file/directory attributes. Lines of this type accept shell-style globs in |
436 | place of normal path names.</para> | |
fa3f5fd2 | 437 | |
f3d3a9ca | 438 | <para>The format of the argument field is <varname>[+-=][aAcCdDeijPsStTu]</varname>. The prefix |
0923b425 ZJS |
439 | <varname>+</varname> (the default one) causes the attributes to be added; <varname>-</varname> |
440 | causes the attributes to be removed; <varname>=</varname> causes the attributes to be set exactly | |
75006470 LP |
441 | as the following letters. The letters <literal>aAcCdDeijPsStTu</literal> select the new attributes |
442 | for the files, see <citerefentry project='man-pages'><refentrytitle>chattr</refentrytitle> | |
fa3f5fd2 GB |
443 | <manvolnum>1</manvolnum></citerefentry> for further information. |
444 | </para> | |
f3d3a9ca LP |
445 | |
446 | <para>Passing only <varname>=</varname> as argument resets all the file attributes listed above. It | |
447 | has to be pointed out that the <varname>=</varname> prefix limits itself to the attributes | |
448 | corresponding to the letters listed here. All other attributes will be left untouched. Does not | |
449 | follow symlinks.</para> | |
450 | ||
451 | <para>Please note that the Linux file attributes settable with this line type are a different | |
452 | concept from the extended attributes settable with <varname>t</varname>/<varname>T</varname>, | |
453 | see above.</para></listitem> | |
fa3f5fd2 GB |
454 | </varlistentry> |
455 | ||
456 | <varlistentry> | |
457 | <term><varname>H</varname></term> | |
aefdc112 AK |
458 | <listitem><para>Sames as <varname>h</varname>, but operates recursively.</para> |
459 | ||
460 | <xi:include href="version-info.xml" xpointer="v220"/></listitem> | |
fa3f5fd2 GB |
461 | </varlistentry> |
462 | ||
f8eeeaf9 ZJS |
463 | <varlistentry> |
464 | <term><varname>a</varname></term> | |
50d9e46d | 465 | <term><varname>a+</varname></term> |
d2149f6c ZJS |
466 | <listitem><para>Set POSIX ACLs (access control lists), see |
467 | <citerefentry project='man-pages'><refentrytitle>acl</refentrytitle><manvolnum>5</manvolnum></citerefentry>. | |
468 | Additionally, if 'X' is used, the execute bit is set only if the file is a directory or already has | |
469 | execute permission for some user, as mentioned in | |
26d98cdd MY |
470 | <citerefentry project='man-pages'><refentrytitle>setfacl</refentrytitle><manvolnum>1</manvolnum></citerefentry>. |
471 | If suffixed with <varname>+</varname>, the specified entries will be added to the existing set. | |
d2149f6c ZJS |
472 | <citerefentry><refentrytitle>systemd-tmpfiles</refentrytitle><manvolnum>8</manvolnum></citerefentry> |
473 | will automatically add the required base entries for user and group based on the access mode of the | |
474 | file, unless base entries already exist or are explicitly specified. The mask will be added if not | |
475 | specified explicitly or already present. Lines of this type accept shell-style globs in place of | |
476 | normal path names. This can be useful for allowing additional access to certain files. Does not | |
aefdc112 AK |
477 | follow symlinks.</para> |
478 | ||
479 | <xi:include href="version-info.xml" xpointer="v219"/></listitem> | |
b705ab6a ZJS |
480 | </varlistentry> |
481 | ||
482 | <varlistentry> | |
483 | <term><varname>A</varname></term> | |
50d9e46d ZJS |
484 | <term><varname>A+</varname></term> |
485 | <listitem><para>Same as <varname>a</varname> and | |
6a9171d2 | 486 | <varname>a+</varname>, but recursive. Does not follow |
aefdc112 AK |
487 | symlinks.</para> |
488 | ||
489 | <xi:include href="version-info.xml" xpointer="v219"/></listitem> | |
f8eeeaf9 | 490 | </varlistentry> |
302fbdf2 | 491 | </variablelist> |
67ff6b30 LP |
492 | </refsect2> |
493 | ||
494 | <refsect2> | |
495 | <title>Type Modifiers</title> | |
302fbdf2 | 496 | |
f742f9d3 LP |
497 | <para>If the exclamation mark (<literal>!</literal>) is used, this line is only safe to execute during |
498 | boot, and can break a running system. Lines without the exclamation mark are presumed to be safe to | |
d2149f6c ZJS |
499 | execute at any time, e.g. on package upgrades. |
500 | <citerefentry><refentrytitle>systemd-tmpfiles</refentrytitle><manvolnum>8</manvolnum></citerefentry> | |
501 | will take lines with an exclamation mark only into consideration, if the <option>--boot</option> option | |
502 | is given.</para> | |
302fbdf2 ZJS |
503 | |
504 | <para>For example: | |
505 | <programlisting># Make sure these are created by default so that nobody else can | |
9b9c30ec | 506 | d /tmp/.X11-unix 1777 root root 10d |
302fbdf2 | 507 | |
9b9c30ec LP |
508 | # Unlink the X11 lock files |
509 | r! /tmp/.X[0-9]*-lock</programlisting> | |
302fbdf2 ZJS |
510 | The second line in contrast to the first one would break a |
511 | running system, and will only be executed with | |
512 | <option>--boot</option>.</para> | |
7fa10748 | 513 | |
f742f9d3 LP |
514 | <para>If the minus sign (<literal>-</literal>) is used, this line failing to run successfully during |
515 | create (and only create) will not cause the execution of <command>systemd-tmpfiles</command> to return | |
6d7b5433 WD |
516 | an error.</para> |
517 | ||
518 | <para>For example: | |
519 | <programlisting># Modify sysfs but don't fail if we are in a container with a read-only /proc | |
520 | w- /proc/sys/vm/swappiness - - - - 10</programlisting></para> | |
521 | ||
c46c3233 AW |
522 | <para>If the equals sign (<literal>=</literal>) is used, the file types of existing objects in the specified path |
523 | are checked, and removed if they do not match. This includes any implicitly created parent directories (which can | |
524 | be either directories or directory symlinks). For example, if there is a FIFO in place of one of the parent path | |
525 | components it will be replaced with a directory.</para> | |
526 | ||
708daf42 LP |
527 | <para>If the tilde character (<literal>~</literal>) is used, the argument (i.e. 6th) column is <ulink |
528 | url="https://www.rfc-editor.org/rfc/rfc4648.html">Base64 decoded</ulink> before use. This modifier is | |
529 | only supported on line types that can write file contents, i.e. <varname>f</varname>, | |
e52f6f63 LP |
530 | <varname>f+</varname>, <varname>w</varname>, <varname>+</varname>. This is useful for writing arbitrary |
531 | binary data (including newlines and NUL bytes) to files. Note that if this switch is used, the argument | |
532 | is not subject to specifier expansion, neither before nor after Base64 decoding.</para> | |
533 | ||
534 | <para>If the caret character (<literal>^</literal>) is used, the argument (i.e. 6th) column takes a | |
535 | service credential name to read the argument data from. See <ulink | |
536 | url="https://systemd.io/CREDENTIALS">System and Service Credentials</ulink> for details about the | |
537 | credentials concept. This modifier is only supported on line types that can write file contents, | |
538 | i.e. <varname>f</varname>, <varname>f+</varname>, <varname>w</varname>, <varname>w+</varname>. This is | |
539 | useful for writing arbitrary files with contents sourced from elsewhere, including from VM or container | |
540 | managers further up. If the specified credential is not set for the <command>systemd-tmpfiles</command> | |
541 | service, the line is silently skipped. If <literal>^</literal> and <literal>~</literal> are combined | |
542 | Base64 decoding is applied to the credential contents.</para> | |
708daf42 | 543 | |
7fa10748 LP |
544 | <para>Note that for all line types that result in creation of any kind of file node |
545 | (i.e. <varname>f</varname>/<varname>F</varname>, | |
546 | <varname>d</varname>/<varname>D</varname>/<varname>v</varname>/<varname>q</varname>/<varname>Q</varname>, | |
547 | <varname>p</varname>, <varname>L</varname>, <varname>c</varname>/<varname>b</varname> and <varname>C</varname>) | |
548 | leading directories are implicitly created if needed, owned by root with an access mode of 0755. In order to | |
549 | create them with different modes or ownership make sure to add appropriate <varname>d</varname> lines.</para> | |
302fbdf2 ZJS |
550 | </refsect2> |
551 | ||
552 | <refsect2> | |
553 | <title>Path</title> | |
554 | ||
555 | <para>The file system path specification supports simple | |
2df36d09 ZJS |
556 | specifier expansion, see below. The path (after expansion) must be |
557 | absolute.</para> | |
302fbdf2 ZJS |
558 | </refsect2> |
559 | ||
560 | <refsect2> | |
561 | <title>Mode</title> | |
562 | ||
fdc4b8b1 | 563 | <para>The file access mode to use when creating this file or directory. If omitted or when set to |
6ebfecd0 | 564 | <literal>-</literal>, the default is used: 0755 for directories, 0644 for all other file objects. For |
fdc4b8b1 LP |
565 | <varname>z</varname>, <varname>Z</varname> lines, if omitted or when set to <literal>-</literal>, the |
566 | file access mode will not be modified. This parameter is ignored for <varname>x</varname>, | |
567 | <varname>r</varname>, <varname>R</varname>, <varname>L</varname>, <varname>t</varname>, and | |
568 | <varname>a</varname> lines.</para> | |
569 | ||
570 | <para>Optionally, if prefixed with <literal>~</literal>, the access mode is masked based on the already | |
571 | set access bits for existing file or directories: if the existing file has all executable bits unset, | |
572 | all executable bits are removed from the new access mode, too. Similarly, if all read bits are removed | |
573 | from the old access mode, they will be removed from the new access mode too, and if all write bits are | |
574 | removed, they will be removed from the new access mode too. In addition, the sticky/SUID/SGID bit is | |
575 | removed unless applied to a directory. This functionality is particularly useful in conjunction with | |
576 | <varname>Z</varname>.</para> | |
577 | ||
3cb938bd LP |
578 | <para>By default the access mode of listed inodes is set to the specified mode regardless if it is |
579 | created anew, or already existed. Optionally, if prefixed with <literal>:</literal>, the configured | |
580 | access mode is only applied when creating new inodes, and if the inode the line refers to | |
581 | already exists, its access mode is left in place unmodified.</para> | |
302fbdf2 ZJS |
582 | </refsect2> |
583 | ||
584 | <refsect2> | |
488e4352 ZJS |
585 | <title>User, Group</title> |
586 | ||
587 | <para>The user and group to use for this file or directory. This may either be a numeric ID or a | |
588 | user/group name. If omitted or when set to <literal>-</literal>, the user and group of the user who | |
d2149f6c ZJS |
589 | invokes |
590 | <citerefentry><refentrytitle>systemd-tmpfiles</refentrytitle><manvolnum>8</manvolnum></citerefentry> is | |
591 | used. For <varname>z</varname> and <varname>Z</varname> lines, when omitted or when set to | |
592 | <literal>-</literal>, the file ownership will not be modified. These parameters are ignored for | |
593 | <varname>x</varname>, <varname>r</varname>, <varname>R</varname>, <varname>L</varname>, | |
594 | <varname>t</varname>, and <varname>a</varname> lines.</para> | |
007b77ac LP |
595 | |
596 | <para>This field should generally only reference system users/groups, i.e. users/groups that are | |
597 | guaranteed to be resolvable during early boot. If this field references users/groups that only become | |
598 | resolveable during later boot (i.e. after NIS, LDAP or a similar networked directory service become | |
599 | available), execution of the operations declared by the line will likely fail. Also see <ulink | |
d59fc29b | 600 | url="https://systemd.io/UIDS-GIDS/#notes-on-resolvability-of-user-and-group-names">Notes on |
007b77ac LP |
601 | Resolvability of User and Group Names</ulink> for more information on requirements on system user/group |
602 | definitions.</para> | |
fdc4b8b1 | 603 | |
3cb938bd LP |
604 | <para>By default the ownership of listed inodes is set to the specified user/group regardless if it is |
605 | created anew, or already existed. Optionally, if prefixed with <literal>:</literal>, the configured | |
606 | user/group information is only applied when creating new inodes, and if the inode the line refers to | |
607 | already exists, its user/group is left in place unmodified.</para> | |
302fbdf2 ZJS |
608 | </refsect2> |
609 | ||
610 | <refsect2> | |
611 | <title>Age</title> | |
dab1fe1a | 612 | |
302fbdf2 ZJS |
613 | <para>The date field, when set, is used to decide what files to |
614 | delete when cleaning. If a file or directory is older than the | |
615 | current time minus the age field, it is deleted. The field | |
616 | format is a series of integers each followed by one of the | |
a8eaaee7 | 617 | following suffixes for the respective time units: |
00c53f42 ZJS |
618 | <constant>s</constant>, |
619 | <constant>m</constant> or <constant>min</constant>, | |
620 | <constant>h</constant>, | |
621 | <constant>d</constant>, | |
622 | <constant>w</constant>, | |
a8eaaee7 | 623 | <constant>ms</constant>, and |
00c53f42 | 624 | <constant>us</constant>, |
a8eaaee7 JE |
625 | meaning seconds, minutes, hours, days, weeks, |
626 | milliseconds, and microseconds, respectively. Full names of the time units can | |
00c53f42 ZJS |
627 | be used too. |
628 | </para> | |
302fbdf2 ZJS |
629 | |
630 | <para>If multiple integers and units are specified, the time | |
00c53f42 ZJS |
631 | values are summed. If an integer is given without a unit, |
632 | <constant>s</constant> is assumed. | |
302fbdf2 ZJS |
633 | </para> |
634 | ||
635 | <para>When the age is set to zero, the files are cleaned | |
636 | unconditionally.</para> | |
637 | ||
5fb13eb5 | 638 | <para>The age field only applies to lines starting with |
df8dee85 | 639 | <varname>d</varname>, <varname>D</varname>, <varname>e</varname>, |
5fb13eb5 LP |
640 | <varname>v</varname>, <varname>q</varname>, |
641 | <varname>Q</varname>, <varname>C</varname>, <varname>x</varname> | |
642 | and <varname>X</varname>. If omitted or set to | |
643 | <literal>-</literal>, no automatic clean-up is done.</para> | |
302fbdf2 | 644 | |
dab1fe1a ZJS |
645 | <para>If the age field starts with a tilde character <literal>~</literal>, clean-up is only applied to |
646 | files and directories one level inside the directory specified, but not the files and directories | |
647 | immediately inside it.</para> | |
662b3e58 LW |
648 | |
649 | <para>The age of a file system entry is determined from its last | |
650 | modification timestamp (mtime), its last access timestamp (atime), | |
651 | and (except for directories) its last status change timestamp | |
7f7a50dd SK |
652 | (ctime). By default, any of these three (or two) values will |
653 | prevent cleanup if it is more recent than the current time minus | |
654 | the age field. To restrict the deletion based on particular type | |
655 | of file timestamps, the age-by argument can be used.</para> | |
656 | ||
dab1fe1a ZJS |
657 | <para>The age-by argument overrides the timestamp types to be used for the age check. It can be |
658 | specified by prefixing the age argument with a sequence of characters to specify the timestamp types | |
659 | and a colon (<literal>:</literal>): | |
660 | <literal><replaceable>age-by</replaceable>...:<replaceable>cleanup-age</replaceable></literal>. The | |
661 | argument can consist of <constant>a</constant> (<constant>A</constant> for directories), | |
662 | <constant>b</constant> (<constant>B</constant> for directories), <constant>c</constant> | |
663 | (<constant>C</constant> for directories), or <constant>m</constant> (<constant>M</constant> for | |
664 | directories). Those respectively indicate access, creation, last status change, and last modification | |
665 | time of a file system entry. The lower-case letter signifies that the given timestamp type should be | |
666 | considered for files, while the upper-case letter signifies that the given timestamp type should be | |
667 | considered for directories. See <citerefentry | |
668 | project='man-pages'><refentrytitle>statx</refentrytitle><manvolnum>2</manvolnum></citerefentry> file | |
669 | timestamp fields for more details about timestamp types.</para> | |
670 | ||
671 | <para>If not specified, the age-by field defaults to <constant>abcmABM</constant>, i.e. by default all | |
672 | file timestamps are taken into consideration, with the exception of the last status change timestamp | |
673 | (ctime) for directories. This is because the aging logic itself will alter the ctime whenever it | |
674 | deletes a file inside it. To ensure that running the aging logic does not feed back into the next | |
675 | iteration of itself, ctime for directories is ignored by default.</para> | |
7f7a50dd SK |
676 | |
677 | <para>For example:<programlisting> | |
678 | # Files created and modified, and directories accessed more than | |
679 | # an hour ago in "/tmp/foo/bar", are subject to time-based cleanup. | |
f90360eb | 680 | d /tmp/foo/bar - - - bmA:1h -</programlisting></para> |
aa1f2e52 | 681 | |
65e179a1 | 682 | <para>Note that while the aging algorithm is run an exclusive BSD file lock (see <citerefentry |
aa1f2e52 | 683 | project='man-pages'><refentrytitle>flock</refentrytitle><manvolnum>2</manvolnum></citerefentry>) is |
e6e5a272 N |
684 | taken on each directory/file the algorithm decides to remove. If the aging algorithm finds a lock |
685 | (shared or exclusive) is already taken on some directory/file, it (and everything below it) is skipped. | |
65e179a1 DDM |
686 | Applications may use this to temporarily exclude certain directory subtrees from the aging algorithm: |
687 | the applications can take a BSD file lock themselves, and as long as they keep it aging of the | |
688 | directory/file and everything below it is disabled.</para> | |
dbc3cc8b DDM |
689 | |
690 | <para>This behavior can be used to ensure guaranteed cleanup of files or directories whose lifetime | |
691 | should be aligned with the process that created them by having that process create them in a location | |
692 | monitored by <command>systemd-tmpfiles</command> with an age of <literal>0</literal>, and having the | |
693 | process immediately lock the directory or file before using it. Because the BSD lock is process | |
694 | specific, the file is guaranteed to be unlocked as soon as the process exits, meaning that even if the | |
695 | process crashes, those files and directories will be unlocked and cleaned up by | |
696 | <command>systemd-tmpfiles</command>.</para> | |
302fbdf2 ZJS |
697 | </refsect2> |
698 | ||
699 | <refsect2> | |
700 | <title>Argument</title> | |
701 | ||
49e87292 LP |
702 | <para>For <varname>L</varname> lines determines the destination path of the symlink. For <varname>c</varname> and |
703 | <varname>b</varname>, determines the major/minor of the device node, with major and minor formatted as integers, | |
704 | separated by <literal>:</literal>, e.g. <literal>1:3</literal>. For <varname>f</varname>, <varname>F</varname>, | |
705 | and <varname>w</varname>, the argument may be used to specify a short string that is written to the file, | |
706 | suffixed by a newline. For <varname>C</varname>, specifies the source file or directory. For <varname>t</varname> | |
707 | and <varname>T</varname>, determines extended attributes to be set. For <varname>a</varname> and | |
708 | <varname>A</varname>, determines ACL attributes to be set. For <varname>h</varname> and <varname>H</varname>, | |
709 | determines the file attributes to set. Ignored for all other lines.</para> | |
2df36d09 ZJS |
710 | |
711 | <para>This field can contain specifiers, see below.</para> | |
302fbdf2 | 712 | </refsect2> |
2df36d09 | 713 | </refsect1> |
302fbdf2 | 714 | |
2df36d09 ZJS |
715 | <refsect1> |
716 | <title>Specifiers</title> | |
717 | ||
718 | <para>Specifiers can be used in the "path" and "argument" fields. | |
751223fe | 719 | An unknown or unresolvable specifier is treated as invalid configuration. |
2df36d09 | 720 | The following expansions are understood:</para> |
0d525a3e | 721 | <table class='specifiers'> |
2df36d09 ZJS |
722 | <title>Specifiers available</title> |
723 | <tgroup cols='3' align='left' colsep='1' rowsep='1'> | |
724 | <colspec colname="spec" /> | |
725 | <colspec colname="mean" /> | |
726 | <colspec colname="detail" /> | |
727 | <thead> | |
728 | <row> | |
729 | <entry>Specifier</entry> | |
730 | <entry>Meaning</entry> | |
731 | <entry>Details</entry> | |
732 | </row> | |
733 | </thead> | |
734 | <tbody> | |
503298b7 | 735 | <xi:include href="standard-specifiers.xml" xpointer="a"/> |
9a515f0a | 736 | <xi:include href="standard-specifiers.xml" xpointer="A"/> |
c83347b4 | 737 | <xi:include href="standard-specifiers.xml" xpointer="b"/> |
503298b7 | 738 | <xi:include href="standard-specifiers.xml" xpointer="B"/> |
709f4c47 LP |
739 | <row> |
740 | <entry><literal>%C</literal></entry> | |
741 | <entry>System or user cache directory</entry> | |
742 | <entry>In <option>--user</option> mode, this is the same as <varname>$XDG_CACHE_HOME</varname>, and <filename>/var/cache</filename> otherwise.</entry> | |
743 | </row> | |
55318801 YW |
744 | <row> |
745 | <entry><literal>%g</literal></entry> | |
746 | <entry>User group</entry> | |
747 | <entry>This is the name of the group running the command. In case of the system instance this resolves to <literal>root</literal>.</entry> | |
748 | </row> | |
749 | <row> | |
750 | <entry><literal>%G</literal></entry> | |
751 | <entry>User GID</entry> | |
752 | <entry>This is the numeric GID of the group running the command. In case of the system instance this resolves to <constant>0</constant>.</entry> | |
753 | </row> | |
709f4c47 LP |
754 | <row> |
755 | <entry><literal>%h</literal></entry> | |
756 | <entry>User home directory</entry> | |
052c59c3 | 757 | <entry>This is the home directory of the user running the command. In case of the system instance this resolves to <literal>/root</literal>.</entry> |
709f4c47 | 758 | </row> |
c83347b4 | 759 | <xi:include href="standard-specifiers.xml" xpointer="H"/> |
e97708fa | 760 | <xi:include href="standard-specifiers.xml" xpointer="l"/> |
2df36d09 | 761 | <row> |
709f4c47 LP |
762 | <entry><literal>%L</literal></entry> |
763 | <entry>System or user log directory</entry> | |
b50aadaf | 764 | <entry>In <option>--user</option> mode, this is the same as <varname>$XDG_STATE_HOME</varname> with <filename index="false">/log</filename> appended, and <filename>/var/log</filename> otherwise.</entry> |
ca23eeb5 | 765 | </row> |
c83347b4 | 766 | <xi:include href="standard-specifiers.xml" xpointer="m"/> |
9a515f0a | 767 | <xi:include href="standard-specifiers.xml" xpointer="M"/> |
503298b7 | 768 | <xi:include href="standard-specifiers.xml" xpointer="o"/> |
ca23eeb5 | 769 | <row> |
709f4c47 LP |
770 | <entry><literal>%S</literal></entry> |
771 | <entry>System or user state directory</entry> | |
b50aadaf | 772 | <entry>In <option>--user</option> mode, this is the same as <varname>$XDG_STATE_HOME</varname>, and <filename>/var/lib</filename> otherwise.</entry> |
ca23eeb5 | 773 | </row> |
5a8575ef ZJS |
774 | <row> |
775 | <entry><literal>%t</literal></entry> | |
776 | <entry>System or user runtime directory</entry> | |
3b121157 | 777 | <entry>In <option>--user</option> mode, this is the same <varname>$XDG_RUNTIME_DIR</varname>, and <filename>/run/</filename> otherwise.</entry> |
5a8575ef | 778 | </row> |
806d919c | 779 | <xi:include href="standard-specifiers.xml" xpointer="T"/> |
5a8575ef | 780 | <row> |
709f4c47 LP |
781 | <entry><literal>%u</literal></entry> |
782 | <entry>User name</entry> | |
052c59c3 | 783 | <entry>This is the name of the user running the command. In case of the system instance this resolves to <literal>root</literal>.</entry> |
5a8575ef ZJS |
784 | </row> |
785 | <row> | |
709f4c47 LP |
786 | <entry><literal>%U</literal></entry> |
787 | <entry>User UID</entry> | |
052c59c3 | 788 | <entry>This is the numeric UID of the user running the command. In case of the system instance this resolves to <constant>0</constant>.</entry> |
5a8575ef | 789 | </row> |
c83347b4 | 790 | <xi:include href="standard-specifiers.xml" xpointer="v"/> |
806d919c | 791 | <xi:include href="standard-specifiers.xml" xpointer="V"/> |
503298b7 LP |
792 | <xi:include href="standard-specifiers.xml" xpointer="w"/> |
793 | <xi:include href="standard-specifiers.xml" xpointer="W"/> | |
c83347b4 | 794 | <xi:include href="standard-specifiers.xml" xpointer="percent"/> |
2df36d09 ZJS |
795 | </tbody> |
796 | </tgroup> | |
797 | </table> | |
302fbdf2 ZJS |
798 | </refsect1> |
799 | ||
800 | <refsect1> | |
4b743d67 | 801 | <title>Examples</title> |
302fbdf2 | 802 | <example> |
4b743d67 ZJS |
803 | <title>Create directories with specific mode and ownership</title> |
804 | <para> | |
0a07667d | 805 | <citerefentry project='die-net'><refentrytitle>screen</refentrytitle><manvolnum>1</manvolnum></citerefentry>, |
4b743d67 ZJS |
806 | needs two directories created at boot with specific modes and ownership:</para> |
807 | ||
808 | <programlisting># /usr/lib/tmpfiles.d/screen.conf | |
809 | d /run/screens 1777 root screen 10d | |
810 | d /run/uscreens 0755 root screen 10d12h | |
811 | </programlisting> | |
812 | ||
813 | <para>Contents of <filename>/run/screens</filename> and /run/uscreens will | |
1655cdee | 814 | be cleaned up after 10 and 10½ days, respectively.</para> |
4b743d67 | 815 | </example> |
302fbdf2 | 816 | |
4b743d67 ZJS |
817 | <example> |
818 | <title>Create a directory with a SMACK attribute</title> | |
819 | <programlisting>D /run/cups - - - - | |
820 | t /run/cups - - - - security.SMACK64=printing user.attr-with-spaces="foo bar" | |
821 | </programlisting> | |
822 | ||
b17649ee | 823 | <para>The directory will be owned by root and have default mode. Its contents are |
164297cd | 824 | not subject to time-based cleanup, but will be obliterated when |
4b743d67 | 825 | <command>systemd-tmpfiles --remove</command> runs.</para> |
302fbdf2 | 826 | </example> |
4b743d67 | 827 | |
302fbdf2 | 828 | <example> |
4b743d67 ZJS |
829 | <title>Create a directory and prevent its contents from cleanup</title> |
830 | <para> | |
0a07667d | 831 | <citerefentry project='die-net'><refentrytitle>abrt</refentrytitle><manvolnum>1</manvolnum></citerefentry>, |
4b743d67 ZJS |
832 | needs a directory created at boot with specific mode and ownership and its content |
833 | should be preserved from the automatic cleanup applied to the contents of | |
834 | <filename>/var/tmp</filename>:</para> | |
835 | ||
836 | <programlisting># /usr/lib/tmpfiles.d/tmp.conf | |
837 | d /var/tmp 1777 root root 30d | |
838 | </programlisting> | |
839 | ||
840 | <programlisting># /usr/lib/tmpfiles.d/abrt.conf | |
841 | d /var/tmp/abrt 0755 abrt abrt - | |
df8dee85 ZJS |
842 | </programlisting> |
843 | </example> | |
844 | ||
845 | <example> | |
846 | <title>Apply clean up during boot and based on time</title> | |
847 | ||
848 | <programlisting># /usr/lib/tmpfiles.d/dnf.conf | |
849 | r! /var/cache/dnf/*/*/download_lock.pid | |
850 | r! /var/cache/dnf/*/*/metadata_lock.pid | |
851 | r! /var/lib/dnf/rpmdb_lock.pid | |
e80f1a79 | 852 | e /var/cache/dnf/ - - - 30d |
4b743d67 | 853 | </programlisting> |
302fbdf2 | 854 | |
df8dee85 | 855 | <para>The lock files will be removed during boot. Any files and directories in |
e80f1a79 | 856 | <filename>/var/cache/dnf/</filename> will be removed after they have not been |
df8dee85 | 857 | accessed in 30 days.</para> |
302fbdf2 | 858 | </example> |
ed7fd549 ZJS |
859 | |
860 | <example> | |
b719b26c | 861 | <title>Empty the contents of a cache directory on boot</title> |
ed7fd549 ZJS |
862 | |
863 | <programlisting># /usr/lib/tmpfiles.d/krb5rcache.conf | |
864 | e! /var/cache/krb5rcache - - - 0 | |
865 | </programlisting> | |
866 | ||
867 | <para>Any files and subdirectories in <filename>/var/cache/krb5rcache/</filename> | |
868 | will be removed on boot. The directory will not be created. | |
869 | </para> | |
870 | </example> | |
87d18863 LB |
871 | |
872 | <example> | |
873 | <title>Provision SSH public key access for root user via Credentials in QEMU</title> | |
874 | ||
875 | <programlisting>-smbios type=11,value=io.systemd.credential.binary:tmpfiles.extra=$(echo "f~ /root/.ssh/authorized_keys 700 root root - $(ssh-add -L | base64 -w 0)" | base64 -w 0) | |
876 | </programlisting> | |
877 | ||
bf63dadb ZJS |
878 | <para>By passing this line to QEMU, the public key of the current user will be encoded in base64, added |
879 | to a tmpfiles.d line that tells <command>systemd-tmpfiles</command> to decode it into | |
880 | <filename>/root/.ssh/authorized_keys</filename>, encode that line itself in base64 and pass it as a | |
881 | Credential that will be picked up by systemd from SMBIOS on boot. | |
87d18863 LB |
882 | </para> |
883 | </example> | |
302fbdf2 ZJS |
884 | </refsect1> |
885 | ||
6a89d671 ZJS |
886 | <refsect1> |
887 | <title><filename>/run/</filename> and <filename>/var/run/</filename></title> | |
888 | <para><filename>/var/run/</filename> is a deprecated symlink to <filename>/run/</filename>, and | |
889 | applications should use the latter. <command>systemd-tmpfiles</command> will warn if | |
890 | <filename>/var/run/</filename> is used.</para> | |
891 | </refsect1> | |
892 | ||
302fbdf2 ZJS |
893 | <refsect1> |
894 | <title>See Also</title> | |
13a69c12 DT |
895 | <para><simplelist type="inline"> |
896 | <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member> | |
897 | <member><citerefentry><refentrytitle>systemd-tmpfiles</refentrytitle><manvolnum>8</manvolnum></citerefentry></member> | |
898 | <member><citerefentry><refentrytitle>systemd-delta</refentrytitle><manvolnum>1</manvolnum></citerefentry></member> | |
899 | <member><citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry></member> | |
900 | <member><citerefentry project='man-pages'><refentrytitle>attr</refentrytitle><manvolnum>5</manvolnum></citerefentry></member> | |
901 | <member><citerefentry project='man-pages'><refentrytitle>getfattr</refentrytitle><manvolnum>1</manvolnum></citerefentry></member> | |
902 | <member><citerefentry project='man-pages'><refentrytitle>setfattr</refentrytitle><manvolnum>1</manvolnum></citerefentry></member> | |
903 | <member><citerefentry project='man-pages'><refentrytitle>setfacl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member> | |
904 | <member><citerefentry project='man-pages'><refentrytitle>getfacl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member> | |
905 | <member><citerefentry project='man-pages'><refentrytitle>chattr</refentrytitle><manvolnum>1</manvolnum></citerefentry></member> | |
906 | <member><citerefentry project='url'><refentrytitle url='https://btrfs.readthedocs.io/en/latest/btrfs-subvolume.html'>btrfs-subvolume</refentrytitle><manvolnum>8</manvolnum></citerefentry></member> | |
907 | <member><citerefentry project='url'><refentrytitle url='https://btrfs.readthedocs.io/en/latest/btrfs-qgroup.html'>btrfs-qgroup</refentrytitle><manvolnum>8</manvolnum></citerefentry></member> | |
908 | </simplelist></para> | |
302fbdf2 | 909 | </refsect1> |
4149f86d BP |
910 | |
911 | </refentry> |