man/systemd-system.conf.xml

   1 <?xml version='1.0'?>
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
   4 <!ENTITY % entities SYSTEM "custom-entities.ent" >
   5 %entities;
   6 ]>
   7 <!-- SPDX-License-Identifier: LGPL-2.1+ -->
   8
   9 <refentry id="systemd-system.conf"
  10     xmlns:xi="http://www.w3.org/2001/XInclude">
  11   <refentryinfo>
  12     <title>systemd-system.conf</title>
  13     <productname>systemd</productname>
  14   </refentryinfo>
  15
  16   <refmeta>
  17     <refentrytitle>systemd-system.conf</refentrytitle>
  18     <manvolnum>5</manvolnum>
  19   </refmeta>
  20
  21   <refnamediv>
  22     <refname>systemd-system.conf</refname>
  23     <refname>system.conf.d</refname>
  24     <refname>systemd-user.conf</refname>
  25     <refname>user.conf.d</refname>
  26     <refpurpose>System and session service manager configuration files</refpurpose>
  27   </refnamediv>
  28
  29   <refsynopsisdiv>
  30     <para><filename>/etc/systemd/system.conf</filename>,
  31     <filename>/etc/systemd/system.conf.d/*.conf</filename>,
  32     <filename>/run/systemd/system.conf.d/*.conf</filename>,
  33     <filename>/usr/lib/systemd/system.conf.d/*.conf</filename></para>
  34     <para><filename>/etc/systemd/user.conf</filename>,
  35     <filename>/etc/systemd/user.conf.d/*.conf</filename>,
  36     <filename>/run/systemd/user.conf.d/*.conf</filename>,
  37     <filename>/usr/lib/systemd/user.conf.d/*.conf</filename></para>
  38   </refsynopsisdiv>
  39
  40   <refsect1>
  41     <title>Description</title>
  42
  43     <para>When run as a system instance, systemd interprets the
  44     configuration file <filename>system.conf</filename> and the files
  45     in <filename>system.conf.d</filename> directories; when run as a
  46     user instance, systemd interprets the configuration file
  47     <filename>user.conf</filename> and the files in
  48     <filename>user.conf.d</filename> directories. These configuration
  49     files contain a few settings controlling basic manager
  50     operations. See
  51     <citerefentry><refentrytitle>systemd.syntax</refentrytitle><manvolnum>5</manvolnum></citerefentry>
  52     for a general description of the syntax.</para>
  53   </refsect1>
  54
  55   <xi:include href="standard-conf.xml" xpointer="main-conf" />
  56
  57   <refsect1>
  58     <title>Options</title>
  59
  60     <para>All options are configured in the
  61     <literal>[Manager]</literal> section:</para>
  62
  63     <variablelist class='config-directives'>
  64
  65       <varlistentry>
  66         <term><varname>LogLevel=</varname></term>
  67         <term><varname>LogTarget=</varname></term>
  68         <term><varname>LogColor=</varname></term>
  69         <term><varname>LogLocation=</varname></term>
  70         <term><varname>DumpCore=yes</varname></term>
  71         <term><varname>CrashChangeVT=no</varname></term>
  72         <term><varname>CrashShell=no</varname></term>
  73         <term><varname>CrashReboot=no</varname></term>
  74         <term><varname>ShowStatus=yes</varname></term>
  75         <term><varname>DefaultStandardOutput=journal</varname></term>
  76         <term><varname>DefaultStandardError=inherit</varname></term>
  77
  78         <listitem><para>Configures various parameters of basic manager operation. These options may be overridden by
  79         the respective process and kernel command line arguments. See
  80         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
  81         details.</para></listitem>
  82       </varlistentry>
  83
  84       <varlistentry>
  85         <term><varname>CtrlAltDelBurstAction=</varname></term>
  86
  87         <listitem><para>Defines what action will be performed
  88         if user presses Ctrl-Alt-Delete more than 7 times in 2s.
  89         Can be set to <literal>reboot-force</literal>, <literal>poweroff-force</literal>,
  90         <literal>reboot-immediate</literal>, <literal>poweroff-immediate</literal>
  91         or disabled with <literal>none</literal>. Defaults to
  92         <literal>reboot-force</literal>.
  93         </para></listitem>
  94       </varlistentry>
  95
  96       <varlistentry>
  97         <term><varname>CPUAffinity=</varname></term>
  98
  99         <listitem><para>Configures the CPU affinity for the service manager as well as the default CPU
 100         affinity for all forked off processes. Takes a list of CPU indices or ranges separated by either
 101         whitespace or commas. CPU ranges are specified by the lower and upper CPU indices separated by a
 102         dash. This option may be specified more than once, in which case the specified CPU affinity masks are
 103         merged. If the empty string is assigned, the mask is reset, all assignments prior to this will have
 104         no effect. Individual services may override the CPU affinity for their processes with the
 105         <varname>CPUAffinity=</varname> setting in unit files, see
 106         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para></listitem>
 107       </varlistentry>
 108
 109       <varlistentry>
 110         <term><varname>NUMAPolicy=</varname></term>
 111
 112         <listitem><para>Configures the NUMA memory policy for the service manager and the default NUMA memory policy
 113         for all forked off processes. Individual services may override the default policy with the
 114         <varname>NUMAPolicy=</varname> setting in unit files, see
 115         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para></listitem>
 116       </varlistentry>
 117
 118       <varlistentry>
 119         <term><varname>NUMAMask=</varname></term>
 120
 121         <listitem><para>Configures the NUMA node mask that will be associated with the selected NUMA policy. Note that
 122         <option>default</option> and <option>local</option> NUMA policies don't require explicit NUMA node mask and
 123         value of the option can be empty. Similarly to <varname>NUMAPolicy=</varname>, value can be overridden
 124         by individual services in unit files, see
 125         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para></listitem>
 126       </varlistentry>
 127
 128       <varlistentry>
 129         <term><varname>RuntimeWatchdogSec=</varname></term>
 130         <term><varname>RebootWatchdogSec=</varname></term>
 131         <term><varname>KExecWatchdogSec=</varname></term>
 132
 133         <listitem><para>Configure the hardware watchdog at runtime and at reboot. Takes a timeout value in seconds (or
 134         in other time units if suffixed with <literal>ms</literal>, <literal>min</literal>, <literal>h</literal>,
 135         <literal>d</literal>, <literal>w</literal>). If <varname>RuntimeWatchdogSec=</varname> is set to a non-zero
 136         value, the watchdog hardware (<filename>/dev/watchdog</filename> or the path specified with
 137         <varname>WatchdogDevice=</varname> or the kernel option <varname>systemd.watchdog-device=</varname>) will be
 138         programmed to automatically reboot the system if it is not contacted within the specified timeout interval. The
 139         system manager will ensure to contact it at least once in half the specified timeout interval. This feature
 140         requires a hardware watchdog device to be present, as it is commonly the case in embedded and server
 141         systems. Not all hardware watchdogs allow configuration of all possible reboot timeout values, in which case
 142         the closest available timeout is picked. <varname>RebootWatchdogSec=</varname> may be used to configure the
 143         hardware watchdog when the system is asked to reboot. It works as a safety net to ensure that the reboot takes
 144         place even if a clean reboot attempt times out. Note that the <varname>RebootWatchdogSec=</varname> timeout
 145         applies only to the second phase of the reboot, i.e. after all regular services are already terminated, and
 146         after the system and service manager process (PID 1) got replaced by the <filename>systemd-shutdown</filename>
 147         binary, see system <citerefentry><refentrytitle>bootup</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 148         for details. During the first phase of the shutdown operation the system and service manager remains running
 149         and hence <varname>RuntimeWatchdogSec=</varname> is still honoured. In order to define a timeout on this first
 150         phase of system shutdown, configure <varname>JobTimeoutSec=</varname> and <varname>JobTimeoutAction=</varname>
 151         in the <literal>[Unit]</literal> section of the <filename>shutdown.target</filename> unit. By default
 152         <varname>RuntimeWatchdogSec=</varname> defaults to 0 (off), and <varname>RebootWatchdogSec=</varname> to
 153         10min. <varname>KExecWatchdogSec=</varname> may be used to additionally enable the watchdog when kexec
 154         is being executed rather than when rebooting. Note that if the kernel does not reset the watchdog on kexec (depending
 155         on the specific hardware and/or driver), in this case the watchdog might not get disabled after kexec succeeds
 156         and thus the system might get rebooted, unless <varname>RuntimeWatchdogSec=</varname> is also enabled at the same time.
 157         For this reason it is recommended to enable <varname>KExecWatchdogSec=</varname> only if
 158         <varname>RuntimeWatchdogSec=</varname> is also enabled.
 159         These settings have no effect if a hardware watchdog is not available.</para></listitem>
 160       </varlistentry>
 161
 162       <varlistentry>
 163         <term><varname>WatchdogDevice=</varname></term>
 164
 165         <listitem><para>Configure the hardware watchdog device that the
 166         runtime and shutdown watchdog timers will open and use. Defaults
 167         to <filename>/dev/watchdog</filename>. This setting has no
 168         effect if a hardware watchdog is not available.</para></listitem>
 169       </varlistentry>
 170
 171       <varlistentry>
 172         <term><varname>CapabilityBoundingSet=</varname></term>
 173
 174         <listitem><para>Controls which capabilities to include in the
 175         capability bounding set for PID 1 and its children. See
 176         <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 177         for details. Takes a whitespace-separated list of capability
 178         names as read by
 179         <citerefentry project='mankier'><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
 180         Capabilities listed will be included in the bounding set, all
 181         others are removed. If the list of capabilities is prefixed
 182         with ~, all but the listed capabilities will be included, the
 183         effect of the assignment inverted. Note that this option also
 184         affects the respective capabilities in the effective,
 185         permitted and inheritable capability sets. The capability
 186         bounding set may also be individually configured for units
 187         using the <varname>CapabilityBoundingSet=</varname> directive
 188         for units, but note that capabilities dropped for PID 1 cannot
 189         be regained in individual units, they are lost for
 190         good.</para></listitem>
 191       </varlistentry>
 192
 193       <varlistentry>
 194         <term><varname>NoNewPrivileges=</varname></term>
 195
 196         <listitem><para>Takes a boolean argument. If true, ensures that PID 1
 197         and all its children can never gain new privileges through
 198         <citerefentry project='man-pages'><refentrytitle>execve</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 199         (e.g. via setuid or setgid bits, or filesystem capabilities).
 200         Defaults to false. General purpose distributions commonly rely
 201         on executables with setuid or setgid bits and will thus not
 202         function properly with this option enabled. Individual units
 203         cannot disable this option.
 204         Also see <ulink url="https://www.kernel.org/doc/html/latest/userspace-api/no_new_privs.html">No New Privileges Flag</ulink>.
 205         </para></listitem>
 206       </varlistentry>
 207
 208       <varlistentry>
 209         <term><varname>SystemCallArchitectures=</varname></term>
 210
 211         <listitem><para>Takes a space-separated list of architecture
 212         identifiers. Selects from which architectures system calls may
 213         be invoked on this system. This may be used as an effective
 214         way to disable invocation of non-native binaries system-wide,
 215         for example to prohibit execution of 32-bit x86 binaries on
 216         64-bit x86-64 systems. This option operates system-wide, and
 217         acts similar to the
 218         <varname>SystemCallArchitectures=</varname> setting of unit
 219         files, see
 220         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 221         for details. This setting defaults to the empty list, in which
 222         case no filtering of system calls based on architecture is
 223         applied. Known architecture identifiers are
 224         <literal>x86</literal>, <literal>x86-64</literal>,
 225         <literal>x32</literal>, <literal>arm</literal> and the special
 226         identifier <literal>native</literal>. The latter implicitly
 227         maps to the native architecture of the system (or more
 228         specifically, the architecture the system manager was compiled
 229         for). Set this setting to <literal>native</literal> to
 230         prohibit execution of any non-native binaries. When a binary
 231         executes a system call of an architecture that is not listed
 232         in this setting, it will be immediately terminated with the
 233         SIGSYS signal.</para></listitem>
 234       </varlistentry>
 235
 236       <varlistentry>
 237         <term><varname>TimerSlackNSec=</varname></term>
 238
 239         <listitem><para>Sets the timer slack in nanoseconds for PID 1,
 240         which is inherited by all executed processes, unless
 241         overridden individually, for example with the
 242         <varname>TimerSlackNSec=</varname> setting in service units
 243         (for details see
 244         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>).
 245         The timer slack controls the accuracy of wake-ups triggered by
 246         system timers. See
 247         <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 248         for more information. Note that in contrast to most other time
 249         span definitions this parameter takes an integer value in
 250         nano-seconds if no unit is specified. The usual time units are
 251         understood too.</para></listitem>
 252       </varlistentry>
 253
 254       <varlistentry>
 255         <term><varname>StatusUnitFormat=</varname></term>
 256
 257         <listitem><para>Takes either <option>name</option> or <option>description</option> as the value. If
 258         <option>name</option>, the system manager will use unit names in status messages, instead of the
 259         longer and more informative descriptions set with <varname>Description=</varname>, see
 260         <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 261         </para></listitem>
 262       </varlistentry>
 263
 264       <varlistentry>
 265         <term><varname>DefaultTimerAccuracySec=</varname></term>
 266
 267         <listitem><para>Sets the default accuracy of timer units. This
 268         controls the global default for the
 269         <varname>AccuracySec=</varname> setting of timer units, see
 270         <citerefentry><refentrytitle>systemd.timer</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 271         for details. <varname>AccuracySec=</varname> set in individual
 272         units override the global default for the specific unit.
 273         Defaults to 1min. Note that the accuracy of timer units is
 274         also affected by the configured timer slack for PID 1, see
 275         <varname>TimerSlackNSec=</varname> above.</para></listitem>
 276       </varlistentry>
 277
 278       <varlistentry>
 279         <term><varname>DefaultTimeoutStartSec=</varname></term>
 280         <term><varname>DefaultTimeoutStopSec=</varname></term>
 281         <term><varname>DefaultTimeoutAbortSec=</varname></term>
 282         <term><varname>DefaultRestartSec=</varname></term>
 283
 284         <listitem><para>Configures the default timeouts for starting,
 285         stopping and aborting of units, as well as the default time to sleep
 286         between automatic restarts of units, as configured per-unit in
 287         <varname>TimeoutStartSec=</varname>,
 288         <varname>TimeoutStopSec=</varname>,
 289         <varname>TimeoutAbortSec=</varname> and
 290         <varname>RestartSec=</varname> (for services, see
 291         <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 292         for details on the per-unit settings). Disabled by default, when
 293         service with <varname>Type=oneshot</varname> is used.
 294         For non-service units,
 295         <varname>DefaultTimeoutStartSec=</varname> sets the default
 296         <varname>TimeoutSec=</varname>
 297         value. <varname>DefaultTimeoutStartSec=</varname> and
 298         <varname>DefaultTimeoutStopSec=</varname> default to
 299         90s. <varname>DefaultTimeoutAbortSec=</varname> is not set by default
 300         so that all units fall back to <varname>TimeoutStopSec=</varname>.
 301         <varname>DefaultRestartSec=</varname> defaults to
 302         100ms.</para></listitem>
 303       </varlistentry>
 304
 305       <varlistentry>
 306         <term><varname>DefaultStartLimitIntervalSec=</varname></term>
 307         <term><varname>DefaultStartLimitBurst=</varname></term>
 308
 309         <listitem><para>Configure the default unit start rate
 310         limiting, as configured per-service by
 311         <varname>StartLimitIntervalSec=</varname> and
 312         <varname>StartLimitBurst=</varname>. See
 313         <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 314         for details on the per-service settings.
 315         <varname>DefaultStartLimitIntervalSec=</varname> defaults to
 316         10s. <varname>DefaultStartLimitBurst=</varname> defaults to
 317         5.</para></listitem>
 318       </varlistentry>
 319
 320       <varlistentry>
 321         <term><varname>DefaultEnvironment=</varname></term>
 322
 323         <listitem><para>Sets manager environment variables passed to
 324         all executed processes. Takes a space-separated list of
 325         variable assignments. See
 326         <citerefentry project='man-pages'><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 327         for details about environment variables.</para>
 328
 329         <para>Example:
 330
 331         <programlisting>DefaultEnvironment="VAR1=word1 word2" VAR2=word3 "VAR3=word 5 6"</programlisting>
 332
 333         Sets three variables
 334         <literal>VAR1</literal>,
 335         <literal>VAR2</literal>,
 336         <literal>VAR3</literal>.</para></listitem>
 337       </varlistentry>
 338
 339       <varlistentry>
 340         <term><varname>DefaultCPUAccounting=</varname></term>
 341         <term><varname>DefaultBlockIOAccounting=</varname></term>
 342         <term><varname>DefaultMemoryAccounting=</varname></term>
 343         <term><varname>DefaultTasksAccounting=</varname></term>
 344         <term><varname>DefaultIOAccounting=</varname></term>
 345         <term><varname>DefaultIPAccounting=</varname></term>
 346
 347         <listitem><para>Configure the default resource accounting settings, as configured per-unit by
 348         <varname>CPUAccounting=</varname>, <varname>BlockIOAccounting=</varname>, <varname>MemoryAccounting=</varname>,
 349         <varname>TasksAccounting=</varname>, <varname>IOAccounting=</varname> and <varname>IPAccounting=</varname>. See
 350         <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 351         for details on the per-unit settings. <varname>DefaultTasksAccounting=</varname> defaults to yes,
 352         <varname>DefaultMemoryAccounting=</varname> to &MEMORY_ACCOUNTING_DEFAULT;. <varname>DefaultCPUAccounting=</varname>
 353         defaults to yes if enabling CPU accounting doesn't require the CPU controller to be enabled (Linux 4.15+ using the
 354         unified hierarchy for resource control), otherwise it defaults to no. The other three settings default to no.</para></listitem>
 355       </varlistentry>
 356
 357       <varlistentry>
 358         <term><varname>DefaultTasksMax=</varname></term>
 359
 360         <listitem><para>Configure the default value for the per-unit <varname>TasksMax=</varname> setting. See
 361         <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 362         for details. This setting applies to all unit types that support resource control settings, with the exception
 363         of slice units. Defaults to 15%, which equals 4915 with the kernel's defaults on the host, but might be smaller
 364         in OS containers.</para></listitem>
 365       </varlistentry>
 366
 367       <varlistentry>
 368         <term><varname>DefaultLimitCPU=</varname></term>
 369         <term><varname>DefaultLimitFSIZE=</varname></term>
 370         <term><varname>DefaultLimitDATA=</varname></term>
 371         <term><varname>DefaultLimitSTACK=</varname></term>
 372         <term><varname>DefaultLimitCORE=</varname></term>
 373         <term><varname>DefaultLimitRSS=</varname></term>
 374         <term><varname>DefaultLimitNOFILE=</varname></term>
 375         <term><varname>DefaultLimitAS=</varname></term>
 376         <term><varname>DefaultLimitNPROC=</varname></term>
 377         <term><varname>DefaultLimitMEMLOCK=</varname></term>
 378         <term><varname>DefaultLimitLOCKS=</varname></term>
 379         <term><varname>DefaultLimitSIGPENDING=</varname></term>
 380         <term><varname>DefaultLimitMSGQUEUE=</varname></term>
 381         <term><varname>DefaultLimitNICE=</varname></term>
 382         <term><varname>DefaultLimitRTPRIO=</varname></term>
 383         <term><varname>DefaultLimitRTTIME=</varname></term>
 384
 385         <listitem><para>These settings control various default
 386         resource limits for units. See
 387         <citerefentry><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 388         for details. The resource limit is possible to specify in two formats,
 389         <option>value</option> to set soft and hard limits to the same value,
 390         or <option>soft:hard</option> to set both limits individually (e.g. DefaultLimitAS=4G:16G).
 391         Use the string <varname>infinity</varname> to
 392         configure no limit on a specific resource. The multiplicative
 393         suffixes K (=1024), M (=1024*1024) and so on for G, T, P and E
 394         may be used for resource limits measured in bytes
 395         (e.g. DefaultLimitAS=16G). For the limits referring to time values,
 396         the usual time units ms, s, min, h and so on may be used (see
 397         <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 398         for details). Note that if no time unit is specified for
 399         <varname>DefaultLimitCPU=</varname> the default unit of seconds is
 400         implied, while for <varname>DefaultLimitRTTIME=</varname> the default
 401         unit of microseconds is implied. Also, note that the effective
 402         granularity of the limits might influence their
 403         enforcement. For example, time limits specified for
 404         <varname>DefaultLimitCPU=</varname> will be rounded up implicitly to
 405         multiples of 1s. These  settings may be overridden in individual units
 406         using the corresponding LimitXXX= directives. Note that these resource
 407         limits are only defaults for units, they are not applied to PID 1
 408         itself.</para></listitem>
 409       </varlistentry>
 410
 411       <varlistentry>
 412         <term><varname>DefaultOOMPolicy=</varname></term>
 413
 414         <listitem><para>Configure the default policy for reacting to processes being killed by the Linux
 415         Out-Of-Memory (OOM) killer. This may be used to pick a global default for the per-unit
 416         <varname>OOMPolicy=</varname> setting. See
 417         <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 418         for details. Note that this default is not used for services that have <varname>Delegate=</varname>
 419         turned on.</para></listitem>
 420       </varlistentry>
 421     </variablelist>
 422   </refsect1>
 423
 424   <refsect1>
 425       <title>See Also</title>
 426       <para>
 427         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 428         <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 429         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 430         <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 431         <citerefentry project='man-pages'><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
 432         <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 433       </para>
 434   </refsect1>
 435
 436 </refentry>