<citerefentry><refentrytitle>systemd-soft-reboot.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>),
in case the service is configured to survive it.</para>
- <xi:include href="system-only.xml" xpointer="singular"/></listitem>
+ <xi:include href="system-only.xml" xpointer="singular"/>
+
+ <xi:include href="version-info.xml" xpointer="v233"/></listitem>
</varlistentry>
<varlistentry>
<para>In order to allow propagating mounts at runtime in a safe manner, <filename>/run/systemd/propagate</filename>
on the host will be used to set up new mounts, and <filename>/run/host/incoming/</filename> in the private namespace
- will be used as an intermediate step to store them before being moved to the final mount point.</para></listitem>
+ will be used as an intermediate step to store them before being moved to the final mount point.</para>
+
+ <xi:include href="version-info.xml" xpointer="v233"/></listitem>
</varlistentry>
<varlistentry>
<varname>InaccessiblePaths=</varname>, or under <filename>/home/</filename> and other protected
directories if <varname>ProtectHome=yes</varname> is
specified. <varname>TemporaryFileSystem=</varname> with <literal>:ro</literal> or
- <varname>ProtectHome=tmpfs</varname> should be used instead.</para></listitem>
+ <varname>ProtectHome=tmpfs</varname> should be used instead.</para>
+
+ <xi:include href="version-info.xml" xpointer="v233"/></listitem>
</varlistentry>
<varlistentry>
owned by the dynamic user/group that are not subject to the lifecycle and access guarantees of the
service. Note that this option is currently incompatible with D-Bus policies, thus a service using
this option may currently not allocate a D-Bus service name (note that this does not affect calling
- into other D-Bus services). Defaults to off.</para></listitem>
+ into other D-Bus services). Defaults to off.</para>
+
+ <xi:include href="version-info.xml" xpointer="v232"/></listitem>
</varlistentry>
<varlistentry>
give it some capabilities. Note that in this case option <constant>keep-caps</constant> is automatically added
to <varname>SecureBits=</varname> to retain the capabilities over the user
change. <varname>AmbientCapabilities=</varname> does not affect commands prefixed with
- <literal>+</literal>.</para></listitem>
+ <literal>+</literal>.</para>
+
+ <xi:include href="version-info.xml" xpointer="v229"/></listitem>
</varlistentry>
</variablelist>
<citerefentry
project='man-pages'><refentrytitle>crontab</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
<citerefentry><refentrytitle>systemd-run</refentrytitle><manvolnum>1</manvolnum></citerefentry>, or
- arbitrary IPC services.</para></listitem>
+ arbitrary IPC services.</para>
+
+ <xi:include href="version-info.xml" xpointer="v187"/></listitem>
</varlistentry>
<varlistentry>
non-overridden context. This does not affect commands prefixed with <literal>+</literal>. See
<citerefentry
project='die-net'><refentrytitle>setexeccon</refentrytitle><manvolnum>3</manvolnum></citerefentry>
- for details.</para></listitem>
+ for details.</para>
+
+ <xi:include href="version-info.xml" xpointer="v209"/></listitem>
</varlistentry>
<varlistentry>
this profile when started. Profiles must already be loaded in the kernel, or the unit will fail. If
prefixed by <literal>-</literal>, all errors will be ignored. This setting has no effect if AppArmor
is not enabled. This setting does not affect commands prefixed with <literal>+</literal>.</para>
+
+ <xi:include href="version-info.xml" xpointer="v210"/>
</listitem>
</varlistentry>
<para>The value may be prefixed by <literal>-</literal>, in which case all errors will be ignored. An empty
value may be specified to unset previous assignments. This does not affect commands prefixed with
- <literal>+</literal>.</para></listitem>
+ <literal>+</literal>.</para>
+
+ <xi:include href="version-info.xml" xpointer="v218"/></listitem>
</varlistentry>
</variablelist>
<option>inherit</option> is selected the unique invocation ID for the unit (see below) is added as a protected
key by the name <literal>invocation_id</literal> to the newly created session keyring. Defaults to
<option>private</option> for services of the system service manager and to <option>inherit</option> for
- non-service units and for services of the user service manager.</para></listitem>
+ non-service units and for services of the user service manager.</para>
+
+ <xi:include href="version-info.xml" xpointer="v235"/></listitem>
</varlistentry>
<varlistentry>
feature is useful when running 32-bit services on a 64-bit host system. If not specified, the
personality is left unmodified and thus reflects the personality of the host system's kernel. This
option is not useful on architectures for which only one native word width was ever available, such
- as <constant>m68k</constant> (32-bit only) or <constant>alpha</constant> (64-bit only).</para></listitem>
+ as <constant>m68k</constant> (32-bit only) or <constant>alpha</constant> (64-bit only).</para>
+
+ <xi:include href="version-info.xml" xpointer="v209"/></listitem>
</varlistentry>
<varlistentry>
<varname>ReadWritePaths=</varname> may be used to exclude specific directories from being made read-only. This
setting is implied if <varname>DynamicUser=</varname> is set. This setting cannot ensure protection in all
cases. In general it has the same limitations as <varname>ReadOnlyPaths=</varname>, see below. Defaults to
- off.</para></listitem>
+ off.</para>
+
+ <xi:include href="version-info.xml" xpointer="v214"/></listitem>
</varlistentry>
<varlistentry>
<varname>DynamicUser=</varname> is set. This setting cannot ensure protection in all cases. In
general it has the same limitations as <varname>ReadOnlyPaths=</varname>, see below.</para>
- <xi:include href="system-or-user-ns.xml" xpointer="singular"/></listitem>
+ <xi:include href="system-or-user-ns.xml" xpointer="singular"/>
+
+ <xi:include href="version-info.xml" xpointer="v214"/></listitem>
</varlistentry>
<varlistentry>
<programlisting>RuntimeDirectory=foo:bar foo:baz</programlisting>
the service manager creates <filename index='false'>/run/foo</filename> (if it does not exist), and
<filename index='false'>/run/bar</filename> plus <filename index='false'>/run/baz</filename> as symlinks to
- <filename index='false'>/run/foo</filename>.</para></listitem>
+ <filename index='false'>/run/foo</filename>.</para>
+
+ <xi:include href="version-info.xml" xpointer="v211"/></listitem>
</varlistentry>
<varlistentry>
<varname>ConfigurationDirectory=</varname>, respectively, as an octal number. Defaults to
<constant>0755</constant>. See "Permissions" in <citerefentry
project='man-pages'><refentrytitle>path_resolution</refentrytitle><manvolnum>7</manvolnum></citerefentry> for a
- discussion of the meaning of permission bits.</para></listitem>
+ discussion of the meaning of permission bits.</para>
+
+ <xi:include href="version-info.xml" xpointer="v234"/></listitem>
</varlistentry>
<varlistentry>
foo.service</command>. If set to <option>yes</option>, then the directories are not removed when the service is
stopped. Note that since the runtime directory <filename>/run/</filename> is a mount point of
<literal>tmpfs</literal>, then for system services the directories specified in
- <varname>RuntimeDirectory=</varname> are removed when the system is rebooted.</para></listitem>
+ <varname>RuntimeDirectory=</varname> are removed when the system is rebooted.</para>
+
+ <xi:include href="version-info.xml" xpointer="v235"/></listitem>
</varlistentry>
<varlistentry>
ExecPaths=/usr/sbin/my_daemon /usr/lib /usr/lib64
</programlisting></para>
- <xi:include href="system-or-user-ns.xml" xpointer="plural"/></listitem>
+ <xi:include href="system-or-user-ns.xml" xpointer="plural"/>
+
+ <xi:include href="version-info.xml" xpointer="v231"/></listitem>
</varlistentry>
<varlistentry>
<para>When access to some but not all devices must be possible, the <varname>DeviceAllow=</varname>
setting might be used instead. See
<citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
- </para></listitem>
+ </para>
+
+ <xi:include href="version-info.xml" xpointer="v209"/></listitem>
</varlistentry>
<varlistentry>
<para>Note that the implementation of this setting might be impossible (for example if user namespaces are not
available), and the unit should be written in a way that does not solely rely on this setting for
- security.</para></listitem>
+ security.</para>
+
+ <xi:include href="version-info.xml" xpointer="v232"/></listitem>
</varlistentry>
<varlistentry>
inaccessible. If <varname>ProtectKernelTunables=</varname> is set,
<varname>MountAPIVFS=yes</varname> is implied.</para>
- <xi:include href="system-or-user-ns.xml" xpointer="singular"/></listitem>
+ <xi:include href="system-or-user-ns.xml" xpointer="singular"/>
+
+ <xi:include href="version-info.xml" xpointer="v232"/></listitem>
</varlistentry>
<varlistentry>
but the unit doesn't have the <constant>CAP_SYS_ADMIN</constant> capability (e.g. services for
which <varname>User=</varname> is set), <varname>NoNewPrivileges=yes</varname> is implied.</para>
- <xi:include href="system-or-user-ns.xml" xpointer="singular"/></listitem>
+ <xi:include href="system-or-user-ns.xml" xpointer="singular"/>
+
+ <xi:include href="version-info.xml" xpointer="v232"/></listitem>
</varlistentry>
<varlistentry>
above. Defaults to off. If <varname>ProtectControlGroups=</varname> is set, <varname>MountAPIVFS=yes</varname>
is implied.</para>
- <xi:include href="system-only.xml" xpointer="singular"/></listitem>
+ <xi:include href="system-only.xml" xpointer="singular"/>
+
+ <xi:include href="version-info.xml" xpointer="v232"/></listitem>
</varlistentry>
<varlistentry>
<constant>AF_UNIX</constant> address family should be included in the configured allow list as it is frequently
used for local communication, including for
<citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>2</manvolnum></citerefentry>
- logging.</para></listitem>
+ logging.</para>
+
+ <xi:include href="version-info.xml" xpointer="v211"/></listitem>
</varlistentry>
<varlistentry>
If the second line is prefixed with <literal>~</literal>, e.g.,
<programlisting>RestrictNamespaces=cgroup ipc
RestrictNamespaces=~cgroup net</programlisting>
- then, only <constant>ipc</constant> is set.</para></listitem>
+ then, only <constant>ipc</constant> is set.</para>
+
+ <xi:include href="version-info.xml" xpointer="v233"/></listitem>
</varlistentry>
<varlistentry>
<varname>Personality=</varname> directive. This may be useful to improve security, because odd personality
emulations may be poorly tested and source of vulnerabilities. If running in user mode, or in system mode, but
without the <constant>CAP_SYS_ADMIN</constant> capability (e.g. setting <varname>User=</varname>),
- <varname>NoNewPrivileges=yes</varname> is implied.</para></listitem>
+ <varname>NoNewPrivileges=yes</varname> is implied.</para>
+
+ <xi:include href="version-info.xml" xpointer="v235"/></listitem>
</varlistentry>
<varlistentry>
restrictions of this option. Specifically, it is recommended to combine this option with
<varname>SystemCallArchitectures=native</varname> or similar. If running in user mode, or in system
mode, but without the <constant>CAP_SYS_ADMIN</constant> capability (e.g. setting
- <varname>User=</varname>), <varname>NoNewPrivileges=yes</varname> is implied.</para></listitem>
+ <varname>User=</varname>), <varname>NoNewPrivileges=yes</varname> is implied.</para>
+
+ <xi:include href="version-info.xml" xpointer="v231"/></listitem>
</varlistentry>
<varlistentry>
<varname>NoNewPrivileges=yes</varname> is implied. Realtime scheduling policies may be used to monopolize CPU
time for longer periods of time, and may hence be used to lock up or otherwise trigger Denial-of-Service
situations on the system. It is hence recommended to restrict access to realtime scheduling to the few programs
- that actually require them. Defaults to off.</para></listitem>
+ that actually require them. Defaults to off.</para>
+
+ <xi:include href="version-info.xml" xpointer="v231"/></listitem>
</varlistentry>
<varlistentry>
multiple units use the same user or group the IPC objects are removed when the last of these units is
stopped. This setting is implied if <varname>DynamicUser=</varname> is set.</para>
- <xi:include href="system-only.xml" xpointer="singular"/></listitem>
+ <xi:include href="system-only.xml" xpointer="singular"/>
+
+ <xi:include href="version-info.xml" xpointer="v232"/></listitem>
</varlistentry>
<varlistentry>
<varname>PrivateDevices=</varname>, <varname>ProtectSystem=</varname>, <varname>ProtectHome=</varname>,
<varname>ProtectKernelTunables=</varname>, <varname>ProtectControlGroups=</varname>,
<varname>ProtectKernelLogs=</varname>, <varname>ProtectClock=</varname>, <varname>ReadOnlyPaths=</varname>,
- <varname>InaccessiblePaths=</varname> and <varname>ReadWritePaths=</varname>.</para></listitem>
+ <varname>InaccessiblePaths=</varname> and <varname>ReadWritePaths=</varname>.</para>
+
+ <xi:include href="version-info.xml" xpointer="v187"/></listitem>
</varlistentry>
<varlistentry>
project='man-pages'><refentrytitle>errno</refentrytitle><manvolnum>3</manvolnum></citerefentry> for a
full list of error codes. When this setting is not used, or when the empty string or the special
setting <literal>kill</literal> is assigned, the process will be terminated immediately when the
- filter is triggered.</para></listitem>
+ filter is triggered.</para>
+
+ <xi:include href="version-info.xml" xpointer="v209"/></listitem>
</varlistentry>
<varlistentry>
<para>System call architectures may also be restricted system-wide via the
<varname>SystemCallArchitectures=</varname> option in the global configuration. See
<citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
- details.</para></listitem>
+ details.</para>
+
+ <xi:include href="version-info.xml" xpointer="v209"/></listitem>
</varlistentry>
<varlistentry>
<para>
See <citerefentry
project='man-pages'><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry> for details
- about environment variables.</para></listitem>
+ about environment variables.</para>
+
+ <xi:include href="version-info.xml" xpointer="v228"/></listitem>
</varlistentry>
<varlistentry>
<para>See "Environment Variables in Spawned Processes" below for a description of how those
settings combine to form the inherited environment. See <citerefentry
project='man-pages'><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry> for general
- information about environment variables.</para></listitem>
+ information about environment variables.</para>
+
+ <xi:include href="version-info.xml" xpointer="v235"/></listitem>
</varlistentry>
</variablelist>
consumers.</para>
<para>For further information see <ulink url="https://systemd.io/CREDENTIALS">System and Service
- Credentials</ulink> documentation.</para></listitem>
+ Credentials</ulink> documentation.</para>
+
+ <xi:include href="version-info.xml" xpointer="v247"/></listitem>
</varlistentry>
<varlistentry>
<varname>SetCredential=</varname>. As such, <varname>SetCredential=</varname> will act as default if
no credentials are found by any of the former. In this case not being able to retrieve the credential
from the path specified in <varname>LoadCredential=</varname> or
- <varname>LoadCredentialEncrypted=</varname> is not considered fatal.</para></listitem>
+ <varname>LoadCredentialEncrypted=</varname> is not considered fatal.</para>
+
+ <xi:include href="version-info.xml" xpointer="v247"/></listitem>
</varlistentry>
</variablelist>
</refsect1>
utmp/wtmp logic. If <literal>user</literal> is set, first an <constant>INIT_PROCESS</constant> entry, then a
<constant>LOGIN_PROCESS</constant> entry and finally a <constant>USER_PROCESS</constant> entry is
generated. In this case, the invoked process may be any process that is suitable to be run as session
- leader. Defaults to <literal>init</literal>.</para></listitem>
+ leader. Defaults to <literal>init</literal>.</para>
+
+ <xi:include href="version-info.xml" xpointer="v225"/></listitem>
</varlistentry>
</variablelist>
<literal><filename>/usr/local/sbin</filename>:<filename>/usr/local/bin</filename>:<filename>/usr/sbin</filename>:<filename>/usr/bin</filename></literal>
in the system manager. In case of the user manager, a different path may be configured by the
distribution. It is recommended to not rely on the order of entries, and have only one program
- with a given name in <varname>$PATH</varname>.</para></listitem>
+ with a given name in <varname>$PATH</varname>.</para>
+
+ <xi:include href="version-info.xml" xpointer="v208"/></listitem>
</varlistentry>
<varlistentry>
or on the kernel command line (see
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry> and
<citerefentry><refentrytitle>kernel-command-line</refentrytitle><manvolnum>7</manvolnum></citerefentry>).
- </para></listitem>
+ </para>
+
+ <xi:include href="version-info.xml" xpointer="v208"/></listitem>
</varlistentry>
<varlistentry>
<varname>User=</varname> set, which includes user
<command>systemd</command> instances. See
<citerefentry project='die-net'><refentrytitle>passwd</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
- </para></listitem>
+ </para>
+
+ <xi:include href="version-info.xml" xpointer="v208"/></listitem>
</varlistentry>
<varlistentry>
as 32 character hexadecimal string. A new ID is assigned each time the unit changes from an inactive state into
an activating or active state, and may be used to identify this specific runtime cycle, in particular in data
stored offline, such as the journal. The same ID is passed to all processes run as part of the
- unit.</para></listitem>
+ unit.</para>
+
+ <xi:include href="version-info.xml" xpointer="v232"/></listitem>
</varlistentry>
<varlistentry>
services run by the user <command>systemd</command> instance, as well as any system services that use
<varname>PAMName=</varname> with a PAM stack that includes <command>pam_systemd</command>. See below and
<citerefentry><refentrytitle>pam_systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry> for more
- information.</para></listitem>
+ information.</para>
+
+ <xi:include href="version-info.xml" xpointer="v208"/></listitem>
</varlistentry>
<varlistentry>
<varname>RuntimeDirectory=</varname>, <varname>StateDirectory=</varname>,
<varname>CacheDirectory=</varname>, <varname>LogsDirectory=</varname>, and
<varname>ConfigurationDirectory=</varname> when those settings are used.</para>
+
+ <xi:include href="version-info.xml" xpointer="v244"/>
</listitem>
</varlistentry>
<varname>ImportCredential=</varname>/<varname>LoadCredential=</varname>/<varname>SetCredential=</varname>.
The directory is marked read-only and is placed in unswappable memory (if supported and permitted),
and is only accessible to the UID associated with the unit via <varname>User=</varname> or
- <varname>DynamicUser=</varname> (and the superuser).</para></listitem>
+ <varname>DynamicUser=</varname> (and the superuser).</para>
+
+ <xi:include href="version-info.xml" xpointer="v247"/></listitem>
</varlistentry>
<varlistentry>
<listitem><para>The PID of the unit's main process if it is
known. This is only set for control processes as invoked by
- <varname>ExecReload=</varname> and similar.</para></listitem>
+ <varname>ExecReload=</varname> and similar.</para>
+
+ <xi:include href="version-info.xml" xpointer="v209"/></listitem>
</varlistentry>
<varlistentry>
<term><varname>$MANAGERPID</varname></term>
<listitem><para>The PID of the user <command>systemd</command>
- instance, set for processes spawned by it.</para></listitem>
+ instance, set for processes spawned by it.</para>
+
+ <xi:include href="version-info.xml" xpointer="v208"/></listitem>
</varlistentry>
<varlistentry>
<listitem><para>Information about file descriptors passed to a
service for socket activation. See
<citerefentry><refentrytitle>sd_listen_fds</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
- </para></listitem>
+ </para>
+
+ <xi:include href="version-info.xml" xpointer="v208"/></listitem>
</varlistentry>
<varlistentry>
<listitem><para>The socket <function>sd_notify()</function> talks to. See
<citerefentry><refentrytitle>sd_notify</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
- </para></listitem>
+ </para>
+
+ <xi:include href="version-info.xml" xpointer="v229"/></listitem>
</varlistentry>
<varlistentry>
<listitem><para>Information about watchdog keep-alive notifications. See
<citerefentry><refentrytitle>sd_watchdog_enabled</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
- </para></listitem>
+ </para>
+
+ <xi:include href="version-info.xml" xpointer="v229"/></listitem>
</varlistentry>
<varlistentry>
<varname>StandardOutput=tty</varname>, or
<varname>StandardError=tty</varname>). See
<citerefentry project='man-pages'><refentrytitle>termcap</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
- </para></listitem>
+ </para>
+
+ <xi:include href="version-info.xml" xpointer="v209"/></listitem>
</varlistentry>
<varlistentry>
<term><varname>$LOG_NAMESPACE</varname></term>
<listitem><para>Contains the name of the selected logging namespace when the
- <varname>LogNamespace=</varname> service setting is used.</para></listitem>
+ <varname>LogNamespace=</varname> service setting is used.</para>
+
+ <xi:include href="version-info.xml" xpointer="v246"/></listitem>
</varlistentry>
<varlistentry>
protocol to the native journal protocol (using
<citerefentry><refentrytitle>sd_journal_print</refentrytitle><manvolnum>3</manvolnum></citerefentry> and other
functions) if their standard output or standard error output is connected to the journal anyway, thus enabling
- delivery of structured metadata along with logged messages.</para></listitem>
+ delivery of structured metadata along with logged messages.</para>
+
+ <xi:include href="version-info.xml" xpointer="v231"/></listitem>
</varlistentry>
<varlistentry>
though this variable is available in both <varname>ExecStop=</varname> and <varname>ExecStopPost=</varname>, it
is usually a better choice to place monitoring tools in the latter, as the former is only invoked for services
that managed to start up correctly, and the latter covers both services that failed during their start-up and
- those which failed during their runtime.</para></listitem>
+ those which failed during their runtime.</para>
+
+ <xi:include href="version-info.xml" xpointer="v232"/></listitem>
</varlistentry>
<varlistentry>
</row>
</tbody>
</tgroup>
- </table></listitem>
+ </table>
+
+ <xi:include href="version-info.xml" xpointer="v232"/></listitem>
</varlistentry>
<varlistentry>
<citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
for details. Service code may use this environment variable to automatically generate a PID file at
the location configured in the unit file. This field is set to an absolute path in the file
- system.</para></listitem>
+ system.</para>
+
+ <xi:include href="version-info.xml" xpointer="v242"/></listitem>
</varlistentry>
<varlistentry>
projects / thirdparty / systemd.git / blobdiff