]>
Commit | Line | Data |
---|---|---|
514094f9 | 1 | <?xml version='1.0'?> |
3a54a157 | 2 | <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" |
444d5863 ZJS |
3 | "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [ |
4 | <!ENTITY % entities SYSTEM "custom-entities.ent" > | |
5 | %entities; | |
6 | ]> | |
db9ecf05 | 7 | <!-- SPDX-License-Identifier: LGPL-2.1-or-later --> |
f3e219a2 | 8 | |
1b907b5c | 9 | <refentry id="systemd-system.conf" |
798d3a52 ZJS |
10 | xmlns:xi="http://www.w3.org/2001/XInclude"> |
11 | <refentryinfo> | |
12 | <title>systemd-system.conf</title> | |
13 | <productname>systemd</productname> | |
798d3a52 ZJS |
14 | </refentryinfo> |
15 | ||
16 | <refmeta> | |
17 | <refentrytitle>systemd-system.conf</refentrytitle> | |
18 | <manvolnum>5</manvolnum> | |
19 | </refmeta> | |
20 | ||
21 | <refnamediv> | |
22 | <refname>systemd-system.conf</refname> | |
23 | <refname>system.conf.d</refname> | |
24 | <refname>systemd-user.conf</refname> | |
25 | <refname>user.conf.d</refname> | |
26 | <refpurpose>System and session service manager configuration files</refpurpose> | |
27 | </refnamediv> | |
28 | ||
29 | <refsynopsisdiv> | |
03a7b521 LP |
30 | <para><filename>/etc/systemd/system.conf</filename>, |
31 | <filename>/etc/systemd/system.conf.d/*.conf</filename>, | |
32 | <filename>/run/systemd/system.conf.d/*.conf</filename>, | |
33 | <filename>/usr/lib/systemd/system.conf.d/*.conf</filename></para> | |
f70e6fb4 ZJS |
34 | |
35 | <para><filename>~/.config/systemd/user.conf</filename>, | |
36 | <filename>/etc/systemd/user.conf</filename>, | |
03a7b521 LP |
37 | <filename>/etc/systemd/user.conf.d/*.conf</filename>, |
38 | <filename>/run/systemd/user.conf.d/*.conf</filename>, | |
39 | <filename>/usr/lib/systemd/user.conf.d/*.conf</filename></para> | |
798d3a52 ZJS |
40 | </refsynopsisdiv> |
41 | ||
42 | <refsect1> | |
43 | <title>Description</title> | |
44 | ||
f70e6fb4 ZJS |
45 | <para>When run as a system instance, <command>systemd</command> interprets the configuration file |
46 | <filename>system.conf</filename> and the files in <filename>system.conf.d</filename> directories; when | |
47 | run as a user instance, it interprets the configuration file <filename>user.conf</filename> (either in | |
48 | the home directory of the user, or if not found, under <filename>/etc/systemd/</filename>) and the files | |
49 | in <filename>user.conf.d</filename> directories. These configuration files contain a few settings | |
50 | controlling basic manager operations.</para> | |
51 | ||
52 | <para>See | |
53 | <citerefentry><refentrytitle>systemd.syntax</refentrytitle><manvolnum>7</manvolnum></citerefentry> for a | |
54 | general description of the syntax.</para> | |
798d3a52 ZJS |
55 | </refsect1> |
56 | ||
e93549ef | 57 | <xi:include href="standard-conf.xml" xpointer="main-conf" /> |
798d3a52 ZJS |
58 | |
59 | <refsect1> | |
60 | <title>Options</title> | |
61 | ||
62 | <para>All options are configured in the | |
bdac5608 | 63 | [Manager] section:</para> |
798d3a52 | 64 | |
d2acdcc6 | 65 | <variablelist class='config-directives'> |
798d3a52 ZJS |
66 | |
67 | <varlistentry> | |
798d3a52 | 68 | <term><varname>LogColor=</varname></term> |
3d5f0138 | 69 | <term><varname>LogLevel=</varname></term> |
798d3a52 | 70 | <term><varname>LogLocation=</varname></term> |
3d5f0138 | 71 | <term><varname>LogTarget=</varname></term> |
c5673ed0 | 72 | <term><varname>LogTime=</varname></term> |
798d3a52 | 73 | <term><varname>DumpCore=yes</varname></term> |
b9e74c39 | 74 | <term><varname>CrashChangeVT=no</varname></term> |
798d3a52 | 75 | <term><varname>CrashShell=no</varname></term> |
b9e74c39 | 76 | <term><varname>CrashReboot=no</varname></term> |
798d3a52 | 77 | <term><varname>ShowStatus=yes</varname></term> |
798d3a52 ZJS |
78 | <term><varname>DefaultStandardOutput=journal</varname></term> |
79 | <term><varname>DefaultStandardError=inherit</varname></term> | |
80 | ||
33fc1800 LP |
81 | <listitem><para>Configures various parameters of basic manager operation. These options may be overridden by |
82 | the respective process and kernel command line arguments. See | |
83 | <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry> for | |
aefdc112 AK |
84 | details.</para> |
85 | ||
86 | <xi:include href="version-info.xml" xpointer="v198"/></listitem> | |
798d3a52 ZJS |
87 | </varlistentry> |
88 | ||
24dd31c1 LN |
89 | <varlistentry> |
90 | <term><varname>CtrlAltDelBurstAction=</varname></term> | |
91 | ||
92 | <listitem><para>Defines what action will be performed | |
2dd67817 | 93 | if user presses Ctrl-Alt-Delete more than 7 times in 2s. |
ae8c7939 LN |
94 | Can be set to <literal>reboot-force</literal>, <literal>poweroff-force</literal>, |
95 | <literal>reboot-immediate</literal>, <literal>poweroff-immediate</literal> | |
96 | or disabled with <literal>none</literal>. Defaults to | |
24dd31c1 | 97 | <literal>reboot-force</literal>. |
ec07c3c8 AK |
98 | </para> |
99 | ||
100 | <xi:include href="version-info.xml" xpointer="v232"/></listitem> | |
24dd31c1 LN |
101 | </varlistentry> |
102 | ||
798d3a52 ZJS |
103 | <varlistentry> |
104 | <term><varname>CPUAffinity=</varname></term> | |
105 | ||
61fbbac1 ZJS |
106 | <listitem><para>Configures the CPU affinity for the service manager as well as the default CPU |
107 | affinity for all forked off processes. Takes a list of CPU indices or ranges separated by either | |
108 | whitespace or commas. CPU ranges are specified by the lower and upper CPU indices separated by a | |
109 | dash. This option may be specified more than once, in which case the specified CPU affinity masks are | |
110 | merged. If the empty string is assigned, the mask is reset, all assignments prior to this will have | |
111 | no effect. Individual services may override the CPU affinity for their processes with the | |
112 | <varname>CPUAffinity=</varname> setting in unit files, see | |
ec07c3c8 AK |
113 | <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para> |
114 | ||
115 | <xi:include href="version-info.xml" xpointer="v198"/></listitem> | |
b070c7c0 MS |
116 | </varlistentry> |
117 | ||
118 | <varlistentry> | |
119 | <term><varname>NUMAPolicy=</varname></term> | |
120 | ||
121 | <listitem><para>Configures the NUMA memory policy for the service manager and the default NUMA memory policy | |
122 | for all forked off processes. Individual services may override the default policy with the | |
123 | <varname>NUMAPolicy=</varname> setting in unit files, see | |
ec07c3c8 AK |
124 | <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para> |
125 | ||
126 | <xi:include href="version-info.xml" xpointer="v243"/></listitem> | |
b070c7c0 MS |
127 | </varlistentry> |
128 | ||
129 | <varlistentry> | |
130 | <term><varname>NUMAMask=</varname></term> | |
131 | ||
132 | <listitem><para>Configures the NUMA node mask that will be associated with the selected NUMA policy. Note that | |
133 | <option>default</option> and <option>local</option> NUMA policies don't require explicit NUMA node mask and | |
d238709c | 134 | value of the option can be empty. Similarly to <varname>NUMAPolicy=</varname>, value can be overridden |
b070c7c0 | 135 | by individual services in unit files, see |
ec07c3c8 AK |
136 | <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para> |
137 | ||
138 | <xi:include href="version-info.xml" xpointer="v243"/></listitem> | |
798d3a52 ZJS |
139 | </varlistentry> |
140 | ||
798d3a52 ZJS |
141 | <varlistentry> |
142 | <term><varname>RuntimeWatchdogSec=</varname></term> | |
65224c1d | 143 | <term><varname>RebootWatchdogSec=</varname></term> |
acafd7d8 | 144 | <term><varname>KExecWatchdogSec=</varname></term> |
798d3a52 | 145 | |
807938e7 FB |
146 | <listitem><para>Configure the hardware watchdog at runtime and at reboot. Takes a timeout value in |
147 | seconds (or in other time units if suffixed with <literal>ms</literal>, <literal>min</literal>, | |
5254d158 LP |
148 | <literal>h</literal>, <literal>d</literal>, <literal>w</literal>), or the special strings |
149 | <literal>off</literal> or <literal>default</literal>. If set to <literal>off</literal> | |
150 | (alternatively: <literal>0</literal>) the watchdog logic is disabled: no watchdog device is opened, | |
151 | configured, or pinged. If set to the special string <literal>default</literal> the watchdog is opened | |
152 | and pinged in regular intervals, but the timeout is not changed from the default. If set to any other | |
153 | time value the watchdog timeout is configured to the specified value (or a value close to it, | |
154 | depending on hardware capabilities).</para> | |
807938e7 FB |
155 | |
156 | <para>If <varname>RuntimeWatchdogSec=</varname> is set to a non-zero value, the watchdog hardware | |
59bcac0b | 157 | (<filename>/dev/watchdog0</filename> or the path specified with <varname>WatchdogDevice=</varname> or |
807938e7 FB |
158 | the kernel option <varname>systemd.watchdog-device=</varname>) will be programmed to automatically |
159 | reboot the system if it is not contacted within the specified timeout interval. The system manager | |
160 | will ensure to contact it at least once in half the specified timeout interval. This feature requires | |
161 | a hardware watchdog device to be present, as it is commonly the case in embedded and server | |
162 | systems. Not all hardware watchdogs allow configuration of all possible reboot timeout values, in | |
163 | which case the closest available timeout is picked.</para> | |
164 | ||
165 | <para><varname>RebootWatchdogSec=</varname> may be used to configure the hardware watchdog when the | |
166 | system is asked to reboot. It works as a safety net to ensure that the reboot takes place even if a | |
167 | clean reboot attempt times out. Note that the <varname>RebootWatchdogSec=</varname> timeout applies | |
168 | only to the second phase of the reboot, i.e. after all regular services are already terminated, and | |
169 | after the system and service manager process (PID 1) got replaced by the | |
170 | <filename>systemd-shutdown</filename> binary, see system | |
171 | <citerefentry><refentrytitle>bootup</refentrytitle><manvolnum>7</manvolnum></citerefentry> for | |
172 | details. During the first phase of the shutdown operation the system and service manager remains | |
173 | running and hence <varname>RuntimeWatchdogSec=</varname> is still honoured. In order to define a | |
174 | timeout on this first phase of system shutdown, configure <varname>JobTimeoutSec=</varname> and | |
175 | <varname>JobTimeoutAction=</varname> in the [Unit] section of the | |
176 | <filename>shutdown.target</filename> unit. By default <varname>RuntimeWatchdogSec=</varname> defaults | |
177 | to 0 (off), and <varname>RebootWatchdogSec=</varname> to 10min.</para> | |
178 | ||
179 | <para><varname>KExecWatchdogSec=</varname> may be used to additionally enable the watchdog when kexec | |
180 | is being executed rather than when rebooting. Note that if the kernel does not reset the watchdog on | |
181 | kexec (depending on the specific hardware and/or driver), in this case the watchdog might not get | |
182 | disabled after kexec succeeds and thus the system might get rebooted, unless | |
183 | <varname>RuntimeWatchdogSec=</varname> is also enabled at the same time. For this reason it is | |
184 | recommended to enable <varname>KExecWatchdogSec=</varname> only if | |
185 | <varname>RuntimeWatchdogSec=</varname> is also enabled.</para> | |
186 | ||
aefdc112 AK |
187 | <para>These settings have no effect if a hardware watchdog is not available.</para> |
188 | ||
189 | <xi:include href="version-info.xml" xpointer="v198"/></listitem> | |
798d3a52 ZJS |
190 | </varlistentry> |
191 | ||
5717062e CK |
192 | <varlistentry> |
193 | <term><varname>RuntimeWatchdogPreSec=</varname></term> | |
194 | ||
195 | <listitem><para>Configure the hardware watchdog device pre-timeout value. | |
196 | Takes a timeout value in seconds (or in other time units similar to | |
197 | <varname>RuntimeWatchdogSec=</varname>). A watchdog pre-timeout is a | |
198 | notification generated by the watchdog before the watchdog reset might | |
199 | occur in the event the watchdog has not been serviced. This notification | |
200 | is handled by the kernel and can be configured to take an action (i.e. | |
aff3a9e1 LB |
201 | generate a kernel panic) using <varname>RuntimeWatchdogPreGovernor=</varname>. |
202 | Not all watchdog hardware or drivers support generating a pre-timeout and | |
203 | depending on the state of the system, the kernel may be unable to take the | |
204 | configured action before the watchdog reboot. The watchdog will be configured | |
205 | to generate the pre-timeout event at the amount of time specified by | |
206 | <varname>RuntimeWatchdogPreSec=</varname> before the runtime watchdog timeout | |
207 | (set by <varname>RuntimeWatchdogSec=</varname>). For example, if the we have | |
5717062e CK |
208 | <varname>RuntimeWatchdogSec=30</varname> and |
209 | <varname>RuntimeWatchdogPreSec=10</varname>, then the pre-timeout event | |
210 | will occur if the watchdog has not pinged for 20s (10s before the | |
211 | watchdog would fire). By default, <varname>RuntimeWatchdogPreSec=</varname> | |
212 | defaults to 0 (off). The value set for <varname>RuntimeWatchdogPreSec=</varname> | |
213 | must be smaller than the timeout value for <varname>RuntimeWatchdogSec=</varname>. | |
214 | This setting has no effect if a hardware watchdog is not available or the | |
215 | hardware watchdog does not support a pre-timeout and will be ignored by the | |
ec07c3c8 AK |
216 | kernel if the setting is greater than the actual watchdog timeout.</para> |
217 | ||
218 | <xi:include href="version-info.xml" xpointer="v251"/></listitem> | |
5717062e CK |
219 | </varlistentry> |
220 | ||
aff3a9e1 LB |
221 | <varlistentry> |
222 | <term><varname>RuntimeWatchdogPreGovernor=</varname></term> | |
223 | ||
224 | <listitem><para>Configure the action taken by the hardware watchdog device | |
225 | when the pre-timeout expires. The default action for the pre-timeout event | |
226 | depends on the kernel configuration, but it is usually to log a kernel | |
227 | message. For a list of valid actions available for a given watchdog device, | |
228 | check the content of the | |
229 | <filename>/sys/class/watchdog/watchdog<replaceable>X</replaceable>/pretimeout_available_governors</filename> | |
230 | file. Typically, available governor types are <varname>noop</varname> and <varname>panic</varname>. | |
231 | Availability, names and functionality might vary depending on the specific device driver | |
232 | in use. If the <filename>pretimeout_available_governors</filename> sysfs file is empty, | |
233 | the governor might be built as a kernel module and might need to be manually loaded | |
234 | (e.g. <varname>pretimeout_noop.ko</varname>), or the watchdog device might not support | |
ec07c3c8 AK |
235 | pre-timeouts.</para> |
236 | ||
237 | <xi:include href="version-info.xml" xpointer="v251"/></listitem> | |
aff3a9e1 LB |
238 | </varlistentry> |
239 | ||
c75396c3 EJ |
240 | <varlistentry> |
241 | <term><varname>WatchdogDevice=</varname></term> | |
242 | ||
243 | <listitem><para>Configure the hardware watchdog device that the | |
244 | runtime and shutdown watchdog timers will open and use. Defaults | |
59bcac0b | 245 | to <filename>/dev/watchdog0</filename>. This setting has no |
ec07c3c8 AK |
246 | effect if a hardware watchdog is not available.</para> |
247 | ||
248 | <xi:include href="version-info.xml" xpointer="v236"/></listitem> | |
c75396c3 EJ |
249 | </varlistentry> |
250 | ||
798d3a52 ZJS |
251 | <varlistentry> |
252 | <term><varname>CapabilityBoundingSet=</varname></term> | |
253 | ||
254 | <listitem><para>Controls which capabilities to include in the | |
255 | capability bounding set for PID 1 and its children. See | |
256 | <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry> | |
257 | for details. Takes a whitespace-separated list of capability | |
258 | names as read by | |
3ba3a79d | 259 | <citerefentry project='mankier'><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>. |
798d3a52 ZJS |
260 | Capabilities listed will be included in the bounding set, all |
261 | others are removed. If the list of capabilities is prefixed | |
262 | with ~, all but the listed capabilities will be included, the | |
263 | effect of the assignment inverted. Note that this option also | |
264 | affects the respective capabilities in the effective, | |
265 | permitted and inheritable capability sets. The capability | |
266 | bounding set may also be individually configured for units | |
267 | using the <varname>CapabilityBoundingSet=</varname> directive | |
268 | for units, but note that capabilities dropped for PID 1 cannot | |
269 | be regained in individual units, they are lost for | |
ec07c3c8 AK |
270 | good.</para> |
271 | ||
272 | <xi:include href="version-info.xml" xpointer="v198"/></listitem> | |
798d3a52 ZJS |
273 | </varlistentry> |
274 | ||
39362f6f JB |
275 | <varlistentry> |
276 | <term><varname>NoNewPrivileges=</varname></term> | |
277 | ||
278 | <listitem><para>Takes a boolean argument. If true, ensures that PID 1 | |
279 | and all its children can never gain new privileges through | |
280 | <citerefentry project='man-pages'><refentrytitle>execve</refentrytitle><manvolnum>2</manvolnum></citerefentry> | |
281 | (e.g. via setuid or setgid bits, or filesystem capabilities). | |
282 | Defaults to false. General purpose distributions commonly rely | |
283 | on executables with setuid or setgid bits and will thus not | |
284 | function properly with this option enabled. Individual units | |
285 | cannot disable this option. | |
0e685823 | 286 | Also see <ulink url="https://docs.kernel.org/userspace-api/no_new_privs.html">No New Privileges Flag</ulink>. |
ec07c3c8 AK |
287 | </para> |
288 | ||
289 | <xi:include href="version-info.xml" xpointer="v239"/></listitem> | |
39362f6f JB |
290 | </varlistentry> |
291 | ||
798d3a52 ZJS |
292 | <varlistentry> |
293 | <term><varname>SystemCallArchitectures=</varname></term> | |
294 | ||
295 | <listitem><para>Takes a space-separated list of architecture | |
296 | identifiers. Selects from which architectures system calls may | |
297 | be invoked on this system. This may be used as an effective | |
298 | way to disable invocation of non-native binaries system-wide, | |
299 | for example to prohibit execution of 32-bit x86 binaries on | |
300 | 64-bit x86-64 systems. This option operates system-wide, and | |
301 | acts similar to the | |
302 | <varname>SystemCallArchitectures=</varname> setting of unit | |
303 | files, see | |
304 | <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> | |
305 | for details. This setting defaults to the empty list, in which | |
306 | case no filtering of system calls based on architecture is | |
307 | applied. Known architecture identifiers are | |
308 | <literal>x86</literal>, <literal>x86-64</literal>, | |
309 | <literal>x32</literal>, <literal>arm</literal> and the special | |
310 | identifier <literal>native</literal>. The latter implicitly | |
311 | maps to the native architecture of the system (or more | |
312 | specifically, the architecture the system manager was compiled | |
313 | for). Set this setting to <literal>native</literal> to | |
314 | prohibit execution of any non-native binaries. When a binary | |
315 | executes a system call of an architecture that is not listed | |
316 | in this setting, it will be immediately terminated with the | |
ec07c3c8 AK |
317 | SIGSYS signal.</para> |
318 | ||
319 | <xi:include href="version-info.xml" xpointer="v209"/></listitem> | |
798d3a52 ZJS |
320 | </varlistentry> |
321 | ||
322 | <varlistentry> | |
323 | <term><varname>TimerSlackNSec=</varname></term> | |
324 | ||
325 | <listitem><para>Sets the timer slack in nanoseconds for PID 1, | |
326 | which is inherited by all executed processes, unless | |
327 | overridden individually, for example with the | |
328 | <varname>TimerSlackNSec=</varname> setting in service units | |
329 | (for details see | |
330 | <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>). | |
331 | The timer slack controls the accuracy of wake-ups triggered by | |
332 | system timers. See | |
333 | <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry> | |
334 | for more information. Note that in contrast to most other time | |
335 | span definitions this parameter takes an integer value in | |
336 | nano-seconds if no unit is specified. The usual time units are | |
ec07c3c8 AK |
337 | understood too.</para> |
338 | ||
339 | <xi:include href="version-info.xml" xpointer="v198"/></listitem> | |
798d3a52 ZJS |
340 | </varlistentry> |
341 | ||
36cf4507 ZJS |
342 | <varlistentry> |
343 | <term><varname>StatusUnitFormat=</varname></term> | |
344 | ||
580e198a PM |
345 | <listitem><para>Takes <option>name</option>, <option>description</option> or |
346 | <option>combined</option> as the value. If <option>name</option>, the system manager will use unit | |
04d232d8 ZJS |
347 | names in status messages (e.g. <literal>systemd-journald.service</literal>), instead of the longer |
348 | and more informative descriptions set with <varname>Description=</varname> (e.g. <literal>Journal | |
349 | Logging Service</literal>). If <option>combined</option>, the system manager will use both unit names | |
be0d27ee | 350 | and descriptions in status messages (e.g. <literal>systemd-journald.service - Journal Logging |
04d232d8 ZJS |
351 | Service</literal>).</para> |
352 | ||
353 | <para>See | |
354 | <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry> for | |
ec07c3c8 AK |
355 | details about unit names and <varname>Description=</varname>.</para> |
356 | ||
357 | <xi:include href="version-info.xml" xpointer="v243"/></listitem> | |
36cf4507 ZJS |
358 | </varlistentry> |
359 | ||
798d3a52 ZJS |
360 | <varlistentry> |
361 | <term><varname>DefaultTimerAccuracySec=</varname></term> | |
362 | ||
363 | <listitem><para>Sets the default accuracy of timer units. This | |
364 | controls the global default for the | |
365 | <varname>AccuracySec=</varname> setting of timer units, see | |
366 | <citerefentry><refentrytitle>systemd.timer</refentrytitle><manvolnum>5</manvolnum></citerefentry> | |
367 | for details. <varname>AccuracySec=</varname> set in individual | |
368 | units override the global default for the specific unit. | |
369 | Defaults to 1min. Note that the accuracy of timer units is | |
370 | also affected by the configured timer slack for PID 1, see | |
ec07c3c8 AK |
371 | <varname>TimerSlackNSec=</varname> above.</para> |
372 | ||
373 | <xi:include href="version-info.xml" xpointer="v212"/></listitem> | |
798d3a52 ZJS |
374 | </varlistentry> |
375 | ||
376 | <varlistentry> | |
377 | <term><varname>DefaultTimeoutStartSec=</varname></term> | |
378 | <term><varname>DefaultTimeoutStopSec=</varname></term> | |
dc653bf4 | 379 | <term><varname>DefaultTimeoutAbortSec=</varname></term> |
798d3a52 ZJS |
380 | <term><varname>DefaultRestartSec=</varname></term> |
381 | ||
e4c7b5f5 ZJS |
382 | <listitem><para>Configures the default timeouts for starting, stopping and aborting of units, as well |
383 | as the default time to sleep between automatic restarts of units, as configured per-unit in | |
384 | <varname>TimeoutStartSec=</varname>, <varname>TimeoutStopSec=</varname>, | |
385 | <varname>TimeoutAbortSec=</varname> and <varname>RestartSec=</varname> (for services, see | |
798d3a52 | 386 | <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry> |
e4c7b5f5 ZJS |
387 | for details on the per-unit settings). For non-service units, |
388 | <varname>DefaultTimeoutStartSec=</varname> sets the default <varname>TimeoutSec=</varname> value. | |
389 | </para> | |
390 | ||
391 | <para><varname>DefaultTimeoutStartSec=</varname> and <varname>DefaultTimeoutStopSec=</varname> | |
392 | default to &DEFAULT_TIMEOUT; in the system manager and &DEFAULT_USER_TIMEOUT; in the user manager. | |
393 | <varname>DefaultTimeoutAbortSec=</varname> is not set by default so that all units fall back to | |
394 | <varname>TimeoutStopSec=</varname>. <varname>DefaultRestartSec=</varname> defaults to 100 ms. | |
aefdc112 AK |
395 | </para> |
396 | ||
397 | <xi:include href="version-info.xml" xpointer="v209"/></listitem> | |
798d3a52 ZJS |
398 | </varlistentry> |
399 | ||
9e69bd48 DT |
400 | <varlistentry> |
401 | <term><varname>DefaultDeviceTimeoutSec=</varname></term> | |
402 | ||
403 | <listitem><para>Configures the default timeout for waiting for devices. It can be changed per | |
404 | device via the <varname>x-systemd.device-timeout=</varname> option in <filename>/etc/fstab</filename> | |
405 | and <filename>/etc/crypttab</filename> (see | |
406 | <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>, | |
407 | <citerefentry><refentrytitle>crypttab</refentrytitle><manvolnum>5</manvolnum></citerefentry>). | |
e4c7b5f5 | 408 | Defaults to &DEFAULT_TIMEOUT; in the system manager and &DEFAULT_USER_TIMEOUT; in the user manager. |
ec07c3c8 AK |
409 | </para> |
410 | ||
411 | <xi:include href="version-info.xml" xpointer="v252"/></listitem> | |
9e69bd48 DT |
412 | </varlistentry> |
413 | ||
798d3a52 | 414 | <varlistentry> |
f0367da7 | 415 | <term><varname>DefaultStartLimitIntervalSec=</varname></term> |
798d3a52 ZJS |
416 | <term><varname>DefaultStartLimitBurst=</varname></term> |
417 | ||
418 | <listitem><para>Configure the default unit start rate | |
419 | limiting, as configured per-service by | |
f0367da7 | 420 | <varname>StartLimitIntervalSec=</varname> and |
798d3a52 ZJS |
421 | <varname>StartLimitBurst=</varname>. See |
422 | <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry> | |
f5a05fb5 | 423 | for details on the per-service settings. |
f0367da7 | 424 | <varname>DefaultStartLimitIntervalSec=</varname> defaults to |
f5a05fb5 | 425 | 10s. <varname>DefaultStartLimitBurst=</varname> defaults to |
aefdc112 AK |
426 | 5.</para> |
427 | ||
428 | <xi:include href="version-info.xml" xpointer="v209"/></listitem> | |
798d3a52 ZJS |
429 | </varlistentry> |
430 | ||
431 | <varlistentry> | |
432 | <term><varname>DefaultEnvironment=</varname></term> | |
433 | ||
d55ed7de ZJS |
434 | <listitem><para>Configures environment variables passed to all executed processes. Takes a |
435 | space-separated list of variable assignments. See <citerefentry | |
436 | project='man-pages'><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry> for | |
437 | details about environment variables.</para> | |
798d3a52 | 438 | |
46a9ee5d LP |
439 | <para>Simple <literal>%</literal>-specifier expansion is supported, see below for a list of supported |
440 | specifiers.</para> | |
441 | ||
798d3a52 ZJS |
442 | <para>Example: |
443 | ||
444 | <programlisting>DefaultEnvironment="VAR1=word1 word2" VAR2=word3 "VAR3=word 5 6"</programlisting> | |
445 | ||
446 | Sets three variables | |
447 | <literal>VAR1</literal>, | |
448 | <literal>VAR2</literal>, | |
ec07c3c8 AK |
449 | <literal>VAR3</literal>.</para> |
450 | ||
451 | <xi:include href="version-info.xml" xpointer="v205"/></listitem> | |
798d3a52 ZJS |
452 | </varlistentry> |
453 | ||
d55ed7de ZJS |
454 | <varlistentry> |
455 | <term><varname>ManagerEnvironment=</varname></term> | |
456 | ||
457 | <listitem><para>Takes the same arguments as <varname>DefaultEnvironment=</varname>, see above. Sets | |
c54cfef3 AZ |
458 | environment variables just for the manager process itself. In contrast to user managers, these variables |
459 | are not inherited by processes spawned by the system manager, use <varname>DefaultEnvironment=</varname> | |
460 | for that. Note that these variables are merged into the existing environment block. In particular, in | |
461 | case of the system manager, this includes variables set by the kernel based on the kernel command line.</para> | |
d55ed7de ZJS |
462 | |
463 | <para>Setting environment variables for the manager process may be useful to modify its behaviour. | |
464 | See <ulink url="https://systemd.io/ENVIRONMENT">ENVIRONMENT</ulink> for a descriptions of some | |
46a9ee5d LP |
465 | variables understood by <command>systemd</command>.</para> |
466 | ||
467 | <para>Simple <literal>%</literal>-specifier expansion is supported, see below for a list of supported | |
468 | specifiers.</para> | |
ec07c3c8 AK |
469 | |
470 | <xi:include href="version-info.xml" xpointer="v248"/> | |
46a9ee5d | 471 | </listitem> |
d55ed7de ZJS |
472 | </varlistentry> |
473 | ||
798d3a52 ZJS |
474 | <varlistentry> |
475 | <term><varname>DefaultCPUAccounting=</varname></term> | |
798d3a52 | 476 | <term><varname>DefaultMemoryAccounting=</varname></term> |
03a7b521 | 477 | <term><varname>DefaultTasksAccounting=</varname></term> |
b34a2108 | 478 | <term><varname>DefaultIOAccounting=</varname></term> |
8d8631d4 | 479 | <term><varname>DefaultIPAccounting=</varname></term> |
798d3a52 | 480 | |
d9714fe4 SM |
481 | <listitem> |
482 | <para>Configure the default resource accounting settings, as configured per-unit by | |
6d48c7cf LP |
483 | <varname>CPUAccounting=</varname>, <varname>MemoryAccounting=</varname>, |
484 | <varname>TasksAccounting=</varname>, <varname>IOAccounting=</varname> and | |
485 | <varname>IPAccounting=</varname>. See | |
798d3a52 | 486 | <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry> |
d9714fe4 SM |
487 | for details on the per-unit settings.</para> |
488 | ||
489 | <para><varname>DefaultCPUAccounting=</varname> defaults to yes when running on kernel ≥4.15, and no on older versions. | |
490 | <varname>DefaultMemoryAccounting=</varname> defaults to &MEMORY_ACCOUNTING_DEFAULT;. | |
491 | <varname>DefaultTasksAccounting=</varname> defaults to yes. | |
492 | The other settings default to no.</para> | |
aefdc112 AK |
493 | |
494 | <xi:include href="version-info.xml" xpointer="v211"/> | |
d9714fe4 | 495 | </listitem> |
798d3a52 ZJS |
496 | </varlistentry> |
497 | ||
0af20ea2 LP |
498 | <varlistentry> |
499 | <term><varname>DefaultTasksMax=</varname></term> | |
500 | ||
79baeeb9 | 501 | <listitem><para>Configure the default value for the per-unit <varname>TasksMax=</varname> setting. See |
0af20ea2 | 502 | <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry> |
79baeeb9 | 503 | for details. This setting applies to all unit types that support resource control settings, with the exception |
9c587d66 EL |
504 | of slice units. Defaults to 15% of the minimum of <varname>kernel.pid_max=</varname>, <varname>kernel.threads-max=</varname> |
505 | and root cgroup <varname>pids.max</varname>. | |
77f5277a | 506 | Kernel has a default value for <varname>kernel.pid_max=</varname> and an algorithm of counting in case of more than 32 cores. |
5c7a4f21 | 507 | For example, with the default <varname>kernel.pid_max=</varname>, <varname>DefaultTasksMax=</varname> defaults to 4915, |
ec07c3c8 AK |
508 | but might be greater in other systems or smaller in OS containers.</para> |
509 | ||
510 | <xi:include href="version-info.xml" xpointer="v228"/></listitem> | |
0af20ea2 LP |
511 | </varlistentry> |
512 | ||
798d3a52 ZJS |
513 | <varlistentry> |
514 | <term><varname>DefaultLimitCPU=</varname></term> | |
515 | <term><varname>DefaultLimitFSIZE=</varname></term> | |
516 | <term><varname>DefaultLimitDATA=</varname></term> | |
517 | <term><varname>DefaultLimitSTACK=</varname></term> | |
518 | <term><varname>DefaultLimitCORE=</varname></term> | |
519 | <term><varname>DefaultLimitRSS=</varname></term> | |
520 | <term><varname>DefaultLimitNOFILE=</varname></term> | |
521 | <term><varname>DefaultLimitAS=</varname></term> | |
522 | <term><varname>DefaultLimitNPROC=</varname></term> | |
523 | <term><varname>DefaultLimitMEMLOCK=</varname></term> | |
524 | <term><varname>DefaultLimitLOCKS=</varname></term> | |
525 | <term><varname>DefaultLimitSIGPENDING=</varname></term> | |
526 | <term><varname>DefaultLimitMSGQUEUE=</varname></term> | |
527 | <term><varname>DefaultLimitNICE=</varname></term> | |
528 | <term><varname>DefaultLimitRTPRIO=</varname></term> | |
529 | <term><varname>DefaultLimitRTTIME=</varname></term> | |
530 | ||
54ed193f LP |
531 | <listitem><para>These settings control various default resource limits for processes executed by |
532 | units. See | |
533 | <citerefentry><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry> for | |
534 | details. These settings may be overridden in individual units using the corresponding | |
e9dd6984 ZJS |
535 | <varname>LimitXXX=</varname> directives and they accept the same parameter syntax, |
536 | see <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> | |
537 | for details. Note that these resource limits are only defaults | |
1539124b AZ |
538 | for units, they are not applied to the service manager process (i.e. PID 1) itself.</para> |
539 | ||
540 | <para>Most of these settings are unset, which means the resource limits are inherited from the kernel or, if | |
541 | invoked in a container, from the container manager. However, the following have defaults:</para> | |
542 | <itemizedlist> | |
852b6250 | 543 | <listitem><para><varname>DefaultLimitNOFILE=</varname> defaults to 1024:&HIGH_RLIMIT_NOFILE;. |
1539124b AZ |
544 | </para></listitem> |
545 | ||
852b6250 LP |
546 | <listitem><para><varname>DefaultLimitMEMLOCK=</varname> defaults to 8M.</para></listitem> |
547 | ||
1539124b AZ |
548 | <listitem><para><varname>DefaultLimitCORE=</varname> does not have a default but it is worth mentioning that |
549 | <varname>RLIMIT_CORE</varname> is set to <literal>infinity</literal> by PID 1 which is inherited by its | |
550 | children.</para></listitem> | |
1539124b AZ |
551 | </itemizedlist> |
552 | ||
852b6250 LP |
553 | <para>Note that the service manager internally in PID 1 bumps <varname>RLIMIT_NOFILE</varname> and |
554 | <varname>RLIMIT_MEMLOCK</varname> to higher values, however the limit is reverted to the mentioned | |
555 | defaults for all child processes forked off.</para> | |
ec07c3c8 AK |
556 | |
557 | <xi:include href="version-info.xml" xpointer="v198"/> | |
1539124b | 558 | </listitem> |
798d3a52 | 559 | </varlistentry> |
8e74bf7f LP |
560 | |
561 | <varlistentry> | |
562 | <term><varname>DefaultOOMPolicy=</varname></term> | |
563 | ||
564 | <listitem><para>Configure the default policy for reacting to processes being killed by the Linux | |
2e3591a4 | 565 | Out-Of-Memory (OOM) killer or <command>systemd-oomd</command>. This may be used to pick a global default for the per-unit |
8e74bf7f LP |
566 | <varname>OOMPolicy=</varname> setting. See |
567 | <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry> | |
568 | for details. Note that this default is not used for services that have <varname>Delegate=</varname> | |
ec07c3c8 AK |
569 | turned on.</para> |
570 | ||
571 | <xi:include href="version-info.xml" xpointer="v243"/></listitem> | |
8e74bf7f | 572 | </varlistentry> |
643006f6 LP |
573 | |
574 | <varlistentry> | |
575 | <term><varname>DefaultOOMScoreAdjust=</varname></term> | |
576 | ||
577 | <listitem><para>Configures the default OOM score adjustments of processes run by the service | |
578 | manager. This defaults to unset (meaning the forked off processes inherit the service manager's OOM | |
579 | score adjustment value), except if the service manager is run for an unprivileged user, in which case | |
580 | this defaults to the service manager's OOM adjustment value plus 100 (this makes service processes | |
581 | slightly more likely to be killed under memory pressure than the manager itself). This may be used to | |
582 | pick a global default for the per-unit <varname>OOMScoreAdjust=</varname> setting. See | |
583 | <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> for | |
584 | details. Note that this setting has no effect on the OOM score adjustment value of the service | |
ec07c3c8 AK |
585 | manager process itself, it retains the original value set during its invocation.</para> |
586 | ||
587 | <xi:include href="version-info.xml" xpointer="v250"/></listitem> | |
643006f6 | 588 | </varlistentry> |
aa5ae971 ŁS |
589 | |
590 | <varlistentry> | |
591 | <term><varname>DefaultSmackProcessLabel=</varname></term> | |
592 | ||
593 | <listitem><para>Takes a <option>SMACK64</option> security label as the argument. The process executed | |
594 | by a unit will be started under this label if <varname>SmackProcessLabel=</varname> is not set in the | |
595 | unit. See <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> | |
596 | for the details.</para> | |
597 | ||
598 | <para>If the value is <literal>/</literal>, only labels specified with <varname>SmackProcessLabel=</varname> | |
ec07c3c8 AK |
599 | are assigned and the compile-time default is ignored.</para> |
600 | ||
601 | <xi:include href="version-info.xml" xpointer="v252"/></listitem> | |
aa5ae971 | 602 | </varlistentry> |
856bfaeb LB |
603 | |
604 | <varlistentry> | |
605 | <term><varname>ReloadLimitIntervalSec=</varname></term> | |
606 | <term><varname>ReloadLimitBurst=</varname></term> | |
607 | ||
608 | <listitem><para>Rate limiting for daemon-reload requests. Default to unset, and any number of daemon-reload | |
609 | operations can be requested at any time. <varname>ReloadLimitIntervalSec=</varname> takes a value in seconds | |
610 | to configure the rate limit window, and <varname>ReloadLimitBurst=</varname> takes a positive integer to | |
ec07c3c8 AK |
611 | configure the maximum allowed number of reloads within the configured time window.</para> |
612 | ||
613 | <xi:include href="version-info.xml" xpointer="v253"/></listitem> | |
856bfaeb | 614 | </varlistentry> |
6bb00842 LP |
615 | |
616 | <varlistentry> | |
617 | <term><varname>DefaultMemoryPressureWatch=</varname></term> | |
618 | <term><varname>DefaultMemoryPressureThresholdSec=</varname></term> | |
619 | ||
620 | <listitem><para>Configures the default settings for the per-unit | |
621 | <varname>MemoryPressureWatch=</varname> and <varname>MemoryPressureThresholdSec=</varname> | |
622 | settings. See | |
623 | <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry> | |
a6170074 | 624 | for details. Defaults to <literal>auto</literal> and <literal>200ms</literal>, respectively. This |
ec07c3c8 AK |
625 | also sets the memory pressure monitoring threshold for the service manager itself.</para> |
626 | ||
627 | <xi:include href="version-info.xml" xpointer="v254"/></listitem> | |
6bb00842 | 628 | </varlistentry> |
798d3a52 ZJS |
629 | </variablelist> |
630 | </refsect1> | |
631 | ||
46a9ee5d LP |
632 | <refsect1> |
633 | <title>Specifiers</title> | |
634 | ||
635 | <para>Specifiers may be used in the <varname>DefaultEnvironment=</varname> and | |
636 | <varname>ManagerEnvironment=</varname> settings. The following expansions are understood:</para> | |
637 | <table class='specifiers'> | |
638 | <title>Specifiers available</title> | |
639 | <tgroup cols='3' align='left' colsep='1' rowsep='1'> | |
640 | <colspec colname="spec" /> | |
641 | <colspec colname="mean" /> | |
642 | <colspec colname="detail" /> | |
643 | <thead> | |
644 | <row> | |
645 | <entry>Specifier</entry> | |
646 | <entry>Meaning</entry> | |
647 | <entry>Details</entry> | |
648 | </row> | |
649 | </thead> | |
650 | <tbody> | |
651 | <xi:include href="standard-specifiers.xml" xpointer="a"/> | |
652 | <xi:include href="standard-specifiers.xml" xpointer="A"/> | |
653 | <xi:include href="standard-specifiers.xml" xpointer="b"/> | |
654 | <xi:include href="standard-specifiers.xml" xpointer="B"/> | |
655 | <xi:include href="standard-specifiers.xml" xpointer="H"/> | |
656 | <xi:include href="standard-specifiers.xml" xpointer="l"/> | |
657 | <xi:include href="standard-specifiers.xml" xpointer="m"/> | |
658 | <xi:include href="standard-specifiers.xml" xpointer="M"/> | |
659 | <xi:include href="standard-specifiers.xml" xpointer="o"/> | |
660 | <xi:include href="standard-specifiers.xml" xpointer="v"/> | |
661 | <xi:include href="standard-specifiers.xml" xpointer="w"/> | |
662 | <xi:include href="standard-specifiers.xml" xpointer="W"/> | |
663 | <xi:include href="standard-specifiers.xml" xpointer="T"/> | |
664 | <xi:include href="standard-specifiers.xml" xpointer="V"/> | |
0b40688d RP |
665 | <row> |
666 | <entry><literal>%h</literal></entry> | |
667 | <entry>User home directory</entry> | |
668 | <entry>This is the home directory of the <emphasis>user running the service manager instance</emphasis>.</entry> | |
669 | </row> | |
670 | <row> | |
671 | <entry><literal>%u</literal></entry> | |
672 | <entry>Username</entry> | |
673 | <entry>This is the username of the <emphasis>user running the service manager instance</emphasis>.</entry> | |
674 | </row> | |
675 | <row> | |
676 | <entry><literal>%U</literal></entry> | |
677 | <entry>User id</entry> | |
678 | <entry>This is the user id of the <emphasis>user running the service manager instance</emphasis>.</entry> | |
679 | </row> | |
680 | <row> | |
681 | <entry><literal>%g</literal></entry> | |
682 | <entry>Primary group</entry> | |
683 | <entry>This is the primary group of the <emphasis>user running the service manager instance</emphasis>.</entry> | |
684 | </row> | |
685 | <row> | |
686 | <entry><literal>%G</literal></entry> | |
687 | <entry>Primary group id</entry> | |
688 | <entry>This is the primary group id of the <emphasis>user running the service manager instance</emphasis>.</entry> | |
689 | </row> | |
690 | <row> | |
691 | <entry><literal>%s</literal></entry> | |
692 | <entry>User shell</entry> | |
693 | <entry>This is the shell of the <emphasis>user running the service manager instance</emphasis>.</entry> | |
694 | </row> | |
46a9ee5d LP |
695 | <xi:include href="standard-specifiers.xml" xpointer="percent"/> |
696 | </tbody> | |
697 | </tgroup> | |
698 | </table> | |
699 | </refsect1> | |
700 | ||
7a9e0bd0 ZJS |
701 | <refsect1> |
702 | <title>History</title> | |
703 | ||
704 | <variablelist> | |
705 | <varlistentry> | |
706 | <term>systemd 252</term> | |
707 | <listitem><para>Option <varname>DefaultBlockIOAccounting=</varname> was deprecated. Please switch | |
ec07c3c8 AK |
708 | to the unified cgroup hierarchy.</para> |
709 | ||
710 | <xi:include href="version-info.xml" xpointer="v252"/></listitem> | |
7a9e0bd0 ZJS |
711 | </varlistentry> |
712 | </variablelist> | |
713 | </refsect1> | |
714 | ||
798d3a52 ZJS |
715 | <refsect1> |
716 | <title>See Also</title> | |
717 | <para> | |
718 | <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>, | |
719 | <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>, | |
720 | <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>, | |
721 | <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>, | |
722 | <citerefentry project='man-pages'><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>, | |
723 | <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry> | |
724 | </para> | |
725 | </refsect1> | |
f3e219a2 LP |
726 | |
727 | </refentry> |