man/systemd-system.conf.xml

   1 <?xml version='1.0'?>
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
   4 <!ENTITY % entities SYSTEM "custom-entities.ent" >
   5 %entities;
   6 ]>
   7 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
   8
   9 <refentry id="systemd-system.conf"
  10     xmlns:xi="http://www.w3.org/2001/XInclude">
  11   <refentryinfo>
  12     <title>systemd-system.conf</title>
  13     <productname>systemd</productname>
  14   </refentryinfo>
  15
  16   <refmeta>
  17     <refentrytitle>systemd-system.conf</refentrytitle>
  18     <manvolnum>5</manvolnum>
  19   </refmeta>
  20
  21   <refnamediv>
  22     <refname>systemd-system.conf</refname>
  23     <refname>system.conf.d</refname>
  24     <refname>systemd-user.conf</refname>
  25     <refname>user.conf.d</refname>
  26     <refpurpose>System and session service manager configuration files</refpurpose>
  27   </refnamediv>
  28
  29   <refsynopsisdiv>
  30     <para><filename>/etc/systemd/system.conf</filename>,
  31     <filename>/run/systemd/system.conf</filename>,
  32     <filename>/usr/lib/systemd/system.conf</filename>,
  33     <filename>/etc/systemd/system.conf.d/*.conf</filename>,
  34     <filename>/run/systemd/system.conf.d/*.conf</filename>,
  35     <filename>/usr/lib/systemd/system.conf.d/*.conf</filename></para>
  36
  37     <para><filename>~/.config/systemd/user.conf</filename>,
  38     <filename>/etc/systemd/user.conf</filename>,
  39     <filename>/run/systemd/user.conf</filename>,
  40     <filename>/usr/lib/systemd/user.conf</filename>,
  41     <filename>/etc/systemd/user.conf.d/*.conf</filename>,
  42     <filename>/run/systemd/user.conf.d/*.conf</filename>,
  43     <filename>/usr/lib/systemd/user.conf.d/*.conf</filename></para>
  44   </refsynopsisdiv>
  45
  46   <refsect1>
  47     <title>Description</title>
  48
  49     <para>When run as a system instance, <command>systemd</command> interprets the configuration file
  50     <filename>system.conf</filename> and the files in <filename>system.conf.d</filename> directories; when
  51     run as a user instance, it interprets the configuration file <filename>user.conf</filename> (in order of
  52     priority, in the home directory of the user and under <filename>/etc/systemd/</filename>,
  53     <filename>/run/systemd/</filename>, and <filename>/usr/lib/systemd/</filename>) and the files in
  54     <filename>user.conf.d</filename> directories. These configuration files contain a few settings
  55     controlling basic manager operations.</para>
  56
  57     <para>See
  58     <citerefentry><refentrytitle>systemd.syntax</refentrytitle><manvolnum>7</manvolnum></citerefentry> for a
  59     general description of the syntax.</para>
  60   </refsect1>
  61
  62   <xi:include href="standard-conf.xml" xpointer="main-conf" />
  63
  64   <refsect1>
  65     <title>Options</title>
  66
  67     <para>All options are configured in the
  68     [Manager] section:</para>
  69
  70     <variablelist class='config-directives'>
  71
  72       <varlistentry>
  73         <term><varname>LogColor=</varname></term>
  74         <term><varname>LogLevel=</varname></term>
  75         <term><varname>LogLocation=</varname></term>
  76         <term><varname>LogTarget=</varname></term>
  77         <term><varname>LogTime=</varname></term>
  78         <term><varname>DumpCore=yes</varname></term>
  79         <term><varname>CrashChangeVT=no</varname></term>
  80         <term><varname>CrashShell=no</varname></term>
  81         <term><varname>CrashAction=freeze</varname></term>
  82         <term><varname>ShowStatus=yes</varname></term>
  83         <term><varname>DefaultStandardOutput=journal</varname></term>
  84         <term><varname>DefaultStandardError=inherit</varname></term>
  85
  86         <listitem><para>Configures various parameters of basic manager operation. These options may be overridden by
  87         the respective process and kernel command line arguments. See
  88         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
  89         details.</para>
  90
  91         <xi:include href="version-info.xml" xpointer="v198"/></listitem>
  92       </varlistentry>
  93
  94       <varlistentry>
  95         <term><varname>CtrlAltDelBurstAction=</varname></term>
  96
  97         <listitem><para>Defines what action will be performed
  98         if user presses Ctrl-Alt-Delete more than 7 times in 2s.
  99         Can be set to <literal>reboot-force</literal>, <literal>poweroff-force</literal>,
 100         <literal>reboot-immediate</literal>, <literal>poweroff-immediate</literal>
 101         or disabled with <literal>none</literal>. Defaults to
 102         <literal>reboot-force</literal>.
 103         </para>
 104
 105         <xi:include href="version-info.xml" xpointer="v232"/></listitem>
 106       </varlistentry>
 107
 108       <varlistentry>
 109         <term><varname>CPUAffinity=</varname></term>
 110
 111         <listitem><para>Configures the CPU affinity for the service manager as well as the default CPU
 112         affinity for all forked off processes. Takes a list of CPU indices or ranges separated by either
 113         whitespace or commas. CPU ranges are specified by the lower and upper CPU indices separated by a
 114         dash. This option may be specified more than once, in which case the specified CPU affinity masks are
 115         merged. If the empty string is assigned, the mask is reset, all assignments prior to this will have
 116         no effect. Individual services may override the CPU affinity for their processes with the
 117         <varname>CPUAffinity=</varname> setting in unit files, see
 118         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
 119
 120         <xi:include href="version-info.xml" xpointer="v198"/></listitem>
 121       </varlistentry>
 122
 123       <varlistentry>
 124         <term><varname>NUMAPolicy=</varname></term>
 125
 126         <listitem><para>Configures the NUMA memory policy for the service manager and the default NUMA memory policy
 127         for all forked off processes. Individual services may override the default policy with the
 128         <varname>NUMAPolicy=</varname> setting in unit files, see
 129         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
 130
 131         <xi:include href="version-info.xml" xpointer="v243"/></listitem>
 132       </varlistentry>
 133
 134       <varlistentry>
 135         <term><varname>NUMAMask=</varname></term>
 136
 137         <listitem><para>Configures the NUMA node mask that will be associated with the selected NUMA policy. Note that
 138         <option>default</option> and <option>local</option> NUMA policies don't require explicit NUMA node mask and
 139         value of the option can be empty. Similarly to <varname>NUMAPolicy=</varname>, value can be overridden
 140         by individual services in unit files, see
 141         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
 142
 143         <xi:include href="version-info.xml" xpointer="v243"/></listitem>
 144       </varlistentry>
 145
 146       <varlistentry>
 147         <term><varname>RuntimeWatchdogSec=</varname></term>
 148         <term><varname>RebootWatchdogSec=</varname></term>
 149         <term><varname>KExecWatchdogSec=</varname></term>
 150
 151         <listitem><para>Configure the hardware watchdog at runtime and at reboot. Takes a timeout value in
 152         seconds (or in other time units if suffixed with <literal>ms</literal>, <literal>min</literal>,
 153         <literal>h</literal>, <literal>d</literal>, <literal>w</literal>), or the special strings
 154         <literal>off</literal> or <literal>default</literal>. If set to <literal>off</literal>
 155         (alternatively: <literal>0</literal>) the watchdog logic is disabled: no watchdog device is opened,
 156         configured, or pinged. If set to the special string <literal>default</literal> the watchdog is opened
 157         and pinged in regular intervals, but the timeout is not changed from the default. If set to any other
 158         time value the watchdog timeout is configured to the specified value (or a value close to it,
 159         depending on hardware capabilities).</para>
 160
 161         <para>If <varname>RuntimeWatchdogSec=</varname> is set to a non-zero value, the watchdog hardware
 162         (<filename>/dev/watchdog0</filename> or the path specified with <varname>WatchdogDevice=</varname> or
 163         the kernel option <varname>systemd.watchdog-device=</varname>) will be programmed to automatically
 164         reboot the system if it is not contacted within the specified timeout interval. The system manager
 165         will ensure to contact it at least once in half the specified timeout interval. This feature requires
 166         a hardware watchdog device to be present, as it is commonly the case in embedded and server
 167         systems. Not all hardware watchdogs allow configuration of all possible reboot timeout values, in
 168         which case the closest available timeout is picked.</para>
 169
 170         <para><varname>RebootWatchdogSec=</varname> may be used to configure the hardware watchdog when the
 171         system is asked to reboot. It works as a safety net to ensure that the reboot takes place even if a
 172         clean reboot attempt times out. Note that the <varname>RebootWatchdogSec=</varname> timeout applies
 173         only to the second phase of the reboot, i.e. after all regular services are already terminated, and
 174         after the system and service manager process (PID 1) got replaced by the
 175         <filename>systemd-shutdown</filename> binary, see system
 176         <citerefentry><refentrytitle>bootup</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
 177         details. During the first phase of the shutdown operation the system and service manager remains
 178         running and hence <varname>RuntimeWatchdogSec=</varname> is still honoured. In order to define a
 179         timeout on this first phase of system shutdown, configure <varname>JobTimeoutSec=</varname> and
 180         <varname>JobTimeoutAction=</varname> in the [Unit] section of the
 181         <filename>shutdown.target</filename> unit. By default <varname>RuntimeWatchdogSec=</varname> defaults
 182         to 0 (off), and <varname>RebootWatchdogSec=</varname> to 10min.</para>
 183
 184         <para><varname>KExecWatchdogSec=</varname> may be used to additionally enable the watchdog when kexec
 185         is being executed rather than when rebooting. Note that if the kernel does not reset the watchdog on
 186         kexec (depending on the specific hardware and/or driver), in this case the watchdog might not get
 187         disabled after kexec succeeds and thus the system might get rebooted, unless
 188         <varname>RuntimeWatchdogSec=</varname> is also enabled at the same time.  For this reason it is
 189         recommended to enable <varname>KExecWatchdogSec=</varname> only if
 190         <varname>RuntimeWatchdogSec=</varname> is also enabled.</para>
 191
 192         <para>These settings have no effect if a hardware watchdog is not available.</para>
 193
 194         <xi:include href="version-info.xml" xpointer="v198"/></listitem>
 195       </varlistentry>
 196
 197       <varlistentry>
 198         <term><varname>RuntimeWatchdogPreSec=</varname></term>
 199
 200         <listitem><para>Configure the hardware watchdog device pre-timeout value.
 201         Takes a timeout value in seconds (or in other time units similar to
 202         <varname>RuntimeWatchdogSec=</varname>). A watchdog pre-timeout is a
 203         notification generated by the watchdog before the watchdog reset might
 204         occur in the event the watchdog has not been serviced. This notification
 205         is handled by the kernel and can be configured to take an action (i.e.
 206         generate a kernel panic) using <varname>RuntimeWatchdogPreGovernor=</varname>.
 207         Not all watchdog hardware or drivers support generating a pre-timeout and
 208         depending on the state of the system, the kernel may be unable to take the
 209         configured action before the watchdog reboot. The watchdog will be configured
 210         to generate the pre-timeout event at the amount of time specified by
 211         <varname>RuntimeWatchdogPreSec=</varname> before the runtime watchdog timeout
 212         (set by <varname>RuntimeWatchdogSec=</varname>). For example, if the we have
 213         <varname>RuntimeWatchdogSec=30</varname> and
 214         <varname>RuntimeWatchdogPreSec=10</varname>, then the pre-timeout event
 215         will occur if the watchdog has not pinged for 20s (10s before the
 216         watchdog would fire). By default, <varname>RuntimeWatchdogPreSec=</varname>
 217         defaults to 0 (off). The value set for <varname>RuntimeWatchdogPreSec=</varname>
 218         must be smaller than the timeout value for <varname>RuntimeWatchdogSec=</varname>.
 219         This setting has no effect if a hardware watchdog is not available or the
 220         hardware watchdog does not support a pre-timeout and will be ignored by the
 221         kernel if the setting is greater than the actual watchdog timeout.</para>
 222
 223         <xi:include href="version-info.xml" xpointer="v251"/></listitem>
 224       </varlistentry>
 225
 226       <varlistentry>
 227         <term><varname>RuntimeWatchdogPreGovernor=</varname></term>
 228
 229         <listitem><para>Configure the action taken by the hardware watchdog device
 230         when the pre-timeout expires. The default action for the pre-timeout event
 231         depends on the kernel configuration, but it is usually to log a kernel
 232         message. For a list of valid actions available for a given watchdog device,
 233         check the content of the
 234         <filename>/sys/class/watchdog/watchdog<replaceable>X</replaceable>/pretimeout_available_governors</filename>
 235         file. Typically, available governor types are <varname>noop</varname> and <varname>panic</varname>.
 236         Availability, names and functionality might vary depending on the specific device driver
 237         in use. If the <filename>pretimeout_available_governors</filename> sysfs file is empty,
 238         the governor might be built as a kernel module and might need to be manually loaded
 239         (e.g. <varname>pretimeout_noop.ko</varname>), or the watchdog device might not support
 240         pre-timeouts.</para>
 241
 242         <xi:include href="version-info.xml" xpointer="v251"/></listitem>
 243       </varlistentry>
 244
 245       <varlistentry>
 246         <term><varname>WatchdogDevice=</varname></term>
 247
 248         <listitem><para>Configure the hardware watchdog device that the
 249         runtime and shutdown watchdog timers will open and use. Defaults
 250         to <filename>/dev/watchdog0</filename>. This setting has no
 251         effect if a hardware watchdog is not available.</para>
 252
 253         <xi:include href="version-info.xml" xpointer="v236"/></listitem>
 254       </varlistentry>
 255
 256       <varlistentry>
 257         <term><varname>CapabilityBoundingSet=</varname></term>
 258
 259         <listitem><para>Controls which capabilities to include in the
 260         capability bounding set for PID 1 and its children. See
 261         <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 262         for details. Takes a whitespace-separated list of capability
 263         names as read by
 264         <citerefentry project='mankier'><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
 265         Capabilities listed will be included in the bounding set, all
 266         others are removed. If the list of capabilities is prefixed
 267         with ~, all but the listed capabilities will be included, the
 268         effect of the assignment inverted. Note that this option also
 269         affects the respective capabilities in the effective,
 270         permitted and inheritable capability sets. The capability
 271         bounding set may also be individually configured for units
 272         using the <varname>CapabilityBoundingSet=</varname> directive
 273         for units, but note that capabilities dropped for PID 1 cannot
 274         be regained in individual units, they are lost for
 275         good.</para>
 276
 277         <xi:include href="version-info.xml" xpointer="v198"/></listitem>
 278       </varlistentry>
 279
 280       <varlistentry>
 281         <term><varname>NoNewPrivileges=</varname></term>
 282
 283         <listitem><para>Takes a boolean argument. If true, ensures that PID 1
 284         and all its children can never gain new privileges through
 285         <citerefentry project='man-pages'><refentrytitle>execve</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 286         (e.g. via setuid or setgid bits, or filesystem capabilities).
 287         Defaults to false. General purpose distributions commonly rely
 288         on executables with setuid or setgid bits and will thus not
 289         function properly with this option enabled. Individual units
 290         cannot disable this option.
 291         Also see <ulink url="https://docs.kernel.org/userspace-api/no_new_privs.html">No New Privileges Flag</ulink>.
 292         </para>
 293
 294         <xi:include href="version-info.xml" xpointer="v239"/></listitem>
 295       </varlistentry>
 296
 297       <varlistentry>
 298         <term><varname>ProtectSystem=</varname></term>
 299
 300         <listitem><para>Takes a boolean argument or the string <literal>auto</literal>. If set to true this
 301         will remount <filename>/usr/</filename> read-only. If set to <literal>auto</literal> (the default)
 302         and running in an initrd equivalent to true, otherwise false. This implements a restricted subset of
 303         the per-unit setting of the same name, see
 304         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
 305         details: currently, the <literal>full</literal> or <literal>struct</literal> values are not
 306         supported.</para>
 307
 308         <xi:include href="version-info.xml" xpointer="v256"/></listitem>
 309       </varlistentry>
 310
 311       <varlistentry>
 312         <term><varname>SystemCallArchitectures=</varname></term>
 313
 314         <listitem><para>Takes a space-separated list of architecture
 315         identifiers. Selects from which architectures system calls may
 316         be invoked on this system. This may be used as an effective
 317         way to disable invocation of non-native binaries system-wide,
 318         for example to prohibit execution of 32-bit x86 binaries on
 319         64-bit x86-64 systems. This option operates system-wide, and
 320         acts similar to the
 321         <varname>SystemCallArchitectures=</varname> setting of unit
 322         files, see
 323         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 324         for details. This setting defaults to the empty list, in which
 325         case no filtering of system calls based on architecture is
 326         applied. Known architecture identifiers are
 327         <literal>x86</literal>, <literal>x86-64</literal>,
 328         <literal>x32</literal>, <literal>arm</literal> and the special
 329         identifier <literal>native</literal>. The latter implicitly
 330         maps to the native architecture of the system (or more
 331         specifically, the architecture the system manager was compiled
 332         for). Set this setting to <literal>native</literal> to
 333         prohibit execution of any non-native binaries. When a binary
 334         executes a system call of an architecture that is not listed
 335         in this setting, it will be immediately terminated with the
 336         SIGSYS signal.</para>
 337
 338         <xi:include href="version-info.xml" xpointer="v209"/></listitem>
 339       </varlistentry>
 340
 341       <varlistentry>
 342         <term><varname>TimerSlackNSec=</varname></term>
 343
 344         <listitem><para>Sets the timer slack in nanoseconds for PID 1,
 345         which is inherited by all executed processes, unless
 346         overridden individually, for example with the
 347         <varname>TimerSlackNSec=</varname> setting in service units
 348         (for details see
 349         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>).
 350         The timer slack controls the accuracy of wake-ups triggered by
 351         system timers. See
 352         <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 353         for more information. Note that in contrast to most other time
 354         span definitions this parameter takes an integer value in
 355         nano-seconds if no unit is specified. The usual time units are
 356         understood too.</para>
 357
 358         <xi:include href="version-info.xml" xpointer="v198"/></listitem>
 359       </varlistentry>
 360
 361       <varlistentry>
 362         <term><varname>StatusUnitFormat=</varname></term>
 363
 364         <listitem><para>Takes <option>name</option>, <option>description</option> or
 365         <option>combined</option> as the value. If <option>name</option>, the system manager will use unit
 366         names in status messages (e.g. <literal>systemd-journald.service</literal>), instead of the longer
 367         and more informative descriptions set with <varname>Description=</varname> (e.g. <literal>Journal
 368         Logging Service</literal>). If <option>combined</option>, the system manager will use both unit names
 369         and descriptions in status messages (e.g. <literal>systemd-journald.service - Journal Logging
 370         Service</literal>).</para>
 371
 372         <para>See
 373         <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
 374         details about unit names and <varname>Description=</varname>.</para>
 375
 376         <xi:include href="version-info.xml" xpointer="v243"/></listitem>
 377       </varlistentry>
 378
 379       <varlistentry>
 380         <term><varname>DefaultTimerAccuracySec=</varname></term>
 381
 382         <listitem><para>Sets the default accuracy of timer units. This
 383         controls the global default for the
 384         <varname>AccuracySec=</varname> setting of timer units, see
 385         <citerefentry><refentrytitle>systemd.timer</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 386         for details. <varname>AccuracySec=</varname> set in individual
 387         units override the global default for the specific unit.
 388         Defaults to 1min. Note that the accuracy of timer units is
 389         also affected by the configured timer slack for PID 1, see
 390         <varname>TimerSlackNSec=</varname> above.</para>
 391
 392         <xi:include href="version-info.xml" xpointer="v212"/></listitem>
 393       </varlistentry>
 394
 395       <varlistentry>
 396         <term><varname>DefaultTimeoutStartSec=</varname></term>
 397         <term><varname>DefaultTimeoutStopSec=</varname></term>
 398         <term><varname>DefaultTimeoutAbortSec=</varname></term>
 399         <term><varname>DefaultRestartSec=</varname></term>
 400
 401         <listitem><para>Configures the default timeouts for starting, stopping and aborting of units, as well
 402         as the default time to sleep between automatic restarts of units, as configured per-unit in
 403         <varname>TimeoutStartSec=</varname>, <varname>TimeoutStopSec=</varname>,
 404         <varname>TimeoutAbortSec=</varname> and <varname>RestartSec=</varname> (for services, see
 405         <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 406         for details on the per-unit settings). For non-service units,
 407         <varname>DefaultTimeoutStartSec=</varname> sets the default <varname>TimeoutSec=</varname> value.
 408         </para>
 409
 410         <para><varname>DefaultTimeoutStartSec=</varname> and <varname>DefaultTimeoutStopSec=</varname>
 411         default to &DEFAULT_TIMEOUT; in the system manager and &DEFAULT_USER_TIMEOUT; in the user manager.
 412         <varname>DefaultTimeoutAbortSec=</varname> is not set by default so that all units fall back to
 413         <varname>TimeoutStopSec=</varname>. <varname>DefaultRestartSec=</varname> defaults to 100 ms.
 414         </para>
 415
 416         <xi:include href="version-info.xml" xpointer="v209"/></listitem>
 417       </varlistentry>
 418
 419       <varlistentry>
 420         <term><varname>DefaultDeviceTimeoutSec=</varname></term>
 421
 422         <listitem><para>Configures the default timeout for waiting for devices. It can be changed per
 423         device via the <varname>x-systemd.device-timeout=</varname> option in <filename>/etc/fstab</filename>
 424         and <filename>/etc/crypttab</filename> (see
 425         <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 426         <citerefentry><refentrytitle>crypttab</refentrytitle><manvolnum>5</manvolnum></citerefentry>).
 427         Defaults to &DEFAULT_TIMEOUT; in the system manager and &DEFAULT_USER_TIMEOUT; in the user manager.
 428         </para>
 429
 430         <xi:include href="version-info.xml" xpointer="v252"/></listitem>
 431       </varlistentry>
 432
 433       <varlistentry>
 434         <term><varname>DefaultStartLimitIntervalSec=</varname></term>
 435         <term><varname>DefaultStartLimitBurst=</varname></term>
 436
 437         <listitem><para>Configure the default unit start rate
 438         limiting, as configured per-service by
 439         <varname>StartLimitIntervalSec=</varname> and
 440         <varname>StartLimitBurst=</varname>. See
 441         <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 442         for details on the per-service settings.
 443         <varname>DefaultStartLimitIntervalSec=</varname> defaults to
 444         10s. <varname>DefaultStartLimitBurst=</varname> defaults to
 445         5.</para>
 446
 447         <xi:include href="version-info.xml" xpointer="v209"/></listitem>
 448       </varlistentry>
 449
 450       <varlistentry>
 451         <term><varname>DefaultEnvironment=</varname></term>
 452
 453         <listitem><para>Configures environment variables passed to all executed processes. Takes a
 454         space-separated list of variable assignments. See <citerefentry
 455         project='man-pages'><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
 456         details about environment variables.</para>
 457
 458         <para>Simple <literal>%</literal>-specifier expansion is supported, see below for a list of supported
 459         specifiers.</para>
 460
 461         <para>Example:
 462
 463         <programlisting>DefaultEnvironment="VAR1=word1 word2" VAR2=word3 "VAR3=word 5 6"</programlisting>
 464
 465         Sets three variables
 466         <literal>VAR1</literal>,
 467         <literal>VAR2</literal>,
 468         <literal>VAR3</literal>.</para>
 469
 470         <xi:include href="version-info.xml" xpointer="v205"/></listitem>
 471       </varlistentry>
 472
 473       <varlistentry>
 474         <term><varname>ManagerEnvironment=</varname></term>
 475
 476         <listitem><para>Takes the same arguments as <varname>DefaultEnvironment=</varname>, see above. Sets
 477         environment variables just for the manager process itself. In contrast to user managers, these variables
 478         are not inherited by processes spawned by the system manager, use <varname>DefaultEnvironment=</varname>
 479         for that. Note that these variables are merged into the existing environment block. In particular, in
 480         case of the system manager, this includes variables set by the kernel based on the kernel command line.</para>
 481
 482         <para>Setting environment variables for the manager process may be useful to modify its behaviour.
 483         See <ulink url="https://systemd.io/ENVIRONMENT">Known Environment Variables</ulink> for a
 484         descriptions of some variables understood by <command>systemd</command>.</para>
 485
 486         <para>Simple <literal>%</literal>-specifier expansion is supported, see below for a list of supported
 487         specifiers.</para>
 488
 489         <xi:include href="version-info.xml" xpointer="v248"/>
 490         </listitem>
 491       </varlistentry>
 492
 493       <varlistentry>
 494         <term><varname>DefaultCPUAccounting=</varname></term>
 495         <term><varname>DefaultMemoryAccounting=</varname></term>
 496         <term><varname>DefaultTasksAccounting=</varname></term>
 497         <term><varname>DefaultIOAccounting=</varname></term>
 498         <term><varname>DefaultIPAccounting=</varname></term>
 499
 500         <listitem>
 501         <para>Configure the default resource accounting settings, as configured per-unit by
 502         <varname>CPUAccounting=</varname>, <varname>MemoryAccounting=</varname>,
 503         <varname>TasksAccounting=</varname>, <varname>IOAccounting=</varname> and
 504         <varname>IPAccounting=</varname>. See
 505         <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 506         for details on the per-unit settings.</para>
 507
 508         <para><varname>DefaultCPUAccounting=</varname> defaults to yes when running on kernel ≥4.15, and no on older versions.
 509         <varname>DefaultMemoryAccounting=</varname> defaults to &MEMORY_ACCOUNTING_DEFAULT;.
 510         <varname>DefaultTasksAccounting=</varname> defaults to yes.
 511         The other settings default to no.</para>
 512
 513         <xi:include href="version-info.xml" xpointer="v211"/>
 514         </listitem>
 515       </varlistentry>
 516
 517       <varlistentry>
 518         <term><varname>DefaultTasksMax=</varname></term>
 519
 520         <listitem><para>Configure the default value for the per-unit <varname>TasksMax=</varname> setting. See
 521         <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 522         for details. This setting applies to all unit types that support resource control settings, with the exception
 523         of slice units. Defaults to 15% of the minimum of <varname>kernel.pid_max=</varname>, <varname>kernel.threads-max=</varname>
 524         and root cgroup <varname>pids.max</varname>.
 525         Kernel has a default value for <varname>kernel.pid_max=</varname> and an algorithm of counting in case of more than 32 cores.
 526         For example, with the default <varname>kernel.pid_max=</varname>, <varname>DefaultTasksMax=</varname> defaults to 4915,
 527         but might be greater in other systems or smaller in OS containers.</para>
 528
 529         <xi:include href="version-info.xml" xpointer="v228"/></listitem>
 530       </varlistentry>
 531
 532       <varlistentry>
 533         <term><varname>DefaultLimitCPU=</varname></term>
 534         <term><varname>DefaultLimitFSIZE=</varname></term>
 535         <term><varname>DefaultLimitDATA=</varname></term>
 536         <term><varname>DefaultLimitSTACK=</varname></term>
 537         <term><varname>DefaultLimitCORE=</varname></term>
 538         <term><varname>DefaultLimitRSS=</varname></term>
 539         <term><varname>DefaultLimitNOFILE=</varname></term>
 540         <term><varname>DefaultLimitAS=</varname></term>
 541         <term><varname>DefaultLimitNPROC=</varname></term>
 542         <term><varname>DefaultLimitMEMLOCK=</varname></term>
 543         <term><varname>DefaultLimitLOCKS=</varname></term>
 544         <term><varname>DefaultLimitSIGPENDING=</varname></term>
 545         <term><varname>DefaultLimitMSGQUEUE=</varname></term>
 546         <term><varname>DefaultLimitNICE=</varname></term>
 547         <term><varname>DefaultLimitRTPRIO=</varname></term>
 548         <term><varname>DefaultLimitRTTIME=</varname></term>
 549
 550         <listitem><para>These settings control various default resource limits for processes executed by
 551         units. See
 552         <citerefentry><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
 553         details. These settings may be overridden in individual units using the corresponding
 554         <varname>LimitXXX=</varname> directives and they accept the same parameter syntax,
 555         see <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 556         for details. Note that these resource limits are only defaults
 557         for units, they are not applied to the service manager process (i.e. PID 1) itself.</para>
 558
 559         <para>Most of these settings are unset, which means the resource limits are inherited from the kernel or, if
 560         invoked in a container, from the container manager. However, the following have defaults:</para>
 561         <itemizedlist>
 562           <listitem><para><varname>DefaultLimitNOFILE=</varname> defaults to 1024:&HIGH_RLIMIT_NOFILE;.
 563           </para></listitem>
 564
 565           <listitem><para><varname>DefaultLimitMEMLOCK=</varname> defaults to 8M.</para></listitem>
 566
 567           <listitem><para><varname>DefaultLimitCORE=</varname> does not have a default but it is worth mentioning that
 568           <varname>RLIMIT_CORE</varname> is set to <literal>infinity</literal> by PID 1 which is inherited by its
 569           children.</para></listitem>
 570         </itemizedlist>
 571
 572         <para>Note that the service manager internally in PID 1 bumps <varname>RLIMIT_NOFILE</varname> and
 573         <varname>RLIMIT_MEMLOCK</varname> to higher values, however the limit is reverted to the mentioned
 574         defaults for all child processes forked off.</para>
 575
 576         <xi:include href="version-info.xml" xpointer="v198"/>
 577       </listitem>
 578       </varlistentry>
 579
 580       <varlistentry>
 581         <term><varname>DefaultOOMPolicy=</varname></term>
 582
 583         <listitem><para>Configure the default policy for reacting to processes being killed by the Linux
 584         Out-Of-Memory (OOM) killer or <command>systemd-oomd</command>. This may be used to pick a global default for the per-unit
 585         <varname>OOMPolicy=</varname> setting. See
 586         <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 587         for details. Note that this default is not used for services that have <varname>Delegate=</varname>
 588         turned on.</para>
 589
 590         <xi:include href="version-info.xml" xpointer="v243"/></listitem>
 591       </varlistentry>
 592
 593       <varlistentry>
 594         <term><varname>DefaultOOMScoreAdjust=</varname></term>
 595
 596         <listitem><para>Configures the default OOM score adjustments of processes run by the service
 597         manager. This defaults to unset (meaning the forked off processes inherit the service manager's OOM
 598         score adjustment value), except if the service manager is run for an unprivileged user, in which case
 599         this defaults to the service manager's OOM adjustment value plus 100 (this makes service processes
 600         slightly more likely to be killed under memory pressure than the manager itself). This may be used to
 601         pick a global default for the per-unit <varname>OOMScoreAdjust=</varname> setting. See
 602         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
 603         details. Note that this setting has no effect on the OOM score adjustment value of the service
 604         manager process itself, it retains the original value set during its invocation.</para>
 605
 606         <xi:include href="version-info.xml" xpointer="v250"/></listitem>
 607       </varlistentry>
 608
 609       <varlistentry>
 610         <term><varname>DefaultSmackProcessLabel=</varname></term>
 611
 612         <listitem><para>Takes a <option>SMACK64</option> security label as the argument. The process executed
 613         by a unit will be started under this label if <varname>SmackProcessLabel=</varname> is not set in the
 614         unit. See <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 615         for the details.</para>
 616
 617         <para>If the value is <literal>/</literal>, only labels specified with <varname>SmackProcessLabel=</varname>
 618         are assigned and the compile-time default is ignored.</para>
 619
 620         <xi:include href="version-info.xml" xpointer="v252"/></listitem>
 621       </varlistentry>
 622
 623       <varlistentry>
 624         <term><varname>ReloadLimitIntervalSec=</varname></term>
 625         <term><varname>ReloadLimitBurst=</varname></term>
 626
 627         <listitem><para>Rate limiting for daemon-reload and (since v256) daemon-reexec requests. The setting
 628         applies to both operations, but the rate limits are tracked separately. Defaults to unset, and any
 629         number of operations can be requested at any time. <varname>ReloadLimitIntervalSec=</varname> takes
 630         a value in seconds to configure the rate limit window, and <varname>ReloadLimitBurst=</varname>
 631         takes a positive integer to configure the maximum allowed number of operations within the configured
 632         time window.</para>
 633
 634         <xi:include href="version-info.xml" xpointer="v253"/></listitem>
 635       </varlistentry>
 636
 637       <varlistentry>
 638         <term><varname>DefaultMemoryPressureWatch=</varname></term>
 639         <term><varname>DefaultMemoryPressureThresholdSec=</varname></term>
 640
 641         <listitem><para>Configures the default settings for the per-unit
 642         <varname>MemoryPressureWatch=</varname> and <varname>MemoryPressureThresholdSec=</varname>
 643         settings. See
 644         <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 645         for details. Defaults to <literal>auto</literal> and <literal>200ms</literal>, respectively. This
 646         also sets the memory pressure monitoring threshold for the service manager itself.</para>
 647
 648         <xi:include href="version-info.xml" xpointer="v254"/></listitem>
 649       </varlistentry>
 650     </variablelist>
 651   </refsect1>
 652
 653   <refsect1>
 654     <title>Specifiers</title>
 655
 656     <para>Specifiers may be used in the <varname>DefaultEnvironment=</varname> and
 657     <varname>ManagerEnvironment=</varname> settings. The following expansions are understood:</para>
 658       <table class='specifiers'>
 659         <title>Specifiers available</title>
 660         <tgroup cols='3' align='left' colsep='1' rowsep='1'>
 661           <colspec colname="spec" />
 662           <colspec colname="mean" />
 663           <colspec colname="detail" />
 664           <thead>
 665             <row>
 666               <entry>Specifier</entry>
 667               <entry>Meaning</entry>
 668               <entry>Details</entry>
 669             </row>
 670           </thead>
 671           <tbody>
 672             <xi:include href="standard-specifiers.xml" xpointer="a"/>
 673             <xi:include href="standard-specifiers.xml" xpointer="A"/>
 674             <xi:include href="standard-specifiers.xml" xpointer="b"/>
 675             <xi:include href="standard-specifiers.xml" xpointer="B"/>
 676             <xi:include href="standard-specifiers.xml" xpointer="H"/>
 677             <xi:include href="standard-specifiers.xml" xpointer="l"/>
 678             <xi:include href="standard-specifiers.xml" xpointer="m"/>
 679             <xi:include href="standard-specifiers.xml" xpointer="M"/>
 680             <xi:include href="standard-specifiers.xml" xpointer="o"/>
 681             <xi:include href="standard-specifiers.xml" xpointer="v"/>
 682             <xi:include href="standard-specifiers.xml" xpointer="w"/>
 683             <xi:include href="standard-specifiers.xml" xpointer="W"/>
 684             <xi:include href="standard-specifiers.xml" xpointer="T"/>
 685             <xi:include href="standard-specifiers.xml" xpointer="V"/>
 686             <row>
 687               <entry><literal>%h</literal></entry>
 688               <entry>User home directory</entry>
 689               <entry>This is the home directory of the <emphasis>user running the service manager instance</emphasis>.</entry>
 690             </row>
 691             <row>
 692               <entry><literal>%u</literal></entry>
 693               <entry>Username</entry>
 694               <entry>This is the username of the <emphasis>user running the service manager instance</emphasis>.</entry>
 695             </row>
 696             <row>
 697               <entry><literal>%U</literal></entry>
 698               <entry>User id</entry>
 699               <entry>This is the user id of the <emphasis>user running the service manager instance</emphasis>.</entry>
 700             </row>
 701             <row>
 702               <entry><literal>%g</literal></entry>
 703               <entry>Primary group</entry>
 704               <entry>This is the primary group of the <emphasis>user running the service manager instance</emphasis>.</entry>
 705             </row>
 706             <row>
 707               <entry><literal>%G</literal></entry>
 708               <entry>Primary group id</entry>
 709               <entry>This is the primary group id of the <emphasis>user running the service manager instance</emphasis>.</entry>
 710             </row>
 711             <row>
 712               <entry><literal>%s</literal></entry>
 713               <entry>User shell</entry>
 714               <entry>This is the shell of the <emphasis>user running the service manager instance</emphasis>.</entry>
 715             </row>
 716             <xi:include href="standard-specifiers.xml" xpointer="percent"/>
 717           </tbody>
 718         </tgroup>
 719       </table>
 720   </refsect1>
 721
 722   <refsect1>
 723       <title>History</title>
 724
 725       <variablelist>
 726         <varlistentry>
 727           <term>systemd 252</term>
 728           <listitem><para>Option <varname>DefaultBlockIOAccounting=</varname> was deprecated. Please switch
 729           to the unified cgroup hierarchy.</para>
 730
 731           <xi:include href="version-info.xml" xpointer="v252"/></listitem>
 732         </varlistentry>
 733       </variablelist>
 734   </refsect1>
 735
 736   <refsect1>
 737       <title>See Also</title>
 738       <para><simplelist type="inline">
 739         <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
 740         <member><citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry></member>
 741         <member><citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
 742         <member><citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
 743         <member><citerefentry project='man-pages'><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry></member>
 744         <member><citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry></member>
 745       </simplelist></para>
 746   </refsect1>
 747
 748 </refentry>