1 <?xml version='
1.0'
?> <!--*- Mode: nxml; nxml-child-indent: 2; indent-tabs-mode: nil -*-->
2 <!DOCTYPE refentry PUBLIC
"-//OASIS//DTD DocBook XML V4.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
6 This file is part of systemd.
8 Copyright 2010 Lennart Poettering
10 systemd is free software; you can redistribute it and/or modify it
11 under the terms of the GNU Lesser General Public License as published by
12 the Free Software Foundation; either version 2.1 of the License, or
13 (at your option) any later version.
15 systemd is distributed in the hope that it will be useful, but
16 WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Lesser General Public License for more details.
20 You should have received a copy of the GNU Lesser General Public License
21 along with systemd; If not, see <http://www.gnu.org/licenses/>.
24 <refentry id=
"systemd.exec">
26 <title>systemd.exec
</title>
27 <productname>systemd
</productname>
31 <contrib>Developer
</contrib>
32 <firstname>Lennart
</firstname>
33 <surname>Poettering
</surname>
34 <email>lennart@poettering.net
</email>
40 <refentrytitle>systemd.exec
</refentrytitle>
41 <manvolnum>5</manvolnum>
45 <refname>systemd.exec
</refname>
46 <refpurpose>Execution environment configuration
</refpurpose>
50 <para><filename><replaceable>service
</replaceable>.service
</filename>,
51 <filename><replaceable>socket
</replaceable>.socket
</filename>,
52 <filename><replaceable>mount
</replaceable>.mount
</filename>,
53 <filename><replaceable>swap
</replaceable>.swap
</filename></para>
57 <title>Description
</title>
59 <para>Unit configuration files for services, sockets, mount
60 points, and swap devices share a subset of configuration options
61 which define the execution environment of spawned
64 <para>This man page lists the configuration options shared by
65 these four unit types. See
66 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
67 for the common options of all unit configuration files, and
68 <citerefentry><refentrytitle>systemd.service
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
69 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
70 <citerefentry><refentrytitle>systemd.swap
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
72 <citerefentry><refentrytitle>systemd.mount
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
73 for more information on the specific unit configuration files. The
74 execution specific configuration options are configured in the
75 [Service], [Socket], [Mount], or [Swap] sections, depending on the
80 <title>Options
</title>
82 <variablelist class='unit-directives'
>
85 <term><varname>WorkingDirectory=
</varname></term>
87 <listitem><para>Takes an absolute directory path, or the
88 special value
<literal>~
</literal>. Sets the working directory
89 for executed processes. If set to
<literal>~
</literal>, the
90 home directory of the user specified in
91 <varname>User=
</varname> is used. If not set, defaults to the
92 root directory when systemd is running as a system instance
93 and the respective user's home directory if run as user. If
94 the setting is prefixed with the
<literal>-
</literal>
95 character, a missing working directory is not considered
96 fatal.
</para></listitem>
100 <term><varname>RootDirectory=
</varname></term>
102 <listitem><para>Takes an absolute directory path. Sets the
103 root directory for executed processes, with the
<citerefentry
104 project='man-pages'
><refentrytitle>chroot
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
105 system call. If this is used, it must be ensured that the
106 process binary and all its auxiliary files are available in
107 the
<function>chroot()
</function> jail.
</para></listitem>
111 <term><varname>User=
</varname></term>
112 <term><varname>Group=
</varname></term>
114 <listitem><para>Sets the Unix user or group that the processes
115 are executed as, respectively. Takes a single user or group
116 name or ID as argument. If no group is set, the default group
117 of the user is chosen.
</para></listitem>
121 <term><varname>SupplementaryGroups=
</varname></term>
123 <listitem><para>Sets the supplementary Unix groups the
124 processes are executed as. This takes a space-separated list
125 of group names or IDs. This option may be specified more than
126 once, in which case all listed groups are set as supplementary
127 groups. When the empty string is assigned, the list of
128 supplementary groups is reset, and all assignments prior to
129 this one will have no effect. In any way, this option does not
130 override, but extends the list of supplementary groups
131 configured in the system group database for the
132 user.
</para></listitem>
136 <term><varname>Nice=
</varname></term>
138 <listitem><para>Sets the default nice level (scheduling
139 priority) for executed processes. Takes an integer between -
20
140 (highest priority) and
19 (lowest priority). See
141 <citerefentry><refentrytitle>setpriority
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
142 for details.
</para></listitem>
146 <term><varname>OOMScoreAdjust=
</varname></term>
148 <listitem><para>Sets the adjustment level for the
149 Out-Of-Memory killer for executed processes. Takes an integer
150 between -
1000 (to disable OOM killing for this process) and
151 1000 (to make killing of this process under memory pressure
152 very likely). See
<ulink
153 url=
"https://www.kernel.org/doc/Documentation/filesystems/proc.txt">proc.txt
</ulink>
154 for details.
</para></listitem>
158 <term><varname>IOSchedulingClass=
</varname></term>
160 <listitem><para>Sets the I/O scheduling class for executed
161 processes. Takes an integer between
0 and
3 or one of the
162 strings
<option>none
</option>,
<option>realtime
</option>,
163 <option>best-effort
</option> or
<option>idle
</option>. See
164 <citerefentry><refentrytitle>ioprio_set
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
165 for details.
</para></listitem>
169 <term><varname>IOSchedulingPriority=
</varname></term>
171 <listitem><para>Sets the I/O scheduling priority for executed
172 processes. Takes an integer between
0 (highest priority) and
7
173 (lowest priority). The available priorities depend on the
174 selected I/O scheduling class (see above). See
175 <citerefentry><refentrytitle>ioprio_set
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
176 for details.
</para></listitem>
180 <term><varname>CPUSchedulingPolicy=
</varname></term>
182 <listitem><para>Sets the CPU scheduling policy for executed
183 processes. Takes one of
184 <option>other
</option>,
185 <option>batch
</option>,
186 <option>idle
</option>,
187 <option>fifo
</option> or
188 <option>rr
</option>. See
189 <citerefentry><refentrytitle>sched_setscheduler
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
190 for details.
</para></listitem>
194 <term><varname>CPUSchedulingPriority=
</varname></term>
196 <listitem><para>Sets the CPU scheduling priority for executed
197 processes. The available priority range depends on the
198 selected CPU scheduling policy (see above). For real-time
199 scheduling policies an integer between
1 (lowest priority) and
200 99 (highest priority) can be used. See
201 <citerefentry><refentrytitle>sched_setscheduler
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
202 for details.
</para></listitem>
206 <term><varname>CPUSchedulingResetOnFork=
</varname></term>
208 <listitem><para>Takes a boolean argument. If true, elevated
209 CPU scheduling priorities and policies will be reset when the
210 executed processes fork, and can hence not leak into child
212 <citerefentry><refentrytitle>sched_setscheduler
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
213 for details. Defaults to false.
</para></listitem>
217 <term><varname>CPUAffinity=
</varname></term>
219 <listitem><para>Controls the CPU affinity of the executed
220 processes. Takes a list of CPU indices or ranges separated by
221 either whitespace or commas. CPU ranges are specified by the
222 lower and upper CPU indices separated by a dash.
223 This option may be specified more than once, in which case the
224 specified CPU affinity masks are merged. If the empty string
225 is assigned, the mask is reset, all assignments prior to this
226 will have no effect. See
227 <citerefentry><refentrytitle>sched_setaffinity
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
228 for details.
</para></listitem>
232 <term><varname>UMask=
</varname></term>
234 <listitem><para>Controls the file mode creation mask. Takes an
235 access mode in octal notation. See
236 <citerefentry><refentrytitle>umask
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
237 for details. Defaults to
0022.
</para></listitem>
241 <term><varname>Environment=
</varname></term>
243 <listitem><para>Sets environment variables for executed
244 processes. Takes a space-separated list of variable
245 assignments. This option may be specified more than once, in
246 which case all listed variables will be set. If the same
247 variable is set twice, the later setting will override the
248 earlier setting. If the empty string is assigned to this
249 option, the list of environment variables is reset, all prior
250 assignments have no effect. Variable expansion is not
251 performed inside the strings, however, specifier expansion is
252 possible. The $ character has no special meaning. If you need
253 to assign a value containing spaces to a variable, use double
254 quotes (
") for the assignment.</para>
257 <programlisting>Environment="VAR1=word1 word2
" VAR2=word3 "VAR3=$word
5 6"</programlisting>
258 gives three variables <literal>VAR1</literal>,
259 <literal>VAR2</literal>, <literal>VAR3</literal>
260 with the values <literal>word1 word2</literal>,
261 <literal>word3</literal>, <literal>$word 5 6</literal>.
266 <citerefentry project='man-pages'><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>
267 for details about environment variables.</para></listitem>
270 <term><varname>EnvironmentFile=</varname></term>
271 <listitem><para>Similar to <varname>Environment=</varname> but
272 reads the environment variables from a text file. The text
273 file should contain new-line-separated variable assignments.
274 Empty lines, lines without an <literal>=</literal> separator,
275 or lines starting with ; or # will be ignored,
276 which may be used for commenting. A line ending with a
277 backslash will be concatenated with the following one,
278 allowing multiline variable definitions. The parser strips
279 leading and trailing whitespace from the values of
280 assignments, unless you use double quotes (").
</para>
282 <para>The argument passed should be an absolute filename or
283 wildcard expression, optionally prefixed with
284 <literal>-
</literal>, which indicates that if the file does
285 not exist, it will not be read and no error or warning message
286 is logged. This option may be specified more than once in
287 which case all specified files are read. If the empty string
288 is assigned to this option, the list of file to read is reset,
289 all prior assignments have no effect.
</para>
291 <para>The files listed with this directive will be read
292 shortly before the process is executed (more specifically,
293 after all processes from a previous unit state terminated.
294 This means you can generate these files in one unit state, and
295 read it with this option in the next).
</para>
297 <para>Settings from these
298 files override settings made with
299 <varname>Environment=
</varname>. If the same variable is set
300 twice from these files, the files will be read in the order
301 they are specified and the later setting will override the
302 earlier setting.
</para></listitem>
306 <term><varname>StandardInput=
</varname></term>
307 <listitem><para>Controls where file descriptor
0 (STDIN) of
308 the executed processes is connected to. Takes one of
309 <option>null
</option>,
310 <option>tty
</option>,
311 <option>tty-force
</option>,
312 <option>tty-fail
</option> or
313 <option>socket
</option>.
</para>
315 <para>If
<option>null
</option> is selected, standard input
316 will be connected to
<filename>/dev/null
</filename>, i.e. all
317 read attempts by the process will result in immediate
320 <para>If
<option>tty
</option> is selected, standard input is
321 connected to a TTY (as configured by
322 <varname>TTYPath=
</varname>, see below) and the executed
323 process becomes the controlling process of the terminal. If
324 the terminal is already being controlled by another process,
325 the executed process waits until the current controlling
326 process releases the terminal.
</para>
328 <para><option>tty-force
</option> is similar to
329 <option>tty
</option>, but the executed process is forcefully
330 and immediately made the controlling process of the terminal,
331 potentially removing previous controlling processes from the
334 <para><option>tty-fail
</option> is similar to
335 <option>tty
</option> but if the terminal already has a
336 controlling process start-up of the executed process
339 <para>The
<option>socket
</option> option is only valid in
340 socket-activated services, and only when the socket
341 configuration file (see
342 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
343 for details) specifies a single socket only. If this option is
344 set, standard input will be connected to the socket the
345 service was activated from, which is primarily useful for
346 compatibility with daemons designed for use with the
348 <citerefentry project='freebsd'
><refentrytitle>inetd
</refentrytitle><manvolnum>8</manvolnum></citerefentry>
351 <para>This setting defaults to
352 <option>null
</option>.
</para></listitem>
355 <term><varname>StandardOutput=
</varname></term>
356 <listitem><para>Controls where file descriptor
1 (STDOUT) of
357 the executed processes is connected to. Takes one of
358 <option>inherit
</option>,
359 <option>null
</option>,
360 <option>tty
</option>,
361 <option>journal
</option>,
362 <option>syslog
</option>,
363 <option>kmsg
</option>,
364 <option>journal+console
</option>,
365 <option>syslog+console
</option>,
366 <option>kmsg+console
</option> or
367 <option>socket
</option>.
</para>
369 <para><option>inherit
</option> duplicates the file descriptor
370 of standard input for standard output.
</para>
372 <para><option>null
</option> connects standard output to
373 <filename>/dev/null
</filename>, i.e. everything written to it
376 <para><option>tty
</option> connects standard output to a tty
377 (as configured via
<varname>TTYPath=
</varname>, see below). If
378 the TTY is used for output only, the executed process will not
379 become the controlling process of the terminal, and will not
380 fail or wait for other processes to release the
383 <para><option>journal
</option> connects standard output with
384 the journal which is accessible via
385 <citerefentry><refentrytitle>journalctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
386 Note that everything that is written to syslog or kmsg (see
387 below) is implicitly stored in the journal as well, the
388 specific two options listed below are hence supersets of this
391 <para><option>syslog
</option> connects standard output to the
392 <citerefentry project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
393 system syslog service, in addition to the journal. Note that
394 the journal daemon is usually configured to forward everything
395 it receives to syslog anyway, in which case this option is no
396 different from
<option>journal
</option>.
</para>
398 <para><option>kmsg
</option> connects standard output with the
399 kernel log buffer which is accessible via
400 <citerefentry project='man-pages'
><refentrytitle>dmesg
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
401 in addition to the journal. The journal daemon might be
402 configured to send all logs to kmsg anyway, in which case this
403 option is no different from
<option>journal
</option>.
</para>
405 <para><option>journal+console
</option>,
406 <option>syslog+console
</option> and
407 <option>kmsg+console
</option> work in a similar way as the
408 three options above but copy the output to the system console
411 <para><option>socket
</option> connects standard output to a
412 socket acquired via socket activation. The semantics are
413 similar to the same option of
414 <varname>StandardInput=
</varname>.
</para>
416 <para>This setting defaults to the value set with
417 <option>DefaultStandardOutput=
</option> in
418 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
419 which defaults to
<option>journal
</option>.
</para></listitem>
422 <term><varname>StandardError=
</varname></term>
423 <listitem><para>Controls where file descriptor
2 (STDERR) of
424 the executed processes is connected to. The available options
425 are identical to those of
<varname>StandardOutput=
</varname>,
426 with one exception: if set to
<option>inherit
</option> the
427 file descriptor used for standard output is duplicated for
428 standard error. This setting defaults to the value set with
429 <option>DefaultStandardError=
</option> in
430 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
431 which defaults to
<option>inherit
</option>.
</para></listitem>
434 <term><varname>TTYPath=
</varname></term>
435 <listitem><para>Sets the terminal device node to use if
436 standard input, output, or error are connected to a TTY (see
438 <filename>/dev/console
</filename>.
</para></listitem>
441 <term><varname>TTYReset=
</varname></term>
442 <listitem><para>Reset the terminal device specified with
443 <varname>TTYPath=
</varname> before and after execution.
444 Defaults to
<literal>no
</literal>.
</para></listitem>
447 <term><varname>TTYVHangup=
</varname></term>
448 <listitem><para>Disconnect all clients which have opened the
449 terminal device specified with
<varname>TTYPath=
</varname>
450 before and after execution. Defaults to
451 <literal>no
</literal>.
</para></listitem>
454 <term><varname>TTYVTDisallocate=
</varname></term>
455 <listitem><para>If the terminal device specified with
456 <varname>TTYPath=
</varname> is a virtual console terminal, try
457 to deallocate the TTY before and after execution. This ensures
458 that the screen and scrollback buffer is cleared. Defaults to
459 <literal>no
</literal>.
</para></listitem>
462 <term><varname>SyslogIdentifier=
</varname></term>
463 <listitem><para>Sets the process name to prefix log lines sent
464 to the logging system or the kernel log buffer with. If not
465 set, defaults to the process name of the executed process.
466 This option is only useful when
467 <varname>StandardOutput=
</varname> or
468 <varname>StandardError=
</varname> are set to
469 <option>syslog
</option>,
<option>journal
</option> or
470 <option>kmsg
</option> (or to the same settings in combination
471 with
<option>+console
</option>).
</para></listitem>
474 <term><varname>SyslogFacility=
</varname></term>
475 <listitem><para>Sets the syslog facility to use when logging
476 to syslog. One of
<option>kern
</option>,
477 <option>user
</option>,
<option>mail
</option>,
478 <option>daemon
</option>,
<option>auth
</option>,
479 <option>syslog
</option>,
<option>lpr
</option>,
480 <option>news
</option>,
<option>uucp
</option>,
481 <option>cron
</option>,
<option>authpriv
</option>,
482 <option>ftp
</option>,
<option>local0
</option>,
483 <option>local1
</option>,
<option>local2
</option>,
484 <option>local3
</option>,
<option>local4
</option>,
485 <option>local5
</option>,
<option>local6
</option> or
486 <option>local7
</option>. See
487 <citerefentry project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
488 for details. This option is only useful when
489 <varname>StandardOutput=
</varname> or
490 <varname>StandardError=
</varname> are set to
491 <option>syslog
</option>. Defaults to
492 <option>daemon
</option>.
</para></listitem>
495 <term><varname>SyslogLevel=
</varname></term>
496 <listitem><para>The default syslog level to use when logging to
497 syslog or the kernel log buffer. One of
498 <option>emerg
</option>,
499 <option>alert
</option>,
500 <option>crit
</option>,
501 <option>err
</option>,
502 <option>warning
</option>,
503 <option>notice
</option>,
504 <option>info
</option>,
505 <option>debug
</option>. See
506 <citerefentry project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
507 for details. This option is only useful when
508 <varname>StandardOutput=
</varname> or
509 <varname>StandardError=
</varname> are set to
510 <option>syslog
</option> or
<option>kmsg
</option>. Note that
511 individual lines output by the daemon might be prefixed with a
512 different log level which can be used to override the default
513 log level specified here. The interpretation of these prefixes
514 may be disabled with
<varname>SyslogLevelPrefix=
</varname>,
515 see below. For details, see
516 <citerefentry><refentrytitle>sd-daemon
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
519 <option>info
</option>.
</para></listitem>
523 <term><varname>SyslogLevelPrefix=
</varname></term>
524 <listitem><para>Takes a boolean argument. If true and
525 <varname>StandardOutput=
</varname> or
526 <varname>StandardError=
</varname> are set to
527 <option>syslog
</option>,
<option>kmsg
</option> or
528 <option>journal
</option>, log lines written by the executed
529 process that are prefixed with a log level will be passed on
530 to syslog with this log level set but the prefix removed. If
531 set to false, the interpretation of these prefixes is disabled
532 and the logged lines are passed on as-is. For details about
534 <citerefentry><refentrytitle>sd-daemon
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
535 Defaults to true.
</para></listitem>
539 <term><varname>TimerSlackNSec=
</varname></term>
540 <listitem><para>Sets the timer slack in nanoseconds for the
541 executed processes. The timer slack controls the accuracy of
542 wake-ups triggered by timers. See
543 <citerefentry><refentrytitle>prctl
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
544 for more information. Note that in contrast to most other time
545 span definitions this parameter takes an integer value in
546 nano-seconds if no unit is specified. The usual time units are
547 understood too.
</para></listitem>
551 <term><varname>LimitCPU=
</varname></term>
552 <term><varname>LimitFSIZE=
</varname></term>
553 <term><varname>LimitDATA=
</varname></term>
554 <term><varname>LimitSTACK=
</varname></term>
555 <term><varname>LimitCORE=
</varname></term>
556 <term><varname>LimitRSS=
</varname></term>
557 <term><varname>LimitNOFILE=
</varname></term>
558 <term><varname>LimitAS=
</varname></term>
559 <term><varname>LimitNPROC=
</varname></term>
560 <term><varname>LimitMEMLOCK=
</varname></term>
561 <term><varname>LimitLOCKS=
</varname></term>
562 <term><varname>LimitSIGPENDING=
</varname></term>
563 <term><varname>LimitMSGQUEUE=
</varname></term>
564 <term><varname>LimitNICE=
</varname></term>
565 <term><varname>LimitRTPRIO=
</varname></term>
566 <term><varname>LimitRTTIME=
</varname></term>
567 <listitem><para>These settings set both soft and hard limits
568 of various resources for executed processes. See
569 <citerefentry><refentrytitle>setrlimit
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
570 for details. Use the string
<varname>infinity
</varname> to
571 configure no limit on a specific resource. The multiplicative
572 suffixes K (=
1024), M (=
1024*
1024) and so on for G, T, P and E
573 may be used for resource limits measured in bytes
574 (e.g. LimitAS=
16G). For the limits referring to time values,
575 the usual time units ms, s, min, h and so on may be used (see
576 <citerefentry><refentrytitle>systemd.time
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
577 for details). Note that if no time unit is specified for
578 <varname>LimitCPU=
</varname> the default unit of seconds is
579 implied, while for
<varname>LimitRTTIME=
</varname> the default
580 unit of microseconds is implied. Also, note that the effective
581 granularity of the limits might influence their
582 enforcement. For example, time limits specified for
583 <varname>LimitCPU=
</varname> will be rounded up implicitly to
584 multiples of
1s.
</para>
586 <para>Note that most process resource limits configured with
587 these options are per-process, and processes may fork in order
588 to acquire a new set of resources that are accounted
589 independently of the original process, and may thus escape
590 limits set. Also note that
<varname>LimitRSS=
</varname> is not
591 implemented on Linux, and setting it has no effect. Often it
592 is advisable to prefer the resource controls listed in
593 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
594 over these per-process limits, as they apply to services as a
595 whole, may be altered dynamically at runtime, and are
596 generally more expressive. For example,
597 <varname>MemoryLimit=
</varname> is a more powerful (and
598 working) replacement for
<varname>LimitRSS=
</varname>.
</para>
601 <title>Limit directives and their equivalent with ulimit
</title>
604 <colspec colname='directive'
/>
605 <colspec colname='equivalent'
/>
606 <colspec colname='unit'
/>
609 <entry>Directive
</entry>
610 <entry>ulimit equivalent
</entry>
616 <entry>LimitCPU=
</entry>
617 <entry>ulimit -t
</entry>
618 <entry>Seconds
</entry>
621 <entry>LimitFSIZE=
</entry>
622 <entry>ulimit -f
</entry>
626 <entry>LimitDATA=
</entry>
627 <entry>ulimit -d
</entry>
631 <entry>LimitSTACK=
</entry>
632 <entry>ulimit -s
</entry>
636 <entry>LimitCORE=
</entry>
637 <entry>ulimit -c
</entry>
641 <entry>LimitRSS=
</entry>
642 <entry>ulimit -m
</entry>
646 <entry>LimitNOFILE=
</entry>
647 <entry>ulimit -n
</entry>
648 <entry>Number of File Descriptors
</entry>
651 <entry>LimitAS=
</entry>
652 <entry>ulimit -v
</entry>
656 <entry>LimitNPROC=
</entry>
657 <entry>ulimit -u
</entry>
658 <entry>Number of Processes
</entry>
661 <entry>LimitMEMLOCK=
</entry>
662 <entry>ulimit -l
</entry>
666 <entry>LimitLOCKS=
</entry>
667 <entry>ulimit -x
</entry>
668 <entry>Number of Locks
</entry>
671 <entry>LimitSIGPENDING=
</entry>
672 <entry>ulimit -i
</entry>
673 <entry>Number of Queued Signals
</entry>
676 <entry>LimitMSGQUEUE=
</entry>
677 <entry>ulimit -q
</entry>
681 <entry>LimitNICE=
</entry>
682 <entry>ulimit -e
</entry>
683 <entry>Nice Level
</entry>
686 <entry>LimitRTPRIO=
</entry>
687 <entry>ulimit -r
</entry>
688 <entry>Realtime Priority
</entry>
691 <entry>LimitRTTIME=
</entry>
692 <entry>No equivalent
</entry>
693 <entry>Microseconds
</entry>
701 <term><varname>PAMName=
</varname></term>
702 <listitem><para>Sets the PAM service name to set up a session
703 as. If set, the executed process will be registered as a PAM
704 session under the specified service name. This is only useful
705 in conjunction with the
<varname>User=
</varname> setting. If
706 not set, no PAM session will be opened for the executed
708 <citerefentry project='man-pages'
><refentrytitle>pam
</refentrytitle><manvolnum>8</manvolnum></citerefentry>
709 for details.
</para></listitem>
713 <term><varname>CapabilityBoundingSet=
</varname></term>
715 <listitem><para>Controls which capabilities to include in the
716 capability bounding set for the executed process. See
717 <citerefentry project='man-pages'
><refentrytitle>capabilities
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
718 for details. Takes a whitespace-separated list of capability
720 <citerefentry project='mankier'
><refentrytitle>cap_from_name
</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
721 e.g.
<constant>CAP_SYS_ADMIN
</constant>,
722 <constant>CAP_DAC_OVERRIDE
</constant>,
723 <constant>CAP_SYS_PTRACE
</constant>. Capabilities listed will
724 be included in the bounding set, all others are removed. If
725 the list of capabilities is prefixed with
726 <literal>~
</literal>, all but the listed capabilities will be
727 included, the effect of the assignment inverted. Note that
728 this option also affects the respective capabilities in the
729 effective, permitted and inheritable capability sets, on top
730 of what
<varname>Capabilities=
</varname> does. If this option
731 is not used, the capability bounding set is not modified on
732 process execution, hence no limits on the capabilities of the
733 process are enforced. This option may appear more than once, in
734 which case the bounding sets are merged. If the empty string
735 is assigned to this option, the bounding set is reset to the
736 empty capability set, and all prior settings have no effect.
737 If set to
<literal>~
</literal> (without any further argument),
738 the bounding set is reset to the full set of available
739 capabilities, also undoing any previous
740 settings.
</para></listitem>
744 <term><varname>SecureBits=
</varname></term>
745 <listitem><para>Controls the secure bits set for the executed
746 process. Takes a space-separated combination of options from
748 <option>keep-caps
</option>,
749 <option>keep-caps-locked
</option>,
750 <option>no-setuid-fixup
</option>,
751 <option>no-setuid-fixup-locked
</option>,
752 <option>noroot
</option>, and
753 <option>noroot-locked
</option>.
754 This option may appear more than once, in which case the secure
755 bits are ORed. If the empty string is assigned to this option,
756 the bits are reset to
0. See
757 <citerefentry project='man-pages'
><refentrytitle>capabilities
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
758 for details.
</para></listitem>
762 <term><varname>Capabilities=
</varname></term>
763 <listitem><para>Controls the
764 <citerefentry project='man-pages'
><refentrytitle>capabilities
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
765 set for the executed process. Take a capability string
766 describing the effective, permitted and inherited capability
767 sets as documented in
768 <citerefentry project='mankier'
><refentrytitle>cap_from_text
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
769 Note that these capability sets are usually influenced (and
770 filtered) by the capabilities attached to the executed file.
771 Due to that
<varname>CapabilityBoundingSet=
</varname> is
772 probably a much more useful setting.
</para></listitem>
776 <term><varname>ReadWriteDirectories=
</varname></term>
777 <term><varname>ReadOnlyDirectories=
</varname></term>
778 <term><varname>InaccessibleDirectories=
</varname></term>
780 <listitem><para>Sets up a new file system namespace for
781 executed processes. These options may be used to limit access
782 a process might have to the main file system hierarchy. Each
783 setting takes a space-separated list of absolute directory
784 paths. Directories listed in
785 <varname>ReadWriteDirectories=
</varname> are accessible from
786 within the namespace with the same access rights as from
787 outside. Directories listed in
788 <varname>ReadOnlyDirectories=
</varname> are accessible for
789 reading only, writing will be refused even if the usual file
790 access controls would permit this. Directories listed in
791 <varname>InaccessibleDirectories=
</varname> will be made
792 inaccessible for processes inside the namespace. Note that
793 restricting access with these options does not extend to
794 submounts of a directory that are created later on. These
795 options may be specified more than once, in which case all
796 directories listed will have limited access from within the
797 namespace. If the empty string is assigned to this option, the
798 specific list is reset, and all prior assignments have no
801 <varname>ReadOnlyDirectories=
</varname>
803 <varname>InaccessibleDirectories=
</varname>
805 <literal>-
</literal>, in which case
806 they will be ignored when they do not
807 exist. Note that using this
808 setting will disconnect propagation of
809 mounts from the service to the host
810 (propagation in the opposite direction
811 continues to work). This means that
812 this setting may not be used for
813 services which shall be able to
814 install mount points in the main mount
815 namespace.
</para></listitem>
819 <term><varname>PrivateTmp=
</varname></term>
821 <listitem><para>Takes a boolean argument. If true, sets up a
822 new file system namespace for the executed processes and
823 mounts private
<filename>/tmp
</filename> and
824 <filename>/var/tmp
</filename> directories inside it that is
825 not shared by processes outside of the namespace. This is
826 useful to secure access to temporary files of the process, but
827 makes sharing between processes via
<filename>/tmp
</filename>
828 or
<filename>/var/tmp
</filename> impossible. If this is
829 enabled, all temporary files created by a service in these
830 directories will be removed after the service is stopped.
831 Defaults to false. It is possible to run two or more units
832 within the same private
<filename>/tmp
</filename> and
833 <filename>/var/tmp
</filename> namespace by using the
834 <varname>JoinsNamespaceOf=
</varname> directive, see
835 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
836 for details. Note that using this setting will disconnect
837 propagation of mounts from the service to the host
838 (propagation in the opposite direction continues to work).
839 This means that this setting may not be used for services
840 which shall be able to install mount points in the main mount
841 namespace.
</para></listitem>
845 <term><varname>PrivateDevices=
</varname></term>
847 <listitem><para>Takes a boolean argument. If true, sets up a
848 new /dev namespace for the executed processes and only adds
849 API pseudo devices such as
<filename>/dev/null
</filename>,
850 <filename>/dev/zero
</filename> or
851 <filename>/dev/random
</filename> (as well as the pseudo TTY
852 subsystem) to it, but no physical devices such as
853 <filename>/dev/sda
</filename>. This is useful to securely turn
854 off physical device access by the executed process. Defaults
855 to false. Enabling this option will also remove
856 <constant>CAP_MKNOD
</constant> from the capability bounding
857 set for the unit (see above), and set
858 <varname>DevicePolicy=closed
</varname> (see
859 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
860 for details). Note that using this setting will disconnect
861 propagation of mounts from the service to the host
862 (propagation in the opposite direction continues to work).
863 This means that this setting may not be used for services
864 which shall be able to install mount points in the main mount
865 namespace.
</para></listitem>
869 <term><varname>PrivateNetwork=
</varname></term>
871 <listitem><para>Takes a boolean argument. If true, sets up a
872 new network namespace for the executed processes and
873 configures only the loopback network device
874 <literal>lo
</literal> inside it. No other network devices will
875 be available to the executed process. This is useful to
876 securely turn off network access by the executed process.
877 Defaults to false. It is possible to run two or more units
878 within the same private network namespace by using the
879 <varname>JoinsNamespaceOf=
</varname> directive, see
880 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
881 for details. Note that this option will disconnect all socket
882 families from the host, this includes AF_NETLINK and AF_UNIX.
883 The latter has the effect that AF_UNIX sockets in the abstract
884 socket namespace will become unavailable to the processes
885 (however, those located in the file system will continue to be
886 accessible).
</para></listitem>
890 <term><varname>ProtectSystem=
</varname></term>
892 <listitem><para>Takes a boolean argument or
893 <literal>full
</literal>. If true, mounts the
894 <filename>/usr
</filename> and
<filename>/boot
</filename>
895 directories read-only for processes invoked by this unit. If
896 set to
<literal>full
</literal>, the
<filename>/etc
</filename>
897 directory is mounted read-only, too. This setting ensures that
898 any modification of the vendor-supplied operating system (and
899 optionally its configuration) is prohibited for the service.
900 It is recommended to enable this setting for all long-running
901 services, unless they are involved with system updates or need
902 to modify the operating system in other ways. Note however
903 that processes retaining the CAP_SYS_ADMIN capability can undo
904 the effect of this setting. This setting is hence particularly
905 useful for daemons which have this capability removed, for
906 example with
<varname>CapabilityBoundingSet=
</varname>.
907 Defaults to off.
</para></listitem>
911 <term><varname>ProtectHome=
</varname></term>
913 <listitem><para>Takes a boolean argument or
914 <literal>read-only
</literal>. If true, the directories
915 <filename>/home
</filename>,
<filename>/root
</filename> and
916 <filename>/run/user
</filename>
917 are made inaccessible and empty for processes invoked by this
918 unit. If set to
<literal>read-only
</literal>, the three
919 directories are made read-only instead. It is recommended to
920 enable this setting for all long-running services (in
921 particular network-facing ones), to ensure they cannot get
922 access to private user data, unless the services actually
923 require access to the user's private data. Note however that
924 processes retaining the CAP_SYS_ADMIN capability can undo the
925 effect of this setting. This setting is hence particularly
926 useful for daemons which have this capability removed, for
927 example with
<varname>CapabilityBoundingSet=
</varname>.
928 Defaults to off.
</para></listitem>
932 <term><varname>MountFlags=
</varname></term>
934 <listitem><para>Takes a mount propagation flag:
935 <option>shared
</option>,
<option>slave
</option> or
936 <option>private
</option>, which control whether mounts in the
937 file system namespace set up for this unit's processes will
938 receive or propagate mounts or unmounts. See
939 <citerefentry project='man-pages'
><refentrytitle>mount
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
940 for details. Defaults to
<option>shared
</option>. Use
941 <option>shared
</option> to ensure that mounts and unmounts are
942 propagated from the host to the container and vice versa. Use
943 <option>slave
</option> to run processes so that none of their
944 mounts and unmounts will propagate to the host. Use
945 <option>private
</option> to also ensure that no mounts and
946 unmounts from the host will propagate into the unit processes'
947 namespace. Note that
<option>slave
</option> means that file
948 systems mounted on the host might stay mounted continuously in
949 the unit's namespace, and thus keep the device busy. Note that
950 the file system namespace related options
951 (
<varname>PrivateTmp=
</varname>,
952 <varname>PrivateDevices=
</varname>,
953 <varname>ProtectSystem=
</varname>,
954 <varname>ProtectHome=
</varname>,
955 <varname>ReadOnlyDirectories=
</varname>,
956 <varname>InaccessibleDirectories=
</varname> and
957 <varname>ReadWriteDirectories=
</varname>) require that mount
958 and unmount propagation from the unit's file system namespace
959 is disabled, and hence downgrade
<option>shared
</option> to
960 <option>slave
</option>.
</para></listitem>
964 <term><varname>UtmpIdentifier=
</varname></term>
966 <listitem><para>Takes a four character identifier string for
968 project='man-pages'
><refentrytitle>utmp
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
969 and wtmp entry for this service. This should only be
970 set for services such as
<command>getty
</command>
971 implementations (such as
<citerefentry
972 project='die-net'
><refentrytitle>agetty
</refentrytitle><manvolnum>8</manvolnum></citerefentry>)
973 where utmp/wtmp entries must be created and cleared before and
974 after execution, or for services that shall be executed as if
975 they were run by a
<command>getty
</command> process (see
976 below). If the configured string is longer than four
977 characters, it is truncated and the terminal four characters
978 are used. This setting interprets %I style string
979 replacements. This setting is unset by default, i.e. no
980 utmp/wtmp entries are created or cleaned up for this
981 service.
</para></listitem>
985 <term><varname>UtmpMode=
</varname></term>
987 <listitem><para>Takes one of
<literal>init
</literal>,
988 <literal>login
</literal> or
<literal>user
</literal>. If
989 <varname>UtmpIdentifier=
</varname> is set, controls which
990 type of
<citerefentry
991 project='man-pages'
><refentrytitle>utmp
</refentrytitle><manvolnum>5</manvolnum></citerefentry>/wtmp
992 entries for this service are generated. This setting has no
993 effect unless
<varname>UtmpIdentifier=
</varname> is set
994 too. If
<literal>init
</literal> is set, only an
995 <constant>INIT_PROCESS
</constant> entry is generated and the
996 invoked process must implement a
997 <command>getty
</command>-compatible utmp/wtmp logic. If
998 <literal>login
</literal> is set, first an
999 <constant>INIT_PROCESS
</constant> entry, followed by a
1000 <constant>LOGIN_PROCESS
</constant> entry is generated. In
1001 this case, the invoked process must implement a
<citerefentry
1002 project='die-net'
><refentrytitle>login
</refentrytitle><manvolnum>1</manvolnum></citerefentry>-compatible
1003 utmp/wtmp logic. If
<literal>user
</literal> is set, first an
1004 <constant>INIT_PROCESS
</constant> entry, then a
1005 <constant>LOGIN_PROCESS
</constant> entry and finally a
1006 <constant>USER_PROCESS
</constant> entry is generated. In this
1007 case, the invoked process may be any process that is suitable
1008 to be run as session leader. Defaults to
1009 <literal>init
</literal>.
</para></listitem>
1013 <term><varname>SELinuxContext=
</varname></term>
1015 <listitem><para>Set the SELinux security context of the
1016 executed process. If set, this will override the automated
1017 domain transition. However, the policy still needs to
1018 authorize the transition. This directive is ignored if SELinux
1019 is disabled. If prefixed by
<literal>-
</literal>, all errors
1020 will be ignored. See
1021 <citerefentry project='die-net'
><refentrytitle>setexeccon
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
1022 for details.
</para></listitem>
1026 <term><varname>AppArmorProfile=
</varname></term>
1028 <listitem><para>Takes a profile name as argument. The process
1029 executed by the unit will switch to this profile when started.
1030 Profiles must already be loaded in the kernel, or the unit
1031 will fail. This result in a non operation if AppArmor is not
1032 enabled. If prefixed by
<literal>-
</literal>, all errors will
1033 be ignored.
</para></listitem>
1037 <term><varname>SmackProcessLabel=
</varname></term>
1039 <listitem><para>Takes a
<option>SMACK64
</option> security
1040 label as argument. The process executed by the unit will be
1041 started under this label and SMACK will decide whether the
1042 process is allowed to run or not, based on it. The process
1043 will continue to run under the label specified here unless the
1044 executable has its own
<option>SMACK64EXEC
</option> label, in
1045 which case the process will transition to run under that
1046 label. When not specified, the label that systemd is running
1047 under is used. This directive is ignored if SMACK is
1050 <para>The value may be prefixed by
<literal>-
</literal>, in
1051 which case all errors will be ignored. An empty value may be
1052 specified to unset previous assignments.
</para>
1057 <term><varname>IgnoreSIGPIPE=
</varname></term>
1059 <listitem><para>Takes a boolean argument. If true, causes
1060 <constant>SIGPIPE
</constant> to be ignored in the executed
1061 process. Defaults to true because
<constant>SIGPIPE
</constant>
1062 generally is useful only in shell pipelines.
</para></listitem>
1066 <term><varname>NoNewPrivileges=
</varname></term>
1068 <listitem><para>Takes a boolean argument. If true, ensures
1069 that the service process and all its children can never gain
1070 new privileges. This option is more powerful than the
1071 respective secure bits flags (see above), as it also prohibits
1072 UID changes of any kind. This is the simplest, most effective
1073 way to ensure that a process and its children can never
1074 elevate privileges again.
</para></listitem>
1078 <term><varname>SystemCallFilter=
</varname></term>
1080 <listitem><para>Takes a space-separated list of system call
1081 names. If this setting is used, all system calls executed by
1082 the unit processes except for the listed ones will result in
1083 immediate process termination with the
1084 <constant>SIGSYS
</constant> signal (whitelisting). If the
1085 first character of the list is
<literal>~
</literal>, the
1086 effect is inverted: only the listed system calls will result
1087 in immediate process termination (blacklisting). If running in
1088 user mode and this option is used,
1089 <varname>NoNewPrivileges=yes
</varname> is implied. This
1090 feature makes use of the Secure Computing Mode
2 interfaces of
1091 the kernel ('seccomp filtering') and is useful for enforcing a
1092 minimal sandboxing environment. Note that the
1093 <function>execve
</function>,
1094 <function>rt_sigreturn
</function>,
1095 <function>sigreturn
</function>,
1096 <function>exit_group
</function>,
<function>exit
</function>
1097 system calls are implicitly whitelisted and do not need to be
1098 listed explicitly. This option may be specified more than once,
1099 in which case the filter masks are merged. If the empty string
1100 is assigned, the filter is reset, all prior assignments will
1101 have no effect.
</para>
1103 <para>If you specify both types of this option (i.e.
1104 whitelisting and blacklisting), the first encountered will
1105 take precedence and will dictate the default action
1106 (termination or approval of a system call). Then the next
1107 occurrences of this option will add or delete the listed
1108 system calls from the set of the filtered system calls,
1109 depending of its type and the default action. (For example, if
1110 you have started with a whitelisting of
1111 <function>read
</function> and
<function>write
</function>, and
1112 right after it add a blacklisting of
1113 <function>write
</function>, then
<function>write
</function>
1114 will be removed from the set.)
</para></listitem>
1118 <term><varname>SystemCallErrorNumber=
</varname></term>
1120 <listitem><para>Takes an
<literal>errno
</literal> error number
1121 name to return when the system call filter configured with
1122 <varname>SystemCallFilter=
</varname> is triggered, instead of
1123 terminating the process immediately. Takes an error name such
1124 as
<constant>EPERM
</constant>,
<constant>EACCES
</constant> or
1125 <constant>EUCLEAN
</constant>. When this setting is not used,
1126 or when the empty string is assigned, the process will be
1127 terminated immediately when the filter is
1128 triggered.
</para></listitem>
1132 <term><varname>SystemCallArchitectures=
</varname></term>
1134 <listitem><para>Takes a space-separated list of architecture
1135 identifiers to include in the system call filter. The known
1136 architecture identifiers are
<constant>x86
</constant>,
1137 <constant>x86-
64</constant>,
<constant>x32
</constant>,
1138 <constant>arm
</constant> as well as the special identifier
1139 <constant>native
</constant>. Only system calls of the
1140 specified architectures will be permitted to processes of this
1141 unit. This is an effective way to disable compatibility with
1142 non-native architectures for processes, for example to
1143 prohibit execution of
32-bit x86 binaries on
64-bit x86-
64
1144 systems. The special
<constant>native
</constant> identifier
1145 implicitly maps to the native architecture of the system (or
1146 more strictly: to the architecture the system manager is
1147 compiled for). If running in user mode and this option is
1148 used,
<varname>NoNewPrivileges=yes
</varname> is implied. Note
1149 that setting this option to a non-empty list implies that
1150 <constant>native
</constant> is included too. By default, this
1151 option is set to the empty list, i.e. no architecture system
1152 call filtering is applied.
</para></listitem>
1156 <term><varname>RestrictAddressFamilies=
</varname></term>
1158 <listitem><para>Restricts the set of socket address families
1159 accessible to the processes of this unit. Takes a
1160 space-separated list of address family names to whitelist,
1162 <constant>AF_UNIX
</constant>,
1163 <constant>AF_INET
</constant> or
1164 <constant>AF_INET6
</constant>. When
1165 prefixed with
<constant>~
</constant> the listed address
1166 families will be applied as blacklist, otherwise as whitelist.
1167 Note that this restricts access to the
1168 <citerefentry project='man-pages'
><refentrytitle>socket
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1169 system call only. Sockets passed into the process by other
1170 means (for example, by using socket activation with socket
1172 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry>)
1173 are unaffected. Also, sockets created with
1174 <function>socketpair()
</function> (which creates connected
1175 AF_UNIX sockets only) are unaffected. Note that this option
1176 has no effect on
32-bit x86 and is ignored (but works
1177 correctly on x86-
64). If running in user mode and this option
1178 is used,
<varname>NoNewPrivileges=yes
</varname> is implied. By
1179 default, no restriction applies, all address families are
1180 accessible to processes. If assigned the empty string, any
1181 previous list changes are undone.
</para>
1183 <para>Use this option to limit exposure of processes to remote
1184 systems, in particular via exotic network protocols. Note that
1185 in most cases, the local
<constant>AF_UNIX
</constant> address
1186 family should be included in the configured whitelist as it is
1187 frequently used for local communication, including for
1188 <citerefentry><refentrytitle>syslog
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1189 logging.
</para></listitem>
1193 <term><varname>Personality=
</varname></term>
1195 <listitem><para>Controls which kernel architecture
1196 <citerefentry project='man-pages'
><refentrytitle>uname
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1197 shall report, when invoked by unit processes. Takes one of
1198 <constant>x86
</constant> and
<constant>x86-
64</constant>. This
1199 is useful when running
32-bit services on a
64-bit host
1200 system. If not specified, the personality is left unmodified
1201 and thus reflects the personality of the host system's
1202 kernel.
</para></listitem>
1206 <term><varname>RuntimeDirectory=
</varname></term>
1207 <term><varname>RuntimeDirectoryMode=
</varname></term>
1209 <listitem><para>Takes a list of directory names. If set, one
1210 or more directories by the specified names will be created
1211 below
<filename>/run
</filename> (for system services) or below
1212 <varname>$XDG_RUNTIME_DIR
</varname> (for user services) when
1213 the unit is started, and removed when the unit is stopped. The
1214 directories will have the access mode specified in
1215 <varname>RuntimeDirectoryMode=
</varname>, and will be owned by
1216 the user and group specified in
<varname>User=
</varname> and
1217 <varname>Group=
</varname>. Use this to manage one or more
1218 runtime directories of the unit and bind their lifetime to the
1219 daemon runtime. The specified directory names must be
1220 relative, and may not include a
<literal>/
</literal>, i.e.
1221 must refer to simple directories to create or remove. This is
1222 particularly useful for unprivileged daemons that cannot
1223 create runtime directories in
<filename>/run
</filename> due to
1224 lack of privileges, and to make sure the runtime directory is
1225 cleaned up automatically after use. For runtime directories
1226 that require more complex or different configuration or
1227 lifetime guarantees, please consider using
1228 <citerefentry><refentrytitle>tmpfiles.d
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
</para></listitem>
1235 <title>Environment variables in spawned processes
</title>
1237 <para>Processes started by the system are executed in a clean
1238 environment in which select variables listed below are set. System
1239 processes started by systemd do not inherit variables from PID
1,
1240 but processes started by user systemd instances inherit all
1241 environment variables from the user systemd instance.
1244 <variablelist class='environment-variables'
>
1246 <term><varname>$PATH
</varname></term>
1248 <listitem><para>Colon-separated list of directories to use
1249 when launching executables. Systemd uses a fixed value of
1250 <filename>/usr/local/sbin
</filename>:
<filename>/usr/local/bin
</filename>:
<filename>/usr/sbin
</filename>:
<filename>/usr/bin
</filename>:
<filename>/sbin
</filename>:
<filename>/bin
</filename>.
1255 <term><varname>$LANG
</varname></term>
1257 <listitem><para>Locale. Can be set in
1258 <citerefentry project='man-pages'
><refentrytitle>locale.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1259 or on the kernel command line (see
1260 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry>
1262 <citerefentry><refentrytitle>kernel-command-line
</refentrytitle><manvolnum>7</manvolnum></citerefentry>).
1267 <term><varname>$USER
</varname></term>
1268 <term><varname>$LOGNAME
</varname></term>
1269 <term><varname>$HOME
</varname></term>
1270 <term><varname>$SHELL
</varname></term>
1272 <listitem><para>User name (twice), home directory, and the
1273 login shell. The variables are set for the units that have
1274 <varname>User=
</varname> set, which includes user
1275 <command>systemd
</command> instances. See
1276 <citerefentry project='die-net'
><refentrytitle>passwd
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
1281 <term><varname>$XDG_RUNTIME_DIR
</varname></term>
1283 <listitem><para>The directory for volatile state. Set for the
1284 user
<command>systemd
</command> instance, and also in user
1286 <citerefentry><refentrytitle>pam_systemd
</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
1291 <term><varname>$XDG_SESSION_ID
</varname></term>
1292 <term><varname>$XDG_SEAT
</varname></term>
1293 <term><varname>$XDG_VTNR
</varname></term>
1295 <listitem><para>The identifier of the session, the seat name,
1296 and virtual terminal of the session. Set by
1297 <citerefentry><refentrytitle>pam_systemd
</refentrytitle><manvolnum>8</manvolnum></citerefentry>
1298 for login sessions.
<varname>$XDG_SEAT
</varname> and
1299 <varname>$XDG_VTNR
</varname> will only be set when attached to
1300 a seat and a tty.
</para></listitem>
1304 <term><varname>$MAINPID
</varname></term>
1306 <listitem><para>The PID of the units main process if it is
1307 known. This is only set for control processes as invoked by
1308 <varname>ExecReload=
</varname> and similar.
</para></listitem>
1312 <term><varname>$MANAGERPID
</varname></term>
1314 <listitem><para>The PID of the user
<command>systemd
</command>
1315 instance, set for processes spawned by it.
</para></listitem>
1319 <term><varname>$LISTEN_FDS
</varname></term>
1320 <term><varname>$LISTEN_PID
</varname></term>
1322 <listitem><para>Information about file descriptors passed to a
1323 service for socket activation. See
1324 <citerefentry><refentrytitle>sd_listen_fds
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
1329 <term><varname>$TERM
</varname></term>
1331 <listitem><para>Terminal type, set only for units connected to
1332 a terminal (
<varname>StandardInput=tty
</varname>,
1333 <varname>StandardOutput=tty
</varname>, or
1334 <varname>StandardError=tty
</varname>). See
1335 <citerefentry project='man-pages'
><refentrytitle>termcap
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
1340 <para>Additional variables may be configured by the following
1341 means: for processes spawned in specific units, use the
1342 <varname>Environment=
</varname> and
1343 <varname>EnvironmentFile=
</varname> options above; to specify
1344 variables globally, use
<varname>DefaultEnvironment=
</varname>
1346 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>)
1347 or the kernel option
<varname>systemd.setenv=
</varname> (see
1348 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry>).
1349 Additional variables may also be set through PAM,
1350 cf.
<citerefentry project='man-pages'
><refentrytitle>pam_env
</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
</para>
1354 <title>See Also
</title>
1356 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1357 <citerefentry><refentrytitle>systemctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1358 <citerefentry><refentrytitle>journalctl
</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1359 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1360 <citerefentry><refentrytitle>systemd.service
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1361 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1362 <citerefentry><refentrytitle>systemd.swap
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1363 <citerefentry><refentrytitle>systemd.mount
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1364 <citerefentry><refentrytitle>systemd.kill
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1365 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1366 <citerefentry><refentrytitle>systemd.time
</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
1367 <citerefentry><refentrytitle>systemd.directives
</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
1368 <citerefentry><refentrytitle>tmpfiles.d
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1369 <citerefentry project='man-pages'
><refentrytitle>exec
</refentrytitle><manvolnum>3</manvolnum></citerefentry>