2 <!DOCTYPE refentry PUBLIC
"-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
4 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
6 <refentry id=
"systemd.exec" xmlns:
xi=
"http://www.w3.org/2001/XInclude">
8 <title>systemd.exec
</title>
9 <productname>systemd
</productname>
13 <refentrytitle>systemd.exec
</refentrytitle>
14 <manvolnum>5</manvolnum>
18 <refname>systemd.exec
</refname>
19 <refpurpose>Execution environment configuration
</refpurpose>
23 <para><filename><replaceable>service
</replaceable>.service
</filename>,
24 <filename><replaceable>socket
</replaceable>.socket
</filename>,
25 <filename><replaceable>mount
</replaceable>.mount
</filename>,
26 <filename><replaceable>swap
</replaceable>.swap
</filename></para>
30 <title>Description
</title>
32 <para>Unit configuration files for services, sockets, mount points, and swap devices share a subset of
33 configuration options which define the execution environment of spawned processes.
</para>
35 <para>This man page lists the configuration options shared by these four unit types. See
36 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry> for the common
37 options of all unit configuration files, and
38 <citerefentry><refentrytitle>systemd.service
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
39 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
40 <citerefentry><refentrytitle>systemd.swap
</refentrytitle><manvolnum>5</manvolnum></citerefentry>, and
41 <citerefentry><refentrytitle>systemd.mount
</refentrytitle><manvolnum>5</manvolnum></citerefentry> for more
42 information on the specific unit configuration files. The execution specific configuration options are configured
43 in the [Service], [Socket], [Mount], or [Swap] sections, depending on the unit type.
</para>
45 <para>In addition, options which control resources through Linux Control Groups (cgroups) are listed in
46 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
47 Those options complement options listed here.
</para>
51 <title>Implicit Dependencies
</title>
53 <para>A few execution parameters result in additional, automatic dependencies to be added:
</para>
56 <listitem><para>Units with
<varname>WorkingDirectory=
</varname>,
<varname>RootDirectory=
</varname>,
57 <varname>RootImage=
</varname>,
<varname>RuntimeDirectory=
</varname>,
<varname>StateDirectory=
</varname>,
58 <varname>CacheDirectory=
</varname>,
<varname>LogsDirectory=
</varname> or
59 <varname>ConfigurationDirectory=
</varname> set automatically gain dependencies of type
60 <varname>Requires=
</varname> and
<varname>After=
</varname> on all mount units required to access the specified
61 paths. This is equivalent to having them listed explicitly in
62 <varname>RequiresMountsFor=
</varname>.
</para></listitem>
64 <listitem><para>Similarly, units with
<varname>PrivateTmp=
</varname> enabled automatically get mount
65 unit dependencies for all mounts required to access
<filename>/tmp/
</filename> and
66 <filename>/var/tmp/
</filename>. They will also gain an automatic
<varname>After=
</varname> dependency
68 <citerefentry><refentrytitle>systemd-tmpfiles-setup.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
71 <listitem><para>Units whose standard output or error output is connected to
<option>journal
</option> or
72 <option>kmsg
</option> (or their combinations with console output, see below) automatically acquire
73 dependencies of type
<varname>After=
</varname> on
74 <filename>systemd-journald.socket
</filename>.
</para></listitem>
76 <listitem><para>Units using
<varname>LogNamespace=
</varname> will automatically gain ordering and
77 requirement dependencies on the two socket units associated with
78 <filename>systemd-journald@.service
</filename> instances.
</para></listitem>
82 <!-- We don't have any default dependency here. -->
87 <para>The following settings may be used to change a service's view of the filesystem. Please note that the paths
88 must be absolute and must not contain a
<literal>..
</literal> path component.
</para>
90 <variablelist class='unit-directives'
>
93 <term><varname>ExecSearchPath=
</varname></term>
95 <listitem><para>Takes a colon separated list of absolute paths relative to which the executable
96 used by the
<varname>Exec*=
</varname> (e.g.
<varname>ExecStart=
</varname>,
97 <varname>ExecStop=
</varname>, etc.) properties can be found.
<varname>ExecSearchPath=
</varname>
98 overrides
<varname>$PATH
</varname> if
<varname>$PATH
</varname> is not supplied by the user through
99 <varname>Environment=
</varname>,
<varname>EnvironmentFile=
</varname> or
100 <varname>PassEnvironment=
</varname>. Assigning an empty string removes previous assignments
101 and setting
<varname>ExecSearchPath=
</varname> to a value multiple times will append
102 to the previous setting.
105 <xi:include href=
"version-info.xml" xpointer=
"v250"/></listitem>
109 <term><varname>WorkingDirectory=
</varname></term>
111 <listitem><para>Takes a directory path relative to the service's root directory specified by
112 <varname>RootDirectory=
</varname>, or the special value
<literal>~
</literal>. Sets the working directory for
113 executed processes. If set to
<literal>~
</literal>, the home directory of the user specified in
114 <varname>User=
</varname> is used. If not set, defaults to the root directory when systemd is running as a
115 system instance and the respective user's home directory if run as user. If the setting is prefixed with the
116 <literal>-
</literal> character, a missing working directory is not considered fatal. If
117 <varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname> is not set, then
118 <varname>WorkingDirectory=
</varname> is relative to the root of the system running the service manager. Note
119 that setting this parameter might result in additional dependencies to be added to the unit (see
120 above).
</para></listitem>
124 <term><varname>RootDirectory=
</varname></term>
126 <listitem><para>Takes a directory path relative to the host's root directory (i.e. the root of the system
127 running the service manager). Sets the root directory for executed processes, with the
<citerefentry
128 project='man-pages'
><refentrytitle>chroot
</refentrytitle><manvolnum>2</manvolnum></citerefentry> system
129 call. If this is used, it must be ensured that the process binary and all its auxiliary files are available in
130 the
<function>chroot()
</function> jail. Note that setting this parameter might result in additional
131 dependencies to be added to the unit (see above).
</para>
133 <para>The
<varname>MountAPIVFS=
</varname> and
<varname>PrivateUsers=
</varname> settings are particularly useful
134 in conjunction with
<varname>RootDirectory=
</varname>. For details, see below.
</para>
136 <para>If
<varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname> are used together with
137 <varname>NotifyAccess=
</varname> the notification socket is automatically mounted from the host into
138 the root environment, to ensure the notification interface can work correctly.
</para>
140 <para>Note that services using
<varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname> will
141 not be able to log via the syslog or journal protocols to the host logging infrastructure, unless the
142 relevant sockets are mounted from the host, specifically:
</para>
145 <citerefentry><refentrytitle>os-release
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
146 file will be made available for the service (read-only) as
147 <filename>/run/host/os-release
</filename>.
148 It will be updated automatically on soft reboot (see:
149 <citerefentry><refentrytitle>systemd-soft-reboot.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry>),
150 in case the service is configured to survive it.
</para>
153 <title>Mounting logging sockets into root environment
</title>
155 <programlisting>BindReadOnlyPaths=/dev/log /run/systemd/journal/socket /run/systemd/journal/stdout
</programlisting>
158 <xi:include href=
"vpick.xml" xpointer=
"directory"/>
160 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/></listitem>
164 <term><varname>RootImage=
</varname></term>
166 <listitem><para>Takes a path to a block device node or regular file as argument. This call is similar
167 to
<varname>RootDirectory=
</varname> however mounts a file system hierarchy from a block device node
168 or loopback file instead of a directory. The device node or file system image file needs to contain a
169 file system without a partition table, or a file system within an MBR/MS-DOS or GPT partition table
170 with only a single Linux-compatible partition, or a set of file systems within a GPT partition table
172 <ulink url=
"https://uapi-group.org/specifications/specs/discoverable_partitions_specification">
173 Discoverable Partitions Specification
</ulink>.
</para>
175 <para>When
<varname>DevicePolicy=
</varname> is set to
<literal>closed
</literal> or
176 <literal>strict
</literal>, or set to
<literal>auto
</literal> and
<varname>DeviceAllow=
</varname> is
177 set, then this setting adds
<filename>/dev/loop-control
</filename> with
<constant>rw
</constant> mode,
178 <literal>block-loop
</literal> and
<literal>block-blkext
</literal> with
<constant>rwm
</constant> mode
179 to
<varname>DeviceAllow=
</varname>. See
180 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
181 for the details about
<varname>DevicePolicy=
</varname> or
<varname>DeviceAllow=
</varname>. Also, see
182 <varname>PrivateDevices=
</varname> below, as it may change the setting of
183 <varname>DevicePolicy=
</varname>.
</para>
185 <para>Units making use of
<varname>RootImage=
</varname> automatically gain an
186 <varname>After=
</varname> dependency on
<filename>systemd-udevd.service
</filename>.
</para>
189 <citerefentry><refentrytitle>os-release
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
190 file will be made available for the service (read-only) as
191 <filename>/run/host/os-release
</filename>.
192 It will be updated automatically on soft reboot (see:
193 <citerefentry><refentrytitle>systemd-soft-reboot.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry>),
194 in case the service is configured to survive it.
</para>
196 <xi:include href=
"vpick.xml" xpointer=
"image"/>
198 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
200 <xi:include href=
"version-info.xml" xpointer=
"v233"/></listitem>
204 <term><varname>RootImageOptions=
</varname></term>
206 <listitem><para>Takes a comma-separated list of mount options that will be used on disk images specified by
207 <varname>RootImage=
</varname>. Optionally a partition name can be prefixed, followed by colon, in
208 case the image has multiple partitions, otherwise partition name
<literal>root
</literal> is implied.
209 Options for multiple partitions can be specified in a single line with space separators. Assigning an empty
210 string removes previous assignments. Duplicated options are ignored. For a list of valid mount options, please
212 <citerefentry project='man-pages'
><refentrytitle>mount
</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
215 <para>Valid partition names follow the
216 <ulink url=
"https://uapi-group.org/specifications/specs/discoverable_partitions_specification">
217 Discoverable Partitions Specification
</ulink>:
218 <constant>root
</constant>,
<constant>usr
</constant>,
<constant>home
</constant>,
<constant>srv
</constant>,
219 <constant>esp
</constant>,
<constant>xbootldr
</constant>,
<constant>tmp
</constant>,
220 <constant>var
</constant>.
</para>
222 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
224 <xi:include href=
"version-info.xml" xpointer=
"v247"/></listitem>
228 <term><varname>RootEphemeral=
</varname></term>
230 <listitem><para>Takes a boolean argument. If enabled, executed processes will run in an ephemeral
231 copy of the root directory or root image. The ephemeral copy is placed in
232 <filename>/var/lib/systemd/ephemeral-trees/
</filename> while the service is active and is cleaned up
233 when the service is stopped or restarted. If
<varname>RootDirectory=
</varname> is used and the root
234 directory is a subvolume, the ephemeral copy will be created by making a snapshot of the subvolume.
237 <para>To make sure making ephemeral copies can be made efficiently, the root directory or root image
238 should be located on the same filesystem as
<filename>/var/lib/systemd/ephemeral-trees/
</filename>.
239 When using
<varname>RootEphemeral=
</varname> with root directories,
240 <citerefentry project='url'
><refentrytitle url='https://btrfs.readthedocs.io/en/latest/btrfs-man5.html'
>btrfs
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
241 should be used as the filesystem and the root directory should ideally be a subvolume which
242 <command>systemd
</command> can snapshot to make the ephemeral copy. For root images, a filesystem
243 with support for reflinks should be used to ensure an efficient ephemeral copy.
</para>
245 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
247 <xi:include href=
"version-info.xml" xpointer=
"v254"/></listitem>
251 <term><varname>RootHash=
</varname></term>
253 <listitem><para>Takes a data integrity (dm-verity) root hash specified in hexadecimal, or the path to a file
254 containing a root hash in ASCII hexadecimal format. This option enables data integrity checks using dm-verity,
255 if the used image contains the appropriate integrity data (see above) or if
<varname>RootVerity=
</varname> is used.
256 The specified hash must match the root hash of integrity data, and is usually at least
256 bits (and hence
64
257 formatted hexadecimal characters) long (in case of SHA256 for example). If this option is not specified, but
258 the image file carries the
<literal>user.verity.roothash
</literal> extended file attribute (see
<citerefentry
259 project='man-pages'
><refentrytitle>xattr
</refentrytitle><manvolnum>7</manvolnum></citerefentry>), then the root
260 hash is read from it, also as formatted hexadecimal characters. If the extended file attribute is not found (or
261 is not supported by the underlying file system), but a file with the
<filename>.roothash
</filename> suffix is
262 found next to the image file, bearing otherwise the same name (except if the image has the
263 <filename>.raw
</filename> suffix, in which case the root hash file must not have it in its name), the root hash
264 is read from it and automatically used, also as formatted hexadecimal characters.
</para>
266 <para>If the disk image contains a separate
<filename>/usr/
</filename> partition it may also be
267 Verity protected, in which case the root hash may configured via an extended attribute
268 <literal>user.verity.usrhash
</literal> or a
<filename>.usrhash
</filename> file adjacent to the disk
269 image. There's currently no option to configure the root hash for the
<filename>/usr/
</filename> file
270 system via the unit file directly.
</para>
272 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
274 <xi:include href=
"version-info.xml" xpointer=
"v246"/></listitem>
278 <term><varname>RootHashSignature=
</varname></term>
280 <listitem><para>Takes a PKCS7 signature of the
<varname>RootHash=
</varname> option as a path to a
281 DER-encoded signature file, or as an ASCII base64 string encoding of a DER-encoded signature prefixed
282 by
<literal>base64:
</literal>. The dm-verity volume will only be opened if the signature of the root
283 hash is valid and signed by a public key present in the kernel keyring. If this option is not
284 specified, but a file with the
<filename>.roothash.p7s
</filename> suffix is found next to the image
285 file, bearing otherwise the same name (except if the image has the
<filename>.raw
</filename> suffix,
286 in which case the signature file must not have it in its name), the signature is read from it and
287 automatically used.
</para>
289 <para>If the disk image contains a separate
<filename>/usr/
</filename> partition it may also be
290 Verity protected, in which case the signature for the root hash may configured via a
291 <filename>.usrhash.p7s
</filename> file adjacent to the disk image. There's currently no option to
292 configure the root hash signature for the
<filename>/usr/
</filename> via the unit file
295 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
297 <xi:include href=
"version-info.xml" xpointer=
"v246"/></listitem>
301 <term><varname>RootVerity=
</varname></term>
303 <listitem><para>Takes the path to a data integrity (dm-verity) file. This option enables data integrity checks
304 using dm-verity, if
<varname>RootImage=
</varname> is used and a root-hash is passed and if the used image itself
305 does not contain the integrity data. The integrity data must be matched by the root hash. If this option is not
306 specified, but a file with the
<filename>.verity
</filename> suffix is found next to the image file, bearing otherwise
307 the same name (except if the image has the
<filename>.raw
</filename> suffix, in which case the verity data file must
308 not have it in its name), the verity data is read from it and automatically used.
</para>
310 <para>This option is supported only for disk images that contain a single file system, without an
311 enveloping partition table. Images that contain a GPT partition table should instead include both
312 root file system and matching Verity data in the same image, implementing the
313 <ulink url=
"https://uapi-group.org/specifications/specs/discoverable_partitions_specification">
314 Discoverable Partitions Specification
</ulink>.
</para>
316 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
318 <xi:include href=
"version-info.xml" xpointer=
"v246"/></listitem>
322 <term><varname>RootImagePolicy=
</varname></term>
323 <term><varname>MountImagePolicy=
</varname></term>
324 <term><varname>ExtensionImagePolicy=
</varname></term>
326 <listitem><para>Takes an image policy string as per
327 <citerefentry><refentrytitle>systemd.image-policy
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
328 to use when mounting the disk images (DDI) specified in
<varname>RootImage=
</varname>,
329 <varname>MountImage=
</varname>,
<varname>ExtensionImage=
</varname>, respectively. If not specified
330 the following policy string is the default for
<varname>RootImagePolicy=
</varname> and
<varname>MountImagePolicy
</varname>:
</para>
332 <programlisting>root=verity+signed+encrypted+unprotected+absent: \
333 usr=verity+signed+encrypted+unprotected+absent: \
334 home=encrypted+unprotected+absent: \
335 srv=encrypted+unprotected+absent: \
336 tmp=encrypted+unprotected+absent: \
337 var=encrypted+unprotected+absent
</programlisting>
339 <para>The default policy for
<varname>ExtensionImagePolicy=
</varname> is:
</para>
341 <programlisting>root=verity+signed+encrypted+unprotected+absent: \
342 usr=verity+signed+encrypted+unprotected+absent
</programlisting>
344 <xi:include href=
"version-info.xml" xpointer=
"v254"/></listitem>
348 <term><varname>MountAPIVFS=
</varname></term>
350 <listitem><para>Takes a boolean argument. If on, a private mount namespace for the unit's processes is created
351 and the API file systems
<filename>/proc/
</filename>,
<filename>/sys/
</filename>,
<filename>/dev/
</filename> and
352 <filename>/run/
</filename> (as an empty
<literal>tmpfs
</literal>) are mounted inside of it, unless they are
353 already mounted. Note that this option has no effect unless used in conjunction with
354 <varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname> as these four mounts are
355 generally mounted in the host anyway, and unless the root directory is changed, the private mount namespace
356 will be a
1:
1 copy of the host's, and include these four mounts. Note that the
<filename>/dev/
</filename> file
357 system of the host is bind mounted if this option is used without
<varname>PrivateDevices=
</varname>. To run
358 the service with a private, minimal version of
<filename>/dev/
</filename>, combine this option with
359 <varname>PrivateDevices=
</varname>.
</para>
361 <para>In order to allow propagating mounts at runtime in a safe manner,
<filename>/run/systemd/propagate/
</filename>
362 on the host will be used to set up new mounts, and
<filename>/run/host/incoming/
</filename> in the private namespace
363 will be used as an intermediate step to store them before being moved to the final mount point.
</para>
365 <xi:include href=
"version-info.xml" xpointer=
"v233"/></listitem>
369 <term><varname>ProtectProc=
</varname></term>
371 <listitem><para>Takes one of
<literal>noaccess
</literal>,
<literal>invisible
</literal>,
372 <literal>ptraceable
</literal> or
<literal>default
</literal> (which it defaults to). When set, this
373 controls the
<literal>hidepid=
</literal> mount option of the
<literal>procfs
</literal> instance for
374 the unit that controls which directories with process metainformation
375 (
<filename>/proc/
<replaceable>PID
</replaceable></filename>) are visible and accessible: when set to
376 <literal>noaccess
</literal> the ability to access most of other users' process metadata in
377 <filename>/proc/
</filename> is taken away for processes of the service. When set to
378 <literal>invisible
</literal> processes owned by other users are hidden from
379 <filename>/proc/
</filename>. If
<literal>ptraceable
</literal> all processes that cannot be
380 <function>ptrace()
</function>'ed by a process are hidden to it. If
<literal>default
</literal> no
381 restrictions on
<filename>/proc/
</filename> access or visibility are made. For further details see
382 <ulink url=
"https://docs.kernel.org/filesystems/proc.html#mount-options">The /proc
383 Filesystem
</ulink>. It is generally recommended to run most system services with this option set to
384 <literal>invisible
</literal>. This option is implemented via file system namespacing, and thus cannot
385 be used with services that shall be able to install mount points in the host file system
386 hierarchy. Note that the root user is unaffected by this option, so to be effective it has to be used
387 together with
<varname>User=
</varname> or
<varname>DynamicUser=yes
</varname>, and also without the
388 <literal>CAP_SYS_PTRACE
</literal> capability, which also allows a process to bypass this feature. It
389 cannot be used for services that need to access metainformation about other users' processes. This
390 option implies
<varname>MountAPIVFS=
</varname>.
</para>
392 <para>If the kernel doesn't support per-mount point
<option>hidepid=
</option> mount options this
393 setting remains without effect, and the unit's processes will be able to access and see other process
394 as if the option was not used.
</para>
396 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
398 <xi:include href=
"version-info.xml" xpointer=
"v247"/></listitem>
402 <term><varname>ProcSubset=
</varname></term>
404 <listitem><para>Takes one of
<literal>all
</literal> (the default) and
<literal>pid
</literal>. If
405 <literal>pid
</literal>, all files and directories not directly associated with process management and
406 introspection are made invisible in the
<filename>/proc/
</filename> file system configured for the
407 unit's processes. This controls the
<literal>subset=
</literal> mount option of the
408 <literal>procfs
</literal> instance for the unit. For further details see
<ulink
409 url=
"https://docs.kernel.org/filesystems/proc.html#mount-options">The /proc
410 Filesystem
</ulink>. Note that Linux exposes various kernel APIs via
<filename>/proc/
</filename>,
411 which are made unavailable with this setting. Since these APIs are used frequently this option is
412 useful only in a few, specific cases, and is not suitable for most non-trivial programs.
</para>
414 <para>Much like
<varname>ProtectProc=
</varname> above, this is implemented via file system mount
415 namespacing, and hence the same restrictions apply: it is only available to system services, it
416 disables mount propagation to the host mount table, and it implies
417 <varname>MountAPIVFS=
</varname>. Also, like
<varname>ProtectProc=
</varname> this setting is gracefully
418 disabled if the used kernel does not support the
<literal>subset=
</literal> mount option of
419 <literal>procfs
</literal>.
</para>
421 <xi:include href=
"version-info.xml" xpointer=
"v247"/></listitem>
425 <term><varname>BindPaths=
</varname></term>
426 <term><varname>BindReadOnlyPaths=
</varname></term>
428 <listitem><para>Configures unit-specific bind mounts. A bind mount makes a particular file or directory
429 available at an additional place in the unit's view of the file system. Any bind mounts created with this
430 option are specific to the unit, and are not visible in the host's mount table. This option expects a
431 whitespace separated list of bind mount definitions. Each definition consists of a colon-separated triple of
432 source path, destination path and option string, where the latter two are optional. If only a source path is
433 specified the source and destination is taken to be the same. The option string may be either
434 <literal>rbind
</literal> or
<literal>norbind
</literal> for configuring a recursive or non-recursive bind
435 mount. If the destination path is omitted, the option string must be omitted too.
436 Each bind mount definition may be prefixed with
<literal>-
</literal>, in which case it will be ignored
437 when its source path does not exist.
</para>
439 <para><varname>BindPaths=
</varname> creates regular writable bind mounts (unless the source file system mount
440 is already marked read-only), while
<varname>BindReadOnlyPaths=
</varname> creates read-only bind mounts. These
441 settings may be used more than once, each usage appends to the unit's list of bind mounts. If the empty string
442 is assigned to either of these two options the entire list of bind mounts defined prior to this is reset. Note
443 that in this case both read-only and regular bind mounts are reset, regardless which of the two settings is
446 <para>Using this option implies that a mount namespace is allocated for the unit, i.e. it implies the
447 effect of
<varname>PrivateMounts=
</varname> (see below).
</para>
449 <para>This option is particularly useful when
<varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname>
450 is used. In this case the source path refers to a path on the host file system, while the destination path
451 refers to a path below the root directory of the unit.
</para>
453 <para>Note that the destination directory must exist or systemd must be able to create it. Thus, it
454 is not possible to use those options for mount points nested underneath paths specified in
455 <varname>InaccessiblePaths=
</varname>, or under
<filename>/home/
</filename> and other protected
456 directories if
<varname>ProtectHome=yes
</varname> is
457 specified.
<varname>TemporaryFileSystem=
</varname> with
<literal>:ro
</literal> or
458 <varname>ProtectHome=tmpfs
</varname> should be used instead.
</para>
460 <xi:include href=
"version-info.xml" xpointer=
"v233"/></listitem>
464 <term><varname>MountImages=
</varname></term>
466 <listitem><para>This setting is similar to
<varname>RootImage=
</varname> in that it mounts a file
467 system hierarchy from a block device node or loopback file, but the destination directory can be
468 specified as well as mount options. This option expects a whitespace separated list of mount
469 definitions. Each definition consists of a colon-separated tuple of source path and destination
470 definitions, optionally followed by another colon and a list of mount options.
</para>
472 <para>Mount options may be defined as a single comma-separated list of options, in which case they
473 will be implicitly applied to the root partition on the image, or a series of colon-separated tuples
474 of partition name and mount options. Valid partition names and mount options are the same as for
475 <varname>RootImageOptions=
</varname> setting described above.
</para>
477 <para>Each mount definition may be prefixed with
<literal>-
</literal>, in which case it will be
478 ignored when its source path does not exist. The source argument is a path to a block device node or
479 regular file. If source or destination contain a
<literal>:
</literal>, it needs to be escaped as
480 <literal>\:
</literal>. The device node or file system image file needs to follow the same rules as
481 specified for
<varname>RootImage=
</varname>. Any mounts created with this option are specific to the
482 unit, and are not visible in the host's mount table.
</para>
484 <para>These settings may be used more than once, each usage appends to the unit's list of mount
485 paths. If the empty string is assigned, the entire list of mount paths defined prior to this is
488 <para>Note that the destination directory must exist or systemd must be able to create it. Thus, it
489 is not possible to use those options for mount points nested underneath paths specified in
490 <varname>InaccessiblePaths=
</varname>, or under
<filename>/home/
</filename> and other protected
491 directories if
<varname>ProtectHome=yes
</varname> is specified.
</para>
493 <para>When
<varname>DevicePolicy=
</varname> is set to
<literal>closed
</literal> or
494 <literal>strict
</literal>, or set to
<literal>auto
</literal> and
<varname>DeviceAllow=
</varname> is
495 set, then this setting adds
<filename>/dev/loop-control
</filename> with
<constant>rw
</constant> mode,
496 <literal>block-loop
</literal> and
<literal>block-blkext
</literal> with
<constant>rwm
</constant> mode
497 to
<varname>DeviceAllow=
</varname>. See
498 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
499 for the details about
<varname>DevicePolicy=
</varname> or
<varname>DeviceAllow=
</varname>. Also, see
500 <varname>PrivateDevices=
</varname> below, as it may change the setting of
501 <varname>DevicePolicy=
</varname>.
</para>
503 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
505 <xi:include href=
"version-info.xml" xpointer=
"v247"/></listitem>
509 <term><varname>ExtensionImages=
</varname></term>
511 <listitem><para>This setting is similar to
<varname>MountImages=
</varname> in that it mounts a file
512 system hierarchy from a block device node or loopback file, but instead of providing a destination
513 path, an overlay will be set up. This option expects a whitespace separated list of mount
514 definitions. Each definition consists of a source path, optionally followed by a colon and a list of
515 mount options.
</para>
517 <para>A read-only OverlayFS will be set up on top of
<filename>/usr/
</filename> and
518 <filename>/opt/
</filename> hierarchies for sysext images and
<filename>/etc/
</filename>
519 hierarchy for confext images. The order in which the images are listed will determine the
520 order in which the overlay is laid down: images specified first to last will result in overlayfs
521 layers bottom to top.
</para>
523 <para>Mount options may be defined as a single comma-separated list of options, in which case they
524 will be implicitly applied to the root partition on the image, or a series of colon-separated tuples
525 of partition name and mount options. Valid partition names and mount options are the same as for
526 <varname>RootImageOptions=
</varname> setting described above.
</para>
528 <para>Each mount definition may be prefixed with
<literal>-
</literal>, in which case it will be
529 ignored when its source path does not exist. The source argument is a path to a block device node or
530 regular file. If the source path contains a
<literal>:
</literal>, it needs to be escaped as
531 <literal>\:
</literal>. The device node or file system image file needs to follow the same rules as
532 specified for
<varname>RootImage=
</varname>. Any mounts created with this option are specific to the
533 unit, and are not visible in the host's mount table.
</para>
535 <para>These settings may be used more than once, each usage appends to the unit's list of image
536 paths. If the empty string is assigned, the entire list of mount paths defined prior to this is
539 <para>Each sysext image must carry a
<filename>/usr/lib/extension-release.d/extension-release.IMAGE
</filename>
540 file while each confext image must carry a
<filename>/etc/extension-release.d/extension-release.IMAGE
</filename>
541 file, with the appropriate metadata which matches
<varname>RootImage=
</varname>/
<varname>RootDirectory=
</varname>
543 <citerefentry><refentrytitle>os-release
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
544 To disable the safety check that the extension-release file name matches the image file name, the
545 <varname>x-systemd.relax-extension-release-check
</varname> mount option may be appended.
</para>
547 <para>When
<varname>DevicePolicy=
</varname> is set to
<literal>closed
</literal> or
548 <literal>strict
</literal>, or set to
<literal>auto
</literal> and
<varname>DeviceAllow=
</varname> is
549 set, then this setting adds
<filename>/dev/loop-control
</filename> with
<constant>rw
</constant> mode,
550 <literal>block-loop
</literal> and
<literal>block-blkext
</literal> with
<constant>rwm
</constant> mode
551 to
<varname>DeviceAllow=
</varname>. See
552 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
553 for the details about
<varname>DevicePolicy=
</varname> or
<varname>DeviceAllow=
</varname>. Also, see
554 <varname>PrivateDevices=
</varname> below, as it may change the setting of
555 <varname>DevicePolicy=
</varname>.
</para>
557 <xi:include href=
"vpick.xml" xpointer=
"image"/>
559 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
561 <xi:include href=
"version-info.xml" xpointer=
"v248"/></listitem>
565 <term><varname>ExtensionDirectories=
</varname></term>
567 <listitem><para>This setting is similar to
<varname>BindReadOnlyPaths=
</varname> in that it mounts a file
568 system hierarchy from a directory, but instead of providing a destination path, an overlay will be set
569 up. This option expects a whitespace separated list of source directories.
</para>
571 <para>A read-only OverlayFS will be set up on top of
<filename>/usr/
</filename> and
572 <filename>/opt/
</filename> hierarchies for sysext images and
<filename>/etc/
</filename>
573 hierarchy for confext images. The order in which the directories are listed will determine
574 the order in which the overlay is laid down: directories specified first to last will result in overlayfs
575 layers bottom to top.
</para>
577 <para>Each directory listed in
<varname>ExtensionDirectories=
</varname> may be prefixed with
<literal>-
</literal>,
578 in which case it will be ignored when its source path does not exist. Any mounts created with this option are
579 specific to the unit, and are not visible in the host's mount table.
</para>
581 <para>These settings may be used more than once, each usage appends to the unit's list of directories
582 paths. If the empty string is assigned, the entire list of mount paths defined prior to this is
585 <para>Each sysext directory must contain a
<filename>/usr/lib/extension-release.d/extension-release.IMAGE
</filename>
586 file while each confext directory must carry a
<filename>/etc/extension-release.d/extension-release.IMAGE
</filename>
587 file, with the appropriate metadata which matches
<varname>RootImage=
</varname>/
<varname>RootDirectory=
</varname>
589 <citerefentry><refentrytitle>os-release
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
</para>
591 <para>Note that usage from user units requires overlayfs support in unprivileged user namespaces,
592 which was first introduced in kernel v5.11.
</para>
594 <xi:include href=
"vpick.xml" xpointer=
"directory"/>
596 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
598 <xi:include href=
"version-info.xml" xpointer=
"v251"/></listitem>
604 <title>User/Group Identity
</title>
606 <xi:include href=
"system-only.xml" xpointer=
"plural"/>
608 <variablelist class='unit-directives'
>
611 <term><varname>User=
</varname></term>
612 <term><varname>Group=
</varname></term>
614 <listitem><para>Set the UNIX user or group that the processes are executed as, respectively. Takes a single
615 user or group name, or a numeric ID as argument. For system services (services run by the system service
616 manager, i.e. managed by PID
1) and for user services of the root user (services managed by root's instance of
617 <command>systemd --user
</command>), the default is
<literal>root
</literal>, but
<varname>User=
</varname> may be
618 used to specify a different user. For user services of any other user, switching user identity is not
619 permitted, hence the only valid setting is the same user the user's service manager is running as. If no group
620 is set, the default group of the user is used. This setting does not affect commands whose command line is
621 prefixed with
<literal>+
</literal>.
</para>
623 <para>Note that this enforces only weak restrictions on the user/group name syntax, but will generate
624 warnings in many cases where user/group names do not adhere to the following rules: the specified
625 name should consist only of the characters a-z, A-Z,
0-
9,
<literal>_
</literal> and
626 <literal>-
</literal>, except for the first character which must be one of a-z, A-Z and
627 <literal>_
</literal> (i.e. digits and
<literal>-
</literal> are not permitted as first character). The
628 user/group name must have at least one character, and at most
31. These restrictions are made in
629 order to avoid ambiguities and to ensure user/group names and unit files remain portable among Linux
630 systems. For further details on the names accepted and the names warned about see
<ulink
631 url=
"https://systemd.io/USER_NAMES">User/Group Name Syntax
</ulink>.
</para>
633 <para>When used in conjunction with
<varname>DynamicUser=
</varname> the user/group name specified is
634 dynamically allocated at the time the service is started, and released at the time the service is
635 stopped — unless it is already allocated statically (see below). If
<varname>DynamicUser=
</varname>
636 is not used the specified user and group must have been created statically in the user database no
637 later than the moment the service is started, for example using the
638 <citerefentry><refentrytitle>sysusers.d
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
639 facility, which is applied at boot or package install time. If the user does not exist by then
640 program invocation will fail.
</para>
642 <para>If the
<varname>User=
</varname> setting is used the supplementary group list is initialized
643 from the specified user's default group list, as defined in the system's user and group
644 database. Additional groups may be configured through the
<varname>SupplementaryGroups=
</varname>
645 setting (see below).
</para></listitem>
649 <term><varname>DynamicUser=
</varname></term>
651 <listitem><para>Takes a boolean parameter. If set, a UNIX user and group pair is allocated
652 dynamically when the unit is started, and released as soon as it is stopped. The user and group will
653 not be added to
<filename>/etc/passwd
</filename> or
<filename>/etc/group
</filename>, but are managed
654 transiently during runtime. The
655 <citerefentry><refentrytitle>nss-systemd
</refentrytitle><manvolnum>8</manvolnum></citerefentry> glibc
656 NSS module provides integration of these dynamic users/groups into the system's user and group
657 databases. The user and group name to use may be configured via
<varname>User=
</varname> and
658 <varname>Group=
</varname> (see above). If these options are not used and dynamic user/group
659 allocation is enabled for a unit, the name of the dynamic user/group is implicitly derived from the
660 unit name. If the unit name without the type suffix qualifies as valid user name it is used directly,
661 otherwise a name incorporating a hash of it is used. If a statically allocated user or group of the
662 configured name already exists, it is used and no dynamic user/group is allocated. Note that if
663 <varname>User=
</varname> is specified and the static group with the name exists, then it is required
664 that the static user with the name already exists. Similarly, if
<varname>Group=
</varname> is
665 specified and the static user with the name exists, then it is required that the static group with
666 the name already exists. Dynamic users/groups are allocated from the UID/GID range
61184…
65519. It is
667 recommended to avoid this range for regular system or login users. At any point in time each UID/GID
668 from this range is only assigned to zero or one dynamically allocated users/groups in use. However,
669 UID/GIDs are recycled after a unit is terminated. Care should be taken that any processes running as
670 part of a unit for which dynamic users/groups are enabled do not leave files or directories owned by
671 these users/groups around, as a different unit might get the same UID/GID assigned later on, and thus
672 gain access to these files or directories. If
<varname>DynamicUser=
</varname> is enabled,
673 <varname>RemoveIPC=
</varname> and
<varname>PrivateTmp=
</varname> are implied (and cannot be turned
674 off). This ensures that the lifetime of IPC objects and temporary files created by the executed
675 processes is bound to the runtime of the service, and hence the lifetime of the dynamic
676 user/group. Since
<filename>/tmp/
</filename> and
<filename>/var/tmp/
</filename> are usually the only
677 world-writable directories on a system this ensures that a unit making use of dynamic user/group
678 allocation cannot leave files around after unit termination. Furthermore
679 <varname>NoNewPrivileges=
</varname> and
<varname>RestrictSUIDSGID=
</varname> are implicitly enabled
680 (and cannot be disabled), to ensure that processes invoked cannot take benefit or create SUID/SGID
681 files or directories. Moreover
<varname>ProtectSystem=strict
</varname> and
682 <varname>ProtectHome=read-only
</varname> are implied, thus prohibiting the service to write to
683 arbitrary file system locations. In order to allow the service to write to certain directories, they
684 have to be allow-listed using
<varname>ReadWritePaths=
</varname>, but care must be taken so that
685 UID/GID recycling doesn't create security issues involving files created by the service. Use
686 <varname>RuntimeDirectory=
</varname> (see below) in order to assign a writable runtime directory to a
687 service, owned by the dynamic user/group and removed automatically when the unit is terminated. Use
688 <varname>StateDirectory=
</varname>,
<varname>CacheDirectory=
</varname> and
689 <varname>LogsDirectory=
</varname> in order to assign a set of writable directories for specific
690 purposes to the service in a way that they are protected from vulnerabilities due to UID reuse (see
691 below). If this option is enabled, care should be taken that the unit's processes do not get access
692 to directories outside of these explicitly configured and managed ones. Specifically, do not use
693 <varname>BindPaths=
</varname> and be careful with
<constant>AF_UNIX
</constant> file descriptor
694 passing for directory file descriptors, as this would permit processes to create files or directories
695 owned by the dynamic user/group that are not subject to the lifecycle and access guarantees of the
696 service. Note that this option is currently incompatible with D-Bus policies, thus a service using
697 this option may currently not allocate a D-Bus service name (note that this does not affect calling
698 into other D-Bus services). Defaults to off.
</para>
700 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
704 <term><varname>SupplementaryGroups=
</varname></term>
706 <listitem><para>Sets the supplementary Unix groups the processes are executed as. This takes a space-separated
707 list of group names or IDs. This option may be specified more than once, in which case all listed groups are
708 set as supplementary groups. When the empty string is assigned, the list of supplementary groups is reset, and
709 all assignments prior to this one will have no effect. In any way, this option does not override, but extends
710 the list of supplementary groups configured in the system group database for the user. This does not affect
711 commands prefixed with
<literal>+
</literal>.
</para></listitem>
715 <term><varname>SetLoginEnvironment=
</varname></term>
717 <listitem><para>Takes a boolean parameter that controls whether to set the
<varname>$HOME
</varname>,
718 <varname>$LOGNAME
</varname>, and
<varname>$SHELL
</varname> environment variables. If not set, this
719 defaults to true if
<varname>User=
</varname>,
<varname>DynamicUser=
</varname> or
720 <varname>PAMName=
</varname> are set, false otherwise. If set to true, the variables will always be
721 set for system services, i.e. even when the default user
<literal>root
</literal> is used. If set to
722 false, the mentioned variables are not set by the service manager, no matter whether
723 <varname>User=
</varname>,
<varname>DynamicUser=
</varname>, or
<varname>PAMName=
</varname> are used or
724 not. This option normally has no effect on services of the per-user service manager, since in that
725 case these variables are typically inherited from user manager's own environment anyway.
</para>
727 <xi:include href=
"version-info.xml" xpointer=
"v255"/></listitem>
731 <term><varname>PAMName=
</varname></term>
733 <listitem><para>Sets the PAM service name to set up a session as. If set, the executed process will be
734 registered as a PAM session under the specified service name. This is only useful in conjunction with the
735 <varname>User=
</varname> setting, and is otherwise ignored. If not set, no PAM session will be opened for the
736 executed processes. See
<citerefentry
737 project='man-pages'
><refentrytitle>pam
</refentrytitle><manvolnum>8</manvolnum></citerefentry> for
740 <para>Note that for each unit making use of this option a PAM session handler process will be maintained as
741 part of the unit and stays around as long as the unit is active, to ensure that appropriate actions can be
742 taken when the unit and hence the PAM session terminates. This process is named
<literal>(sd-pam)
</literal> and
743 is an immediate child process of the unit's main process.
</para>
745 <para>Note that when this option is used for a unit it is very likely (depending on PAM configuration) that the
746 main unit process will be migrated to its own session scope unit when it is activated. This process will hence
747 be associated with two units: the unit it was originally started from (and for which
748 <varname>PAMName=
</varname> was configured), and the session scope unit. Any child processes of that process
749 will however be associated with the session scope unit only. This has implications when used in combination
750 with
<varname>NotifyAccess=
</varname><option>all
</option>, as these child processes will not be able to affect
751 changes in the original unit through notification messages. These messages will be considered belonging to the
752 session scope unit and not the original unit. It is hence not recommended to use
<varname>PAMName=
</varname> in
753 combination with
<varname>NotifyAccess=
</varname><option>all
</option>.
</para>
761 <title>Capabilities
</title>
763 <xi:include href=
"system-or-user-ns.xml" xpointer=
"plural"/>
765 <variablelist class='unit-directives'
>
768 <term><varname>CapabilityBoundingSet=
</varname></term>
770 <listitem><para>Controls which capabilities to include in the capability bounding set for the
771 executed process. See
<citerefentry
772 project='man-pages'
><refentrytitle>capabilities
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
773 for details. Takes a whitespace-separated list of capability names,
774 e.g.
<constant>CAP_SYS_ADMIN
</constant>,
<constant>CAP_DAC_OVERRIDE
</constant>,
775 <constant>CAP_SYS_PTRACE
</constant>. Capabilities listed will be included in the bounding set, all
776 others are removed. If the list of capabilities is prefixed with
<literal>~
</literal>, all but the
777 listed capabilities will be included, the effect of the assignment inverted. Note that this option
778 also affects the respective capabilities in the effective, permitted and inheritable capability
779 sets. If this option is not used, the capability bounding set is not modified on process execution,
780 hence no limits on the capabilities of the process are enforced. This option may appear more than
781 once, in which case the bounding sets are merged by
<constant>OR
</constant>, or by
782 <constant>AND
</constant> if the lines are prefixed with
<literal>~
</literal> (see below). If the
783 empty string is assigned to this option, the bounding set is reset to the empty capability set, and
784 all prior settings have no effect. If set to
<literal>~
</literal> (without any further argument),
785 the bounding set is reset to the full set of available capabilities, also undoing any previous
786 settings. This does not affect commands prefixed with
<literal>+
</literal>.
</para>
789 <citerefentry><refentrytitle>systemd-analyze
</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s
790 <command>capability
</command> command to retrieve a list of capabilities defined on the local
793 <para>Example: if a unit has the following,
794 <programlisting>CapabilityBoundingSet=CAP_A CAP_B
795 CapabilityBoundingSet=CAP_B CAP_C
</programlisting>
796 then
<constant index='false'
>CAP_A
</constant>,
<constant index='false'
>CAP_B
</constant>, and
797 <constant index='false'
>CAP_C
</constant> are set. If the second line is prefixed with
798 <literal>~
</literal>, e.g.,
799 <programlisting>CapabilityBoundingSet=CAP_A CAP_B
800 CapabilityBoundingSet=~CAP_B CAP_C
</programlisting>
801 then, only
<constant index='false'
>CAP_A
</constant> is set.
</para></listitem>
805 <term><varname>AmbientCapabilities=
</varname></term>
807 <listitem><para>Controls which capabilities to include in the ambient capability set for the executed
808 process. Takes a whitespace-separated list of capability names, e.g.
<constant>CAP_SYS_ADMIN
</constant>,
809 <constant>CAP_DAC_OVERRIDE
</constant>,
<constant>CAP_SYS_PTRACE
</constant>. This option may appear more than
810 once, in which case the ambient capability sets are merged (see the above examples in
811 <varname>CapabilityBoundingSet=
</varname>). If the list of capabilities is prefixed with
<literal>~
</literal>,
812 all but the listed capabilities will be included, the effect of the assignment inverted. If the empty string is
813 assigned to this option, the ambient capability set is reset to the empty capability set, and all prior
814 settings have no effect. If set to
<literal>~
</literal> (without any further argument), the ambient capability
815 set is reset to the full set of available capabilities, also undoing any previous settings. Note that adding
816 capabilities to the ambient capability set adds them to the process's inherited capability set.
</para><para>
817 Ambient capability sets are useful if you want to execute a process as a non-privileged user but still want to
818 give it some capabilities. Note that in this case option
<constant>keep-caps
</constant> is automatically added
819 to
<varname>SecureBits=
</varname> to retain the capabilities over the user
820 change.
<varname>AmbientCapabilities=
</varname> does not affect commands prefixed with
821 <literal>+
</literal>.
</para>
823 <xi:include href=
"version-info.xml" xpointer=
"v229"/></listitem>
830 <title>Security
</title>
832 <variablelist class='unit-directives'
>
835 <term><varname>NoNewPrivileges=
</varname></term>
837 <listitem><para>Takes a boolean argument. If true, ensures that the service process and all its
838 children can never gain new privileges through
<function>execve()
</function> (e.g. via setuid or
839 setgid bits, or filesystem capabilities). This is the simplest and most effective way to ensure that
840 a process and its children can never elevate privileges again. Defaults to false. In case the service
841 will be run in a new mount namespace anyway and SELinux is disabled, all file systems are mounted with
842 <constant>MS_NOSUID
</constant> flag. Also see
<ulink
843 url=
"https://docs.kernel.org/userspace-api/no_new_privs.html">No New Privileges Flag
</ulink>.
846 <para>Note that this setting only has an effect on the unit's processes themselves (or any processes
847 directly or indirectly forked off them). It has no effect on processes potentially invoked on request
848 of them through tools such as
<citerefentry
849 project='man-pages'
><refentrytitle>at
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
851 project='man-pages'
><refentrytitle>crontab
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
852 <citerefentry><refentrytitle>systemd-run
</refentrytitle><manvolnum>1</manvolnum></citerefentry>, or
853 arbitrary IPC services.
</para>
855 <xi:include href=
"version-info.xml" xpointer=
"v187"/></listitem>
859 <term><varname>SecureBits=
</varname></term>
861 <listitem><para>Controls the secure bits set for the executed process. Takes a space-separated combination of
862 options from the following list:
<option>keep-caps
</option>,
<option>keep-caps-locked
</option>,
863 <option>no-setuid-fixup
</option>,
<option>no-setuid-fixup-locked
</option>,
<option>noroot
</option>, and
864 <option>noroot-locked
</option>. This option may appear more than once, in which case the secure bits are
865 ORed. If the empty string is assigned to this option, the bits are reset to
0. This does not affect commands
866 prefixed with
<literal>+
</literal>. See
<citerefentry
867 project='man-pages'
><refentrytitle>capabilities
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
868 details.
</para></listitem>
875 <title>Mandatory Access Control
</title>
877 <xi:include href=
"system-only.xml" xpointer=
"plural"/>
879 <variablelist class='unit-directives'
>
882 <term><varname>SELinuxContext=
</varname></term>
884 <listitem><para>Set the SELinux security context of the executed process. If set, this will override the
885 automated domain transition. However, the policy still needs to authorize the transition. This directive is
886 ignored if SELinux is disabled. If prefixed by
<literal>-
</literal>, failing to set the SELinux
887 security context will be ignored, but it's still possible that the subsequent
888 <function>execve()
</function> may fail if the policy doesn't allow the transition for the
889 non-overridden context. This does not affect commands prefixed with
<literal>+
</literal>. See
891 project='die-net'
><refentrytitle>setexeccon
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
894 <xi:include href=
"version-info.xml" xpointer=
"v209"/></listitem>
898 <term><varname>AppArmorProfile=
</varname></term>
900 <listitem><para>Takes a profile name as argument. The process executed by the unit will switch to
901 this profile when started. Profiles must already be loaded in the kernel, or the unit will fail. If
902 prefixed by
<literal>-
</literal>, all errors will be ignored. This setting has no effect if AppArmor
903 is not enabled. This setting does not affect commands prefixed with
<literal>+
</literal>.
</para>
905 <xi:include href=
"version-info.xml" xpointer=
"v210"/>
910 <term><varname>SmackProcessLabel=
</varname></term>
912 <listitem><para>Takes a
<option>SMACK64
</option> security label as argument. The process executed by the unit
913 will be started under this label and SMACK will decide whether the process is allowed to run or not, based on
914 it. The process will continue to run under the label specified here unless the executable has its own
915 <option>SMACK64EXEC
</option> label, in which case the process will transition to run under that label. When not
916 specified, the label that systemd is running under is used. This directive is ignored if SMACK is
919 <para>The value may be prefixed by
<literal>-
</literal>, in which case all errors will be ignored. An empty
920 value may be specified to unset previous assignments. This does not affect commands prefixed with
921 <literal>+
</literal>.
</para>
923 <xi:include href=
"version-info.xml" xpointer=
"v218"/></listitem>
930 <title>Process Properties
</title>
932 <variablelist class='unit-directives'
>
935 <term><varname>LimitCPU=
</varname></term>
936 <term><varname>LimitFSIZE=
</varname></term>
937 <term><varname>LimitDATA=
</varname></term>
938 <term><varname>LimitSTACK=
</varname></term>
939 <term><varname>LimitCORE=
</varname></term>
940 <term><varname>LimitRSS=
</varname></term>
941 <term><varname>LimitNOFILE=
</varname></term>
942 <term><varname>LimitAS=
</varname></term>
943 <term><varname>LimitNPROC=
</varname></term>
944 <term><varname>LimitMEMLOCK=
</varname></term>
945 <term><varname>LimitLOCKS=
</varname></term>
946 <term><varname>LimitSIGPENDING=
</varname></term>
947 <term><varname>LimitMSGQUEUE=
</varname></term>
948 <term><varname>LimitNICE=
</varname></term>
949 <term><varname>LimitRTPRIO=
</varname></term>
950 <term><varname>LimitRTTIME=
</varname></term>
952 <listitem><para>Set soft and hard limits on various resources for executed processes. See
953 <citerefentry><refentrytitle>setrlimit
</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
954 details on the process resource limit concept. Process resource limits may be specified in two formats:
955 either as single value to set a specific soft and hard limit to the same value, or as colon-separated
956 pair
<option>soft:hard
</option> to set both limits individually
957 (e.g.
<literal>LimitAS=
4G:
16G
</literal>). Use the string
<option>infinity
</option> to configure no
958 limit on a specific resource. The multiplicative suffixes K, M, G, T, P and E (to the base
1024) may
959 be used for resource limits measured in bytes (e.g.
<literal>LimitAS=
16G
</literal>). For the limits
960 referring to time values, the usual time units ms, s, min, h and so on may be used (see
961 <citerefentry><refentrytitle>systemd.time
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
962 details). Note that if no time unit is specified for
<varname>LimitCPU=
</varname> the default unit of
963 seconds is implied, while for
<varname>LimitRTTIME=
</varname> the default unit of microseconds is
964 implied. Also, note that the effective granularity of the limits might influence their
965 enforcement. For example, time limits specified for
<varname>LimitCPU=
</varname> will be rounded up
966 implicitly to multiples of
1s. For
<varname>LimitNICE=
</varname> the value may be specified in two
967 syntaxes: if prefixed with
<literal>+
</literal> or
<literal>-
</literal>, the value is understood as
968 regular Linux nice value in the range -
20…
19. If not prefixed like this the value is understood as
969 raw resource limit parameter in the range
0…
40 (with
0 being equivalent to
1).
</para>
971 <para>Note that most process resource limits configured with these options are per-process, and
972 processes may fork in order to acquire a new set of resources that are accounted independently of the
973 original process, and may thus escape limits set. Also note that
<varname>LimitRSS=
</varname> is not
974 implemented on Linux, and setting it has no effect. Often it is advisable to prefer the resource
976 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
977 over these per-process limits, as they apply to services as a whole, may be altered dynamically at
978 runtime, and are generally more expressive. For example,
<varname>MemoryMax=
</varname> is a more
979 powerful (and working) replacement for
<varname>LimitRSS=
</varname>.
</para>
981 <para>Note that
<varname>LimitNPROC=
</varname> will limit the number of processes from one (real) UID and
982 not the number of processes started (forked) by the service. Therefore the limit is cumulative for all
983 processes running under the same UID. Please also note that the
<varname>LimitNPROC=
</varname> will not be
984 enforced if the service is running as root (and not dropping privileges). Due to these limitations,
985 <varname>TasksMax=
</varname> (see
<citerefentry><refentrytitle>systemd.resource-control
</refentrytitle>
986 <manvolnum>5</manvolnum></citerefentry>) is typically a better choice than
<varname>LimitNPROC=
</varname>.
989 <para>Resource limits not configured explicitly for a unit default to the value configured in the various
990 <varname>DefaultLimitCPU=
</varname>,
<varname>DefaultLimitFSIZE=
</varname>, … options available in
991 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>, and –
992 if not configured there – the kernel or per-user defaults, as defined by the OS (the latter only for user
993 services, see below).
</para>
995 <para>For system units these resource limits may be chosen freely. When these settings are configured
996 in a user service (i.e. a service run by the per-user instance of the service manager) they cannot be
997 used to raise the limits above those set for the user manager itself when it was first invoked, as
998 the user's service manager generally lacks the privileges to do so. In user context these
999 configuration options are hence only useful to lower the limits passed in or to raise the soft limit
1000 to the maximum of the hard limit as configured for the user. To raise the user's limits further, the
1001 available configuration mechanisms differ between operating systems, but typically require
1002 privileges. In most cases it is possible to configure higher per-user resource limits via PAM or by
1003 setting limits on the system service encapsulating the user's service manager, i.e. the user's
1004 instance of
<filename>user@.service
</filename>. After making such changes, make sure to restart the
1005 user's service manager.
</para>
1008 <title>Resource limit directives, their equivalent
<command>ulimit
</command> shell commands and the unit used
</title>
1011 <colspec colname='directive'
/>
1012 <colspec colname='equivalent'
/>
1013 <colspec colname='unit'
/>
1014 <colspec colname='notes'
/>
1017 <entry>Directive
</entry>
1018 <entry><command>ulimit
</command> equivalent
</entry>
1020 <entry>Notes
</entry>
1025 <entry>LimitCPU=
</entry>
1026 <entry>ulimit -t
</entry>
1027 <entry>Seconds
</entry>
1031 <entry>LimitFSIZE=
</entry>
1032 <entry>ulimit -f
</entry>
1033 <entry>Bytes
</entry>
1037 <entry>LimitDATA=
</entry>
1038 <entry>ulimit -d
</entry>
1039 <entry>Bytes
</entry>
1040 <entry>Don't use. This limits the allowed address range, not memory use! Defaults to unlimited and should not be lowered. To limit memory use, see
<varname>MemoryMax=
</varname> in
<citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
</entry>
1043 <entry>LimitSTACK=
</entry>
1044 <entry>ulimit -s
</entry>
1045 <entry>Bytes
</entry>
1049 <entry>LimitCORE=
</entry>
1050 <entry>ulimit -c
</entry>
1051 <entry>Bytes
</entry>
1055 <entry>LimitRSS=
</entry>
1056 <entry>ulimit -m
</entry>
1057 <entry>Bytes
</entry>
1058 <entry>Don't use. No effect on Linux.
</entry>
1061 <entry>LimitNOFILE=
</entry>
1062 <entry>ulimit -n
</entry>
1063 <entry>Number of File Descriptors
</entry>
1064 <entry>Don't use. Be careful when raising the soft limit above
1024, since
<citerefentry project='man-pages'
><refentrytitle>select
</refentrytitle><manvolnum>2</manvolnum></citerefentry> cannot function with file descriptors above
1023 on Linux. Nowadays, the hard limit defaults to
524288, a very high value compared to historical defaults. Typically applications should increase their soft limit to the hard limit on their own, if they are OK with working with file descriptors above
1023, i.e. do not use
<citerefentry project='man-pages'
><refentrytitle>select
</refentrytitle><manvolnum>2</manvolnum></citerefentry>. Note that file descriptors are nowadays accounted like any other form of memory, thus there should not be any need to lower the hard limit. Use
<varname>MemoryMax=
</varname> to control overall service memory use, including file descriptor memory.
</entry>
1067 <entry>LimitAS=
</entry>
1068 <entry>ulimit -v
</entry>
1069 <entry>Bytes
</entry>
1070 <entry>Don't use. This limits the allowed address range, not memory use! Defaults to unlimited and should not be lowered. To limit memory use, see
<varname>MemoryMax=
</varname> in
<citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
</entry>
1073 <entry>LimitNPROC=
</entry>
1074 <entry>ulimit -u
</entry>
1075 <entry>Number of Processes
</entry>
1076 <entry>This limit is enforced based on the number of processes belonging to the user. Typically it's better to track processes per service, i.e. use
<varname>TasksMax=
</varname>, see
<citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
</entry>
1079 <entry>LimitMEMLOCK=
</entry>
1080 <entry>ulimit -l
</entry>
1081 <entry>Bytes
</entry>
1085 <entry>LimitLOCKS=
</entry>
1086 <entry>ulimit -x
</entry>
1087 <entry>Number of Locks
</entry>
1091 <entry>LimitSIGPENDING=
</entry>
1092 <entry>ulimit -i
</entry>
1093 <entry>Number of Queued Signals
</entry>
1097 <entry>LimitMSGQUEUE=
</entry>
1098 <entry>ulimit -q
</entry>
1099 <entry>Bytes
</entry>
1103 <entry>LimitNICE=
</entry>
1104 <entry>ulimit -e
</entry>
1105 <entry>Nice Level
</entry>
1109 <entry>LimitRTPRIO=
</entry>
1110 <entry>ulimit -r
</entry>
1111 <entry>Realtime Priority
</entry>
1115 <entry>LimitRTTIME=
</entry>
1116 <entry>ulimit -R
</entry>
1117 <entry>Microseconds
</entry>
1126 <term><varname>UMask=
</varname></term>
1128 <listitem><para>Controls the file mode creation mask. Takes an access mode in octal notation. See
1129 <citerefentry><refentrytitle>umask
</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
1130 details. Defaults to
0022 for system units. For user units the default value is inherited from the
1131 per-user service manager (whose default is in turn inherited from the system service manager, and
1132 thus typically also is
0022 — unless overridden by a PAM module). In order to change the per-user mask
1133 for all user services, consider setting the
<varname>UMask=
</varname> setting of the user's
1134 <filename>user@.service
</filename> system service instance. The per-user umask may also be set via
1135 the
<varname>umask
</varname> field of a user's
<ulink url=
"https://systemd.io/USER_RECORD">JSON User
1136 Record
</ulink> (for users managed by
1137 <citerefentry><refentrytitle>systemd-homed.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry>
1138 this field may be controlled via
<command>homectl --umask=
</command>). It may also be set via a PAM
1139 module, such as
<citerefentry
1140 project='man-pages'
><refentrytitle>pam_umask
</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
</para></listitem>
1144 <term><varname>CoredumpFilter=
</varname></term>
1146 <listitem><para>Controls which types of memory mappings will be saved if the process dumps core
1147 (using the
<filename>/proc/
<replaceable>pid
</replaceable>/coredump_filter
</filename> file). Takes a
1148 whitespace-separated combination of mapping type names or numbers (with the default base
16). Mapping
1149 type names are
<constant>private-anonymous
</constant>,
<constant>shared-anonymous
</constant>,
1150 <constant>private-file-backed
</constant>,
<constant>shared-file-backed
</constant>,
1151 <constant>elf-headers
</constant>,
<constant>private-huge
</constant>,
1152 <constant>shared-huge
</constant>,
<constant>private-dax
</constant>,
<constant>shared-dax
</constant>,
1153 and the special values
<constant>all
</constant> (all types) and
<constant>default
</constant> (the
1154 kernel default of
<literal><constant>private-anonymous
</constant>
1155 <constant>shared-anonymous
</constant> <constant>elf-headers
</constant>
1156 <constant>private-huge
</constant></literal>). See
1157 <citerefentry project='man-pages'
><refentrytitle>core
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1158 for the meaning of the mapping types. When specified multiple times, all specified masks are
1159 ORed. When not set, or if the empty value is assigned, the inherited value is not changed.
</para>
1162 <title>Add DAX pages to the dump filter
</title>
1164 <programlisting>CoredumpFilter=default private-dax shared-dax
</programlisting>
1167 <xi:include href=
"version-info.xml" xpointer=
"v246"/>
1172 <term><varname>KeyringMode=
</varname></term>
1174 <listitem><para>Controls how the kernel session keyring is set up for the service (see
<citerefentry
1175 project='man-pages'
><refentrytitle>session-keyring
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
1176 details on the session keyring). Takes one of
<option>inherit
</option>,
<option>private
</option>,
1177 <option>shared
</option>. If set to
<option>inherit
</option> no special keyring setup is done, and the kernel's
1178 default behaviour is applied. If
<option>private
</option> is used a new session keyring is allocated when a
1179 service process is invoked, and it is not linked up with any user keyring. This is the recommended setting for
1180 system services, as this ensures that multiple services running under the same system user ID (in particular
1181 the root user) do not share their key material among each other. If
<option>shared
</option> is used a new
1182 session keyring is allocated as for
<option>private
</option>, but the user keyring of the user configured with
1183 <varname>User=
</varname> is linked into it, so that keys assigned to the user may be requested by the unit's
1184 processes. In this mode multiple units running processes under the same user ID may share key material. Unless
1185 <option>inherit
</option> is selected the unique invocation ID for the unit (see below) is added as a protected
1186 key by the name
<literal>invocation_id
</literal> to the newly created session keyring. Defaults to
1187 <option>private
</option> for services of the system service manager and to
<option>inherit
</option> for
1188 non-service units and for services of the user service manager.
</para>
1190 <xi:include href=
"version-info.xml" xpointer=
"v235"/></listitem>
1194 <term><varname>OOMScoreAdjust=
</varname></term>
1196 <listitem><para>Sets the adjustment value for the Linux kernel's Out-Of-Memory (OOM) killer score for
1197 executed processes. Takes an integer between -
1000 (to disable OOM killing of processes of this unit)
1198 and
1000 (to make killing of processes of this unit under memory pressure very likely). See
<ulink
1199 url=
"https://docs.kernel.org/filesystems/proc.html">The /proc Filesystem
</ulink> for
1200 details. If not specified defaults to the OOM score adjustment level of the service manager itself,
1201 which is normally at
0.
</para>
1203 <para>Use the
<varname>OOMPolicy=
</varname> setting of service units to configure how the service
1204 manager shall react to the kernel OOM killer or
<command>systemd-oomd
</command> terminating a process of the service. See
1205 <citerefentry><refentrytitle>systemd.service
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1206 for details.
</para></listitem>
1210 <term><varname>TimerSlackNSec=
</varname></term>
1211 <listitem><para>Sets the timer slack in nanoseconds for the executed processes. The timer slack controls the
1212 accuracy of wake-ups triggered by timers. See
1213 <citerefentry><refentrytitle>prctl
</refentrytitle><manvolnum>2</manvolnum></citerefentry> for more
1214 information. Note that in contrast to most other time span definitions this parameter takes an integer value in
1215 nano-seconds if no unit is specified. The usual time units are understood too.
</para></listitem>
1219 <term><varname>Personality=
</varname></term>
1221 <listitem><para>Controls which kernel architecture
<citerefentry
1222 project='man-pages'
><refentrytitle>uname
</refentrytitle><manvolnum>2</manvolnum></citerefentry> shall
1223 report, when invoked by unit processes. Takes one of the architecture identifiers
1224 <constant>arm64
</constant>,
<constant>arm64-be
</constant>,
<constant>arm
</constant>,
1225 <constant>arm-be
</constant>,
<constant>x86
</constant>,
<constant>x86-
64</constant>,
1226 <constant>ppc
</constant>,
<constant>ppc-le
</constant>,
<constant>ppc64
</constant>,
1227 <constant>ppc64-le
</constant>,
<constant>s390
</constant> or
<constant>s390x
</constant>. Which
1228 personality architectures are supported depends on the kernel's native architecture. Usually the
1229 64-bit versions of the various system architectures support their immediate
32-bit personality
1230 architecture counterpart, but no others. For example,
<constant>x86-
64</constant> systems support the
1231 <constant>x86-
64</constant> and
<constant>x86
</constant> personalities but no others. The personality
1232 feature is useful when running
32-bit services on a
64-bit host system. If not specified, the
1233 personality is left unmodified and thus reflects the personality of the host system's kernel. This
1234 option is not useful on architectures for which only one native word width was ever available, such
1235 as
<constant>m68k
</constant> (
32-bit only) or
<constant>alpha
</constant> (
64-bit only).
</para>
1237 <xi:include href=
"version-info.xml" xpointer=
"v209"/></listitem>
1241 <term><varname>IgnoreSIGPIPE=
</varname></term>
1243 <listitem><para>Takes a boolean argument. If true,
<constant>SIGPIPE
</constant> is ignored in the
1244 executed process. Defaults to true since
<constant>SIGPIPE
</constant> is generally only useful in
1245 shell pipelines.
</para></listitem>
1252 <title>Scheduling
</title>
1254 <variablelist class='unit-directives'
>
1257 <term><varname>Nice=
</varname></term>
1259 <listitem><para>Sets the default nice level (scheduling priority) for executed processes. Takes an
1260 integer between -
20 (highest priority) and
19 (lowest priority). In case of resource contention,
1261 smaller values mean more resources will be made available to the unit's processes, larger values mean
1262 less resources will be made available. See
1263 <citerefentry><refentrytitle>setpriority
</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
1264 details.
</para></listitem>
1268 <term><varname>CPUSchedulingPolicy=
</varname></term>
1270 <listitem><para>Sets the CPU scheduling policy for executed processes. Takes one of
<option>other
</option>,
1271 <option>batch
</option>,
<option>idle
</option>,
<option>fifo
</option> or
<option>rr
</option>. See
1272 <citerefentry project='man-pages'
><refentrytitle>sched_setscheduler
</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
1273 details.
</para></listitem>
1277 <term><varname>CPUSchedulingPriority=
</varname></term>
1279 <listitem><para>Sets the CPU scheduling priority for executed processes. The available priority range
1280 depends on the selected CPU scheduling policy (see above). For real-time scheduling policies an
1281 integer between
1 (lowest priority) and
99 (highest priority) can be used. In case of CPU resource
1282 contention, smaller values mean less CPU time is made available to the service, larger values mean
1283 more. See
<citerefentry
1284 project='man-pages'
><refentrytitle>sched_setscheduler
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1285 for details.
</para></listitem>
1289 <term><varname>CPUSchedulingResetOnFork=
</varname></term>
1291 <listitem><para>Takes a boolean argument. If true, elevated CPU scheduling priorities and policies
1292 will be reset when the executed processes call
1293 <citerefentry project='man-pages'
><refentrytitle>fork
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
1294 and can hence not leak into child processes. See
1295 <citerefentry project='man-pages'
><refentrytitle>sched_setscheduler
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1296 for details. Defaults to false.
</para></listitem>
1300 <term><varname>CPUAffinity=
</varname></term>
1302 <listitem><para>Controls the CPU affinity of the executed processes. Takes a list of CPU indices or ranges
1303 separated by either whitespace or commas. Alternatively, takes a special
"numa" value in which case systemd
1304 automatically derives allowed CPU range based on the value of
<varname>NUMAMask=
</varname> option. CPU ranges
1305 are specified by the lower and upper CPU indices separated by a dash. This option may be specified more than
1306 once, in which case the specified CPU affinity masks are merged. If the empty string is assigned, the mask
1307 is reset, all assignments prior to this will have no effect. See
1308 <citerefentry project='man-pages'
><refentrytitle>sched_setaffinity
</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
1309 details.
</para></listitem>
1313 <term><varname>NUMAPolicy=
</varname></term>
1315 <listitem><para>Controls the NUMA memory policy of the executed processes. Takes a policy type, one of:
1316 <option>default
</option>,
<option>preferred
</option>,
<option>bind
</option>,
<option>interleave
</option> and
1317 <option>local
</option>. A list of NUMA nodes that should be associated with the policy must be specified
1318 in
<varname>NUMAMask=
</varname>. For more details on each policy please see,
1319 <citerefentry><refentrytitle>set_mempolicy
</refentrytitle><manvolnum>2</manvolnum></citerefentry>. For overall
1320 overview of NUMA support in Linux see,
1321 <citerefentry project='man-pages'
><refentrytitle>numa
</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
1324 <xi:include href=
"version-info.xml" xpointer=
"v243"/></listitem>
1328 <term><varname>NUMAMask=
</varname></term>
1330 <listitem><para>Controls the NUMA node list which will be applied alongside with selected NUMA policy.
1331 Takes a list of NUMA nodes and has the same syntax as a list of CPUs for
<varname>CPUAffinity=
</varname>
1332 option or special
"all" value which will include all available NUMA nodes in the mask. Note that the list
1333 of NUMA nodes is not required for
<option>default
</option> and
<option>local
</option>
1334 policies and for
<option>preferred
</option> policy we expect a single NUMA node.
</para>
1336 <xi:include href=
"version-info.xml" xpointer=
"v243"/></listitem>
1340 <term><varname>IOSchedulingClass=
</varname></term>
1342 <listitem><para>Sets the I/O scheduling class for executed processes. Takes one of the strings
1343 <option>realtime
</option>,
<option>best-effort
</option> or
<option>idle
</option>. The kernel's
1344 default scheduling class is
<option>best-effort
</option> at a priority of
4. If the empty string is
1345 assigned to this option, all prior assignments to both
<varname>IOSchedulingClass=
</varname> and
1346 <varname>IOSchedulingPriority=
</varname> have no effect. See
1347 <citerefentry><refentrytitle>ioprio_set
</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
1348 details.
</para></listitem>
1352 <term><varname>IOSchedulingPriority=
</varname></term>
1354 <listitem><para>Sets the I/O scheduling priority for executed processes. Takes an integer between
0
1355 (highest priority) and
7 (lowest priority). In case of I/O contention, smaller values mean more I/O
1356 bandwidth is made available to the unit's processes, larger values mean less bandwidth. The available
1357 priorities depend on the selected I/O scheduling class (see above). If the empty string is assigned
1358 to this option, all prior assignments to both
<varname>IOSchedulingClass=
</varname> and
1359 <varname>IOSchedulingPriority=
</varname> have no effect. For the kernel's default scheduling class
1360 (
<option>best-effort
</option>) this defaults to
4. See
1361 <citerefentry><refentrytitle>ioprio_set
</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
1362 details.
</para></listitem>
1369 <title>Sandboxing
</title>
1371 <para>The following sandboxing options are an effective way to limit the exposure of the system towards the unit's
1372 processes. It is recommended to turn on as many of these options for each unit as is possible without negatively
1373 affecting the process' ability to operate. Note that many of these sandboxing features are gracefully turned off on
1374 systems where the underlying security mechanism is not available. For example,
<varname>ProtectSystem=
</varname>
1375 has no effect if the kernel is built without file system namespacing or if the service manager runs in a container
1376 manager that makes file system namespacing unavailable to its payload. Similarly,
1377 <varname>RestrictRealtime=
</varname> has no effect on systems that lack support for SECCOMP system call filtering,
1378 or in containers where support for this is turned off.
</para>
1380 <para>Also note that some sandboxing functionality is generally not available in user services (i.e. services run
1381 by the per-user service manager). Specifically, the various settings requiring file system namespacing support
1382 (such as
<varname>ProtectSystem=
</varname>) are not available, as the underlying kernel functionality is only
1383 accessible to privileged processes. However, most namespacing settings, that will not work on their own in user
1384 services, will work when used in conjunction with
<varname>PrivateUsers=
</varname><option>true
</option>.
</para>
1386 <variablelist class='unit-directives'
>
1389 <term><varname>ProtectSystem=
</varname></term>
1391 <listitem><para>Takes a boolean argument or the special values
<literal>full
</literal> or
1392 <literal>strict
</literal>. If true, mounts the
<filename>/usr/
</filename> and the boot loader
1393 directories (
<filename>/boot
</filename> and
<filename>/efi
</filename>) read-only for processes
1394 invoked by this unit. If set to
<literal>full
</literal>, the
<filename>/etc/
</filename> directory is
1395 mounted read-only, too. If set to
<literal>strict
</literal> the entire file system hierarchy is
1396 mounted read-only, except for the API file system subtrees
<filename>/dev/
</filename>,
1397 <filename>/proc/
</filename> and
<filename>/sys/
</filename> (protect these directories using
1398 <varname>PrivateDevices=
</varname>,
<varname>ProtectKernelTunables=
</varname>,
1399 <varname>ProtectControlGroups=
</varname>). This setting ensures that any modification of the vendor-supplied
1400 operating system (and optionally its configuration, and local mounts) is prohibited for the service. It is
1401 recommended to enable this setting for all long-running services, unless they are involved with system updates
1402 or need to modify the operating system in other ways. If this option is used,
1403 <varname>ReadWritePaths=
</varname> may be used to exclude specific directories from being made read-only. This
1404 setting is implied if
<varname>DynamicUser=
</varname> is set. This setting cannot ensure protection in all
1405 cases. In general it has the same limitations as
<varname>ReadOnlyPaths=
</varname>, see below. Defaults to
1408 <xi:include href=
"version-info.xml" xpointer=
"v214"/></listitem>
1412 <term><varname>ProtectHome=
</varname></term>
1414 <listitem><para>Takes a boolean argument or the special values
<literal>read-only
</literal> or
1415 <literal>tmpfs
</literal>. If true, the directories
<filename>/home/
</filename>,
1416 <filename>/root
</filename>, and
<filename>/run/user
</filename> are made inaccessible and empty for
1417 processes invoked by this unit. If set to
<literal>read-only
</literal>, the three directories are
1418 made read-only instead. If set to
<literal>tmpfs
</literal>, temporary file systems are mounted on the
1419 three directories in read-only mode. The value
<literal>tmpfs
</literal> is useful to hide home
1420 directories not relevant to the processes invoked by the unit, while still allowing necessary
1421 directories to be made visible when listed in
<varname>BindPaths=
</varname> or
1422 <varname>BindReadOnlyPaths=
</varname>.
</para>
1424 <para>Setting this to
<literal>yes
</literal> is mostly equivalent to setting the three directories in
1425 <varname>InaccessiblePaths=
</varname>. Similarly,
<literal>read-only
</literal> is mostly equivalent to
1426 <varname>ReadOnlyPaths=
</varname>, and
<literal>tmpfs
</literal> is mostly equivalent to
1427 <varname>TemporaryFileSystem=
</varname> with
<literal>:ro
</literal>.
</para>
1429 <para>It is recommended to enable this setting for all long-running services (in particular
1430 network-facing ones), to ensure they cannot get access to private user data, unless the services
1431 actually require access to the user's private data. This setting is implied if
1432 <varname>DynamicUser=
</varname> is set. This setting cannot ensure protection in all cases. In
1433 general it has the same limitations as
<varname>ReadOnlyPaths=
</varname>, see below.
</para>
1435 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
1437 <xi:include href=
"version-info.xml" xpointer=
"v214"/></listitem>
1441 <term><varname>RuntimeDirectory=
</varname></term>
1442 <term><varname>StateDirectory=
</varname></term>
1443 <term><varname>CacheDirectory=
</varname></term>
1444 <term><varname>LogsDirectory=
</varname></term>
1445 <term><varname>ConfigurationDirectory=
</varname></term>
1447 <listitem><para>These options take a whitespace-separated list of directory names. The specified
1448 directory names must be relative, and may not include
<literal>..
</literal>. If set, when the unit is
1449 started, one or more directories by the specified names will be created (including their parents)
1450 below the locations defined in the following table. Also, the corresponding environment variable will
1451 be defined with the full paths of the directories. If multiple directories are set, then in the
1452 environment variable the paths are concatenated with colon (
<literal>:
</literal>).
</para>
1454 <title>Automatic directory creation and environment variables
</title>
1458 <entry>Directory
</entry>
1459 <entry>Below path for system units
</entry>
1460 <entry>Below path for user units
</entry>
1461 <entry>Environment variable set
</entry>
1466 <entry><varname>RuntimeDirectory=
</varname></entry>
1467 <entry><filename>/run/
</filename></entry>
1468 <entry><varname>$XDG_RUNTIME_DIR
</varname></entry>
1469 <entry><varname>$RUNTIME_DIRECTORY
</varname></entry>
1472 <entry><varname>StateDirectory=
</varname></entry>
1473 <entry><filename>/var/lib/
</filename></entry>
1474 <entry><varname>$XDG_STATE_HOME
</varname></entry>
1475 <entry><varname>$STATE_DIRECTORY
</varname></entry>
1478 <entry><varname>CacheDirectory=
</varname></entry>
1479 <entry><filename>/var/cache/
</filename></entry>
1480 <entry><varname>$XDG_CACHE_HOME
</varname></entry>
1481 <entry><varname>$CACHE_DIRECTORY
</varname></entry>
1484 <entry><varname>LogsDirectory=
</varname></entry>
1485 <entry><filename>/var/log/
</filename></entry>
1486 <entry><varname>$XDG_STATE_HOME
</varname><filename>/log/
</filename></entry>
1487 <entry><varname>$LOGS_DIRECTORY
</varname></entry>
1490 <entry><varname>ConfigurationDirectory=
</varname></entry>
1491 <entry><filename>/etc/
</filename></entry>
1492 <entry><varname>$XDG_CONFIG_HOME
</varname></entry>
1493 <entry><varname>$CONFIGURATION_DIRECTORY
</varname></entry>
1499 <para>In case of
<varname>RuntimeDirectory=
</varname> the innermost subdirectories are removed when
1500 the unit is stopped. It is possible to preserve the specified directories in this case if
1501 <varname>RuntimeDirectoryPreserve=
</varname> is configured to
<option>restart
</option> or
1502 <option>yes
</option> (see below). The directories specified with
<varname>StateDirectory=
</varname>,
1503 <varname>CacheDirectory=
</varname>,
<varname>LogsDirectory=
</varname>,
1504 <varname>ConfigurationDirectory=
</varname> are not removed when the unit is stopped.
</para>
1506 <para>Except in case of
<varname>ConfigurationDirectory=
</varname>, the innermost specified directories will be
1507 owned by the user and group specified in
<varname>User=
</varname> and
<varname>Group=
</varname>. If the
1508 specified directories already exist and their owning user or group do not match the configured ones, all files
1509 and directories below the specified directories as well as the directories themselves will have their file
1510 ownership recursively changed to match what is configured. As an optimization, if the specified directories are
1511 already owned by the right user and group, files and directories below of them are left as-is, even if they do
1512 not match what is requested. The innermost specified directories will have their access mode adjusted to the
1513 what is specified in
<varname>RuntimeDirectoryMode=
</varname>,
<varname>StateDirectoryMode=
</varname>,
1514 <varname>CacheDirectoryMode=
</varname>,
<varname>LogsDirectoryMode=
</varname> and
1515 <varname>ConfigurationDirectoryMode=
</varname>.
</para>
1517 <para>These options imply
<varname>BindPaths=
</varname> for the specified paths. When combined with
1518 <varname>RootDirectory=
</varname> or
<varname>RootImage=
</varname> these paths always reside on the host and
1519 are mounted from there into the unit's file system namespace.
</para>
1521 <para>If
<varname>DynamicUser=
</varname> is used, the logic for
<varname>CacheDirectory=
</varname>,
1522 <varname>LogsDirectory=
</varname> and
<varname>StateDirectory=
</varname> is slightly altered: the directories are created below
1523 <filename>/var/cache/private
</filename>,
<filename>/var/log/private
</filename> and
<filename>/var/lib/private
</filename>,
1524 respectively, which are host directories made inaccessible to
1525 unprivileged users, which ensures that access to these directories cannot be gained through dynamic
1526 user ID recycling. Symbolic links are created to hide this difference in behaviour. Both from
1527 perspective of the host and from inside the unit, the relevant directories hence always appear
1528 directly below
<filename>/var/cache
</filename>,
<filename>/var/log
</filename> and
1529 <filename>/var/lib
</filename>.
</para>
1531 <para>Use
<varname>RuntimeDirectory=
</varname> to manage one or more runtime directories for the unit and bind
1532 their lifetime to the daemon runtime. This is particularly useful for unprivileged daemons that cannot create
1533 runtime directories in
<filename>/run/
</filename> due to lack of privileges, and to make sure the runtime
1534 directory is cleaned up automatically after use. For runtime directories that require more complex or different
1535 configuration or lifetime guarantees, please consider using
1536 <citerefentry><refentrytitle>tmpfiles.d
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
</para>
1538 <para><varname>RuntimeDirectory=
</varname>,
<varname>StateDirectory=
</varname>,
<varname>CacheDirectory=
</varname>
1539 and
<varname>LogsDirectory=
</varname> optionally support a second parameter, separated by
<literal>:
</literal>.
1540 The second parameter will be interpreted as a destination path that will be created as a symlink to the directory.
1541 The symlinks will be created after any
<varname>BindPaths=
</varname> or
<varname>TemporaryFileSystem=
</varname>
1542 options have been set up, to make ephemeral symlinking possible. The same source can have multiple symlinks, by
1543 using the same first parameter, but a different second parameter.
</para>
1545 <para>The directories defined by these options are always created under the standard paths used by systemd
1546 (
<filename>/var/
</filename>,
<filename>/run/
</filename>,
<filename>/etc/
</filename>, …). If the service needs
1547 directories in a different location, a different mechanism has to be used to create them.
</para>
1549 <para><citerefentry><refentrytitle>tmpfiles.d
</refentrytitle><manvolnum>5</manvolnum></citerefentry> provides
1550 functionality that overlaps with these options. Using these options is recommended, because the lifetime of
1551 the directories is tied directly to the lifetime of the unit, and it is not necessary to ensure that the
1552 <filename>tmpfiles.d
</filename> configuration is executed before the unit is started.
</para>
1554 <para>To remove any of the directories created by these settings, use the
<command>systemctl clean
1555 …
</command> command on the relevant units, see
1556 <citerefentry><refentrytitle>systemctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
1559 <para>Example: if a system service unit has the following,
1560 <programlisting>RuntimeDirectory=foo/bar baz
</programlisting>
1561 the service manager creates
<filename index='false'
>/run/foo
</filename> (if it does not exist),
1563 <filename index='false'
>/run/foo/bar
</filename>, and
<filename index='false'
>/run/baz
</filename>. The
1564 directories
<filename index='false'
>/run/foo/bar
</filename> and
1565 <filename index='false'
>/run/baz
</filename> except
<filename index='false'
>/run/foo
</filename> are
1566 owned by the user and group specified in
<varname>User=
</varname> and
<varname>Group=
</varname>, and removed
1567 when the service is stopped.
</para>
1569 <para>Example: if a system service unit has the following,
1570 <programlisting>RuntimeDirectory=foo/bar
1571 StateDirectory=aaa/bbb ccc
</programlisting>
1572 then the environment variable
<literal>RUNTIME_DIRECTORY
</literal> is set with
<literal>/run/foo/bar
</literal>, and
1573 <literal>STATE_DIRECTORY
</literal> is set with
<literal>/var/lib/aaa/bbb:/var/lib/ccc
</literal>.
</para>
1575 <para>Example: if a system service unit has the following,
1576 <programlisting>RuntimeDirectory=foo:bar foo:baz
</programlisting>
1577 the service manager creates
<filename index='false'
>/run/foo
</filename> (if it does not exist), and
1578 <filename index='false'
>/run/bar
</filename> plus
<filename index='false'
>/run/baz
</filename> as symlinks to
1579 <filename index='false'
>/run/foo
</filename>.
</para>
1581 <xi:include href=
"version-info.xml" xpointer=
"v211"/></listitem>
1585 <term><varname>RuntimeDirectoryMode=
</varname></term>
1586 <term><varname>StateDirectoryMode=
</varname></term>
1587 <term><varname>CacheDirectoryMode=
</varname></term>
1588 <term><varname>LogsDirectoryMode=
</varname></term>
1589 <term><varname>ConfigurationDirectoryMode=
</varname></term>
1591 <listitem><para>Specifies the access mode of the directories specified in
<varname>RuntimeDirectory=
</varname>,
1592 <varname>StateDirectory=
</varname>,
<varname>CacheDirectory=
</varname>,
<varname>LogsDirectory=
</varname>, or
1593 <varname>ConfigurationDirectory=
</varname>, respectively, as an octal number. Defaults to
1594 <constant>0755</constant>. See
"Permissions" in
<citerefentry
1595 project='man-pages'
><refentrytitle>path_resolution
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for a
1596 discussion of the meaning of permission bits.
</para>
1598 <xi:include href=
"version-info.xml" xpointer=
"v234"/></listitem>
1602 <term><varname>RuntimeDirectoryPreserve=
</varname></term>
1604 <listitem><para>Takes a boolean argument or
<option>restart
</option>. If set to
<option>no
</option> (the
1605 default), the directories specified in
<varname>RuntimeDirectory=
</varname> are always removed when the service
1606 stops. If set to
<option>restart
</option> the directories are preserved when the service is both automatically
1607 and manually restarted. Here, the automatic restart means the operation specified in
1608 <varname>Restart=
</varname>, and manual restart means the one triggered by
<command>systemctl restart
1609 foo.service
</command>. If set to
<option>yes
</option>, then the directories are not removed when the service is
1610 stopped. Note that since the runtime directory
<filename>/run/
</filename> is a mount point of
1611 <literal>tmpfs
</literal>, then for system services the directories specified in
1612 <varname>RuntimeDirectory=
</varname> are removed when the system is rebooted.
</para>
1614 <xi:include href=
"version-info.xml" xpointer=
"v235"/></listitem>
1618 <term><varname>TimeoutCleanSec=
</varname></term>
1619 <listitem><para>Configures a timeout on the clean-up operation requested through
<command>systemctl
1620 clean …
</command>, see
1621 <citerefentry><refentrytitle>systemctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
1622 details. Takes the usual time values and defaults to
<constant>infinity
</constant>, i.e. by default
1623 no timeout is applied. If a timeout is configured the clean operation will be aborted forcibly when
1624 the timeout is reached, potentially leaving resources on disk.
</para>
1626 <xi:include href=
"version-info.xml" xpointer=
"v244"/></listitem>
1630 <term><varname>ReadWritePaths=
</varname></term>
1631 <term><varname>ReadOnlyPaths=
</varname></term>
1632 <term><varname>InaccessiblePaths=
</varname></term>
1633 <term><varname>ExecPaths=
</varname></term>
1634 <term><varname>NoExecPaths=
</varname></term>
1636 <listitem><para>Sets up a new file system namespace for executed processes. These options may be used
1637 to limit access a process has to the file system. Each setting takes a space-separated list of paths
1638 relative to the host's root directory (i.e. the system running the service manager). Note that if
1639 paths contain symlinks, they are resolved relative to the root directory set with
1640 <varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname>.
</para>
1642 <para>Paths listed in
<varname>ReadWritePaths=
</varname> are accessible from within the namespace
1643 with the same access modes as from outside of it. Paths listed in
<varname>ReadOnlyPaths=
</varname>
1644 are accessible for reading only, writing will be refused even if the usual file access controls would
1645 permit this. Nest
<varname>ReadWritePaths=
</varname> inside of
<varname>ReadOnlyPaths=
</varname> in
1646 order to provide writable subdirectories within read-only directories. Use
1647 <varname>ReadWritePaths=
</varname> in order to allow-list specific paths for write access if
1648 <varname>ProtectSystem=strict
</varname> is used. Note that
<varname>ReadWritePaths=
</varname> cannot
1649 be used to gain write access to a file system whose superblock is mounted read-only. On Linux, for
1650 each mount point write access is granted only if the mount point itself
<emphasis>and
</emphasis> the
1651 file system superblock backing it are not marked read-only.
<varname>ReadWritePaths=
</varname> only
1652 controls the former, not the latter, hence a read-only file system superblock remains
1655 <para>Paths listed in
<varname>InaccessiblePaths=
</varname> will be made inaccessible for processes inside
1656 the namespace along with everything below them in the file system hierarchy. This may be more restrictive than
1657 desired, because it is not possible to nest
<varname>ReadWritePaths=
</varname>,
<varname>ReadOnlyPaths=
</varname>,
1658 <varname>BindPaths=
</varname>, or
<varname>BindReadOnlyPaths=
</varname> inside it. For a more flexible option,
1659 see
<varname>TemporaryFileSystem=
</varname>.
</para>
1661 <para>Content in paths listed in
<varname>NoExecPaths=
</varname> are not executable even if the usual
1662 file access controls would permit this. Nest
<varname>ExecPaths=
</varname> inside of
1663 <varname>NoExecPaths=
</varname> in order to provide executable content within non-executable
1666 <para>Non-directory paths may be specified as well. These options may be specified more than once,
1667 in which case all paths listed will have limited access from within the namespace. If the empty string is
1668 assigned to this option, the specific list is reset, and all prior assignments have no effect.
</para>
1670 <para>Paths in
<varname>ReadWritePaths=
</varname>,
<varname>ReadOnlyPaths=
</varname>,
1671 <varname>InaccessiblePaths=
</varname>,
<varname>ExecPaths=
</varname> and
1672 <varname>NoExecPaths=
</varname> may be prefixed with
<literal>-
</literal>, in which case they will be
1673 ignored when they do not exist. If prefixed with
<literal>+
</literal> the paths are taken relative to the root
1674 directory of the unit, as configured with
<varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname>,
1675 instead of relative to the root directory of the host (see above). When combining
<literal>-
</literal> and
1676 <literal>+
</literal> on the same path make sure to specify
<literal>-
</literal> first, and
<literal>+
</literal>
1679 <para>Note that these settings will disconnect propagation of mounts from the unit's processes to the
1680 host. This means that this setting may not be used for services which shall be able to install mount points in
1681 the main mount namespace. For
<varname>ReadWritePaths=
</varname> and
<varname>ReadOnlyPaths=
</varname>,
1682 propagation in the other direction is not affected, i.e. mounts created on the host generally appear in the
1683 unit processes' namespace, and mounts removed on the host also disappear there too. In particular, note that
1684 mount propagation from host to unit will result in unmodified mounts to be created in the unit's namespace,
1685 i.e. writable mounts appearing on the host will be writable in the unit's namespace too, even when propagated
1686 below a path marked with
<varname>ReadOnlyPaths=
</varname>! Restricting access with these options hence does
1687 not extend to submounts of a directory that are created later on. This means the lock-down offered by that
1688 setting is not complete, and does not offer full protection.
</para>
1690 <para>Note that the effect of these settings may be undone by privileged processes. In order to set up an
1691 effective sandboxed environment for a unit it is thus recommended to combine these settings with either
1692 <varname>CapabilityBoundingSet=~CAP_SYS_ADMIN
</varname> or
<varname>SystemCallFilter=~@mount
</varname>.
</para>
1694 <para>Please be extra careful when applying these options to API file systems (a list of them could be
1695 found in
<varname>MountAPIVPS=
</varname>), since they may be required for basic system functionalities.
1696 Moreover,
<filename>/run/
</filename> needs to be writable for setting up mount namespace and propagation.
</para>
1698 <para>Simple allow-list example using these directives:
1699 <programlisting>[Service]
1701 ReadWritePaths=/var /run
1702 InaccessiblePaths=-/lost+found
1704 ExecPaths=/usr/sbin/my_daemon /usr/lib /usr/lib64
1705 </programlisting></para>
1707 <xi:include href=
"system-or-user-ns.xml" xpointer=
"plural"/>
1709 <xi:include href=
"version-info.xml" xpointer=
"v231"/></listitem>
1713 <term><varname>TemporaryFileSystem=
</varname></term>
1715 <listitem><para>Takes a space-separated list of mount points for temporary file systems (tmpfs). If set, a new file
1716 system namespace is set up for executed processes, and a temporary file system is mounted on each mount point.
1717 This option may be specified more than once, in which case temporary file systems are mounted on all listed mount
1718 points. If the empty string is assigned to this option, the list is reset, and all prior assignments have no effect.
1719 Each mount point may optionally be suffixed with a colon (
<literal>:
</literal>) and mount options such as
1720 <literal>size=
10%
</literal> or
<literal>ro
</literal>. By default, each temporary file system is mounted
1721 with
<literal>nodev,strictatime,mode=
0755</literal>. These can be disabled by explicitly specifying the corresponding
1722 mount options, e.g.,
<literal>dev
</literal> or
<literal>nostrictatime
</literal>.
</para>
1724 <para>This is useful to hide files or directories not relevant to the processes invoked by the unit, while necessary
1725 files or directories can be still accessed by combining with
<varname>BindPaths=
</varname> or
1726 <varname>BindReadOnlyPaths=
</varname>:
</para>
1728 <para>Example: if a unit has the following,
1729 <programlisting>TemporaryFileSystem=/var:ro
1730 BindReadOnlyPaths=/var/lib/systemd
</programlisting>
1731 then the invoked processes by the unit cannot see any files or directories under
<filename>/var/
</filename> except for
1732 <filename>/var/lib/systemd
</filename> or its contents.
</para>
1734 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
1736 <xi:include href=
"version-info.xml" xpointer=
"v238"/></listitem>
1740 <term><varname>PrivateTmp=
</varname></term>
1742 <listitem><para>Takes a boolean argument. If true, sets up a new file system namespace for the
1743 executed processes and mounts private
<filename>/tmp/
</filename> and
<filename>/var/tmp/
</filename>
1744 directories inside it that are not shared by processes outside of the namespace. This is useful to
1745 secure access to temporary files of the process, but makes sharing between processes via
1746 <filename>/tmp/
</filename> or
<filename>/var/tmp/
</filename> impossible. If true, all temporary files
1747 created by a service in these directories will be removed after the service is stopped. Defaults to
1748 false. It is possible to run two or more units within the same private
<filename>/tmp/
</filename> and
1749 <filename>/var/tmp/
</filename> namespace by using the
<varname>JoinsNamespaceOf=
</varname> directive,
1750 see
<citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1751 for details. This setting is implied if
<varname>DynamicUser=
</varname> is set. For this setting, the
1752 same restrictions regarding mount propagation and privileges apply as for
1753 <varname>ReadOnlyPaths=
</varname> and related calls, see above. Enabling this setting has the side
1754 effect of adding
<varname>Requires=
</varname> and
<varname>After=
</varname> dependencies on all mount
1755 units necessary to access
<filename>/tmp/
</filename> and
<filename>/var/tmp/
</filename>. Moreover an
1756 implicitly
<varname>After=
</varname> ordering on
1757 <citerefentry><refentrytitle>systemd-tmpfiles-setup.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry>
1760 <para>Note that the implementation of this setting might be impossible (for example if mount namespaces are not
1761 available), and the unit should be written in a way that does not solely rely on this setting for
1764 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/></listitem>
1768 <term><varname>PrivateDevices=
</varname></term>
1770 <listitem><para>Takes a boolean argument. If true, sets up a new
<filename>/dev/
</filename> mount for
1771 the executed processes and only adds API pseudo devices such as
<filename>/dev/null
</filename>,
1772 <filename>/dev/zero
</filename> or
<filename>/dev/random
</filename> (as well as the pseudo TTY
1773 subsystem) to it, but no physical devices such as
<filename>/dev/sda
</filename>, system memory
1774 <filename>/dev/mem
</filename>, system ports
<filename>/dev/port
</filename> and others. This is useful
1775 to turn off physical device access by the executed process. Defaults to false.
</para>
1777 <para>Enabling this option will install a system call filter to block low-level I/O system calls that
1778 are grouped in the
<varname>@raw-io
</varname> set, remove
<constant>CAP_MKNOD
</constant> and
1779 <constant>CAP_SYS_RAWIO
</constant> from the capability bounding set for the unit, and set
1780 <varname>DevicePolicy=closed
</varname> (see
1781 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1782 for details). Note that using this setting will disconnect propagation of mounts from the service to
1783 the host (propagation in the opposite direction continues to work). This means that this setting may
1784 not be used for services which shall be able to install mount points in the main mount namespace. The
1785 new
<filename>/dev/
</filename> will be mounted read-only and 'noexec'. The latter may break old
1786 programs which try to set up executable memory by using
1787 <citerefentry><refentrytitle>mmap
</refentrytitle><manvolnum>2</manvolnum></citerefentry> of
1788 <filename>/dev/zero
</filename> instead of using
<constant>MAP_ANON
</constant>. For this setting the
1789 same restrictions regarding mount propagation and privileges apply as for
1790 <varname>ReadOnlyPaths=
</varname> and related calls, see above.
</para>
1792 <para>Note that the implementation of this setting might be impossible (for example if mount
1793 namespaces are not available), and the unit should be written in a way that does not solely rely on
1794 this setting for security.
</para>
1796 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
1798 <para>When access to some but not all devices must be possible, the
<varname>DeviceAllow=
</varname>
1799 setting might be used instead. See
1800 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
1803 <xi:include href=
"version-info.xml" xpointer=
"v209"/></listitem>
1807 <term><varname>PrivateNetwork=
</varname></term>
1809 <listitem><para>Takes a boolean argument. If true, sets up a new network namespace for the executed processes
1810 and configures only the loopback network device
<literal>lo
</literal> inside it. No other network devices will
1811 be available to the executed process. This is useful to turn off network access by the executed process.
1812 Defaults to false. It is possible to run two or more units within the same private network namespace by using
1813 the
<varname>JoinsNamespaceOf=
</varname> directive, see
1814 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
1815 details. Note that this option will disconnect all socket families from the host, including
1816 <constant>AF_NETLINK
</constant> and
<constant>AF_UNIX
</constant>. Effectively, for
1817 <constant>AF_NETLINK
</constant> this means that device configuration events received from
1818 <citerefentry><refentrytitle>systemd-udevd.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry> are
1819 not delivered to the unit's processes. And for
<constant>AF_UNIX
</constant> this has the effect that
1820 <constant>AF_UNIX
</constant> sockets in the abstract socket namespace of the host will become unavailable to
1821 the unit's processes (however, those located in the file system will continue to be accessible).
</para>
1823 <para>Note that the implementation of this setting might be impossible (for example if network namespaces are
1824 not available), and the unit should be written in a way that does not solely rely on this setting for
1827 <para>When this option is enabled,
<varname>PrivateMounts=
</varname> is implied unless it is
1828 explicitly disabled, and
<filename>/sys
</filename> will be remounted to associate it with the new
1829 network namespace.
</para>
1831 <para>When this option is used on a socket unit any sockets bound on behalf of this unit will be
1832 bound within a private network namespace. This may be combined with
1833 <varname>JoinsNamespaceOf=
</varname> to listen on sockets inside of network namespaces of other
1836 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/></listitem>
1840 <term><varname>NetworkNamespacePath=
</varname></term>
1842 <listitem><para>Takes an absolute file system path referring to a Linux network namespace
1843 pseudo-file (i.e. a file like
<filename>/proc/$PID/ns/net
</filename> or a bind mount or symlink to
1844 one). When set the invoked processes are added to the network namespace referenced by that path. The
1845 path has to point to a valid namespace file at the moment the processes are forked off. If this
1846 option is used
<varname>PrivateNetwork=
</varname> has no effect. If this option is used together with
1847 <varname>JoinsNamespaceOf=
</varname> then it only has an effect if this unit is started before any of
1848 the listed units that have
<varname>PrivateNetwork=
</varname> or
1849 <varname>NetworkNamespacePath=
</varname> configured, as otherwise the network namespace of those
1850 units is reused.
</para>
1852 <para>When this option is enabled,
<varname>PrivateMounts=
</varname> is implied unless it is
1853 explicitly disabled, and
<filename>/sys
</filename> will be remounted to associate it with the new
1854 network namespace.
</para>
1856 <para>When this option is used on a socket unit any sockets bound on behalf of this unit will be
1857 bound within the specified network namespace.
</para>
1859 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
1861 <xi:include href=
"version-info.xml" xpointer=
"v242"/></listitem>
1865 <term><varname>PrivateIPC=
</varname></term>
1867 <listitem><para>Takes a boolean argument. If true, sets up a new IPC namespace for the executed processes.
1868 Each IPC namespace has its own set of System V IPC identifiers and its own POSIX message queue file system.
1869 This is useful to avoid name clash of IPC identifiers. Defaults to false. It is possible to run two or
1870 more units within the same private IPC namespace by using the
<varname>JoinsNamespaceOf=
</varname> directive,
1871 see
<citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
1874 <para>Note that IPC namespacing does not have an effect on
1875 <constant>AF_UNIX
</constant> sockets, which are the most common
1876 form of IPC used on Linux. Instead,
<constant>AF_UNIX
</constant>
1877 sockets in the file system are subject to mount namespacing, and
1878 those in the abstract namespace are subject to network namespacing.
1879 IPC namespacing only has an effect on SysV IPC (which is mostly
1880 legacy) as well as POSIX message queues (for which
1881 <constant>AF_UNIX
</constant>/
<constant>SOCK_SEQPACKET
</constant>
1882 sockets are typically a better replacement). IPC namespacing also
1883 has no effect on POSIX shared memory (which is subject to mount
1884 namespacing) either. See
1885 <citerefentry project='man-pages'
><refentrytitle>ipc_namespaces
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
1888 <para>Note that the implementation of this setting might be impossible (for example if IPC namespaces are
1889 not available), and the unit should be written in a way that does not solely rely on this setting for
1892 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
1894 <xi:include href=
"version-info.xml" xpointer=
"v248"/></listitem>
1898 <term><varname>IPCNamespacePath=
</varname></term>
1900 <listitem><para>Takes an absolute file system path referring to a Linux IPC namespace
1901 pseudo-file (i.e. a file like
<filename>/proc/$PID/ns/ipc
</filename> or a bind mount or symlink to
1902 one). When set the invoked processes are added to the network namespace referenced by that path. The
1903 path has to point to a valid namespace file at the moment the processes are forked off. If this
1904 option is used
<varname>PrivateIPC=
</varname> has no effect. If this option is used together with
1905 <varname>JoinsNamespaceOf=
</varname> then it only has an effect if this unit is started before any of
1906 the listed units that have
<varname>PrivateIPC=
</varname> or
1907 <varname>IPCNamespacePath=
</varname> configured, as otherwise the network namespace of those
1908 units is reused.
</para>
1910 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
1912 <xi:include href=
"version-info.xml" xpointer=
"v248"/></listitem>
1916 <term><varname>MemoryKSM=
</varname></term>
1918 <listitem><para>Takes a boolean argument. When set, it enables KSM (kernel samepage merging) for
1919 the processes. KSM is a memory-saving de-duplication feature. Anonymous memory pages with identical
1920 content can be replaced by a single write-protected page. This feature should only be enabled for
1921 jobs that share the same security domain. For details, see
1922 <ulink url=
"https://docs.kernel.org/admin-guide/mm/ksm.html">Kernel Samepage Merging
</ulink> in the
1923 kernel documentation.
</para>
1925 <para>Note that this functionality might not be available, for example if KSM is disabled in the
1926 kernel, or the kernel doesn't support controlling KSM at the process level through
1927 <citerefentry><refentrytitle>prctl
</refentrytitle><manvolnum>2</manvolnum></citerefentry>.
</para>
1929 <xi:include href=
"version-info.xml" xpointer=
"v254"/>
1934 <term><varname>PrivateUsers=
</varname></term>
1936 <listitem><para>Takes a boolean argument. If true, sets up a new user namespace for the executed processes and
1937 configures a minimal user and group mapping, that maps the
<literal>root
</literal> user and group as well as
1938 the unit's own user and group to themselves and everything else to the
<literal>nobody
</literal> user and
1939 group. This is useful to securely detach the user and group databases used by the unit from the rest of the
1940 system, and thus to create an effective sandbox environment. All files, directories, processes, IPC objects and
1941 other resources owned by users/groups not equaling
<literal>root
</literal> or the unit's own will stay visible
1942 from within the unit but appear owned by the
<literal>nobody
</literal> user and group. If this mode is enabled,
1943 all unit processes are run without privileges in the host user namespace (regardless if the unit's own
1944 user/group is
<literal>root
</literal> or not). Specifically this means that the process will have zero process
1945 capabilities on the host's user namespace, but full capabilities within the service's user namespace. Settings
1946 such as
<varname>CapabilityBoundingSet=
</varname> will affect only the latter, and there's no way to acquire
1947 additional capabilities in the host's user namespace. Defaults to off.
</para>
1949 <para>When this setting is set up by a per-user instance of the service manager, the mapping of the
1950 <literal>root
</literal> user and group to itself is omitted (unless the user manager is root).
1951 Additionally, in the per-user instance manager case, the
1952 user namespace will be set up before most other namespaces. This means that combining
1953 <varname>PrivateUsers=
</varname><option>true
</option> with other namespaces will enable use of features not
1954 normally supported by the per-user instances of the service manager.
</para>
1956 <para>This setting is particularly useful in conjunction with
1957 <varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname>, as the need to synchronize the user and group
1958 databases in the root directory and on the host is reduced, as the only users and groups who need to be matched
1959 are
<literal>root
</literal>,
<literal>nobody
</literal> and the unit's own user and group.
</para>
1961 <para>Note that the implementation of this setting might be impossible (for example if user namespaces are not
1962 available), and the unit should be written in a way that does not solely rely on this setting for
1965 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
1969 <term><varname>ProtectHostname=
</varname></term>
1971 <listitem><para>Takes a boolean argument. When set, sets up a new UTS namespace for the executed
1972 processes. In addition, changing hostname or domainname is prevented. Defaults to off.
</para>
1974 <para>Note that the implementation of this setting might be impossible (for example if UTS namespaces
1975 are not available), and the unit should be written in a way that does not solely rely on this setting
1976 for security.
</para>
1978 <para>Note that when this option is enabled for a service hostname changes no longer propagate from
1979 the system into the service, it is hence not suitable for services that need to take notice of system
1980 hostname changes dynamically.
</para>
1982 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
1984 <xi:include href=
"version-info.xml" xpointer=
"v242"/></listitem>
1988 <term><varname>ProtectClock=
</varname></term>
1990 <listitem><para>Takes a boolean argument. If set, writes to the hardware clock or system clock will
1991 be denied. Defaults to off. Enabling this option removes
<constant>CAP_SYS_TIME
</constant> and
1992 <constant>CAP_WAKE_ALARM
</constant> from the capability bounding set for this unit, installs a system
1993 call filter to block calls that can set the clock, and
<varname>DeviceAllow=char-rtc r
</varname> is
1994 implied. Note that the system calls are blocked altogether, the filter does not take into account
1995 that some of the calls can be used to read the clock state with some parameter combinations.
1996 Effectively,
<filename>/dev/rtc0
</filename>,
<filename>/dev/rtc1
</filename>, etc. are made read-only
1998 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1999 for the details about
<varname>DeviceAllow=
</varname>.
</para>
2001 <para>It is recommended to turn this on for most services that do not need modify the clock or check
2004 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
2006 <xi:include href=
"version-info.xml" xpointer=
"v245"/></listitem>
2010 <term><varname>ProtectKernelTunables=
</varname></term>
2012 <listitem><para>Takes a boolean argument. If true, kernel variables accessible through
2013 <filename>/proc/sys/
</filename>,
<filename>/sys/
</filename>,
<filename>/proc/sysrq-trigger
</filename>,
2014 <filename>/proc/latency_stats
</filename>,
<filename>/proc/acpi
</filename>,
2015 <filename>/proc/timer_stats
</filename>,
<filename>/proc/fs
</filename> and
<filename>/proc/irq
</filename> will
2016 be made read-only to all processes of the unit. Usually, tunable kernel variables should be initialized only at
2017 boot-time, for example with the
2018 <citerefentry><refentrytitle>sysctl.d
</refentrytitle><manvolnum>5</manvolnum></citerefentry> mechanism. Few
2019 services need to write to these at runtime; it is hence recommended to turn this on for most services. For this
2020 setting the same restrictions regarding mount propagation and privileges apply as for
2021 <varname>ReadOnlyPaths=
</varname> and related calls, see above. Defaults to off.
2022 Note that this option does not prevent indirect changes to kernel tunables effected by IPC calls to
2023 other processes. However,
<varname>InaccessiblePaths=
</varname> may be used to make relevant IPC file system
2024 objects inaccessible. If
<varname>ProtectKernelTunables=
</varname> is set,
2025 <varname>MountAPIVFS=yes
</varname> is implied.
</para>
2027 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
2029 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
2033 <term><varname>ProtectKernelModules=
</varname></term>
2035 <listitem><para>Takes a boolean argument. If true, explicit module loading will be denied. This allows
2036 module load and unload operations to be turned off on modular kernels. It is recommended to turn this on for most services
2037 that do not need special file systems or extra kernel modules to work. Defaults to off. Enabling this option
2038 removes
<constant>CAP_SYS_MODULE
</constant> from the capability bounding set for the unit, and installs a
2039 system call filter to block module system calls, also
<filename>/usr/lib/modules
</filename> is made
2040 inaccessible. For this setting the same restrictions regarding mount propagation and privileges apply as for
2041 <varname>ReadOnlyPaths=
</varname> and related calls, see above. Note that limited automatic module loading due
2042 to user configuration or kernel mapping tables might still happen as side effect of requested user operations,
2043 both privileged and unprivileged. To disable module auto-load feature please see
2044 <citerefentry><refentrytitle>sysctl.d
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
2045 <constant>kernel.modules_disabled
</constant> mechanism and
2046 <filename>/proc/sys/kernel/modules_disabled
</filename> documentation.
</para>
2048 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
2050 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
2054 <term><varname>ProtectKernelLogs=
</varname></term>
2056 <listitem><para>Takes a boolean argument. If true, access to the kernel log ring buffer will be denied. It is
2057 recommended to turn this on for most services that do not need to read from or write to the kernel log ring
2058 buffer. Enabling this option removes
<constant>CAP_SYSLOG
</constant> from the capability bounding set for this
2059 unit, and installs a system call filter to block the
2060 <citerefentry project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
2061 system call (not to be confused with the libc API
2062 <citerefentry project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
2063 for userspace logging). The kernel exposes its log buffer to userspace via
<filename>/dev/kmsg
</filename> and
2064 <filename>/proc/kmsg
</filename>. If enabled, these are made inaccessible to all the processes in the unit.
2067 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
2069 <xi:include href=
"version-info.xml" xpointer=
"v244"/></listitem>
2073 <term><varname>ProtectControlGroups=
</varname></term>
2075 <listitem><para>Takes a boolean argument. If true, the Linux Control Groups (
<citerefentry
2076 project='man-pages'
><refentrytitle>cgroups
</refentrytitle><manvolnum>7</manvolnum></citerefentry>) hierarchies
2077 accessible through
<filename>/sys/fs/cgroup/
</filename> will be made read-only to all processes of the
2078 unit. Except for container managers no services should require write access to the control groups hierarchies;
2079 it is hence recommended to turn this on for most services. For this setting the same restrictions regarding
2080 mount propagation and privileges apply as for
<varname>ReadOnlyPaths=
</varname> and related calls, see
2081 above. Defaults to off. If
<varname>ProtectControlGroups=
</varname> is set,
<varname>MountAPIVFS=yes
</varname>
2084 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
2086 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
2090 <term><varname>RestrictAddressFamilies=
</varname></term>
2092 <listitem><para>Restricts the set of socket address families accessible to the processes of this
2093 unit. Takes
<literal>none
</literal>, or a space-separated list of address family names to
2094 allow-list, such as
<constant>AF_UNIX
</constant>,
<constant>AF_INET
</constant> or
2095 <constant>AF_INET6
</constant>. When
<literal>none
</literal> is specified, then all address
2096 families will be denied. When prefixed with
<literal>~
</literal> the listed address
2097 families will be applied as deny list, otherwise as allow list. Note that this restricts access
2099 <citerefentry project='man-pages'
><refentrytitle>socket
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
2100 system call only. Sockets passed into the process by other means (for example, by using socket
2101 activation with socket units, see
2102 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry>)
2103 are unaffected. Also, sockets created with
<function>socketpair()
</function> (which creates connected
2104 AF_UNIX sockets only) are unaffected. Note that this option has no effect on
32-bit x86, s390, s390x,
2105 mips, mips-le, ppc, ppc-le, ppc64, ppc64-le and is ignored (but works correctly on other ABIs,
2106 including x86-
64). Note that on systems supporting multiple ABIs (such as x86/x86-
64) it is
2107 recommended to turn off alternative ABIs for services, so that they cannot be used to circumvent the
2108 restrictions of this option. Specifically, it is recommended to combine this option with
2109 <varname>SystemCallArchitectures=native
</varname> or similar. By default, no restrictions apply, all
2110 address families are accessible to processes. If assigned the empty string, any previous address family
2111 restriction changes are undone. This setting does not affect commands prefixed with
<literal>+
</literal>.
</para>
2113 <para>Use this option to limit exposure of processes to remote access, in particular via exotic and sensitive
2114 network protocols, such as
<constant>AF_PACKET
</constant>. Note that in most cases, the local
2115 <constant>AF_UNIX
</constant> address family should be included in the configured allow list as it is frequently
2116 used for local communication, including for
2117 <citerefentry><refentrytitle>syslog
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
2120 <xi:include href=
"version-info.xml" xpointer=
"v211"/></listitem>
2124 <term><varname>RestrictFileSystems=
</varname></term>
2126 <listitem><para>Restricts the set of filesystems processes of this unit can open files on. Takes a space-separated
2127 list of filesystem names. Any filesystem listed is made accessible to the unit's processes, access to filesystem
2128 types not listed is prohibited (allow-listing). If the first character of the list is
<literal>~
</literal>, the
2129 effect is inverted: access to the filesystems listed is prohibited (deny-listing). If the empty string is assigned,
2130 access to filesystems is not restricted.
</para>
2132 <para>If you specify both types of this option (i.e. allow-listing and deny-listing), the first encountered will take
2133 precedence and will dictate the default action (allow access to the filesystem or deny it). Then the next occurrences
2134 of this option will add or delete the listed filesystems from the set of the restricted filesystems, depending on its
2135 type and the default action.
</para>
2137 <para>Example: if a unit has the following,
2138 <programlisting>RestrictFileSystems=ext4 tmpfs
2139 RestrictFileSystems=ext2 ext4
</programlisting>
2140 then access to
<constant>ext4
</constant>,
<constant>tmpfs
</constant>, and
<constant>ext2
</constant> is allowed
2141 and access to other filesystems is denied.
</para>
2143 <para>Example: if a unit has the following,
2144 <programlisting>RestrictFileSystems=ext4 tmpfs
2145 RestrictFileSystems=~ext4
</programlisting>
2146 then only access
<constant>tmpfs
</constant> is allowed.
</para>
2148 <para>Example: if a unit has the following,
2149 <programlisting>RestrictFileSystems=~ext4 tmpfs
2150 RestrictFileSystems=ext4
</programlisting>
2151 then only access to
<constant>tmpfs
</constant> is denied.
</para>
2153 <para>As the number of possible filesystems is large, predefined sets of filesystems are provided. A set
2154 starts with
<literal>@
</literal> character, followed by name of the set.
</para>
2157 <title>Currently predefined filesystem sets
</title>
2160 <colspec colname='set'
/>
2161 <colspec colname='description'
/>
2165 <entry>Description
</entry>
2170 <entry>@basic-api
</entry>
2171 <entry>Basic filesystem API.
</entry>
2174 <entry>@auxiliary-api
</entry>
2175 <entry>Auxiliary filesystem API.
</entry>
2178 <entry>@common-block
</entry>
2179 <entry>Common block device filesystems.
</entry>
2182 <entry>@historical-block
</entry>
2183 <entry>Historical block device filesystems.
</entry>
2186 <entry>@network
</entry>
2187 <entry>Well-known network filesystems.
</entry>
2190 <entry>@privileged-api
</entry>
2191 <entry>Privileged filesystem API.
</entry>
2194 <entry>@temporary
</entry>
2195 <entry>Temporary filesystems: tmpfs, ramfs.
</entry>
2198 <entry>@known
</entry>
2199 <entry>All known filesystems defined by the kernel. This list is defined statically in systemd based on a kernel version that was available when this systemd version was released. It will become progressively more out-of-date as the kernel is updated.
</entry>
2206 <citerefentry><refentrytitle>systemd-analyze
</refentrytitle><manvolnum>1</manvolnum></citerefentry>'s
2207 <command>filesystems
</command> command to retrieve a list of filesystems defined on the local
2210 <para>Note that this setting might not be supported on some systems (for example if the LSM eBPF hook is
2211 not enabled in the underlying kernel or if not using the unified control group hierarchy). In that case this setting
2212 has no effect.
</para>
2214 <xi:include href=
"cgroup-sandboxing.xml" xpointer=
"singular"/>
2216 <xi:include href=
"version-info.xml" xpointer=
"v250"/></listitem>
2220 <term><varname>RestrictNamespaces=
</varname></term>
2222 <listitem><para>Restricts access to Linux namespace functionality for the processes of this unit. For details
2223 about Linux namespaces, see
<citerefentry
2224 project='man-pages'
><refentrytitle>namespaces
</refentrytitle><manvolnum>7</manvolnum></citerefentry>. Either
2225 takes a boolean argument, or a space-separated list of namespace type identifiers. If false (the default), no
2226 restrictions on namespace creation and switching are made. If true, access to any kind of namespacing is
2227 prohibited. Otherwise, a space-separated list of namespace type identifiers must be specified, consisting of
2228 any combination of:
<constant>cgroup
</constant>,
<constant>ipc
</constant>,
<constant>net
</constant>,
2229 <constant>mnt
</constant>,
<constant>pid
</constant>,
<constant>user
</constant> and
<constant>uts
</constant>. Any
2230 namespace type listed is made accessible to the unit's processes, access to namespace types not listed is
2231 prohibited (allow-listing). By prepending the list with a single tilde character (
<literal>~
</literal>) the
2232 effect may be inverted: only the listed namespace types will be made inaccessible, all unlisted ones are
2233 permitted (deny-listing). If the empty string is assigned, the default namespace restrictions are applied,
2234 which is equivalent to false. This option may appear more than once, in which case the namespace types are
2235 merged by
<constant>OR
</constant>, or by
<constant>AND
</constant> if the lines are prefixed with
2236 <literal>~
</literal> (see examples below). Internally, this setting limits access to the
2237 <citerefentry><refentrytitle>unshare
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
2238 <citerefentry><refentrytitle>clone
</refentrytitle><manvolnum>2</manvolnum></citerefentry> and
2239 <citerefentry><refentrytitle>setns
</refentrytitle><manvolnum>2</manvolnum></citerefentry> system calls, taking
2240 the specified flags parameters into account. Note that — if this option is used — in addition to restricting
2241 creation and switching of the specified types of namespaces (or all of them, if true) access to the
2242 <function>setns()
</function> system call with a zero flags parameter is prohibited. This setting is only
2243 supported on x86, x86-
64, mips, mips-le, mips64, mips64-le, mips64-n32, mips64-le-n32, ppc64, ppc64-le, s390
2244 and s390x, and enforces no restrictions on other architectures.
</para>
2246 <para>Example: if a unit has the following,
2247 <programlisting>RestrictNamespaces=cgroup ipc
2248 RestrictNamespaces=cgroup net
</programlisting>
2249 then
<constant>cgroup
</constant>,
<constant>ipc
</constant>, and
<constant>net
</constant> are set.
2250 If the second line is prefixed with
<literal>~
</literal>, e.g.,
2251 <programlisting>RestrictNamespaces=cgroup ipc
2252 RestrictNamespaces=~cgroup net
</programlisting>
2253 then, only
<constant>ipc
</constant> is set.
</para>
2255 <xi:include href=
"version-info.xml" xpointer=
"v233"/></listitem>
2259 <term><varname>LockPersonality=
</varname></term>
2261 <listitem><para>Takes a boolean argument. If set, locks down the
<citerefentry
2262 project='man-pages'
><refentrytitle>personality
</refentrytitle><manvolnum>2</manvolnum></citerefentry> system
2263 call so that the kernel execution domain may not be changed from the default or the personality selected with
2264 <varname>Personality=
</varname> directive. This may be useful to improve security, because odd personality
2265 emulations may be poorly tested and source of vulnerabilities.
</para>
2267 <xi:include href=
"version-info.xml" xpointer=
"v235"/></listitem>
2271 <term><varname>MemoryDenyWriteExecute=
</varname></term>
2273 <listitem><para>Takes a boolean argument. If set, attempts to create memory mappings that are writable and
2274 executable at the same time, or to change existing memory mappings to become executable, or mapping shared
2275 memory segments as executable, are prohibited. Specifically, a system call filter is added (or
2276 preferably, an equivalent kernel check is enabled with
2277 <citerefentry><refentrytitle>prctl
</refentrytitle><manvolnum>2</manvolnum></citerefentry>) that
2278 rejects
<citerefentry><refentrytitle>mmap
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
2279 system calls with both
<constant>PROT_EXEC
</constant> and
<constant>PROT_WRITE
</constant> set,
2280 <citerefentry><refentrytitle>mprotect
</refentrytitle><manvolnum>2</manvolnum></citerefentry> or
2281 <citerefentry><refentrytitle>pkey_mprotect
</refentrytitle><manvolnum>2</manvolnum></citerefentry> system calls
2282 with
<constant>PROT_EXEC
</constant> set and
2283 <citerefentry><refentrytitle>shmat
</refentrytitle><manvolnum>2</manvolnum></citerefentry> system calls with
2284 <constant>SHM_EXEC
</constant> set. Note that this option is incompatible with programs and libraries that
2285 generate program code dynamically at runtime, including JIT execution engines, executable stacks, and code
2286 "trampoline" feature of various C compilers. This option improves service security, as it makes harder for
2287 software exploits to change running code dynamically. However, the protection can be circumvented, if
2288 the service can write to a filesystem, which is not mounted with
<constant>noexec
</constant> (such as
2289 <filename>/dev/shm
</filename>), or it can use
<function>memfd_create()
</function>. This can be
2290 prevented by making such file systems inaccessible to the service
2291 (e.g.
<varname>InaccessiblePaths=/dev/shm
</varname>) and installing further system call filters
2292 (
<varname>SystemCallFilter=~memfd_create
</varname>). Note that this feature is fully available on
2293 x86-
64, and partially on x86. Specifically, the
<function>shmat()
</function> protection is not
2294 available on x86. Note that on systems supporting multiple ABIs (such as x86/x86-
64) it is
2295 recommended to turn off alternative ABIs for services, so that they cannot be used to circumvent the
2296 restrictions of this option. Specifically, it is recommended to combine this option with
2297 <varname>SystemCallArchitectures=native
</varname> or similar.
</para>
2299 <xi:include href=
"version-info.xml" xpointer=
"v231"/></listitem>
2303 <term><varname>RestrictRealtime=
</varname></term>
2305 <listitem><para>Takes a boolean argument. If set, any attempts to enable realtime scheduling in a process of
2306 the unit are refused. This restricts access to realtime task scheduling policies such as
2307 <constant>SCHED_FIFO
</constant>,
<constant>SCHED_RR
</constant> or
<constant>SCHED_DEADLINE
</constant>. See
2308 <citerefentry project='man-pages'
><refentrytitle>sched
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
2309 for details about these scheduling policies. Realtime scheduling policies may be used to monopolize CPU
2310 time for longer periods of time, and may hence be used to lock up or otherwise trigger Denial-of-Service
2311 situations on the system. It is hence recommended to restrict access to realtime scheduling to the few programs
2312 that actually require them. Defaults to off.
</para>
2314 <xi:include href=
"version-info.xml" xpointer=
"v231"/></listitem>
2318 <term><varname>RestrictSUIDSGID=
</varname></term>
2320 <listitem><para>Takes a boolean argument. If set, any attempts to set the set-user-ID (SUID) or
2321 set-group-ID (SGID) bits on files or directories will be denied (for details on these bits see
2323 project='man-pages'
><refentrytitle>inode
</refentrytitle><manvolnum>7</manvolnum></citerefentry>).
2324 As the SUID/SGID bits are mechanisms to elevate privileges, and allow users to acquire the
2325 identity of other users, it is recommended to restrict creation of SUID/SGID files to the few
2326 programs that actually require them. Note that this restricts marking of any type of file system
2327 object with these bits, including both regular files and directories (where the SGID is a different
2328 meaning than for files, see documentation). This option is implied if
<varname>DynamicUser=
</varname>
2329 is enabled. Defaults to off.
</para>
2331 <xi:include href=
"version-info.xml" xpointer=
"v242"/></listitem>
2335 <term><varname>RemoveIPC=
</varname></term>
2337 <listitem><para>Takes a boolean parameter. If set, all System V and POSIX IPC objects owned by the user and
2338 group the processes of this unit are run as are removed when the unit is stopped. This setting only has an
2339 effect if at least one of
<varname>User=
</varname>,
<varname>Group=
</varname> and
2340 <varname>DynamicUser=
</varname> are used. It has no effect on IPC objects owned by the root user. Specifically,
2341 this removes System V semaphores, as well as System V and POSIX shared memory segments and message queues. If
2342 multiple units use the same user or group the IPC objects are removed when the last of these units is
2343 stopped. This setting is implied if
<varname>DynamicUser=
</varname> is set.
</para>
2345 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
2347 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
2351 <term><varname>PrivateMounts=
</varname></term>
2353 <listitem><para>Takes a boolean parameter. If set, the processes of this unit will be run in their own private
2354 file system (mount) namespace with all mount propagation from the processes towards the host's main file system
2355 namespace turned off. This means any file system mount points established or removed by the unit's processes
2356 will be private to them and not be visible to the host. However, file system mount points established or
2357 removed on the host will be propagated to the unit's processes. See
<citerefentry
2358 project='man-pages'
><refentrytitle>mount_namespaces
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
2359 details on file system namespaces. Defaults to off.
</para>
2361 <para>When turned on, this executes three operations for each invoked process: a new
2362 <constant>CLONE_NEWNS
</constant> namespace is created, after which all existing mounts are remounted to
2363 <constant>MS_SLAVE
</constant> to disable propagation from the unit's processes to the host (but leaving
2364 propagation in the opposite direction in effect). Finally, the mounts are remounted again to the propagation
2365 mode configured with
<varname>MountFlags=
</varname>, see below.
</para>
2367 <para>File system namespaces are set up individually for each process forked off by the service manager. Mounts
2368 established in the namespace of the process created by
<varname>ExecStartPre=
</varname> will hence be cleaned
2369 up automatically as soon as that process exits and will not be available to subsequent processes forked off for
2370 <varname>ExecStart=
</varname> (and similar applies to the various other commands configured for
2371 units). Similarly,
<varname>JoinsNamespaceOf=
</varname> does not permit sharing kernel mount namespaces between
2372 units, it only enables sharing of the
<filename>/tmp/
</filename> and
<filename>/var/tmp/
</filename>
2375 <para>Other file system namespace unit settings —
<varname>PrivateTmp=
</varname>,
2376 <varname>PrivateDevices=
</varname>,
<varname>ProtectSystem=
</varname>,
2377 <varname>ProtectHome=
</varname>,
<varname>ReadOnlyPaths=
</varname>,
2378 <varname>InaccessiblePaths=
</varname>,
<varname>ReadWritePaths=
</varname>,
2379 <varname>BindPaths=
</varname>,
<varname>BindReadOnlyPaths=
</varname>, … — also enable file system
2380 namespacing in a fashion equivalent to this option. Hence it is primarily useful to explicitly
2381 request this behaviour if none of the other settings are used.
</para>
2383 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/>
2385 <xi:include href=
"version-info.xml" xpointer=
"v239"/></listitem>
2389 <term><varname>MountFlags=
</varname></term>
2391 <listitem><para>Takes a mount propagation setting:
<option>shared
</option>,
<option>slave
</option> or
2392 <option>private
</option>, which controls whether file system mount points in the file system namespaces set up
2393 for this unit's processes will receive or propagate mounts and unmounts from other file system namespaces. See
2394 <citerefentry project='man-pages'
><refentrytitle>mount
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
2395 for details on mount propagation, and the three propagation flags in particular.
</para>
2397 <para>This setting only controls the
<emphasis>final
</emphasis> propagation setting in effect on all mount
2398 points of the file system namespace created for each process of this unit. Other file system namespacing unit
2399 settings (see the discussion in
<varname>PrivateMounts=
</varname> above) will implicitly disable mount and
2400 unmount propagation from the unit's processes towards the host by changing the propagation setting of all mount
2401 points in the unit's file system namespace to
<option>slave
</option> first. Setting this option to
2402 <option>shared
</option> does not reestablish propagation in that case.
</para>
2404 <para>If not set – but file system namespaces are enabled through another file system namespace unit setting –
2405 <option>shared
</option> mount propagation is used, but — as mentioned — as
<option>slave
</option> is applied
2406 first, propagation from the unit's processes to the host is still turned off.
</para>
2408 <para>It is not recommended to use
<option>private
</option> mount propagation for units, as this means
2409 temporary mounts (such as removable media) of the host will stay mounted and thus indefinitely busy in forked
2410 off processes, as unmount propagation events won't be received by the file system namespace of the unit.
</para>
2412 <para>Usually, it is best to leave this setting unmodified, and use higher level file system namespacing
2413 options instead, in particular
<varname>PrivateMounts=
</varname>, see above.
</para>
2415 <xi:include href=
"system-or-user-ns.xml" xpointer=
"singular"/></listitem>
2422 <title>System Call Filtering
</title>
2423 <variablelist class='unit-directives'
>
2426 <term><varname>SystemCallFilter=
</varname></term>
2428 <listitem><para>Takes a space-separated list of system call names. If this setting is used, all
2429 system calls executed by the unit processes except for the listed ones will result in immediate
2430 process termination with the
<constant>SIGSYS
</constant> signal (allow-listing). (See
2431 <varname>SystemCallErrorNumber=
</varname> below for changing the default action). If the first
2432 character of the list is
<literal>~
</literal>, the effect is inverted: only the listed system calls
2433 will result in immediate process termination (deny-listing). Deny-listed system calls and system call
2434 groups may optionally be suffixed with a colon (
<literal>:
</literal>) and
<literal>errno
</literal>
2435 error number (between
0 and
4095) or errno name such as
<constant>EPERM
</constant>,
2436 <constant>EACCES
</constant> or
<constant>EUCLEAN
</constant> (see
<citerefentry
2437 project='man-pages'
><refentrytitle>errno
</refentrytitle><manvolnum>3</manvolnum></citerefentry> for a
2438 full list). This value will be returned when a deny-listed system call is triggered, instead of
2439 terminating the processes immediately. Special setting
<literal>kill
</literal> can be used to
2440 explicitly specify killing. This value takes precedence over the one given in
2441 <varname>SystemCallErrorNumber=
</varname>, see below. This feature makes use of the Secure Computing Mode
2
2442 interfaces of the kernel ('seccomp filtering') and is useful for enforcing a minimal sandboxing environment.
2443 Note that the
<function>execve()
</function>,
<function>exit()
</function>,
<function>exit_group()
</function>,
2444 <function>getrlimit()
</function>,
<function>rt_sigreturn()
</function>,
<function>sigreturn()
</function>
2445 system calls and the system calls for querying time and sleeping are implicitly allow-listed and do not
2446 need to be listed explicitly. This option may be specified more than once, in which case the filter masks are
2447 merged. If the empty string is assigned, the filter is reset, all prior assignments will have no
2448 effect. This does not affect commands prefixed with
<literal>+
</literal>.
</para>
2450 <para>Note that on systems supporting multiple ABIs (such as x86/x86-
64) it is recommended to turn off
2451 alternative ABIs for services, so that they cannot be used to circumvent the restrictions of this
2452 option. Specifically, it is recommended to combine this option with
2453 <varname>SystemCallArchitectures=native
</varname> or similar.
</para>
2455 <para>Note that strict system call filters may impact execution and error handling code paths of the service
2456 invocation. Specifically, access to the
<function>execve()
</function> system call is required for the execution
2457 of the service binary — if it is blocked service invocation will necessarily fail. Also, if execution of the
2458 service binary fails for some reason (for example: missing service executable), the error handling logic might
2459 require access to an additional set of system calls in order to process and log this failure correctly. It
2460 might be necessary to temporarily disable system call filters in order to simplify debugging of such
2463 <para>If you specify both types of this option (i.e. allow-listing and deny-listing), the first
2464 encountered will take precedence and will dictate the default action (termination or approval of a
2465 system call). Then the next occurrences of this option will add or delete the listed system calls
2466 from the set of the filtered system calls, depending of its type and the default action. (For
2467 example, if you have started with an allow list rule for
<function>read()
</function> and
2468 <function>write()
</function>, and right after it add a deny list rule for
<function>write()
</function>,
2469 then
<function>write()
</function> will be removed from the set.)
</para>
2471 <para>As the number of possible system calls is large, predefined sets of system calls are provided. A set
2472 starts with
<literal>@
</literal> character, followed by name of the set.
2475 <title>Currently predefined system call sets
</title>
2478 <colspec colname='set'
/>
2479 <colspec colname='description'
/>
2483 <entry>Description
</entry>
2489 <entry>Asynchronous I/O (
<citerefentry project='man-pages'
><refentrytitle>io_setup
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>io_submit
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)
</entry>
2492 <entry>@basic-io
</entry>
2493 <entry>System calls for basic I/O: reading, writing, seeking, file descriptor duplication and closing (
<citerefentry project='man-pages'
><refentrytitle>read
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>write
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)
</entry>
2496 <entry>@chown
</entry>
2497 <entry>Changing file ownership (
<citerefentry project='man-pages'
><refentrytitle>chown
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>fchownat
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)
</entry>
2500 <entry>@clock
</entry>
2501 <entry>System calls for changing the system clock (
<citerefentry project='man-pages'
><refentrytitle>adjtimex
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>settimeofday
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)
</entry>
2504 <entry>@cpu-emulation
</entry>
2505 <entry>System calls for CPU emulation functionality (
<citerefentry project='man-pages'
><refentrytitle>vm86
</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)
</entry>
2508 <entry>@debug
</entry>
2509 <entry>Debugging, performance monitoring and tracing functionality (
<citerefentry project='man-pages'
><refentrytitle>ptrace
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>perf_event_open
</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)
</entry>
2512 <entry>@file-system
</entry>
2513 <entry>File system operations: opening, creating files and directories for read and write, renaming and removing them, reading file properties, or creating hard and symbolic links
</entry>
2516 <entry>@io-event
</entry>
2517 <entry>Event loop system calls (
<citerefentry project='man-pages'
><refentrytitle>poll
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>select
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>epoll
</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>eventfd
</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)
</entry>
2521 <entry>Pipes, SysV IPC, POSIX Message Queues and other IPC (
<citerefentry project='man-pages'
><refentrytitle>mq_overview
</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>svipc
</refentrytitle><manvolnum>7</manvolnum></citerefentry>)
</entry>
2524 <entry>@keyring
</entry>
2525 <entry>Kernel keyring access (
<citerefentry project='man-pages'
><refentrytitle>keyctl
</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)
</entry>
2528 <entry>@memlock
</entry>
2529 <entry>Locking of memory in RAM (
<citerefentry project='man-pages'
><refentrytitle>mlock
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>mlockall
</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)
</entry>
2532 <entry>@module
</entry>
2533 <entry>Loading and unloading of kernel modules (
<citerefentry project='man-pages'
><refentrytitle>init_module
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>delete_module
</refentrytitle><manvolnum>2</manvolnum></citerefentry> and related calls)
</entry>
2536 <entry>@mount
</entry>
2537 <entry>Mounting and unmounting of file systems (
<citerefentry project='man-pages'
><refentrytitle>mount
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>chroot
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)
</entry>
2540 <entry>@network-io
</entry>
2541 <entry>Socket I/O (including local AF_UNIX):
<citerefentry project='man-pages'
><refentrytitle>socket
</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>unix
</refentrytitle><manvolnum>7</manvolnum></citerefentry></entry>
2544 <entry>@obsolete
</entry>
2545 <entry>Unusual, obsolete or unimplemented (
<citerefentry project='man-pages'
><refentrytitle>create_module
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>gtty
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, …)
</entry>
2548 <entry>@pkey
</entry>
2549 <entry>System calls that deal with memory protection keys (
<citerefentry project='man-pages'
><refentrytitle>pkeys
</refentrytitle><manvolnum>7</manvolnum></citerefentry>)
</entry>
2552 <entry>@privileged
</entry>
2553 <entry>All system calls which need super-user capabilities (
<citerefentry project='man-pages'
><refentrytitle>capabilities
</refentrytitle><manvolnum>7</manvolnum></citerefentry>)
</entry>
2556 <entry>@process
</entry>
2557 <entry>Process control, execution, namespacing operations (
<citerefentry project='man-pages'
><refentrytitle>clone
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>kill
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>namespaces
</refentrytitle><manvolnum>7</manvolnum></citerefentry>, …)
</entry>
2560 <entry>@raw-io
</entry>
2561 <entry>Raw I/O port access (
<citerefentry project='man-pages'
><refentrytitle>ioperm
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>iopl
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<function>pciconfig_read()
</function>, …)
</entry>
2564 <entry>@reboot
</entry>
2565 <entry>System calls for rebooting and reboot preparation (
<citerefentry project='man-pages'
><refentrytitle>reboot
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<function>kexec()
</function>, …)
</entry>
2568 <entry>@resources
</entry>
2569 <entry>System calls for changing resource limits, memory and scheduling parameters (
<citerefentry project='man-pages'
><refentrytitle>setrlimit
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>setpriority
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, …)
</entry>
2572 <entry>@sandbox
</entry>
2573 <entry>System calls for sandboxing programs (
<citerefentry project='man-pages'
><refentrytitle>seccomp
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, Landlock system calls, …)
</entry>
2576 <entry>@setuid
</entry>
2577 <entry>System calls for changing user ID and group ID credentials, (
<citerefentry project='man-pages'
><refentrytitle>setuid
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>setgid
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>setresuid
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, …)
</entry>
2580 <entry>@signal
</entry>
2581 <entry>System calls for manipulating and handling process signals (
<citerefentry project='man-pages'
><refentrytitle>signal
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>sigprocmask
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, …)
</entry>
2584 <entry>@swap
</entry>
2585 <entry>System calls for enabling/disabling swap devices (
<citerefentry project='man-pages'
><refentrytitle>swapon
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>swapoff
</refentrytitle><manvolnum>2</manvolnum></citerefentry>)
</entry>
2588 <entry>@sync
</entry>
2589 <entry>Synchronizing files and memory to disk (
<citerefentry project='man-pages'
><refentrytitle>fsync
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>msync
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, and related calls)
</entry>
2592 <entry>@system-service
</entry>
2593 <entry>A reasonable set of system calls used by common system services, excluding any special purpose calls. This is the recommended starting point for allow-listing system calls for system services, as it contains what is typically needed by system services, but excludes overly specific interfaces. For example, the following APIs are excluded:
<literal>@clock
</literal>,
<literal>@mount
</literal>,
<literal>@swap
</literal>,
<literal>@reboot
</literal>.
</entry>
2596 <entry>@timer
</entry>
2597 <entry>System calls for scheduling operations by time (
<citerefentry project='man-pages'
><refentrytitle>alarm
</refentrytitle><manvolnum>2</manvolnum></citerefentry>,
<citerefentry project='man-pages'
><refentrytitle>timer_create
</refentrytitle><manvolnum>2</manvolnum></citerefentry>, …)
</entry>
2600 <entry>@known
</entry>
2601 <entry>All system calls defined by the kernel. This list is defined statically in systemd based on a kernel version that was available when this systemd version was released. It will become progressively more out-of-date as the kernel is updated.
</entry>
2607 Note, that as new system calls are added to the kernel, additional system calls might be added to the groups
2608 above. Contents of the sets may also change between systemd versions. In addition, the list of system calls
2609 depends on the kernel version and architecture for which systemd was compiled. Use
2610 <command>systemd-analyze syscall-filter
</command> to list the actual list of system calls in each
2613 <para>Generally, allow-listing system calls (rather than deny-listing) is the safer mode of
2614 operation. It is recommended to enforce system call allow lists for all long-running system
2615 services. Specifically, the following lines are a relatively safe basic choice for the majority of
2616 system services:
</para>
2618 <programlisting>[Service]
2619 SystemCallFilter=@system-service
2620 SystemCallErrorNumber=EPERM
</programlisting>
2622 <para>Note that various kernel system calls are defined redundantly: there are multiple system calls
2623 for executing the same operation. For example, the
<function>pidfd_send_signal()
</function> system
2624 call may be used to execute operations similar to what can be done with the older
2625 <function>kill()
</function> system call, hence blocking the latter without the former only provides
2626 weak protection. Since new system calls are added regularly to the kernel as development progresses,
2627 keeping system call deny lists comprehensive requires constant work. It is thus recommended to use
2628 allow-listing instead, which offers the benefit that new system calls are by default implicitly
2629 blocked until the allow list is updated.
</para>
2631 <para>Also note that a number of system calls are required to be accessible for the dynamic linker to
2632 work. The dynamic linker is required for running most regular programs (specifically: all dynamic ELF
2633 binaries, which is how most distributions build packaged programs). This means that blocking these
2634 system calls (which include
<function>open()
</function>,
<function>openat()
</function> or
2635 <function>mmap()
</function>) will make most programs typically shipped with generic distributions
2638 <para>It is recommended to combine the file system namespacing related options with
2639 <varname>SystemCallFilter=~@mount
</varname>, in order to prohibit the unit's processes to undo the
2640 mappings. Specifically these are the options
<varname>PrivateTmp=
</varname>,
2641 <varname>PrivateDevices=
</varname>,
<varname>ProtectSystem=
</varname>,
<varname>ProtectHome=
</varname>,
2642 <varname>ProtectKernelTunables=
</varname>,
<varname>ProtectControlGroups=
</varname>,
2643 <varname>ProtectKernelLogs=
</varname>,
<varname>ProtectClock=
</varname>,
<varname>ReadOnlyPaths=
</varname>,
2644 <varname>InaccessiblePaths=
</varname> and
<varname>ReadWritePaths=
</varname>.
</para>
2646 <xi:include href=
"version-info.xml" xpointer=
"v187"/></listitem>
2650 <term><varname>SystemCallErrorNumber=
</varname></term>
2652 <listitem><para>Takes an
<literal>errno
</literal> error number (between
1 and
4095) or errno name
2653 such as
<constant>EPERM
</constant>,
<constant>EACCES
</constant> or
<constant>EUCLEAN
</constant>, to
2654 return when the system call filter configured with
<varname>SystemCallFilter=
</varname> is triggered,
2655 instead of terminating the process immediately. See
<citerefentry
2656 project='man-pages'
><refentrytitle>errno
</refentrytitle><manvolnum>3</manvolnum></citerefentry> for a
2657 full list of error codes. When this setting is not used, or when the empty string or the special
2658 setting
<literal>kill
</literal> is assigned, the process will be terminated immediately when the
2659 filter is triggered.
</para>
2661 <xi:include href=
"version-info.xml" xpointer=
"v209"/></listitem>
2665 <term><varname>SystemCallArchitectures=
</varname></term>
2667 <listitem><para>Takes a space-separated list of architecture identifiers to include in the system call
2668 filter. The known architecture identifiers are the same as for
<varname>ConditionArchitecture=
</varname>
2669 described in
<citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
2670 as well as
<constant>x32
</constant>,
<constant>mips64-n32
</constant>,
<constant>mips64-le-n32
</constant>, and
2671 the special identifier
<constant>native
</constant>. The special identifier
<constant>native
</constant>
2672 implicitly maps to the native architecture of the system (or more precisely: to the architecture the system
2673 manager is compiled for). By default, this option is set to the empty list, i.e. no filtering is applied.
</para>
2675 <para>If this setting is used, processes of this unit will only be permitted to call native system calls, and
2676 system calls of the specified architectures. For the purposes of this option, the x32 architecture is treated
2677 as including x86-
64 system calls. However, this setting still fulfills its purpose, as explained below, on
2680 <para>System call filtering is not equally effective on all architectures. For example, on x86
2681 filtering of network socket-related calls is not possible, due to ABI limitations — a limitation that x86-
64
2682 does not have, however. On systems supporting multiple ABIs at the same time — such as x86/x86-
64 — it is hence
2683 recommended to limit the set of permitted system call architectures so that secondary ABIs may not be used to
2684 circumvent the restrictions applied to the native ABI of the system. In particular, setting
2685 <varname>SystemCallArchitectures=native
</varname> is a good choice for disabling non-native ABIs.
</para>
2687 <para>System call architectures may also be restricted system-wide via the
2688 <varname>SystemCallArchitectures=
</varname> option in the global configuration. See
2689 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
2692 <xi:include href=
"version-info.xml" xpointer=
"v209"/></listitem>
2696 <term><varname>SystemCallLog=
</varname></term>
2698 <listitem><para>Takes a space-separated list of system call names. If this setting is used, all
2699 system calls executed by the unit processes for the listed ones will be logged. If the first
2700 character of the list is
<literal>~
</literal>, the effect is inverted: all system calls except the
2701 listed system calls will be logged. This feature makes use of the Secure Computing Mode
2 interfaces
2702 of the kernel ('seccomp filtering') and is useful for auditing or setting up a minimal sandboxing
2703 environment. This option may be specified more than once, in which case the filter masks are merged.
2704 If the empty string is assigned, the filter is reset, all prior assignments will have no effect.
2705 This does not affect commands prefixed with
<literal>+
</literal>.
</para>
2707 <xi:include href=
"version-info.xml" xpointer=
"v247"/></listitem>
2714 <title>Environment
</title>
2716 <variablelist class='unit-directives'
>
2719 <term><varname>Environment=
</varname></term>
2721 <listitem><para>Sets environment variables for executed processes. Each line is unquoted using the
2722 rules described in
"Quoting" section in
2723 <citerefentry><refentrytitle>systemd.syntax
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
2724 and becomes a list of variable assignments. If you need to assign a value containing spaces or the
2725 equals sign to a variable, put quotes around the whole assignment. Variable expansion is not
2726 performed inside the strings and the
<literal>$
</literal> character has no special meaning. Specifier
2727 expansion is performed, see the
"Specifiers" section in
2728 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
2731 <para>This option may be specified more than once, in which case all listed variables will be set. If
2732 the same variable is listed twice, the later setting will override the earlier setting. If the empty
2733 string is assigned to this option, the list of environment variables is reset, all prior assignments
2734 have no effect.
</para>
2736 <para>The names of the variables can contain ASCII letters, digits, and the underscore character.
2737 Variable names cannot be empty or start with a digit. In variable values, most characters are
2738 allowed, but non-printable characters are currently rejected.
</para>
2741 <programlisting>Environment=
"VAR1=word1 word2" VAR2=word3
"VAR3=$word 5 6"</programlisting>
2742 gives three variables
<literal>VAR1
</literal>,
2743 <literal>VAR2
</literal>,
<literal>VAR3
</literal>
2744 with the values
<literal>word1 word2
</literal>,
2745 <literal>word3
</literal>,
<literal>$word
5 6</literal>.
2748 <para>See
<citerefentry
2749 project='man-pages'
><refentrytitle>environ
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
2750 details about environment variables.
</para>
2752 <para>Note that environment variables are not suitable for passing secrets (such as passwords, key
2753 material, …) to service processes. Environment variables set for a unit are exposed to unprivileged
2754 clients via D-Bus IPC, and generally not understood as being data that requires protection. Moreover,
2755 environment variables are propagated down the process tree, including across security boundaries
2756 (such as setuid/setgid executables), and hence might leak to processes that should not have access to
2757 the secret data. Use
<varname>LoadCredential=
</varname>,
<varname>LoadCredentialEncrypted=
</varname>
2758 or
<varname>SetCredentialEncrypted=
</varname> (see below) to pass data to unit processes
2759 securely.
</para></listitem>
2763 <term><varname>EnvironmentFile=
</varname></term>
2765 <listitem><para>Similar to
<varname>Environment=
</varname>, but reads the environment variables from
2766 a text file. The text file should contain newline-separated variable assignments. Empty lines, lines
2767 without an
<literal>=
</literal> separator, or lines starting with
<literal>;
</literal> or
2768 <literal>#
</literal> will be ignored, which may be used for commenting. The file must be encoded with
2769 UTF-
8. Valid characters are
2770 <ulink url=
"https://www.unicode.org/glossary/#unicode_scalar_value">unicode scalar values
</ulink>
2772 <ulink url=
"https://www.unicode.org/glossary/#noncharacter">unicode noncharacters
</ulink>,
2773 <constant>U+
0000</constant> <constant>NUL
</constant>, and
<constant>U+FEFF
</constant>
2774 <ulink url=
"https://www.unicode.org/glossary/#byte_order_mark">unicode byte order mark
</ulink>.
2775 Control codes other than
<constant>NUL
</constant> are allowed.
</para>
2777 <para>In the file, an unquoted value after the
<literal>=
</literal> is parsed with the same backslash-escape
2779 url=
"https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_02_01">POSIX shell unquoted
2780 text
</ulink>, but unlike in a shell, interior whitespace is preserved and quotes after the
2781 first non-whitespace character are preserved. Leading and trailing whitespace (space, tab, carriage return) is
2782 discarded, but interior whitespace within the line is preserved verbatim. A line ending with a backslash will be
2783 continued to the following one, with the newline itself discarded. A backslash
2784 <literal>\
</literal> followed by any character other than newline will preserve the following character, so that
2785 <literal>\\
</literal> will become the value
<literal>\
</literal>.
</para>
2787 <para>In the file, a
<literal>'
</literal>-quoted value after the
<literal>=
</literal> can span
2788 multiple lines and contain any character verbatim other than single quote, like
<ulink
2789 url=
"https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_02_02">POSIX
2790 shell single-quoted text
</ulink>. No backslash-escape sequences are recognized. Leading and trailing
2791 whitespace outside of the single quotes is discarded.
</para>
2793 <para>In the file, a
<literal>"</literal>-quoted value after the <literal>=</literal> can span
2794 multiple lines, and the same escape sequences are recognized as in <ulink
2795 url="https://pubs.opengroup.org/onlinepubs/
9699919799/utilities/V3_chap02.html#tag_18_02_03
">POSIX
2796 shell double-quoted text</ulink>. Backslash (<literal>\</literal>) followed by any of
2797 <literal>"\`$
</literal> will preserve that character. A backslash followed by newline is a line
2798 continuation, and the newline itself is discarded. A backslash followed by any other character is
2799 ignored; both the backslash and the following character are preserved verbatim. Leading and trailing
2800 whitespace outside of the double quotes is discarded.
</para>
2802 <para>The argument passed should be an absolute filename or wildcard expression, optionally prefixed with
2803 <literal>-
</literal>, which indicates that if the file does not exist, it will not be read and no error or
2804 warning message is logged. This option may be specified more than once in which case all specified files are
2805 read. If the empty string is assigned to this option, the list of file to read is reset, all prior assignments
2806 have no effect.
</para>
2808 <para>The files listed with this directive will be read shortly before the process is executed (more
2809 specifically, after all processes from a previous unit state terminated. This means you can generate these
2810 files in one unit state, and read it with this option in the next. The files are read from the file
2811 system of the service manager, before any file system changes like bind mounts take place).
</para>
2813 <para>Settings from these files override settings made with
<varname>Environment=
</varname>. If the same
2814 variable is set twice from these files, the files will be read in the order they are specified and the later
2815 setting will override the earlier setting.
</para></listitem>
2819 <term><varname>PassEnvironment=
</varname></term>
2821 <listitem><para>Pass environment variables set for the system service manager to executed processes. Takes a
2822 space-separated list of variable names. This option may be specified more than once, in which case all listed
2823 variables will be passed. If the empty string is assigned to this option, the list of environment variables to
2824 pass is reset, all prior assignments have no effect. Variables specified that are not set for the system
2825 manager will not be passed and will be silently ignored. Note that this option is only relevant for the system
2826 service manager, as system services by default do not automatically inherit any environment variables set for
2827 the service manager itself. However, in case of the user service manager all environment variables are passed
2828 to the executed processes anyway, hence this option is without effect for the user service manager.
</para>
2830 <para>Variables set for invoked processes due to this setting are subject to being overridden by those
2831 configured with
<varname>Environment=
</varname> or
<varname>EnvironmentFile=
</varname>.
</para>
2834 <programlisting>PassEnvironment=VAR1 VAR2 VAR3
</programlisting>
2835 passes three variables
<literal>VAR1
</literal>,
2836 <literal>VAR2
</literal>,
<literal>VAR3
</literal>
2837 with the values set for those variables in PID1.
</para>
2841 project='man-pages'
><refentrytitle>environ
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for details
2842 about environment variables.
</para>
2844 <xi:include href=
"version-info.xml" xpointer=
"v228"/></listitem>
2848 <term><varname>UnsetEnvironment=
</varname></term>
2850 <listitem><para>Explicitly unset environment variable assignments that would normally be passed from the
2851 service manager to invoked processes of this unit. Takes a space-separated list of variable names or variable
2852 assignments. This option may be specified more than once, in which case all listed variables/assignments will
2853 be unset. If the empty string is assigned to this option, the list of environment variables/assignments to
2854 unset is reset. If a variable assignment is specified (that is: a variable name, followed by
2855 <literal>=
</literal>, followed by its value), then any environment variable matching this precise assignment is
2856 removed. If a variable name is specified (that is a variable name without any following
<literal>=
</literal> or
2857 value), then any assignment matching the variable name, regardless of its value is removed. Note that the
2858 effect of
<varname>UnsetEnvironment=
</varname> is applied as final step when the environment list passed to
2859 executed processes is compiled. That means it may undo assignments from any configuration source, including
2860 assignments made through
<varname>Environment=
</varname> or
<varname>EnvironmentFile=
</varname>, inherited from
2861 the system manager's global set of environment variables, inherited via
<varname>PassEnvironment=
</varname>,
2862 set by the service manager itself (such as
<varname>$NOTIFY_SOCKET
</varname> and such), or set by a PAM module
2863 (in case
<varname>PAMName=
</varname> is used).
</para>
2865 <para>See
"Environment Variables in Spawned Processes" below for a description of how those
2866 settings combine to form the inherited environment. See
<citerefentry
2867 project='man-pages'
><refentrytitle>environ
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for general
2868 information about environment variables.
</para>
2870 <xi:include href=
"version-info.xml" xpointer=
"v235"/></listitem>
2877 <title>Logging and Standard Input/Output
</title>
2879 <variablelist class='unit-directives'
>
2882 <term><varname>StandardInput=
</varname></term>
2884 <listitem><para>Controls where file descriptor
0 (STDIN) of the executed processes is connected to. Takes one
2885 of
<option>null
</option>,
<option>tty
</option>,
<option>tty-force
</option>,
<option>tty-fail
</option>,
2886 <option>data
</option>,
<option>file:
<replaceable>path
</replaceable></option>,
<option>socket
</option> or
2887 <option>fd:
<replaceable>name
</replaceable></option>.
</para>
2889 <para>If
<option>null
</option> is selected, standard input will be connected to
<filename>/dev/null
</filename>,
2890 i.e. all read attempts by the process will result in immediate EOF.
</para>
2892 <para>If
<option>tty
</option> is selected, standard input is connected to a TTY (as configured by
2893 <varname>TTYPath=
</varname>, see below) and the executed process becomes the controlling process of the
2894 terminal. If the terminal is already being controlled by another process, the executed process waits until the
2895 current controlling process releases the terminal.
</para>
2897 <para><option>tty-force
</option> is similar to
<option>tty
</option>, but the executed process is forcefully and
2898 immediately made the controlling process of the terminal, potentially removing previous controlling processes
2899 from the terminal.
</para>
2901 <para><option>tty-fail
</option> is similar to
<option>tty
</option>, but if the terminal already has a
2902 controlling process start-up of the executed process fails.
</para>
2904 <para>The
<option>data
</option> option may be used to configure arbitrary textual or binary data to pass via
2905 standard input to the executed process. The data to pass is configured via
2906 <varname>StandardInputText=
</varname>/
<varname>StandardInputData=
</varname> (see below). Note that the actual
2907 file descriptor type passed (memory file, regular file, UNIX pipe, …) might depend on the kernel and available
2908 privileges. In any case, the file descriptor is read-only, and when read returns the specified data followed by
2911 <para>The
<option>file:
<replaceable>path
</replaceable></option> option may be used to connect a specific file
2912 system object to standard input. An absolute path following the
<literal>:
</literal> character is expected,
2913 which may refer to a regular file, a FIFO or special file. If an
<constant>AF_UNIX
</constant> socket in the
2914 file system is specified, a stream socket is connected to it. The latter is useful for connecting standard
2915 input of processes to arbitrary system services.
</para>
2917 <para>The
<option>socket
</option> option is valid in socket-activated services only, and requires the relevant
2918 socket unit file (see
2919 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details)
2920 to have
<varname>Accept=yes
</varname> set, or to specify a single socket only. If this option is set, standard
2921 input will be connected to the socket the service was activated from, which is primarily useful for
2922 compatibility with daemons designed for use with the traditional
<citerefentry
2923 project='freebsd'
><refentrytitle>inetd
</refentrytitle><manvolnum>8</manvolnum></citerefentry> socket activation
2924 daemon (
<varname>$LISTEN_FDS
</varname> (and related) environment variables are not passed when
2925 <option>socket
</option> value is configured).
</para>
2927 <para>The
<option>fd:
<replaceable>name
</replaceable></option> option connects standard input to a specific,
2928 named file descriptor provided by a socket unit. The name may be specified as part of this option, following a
2929 <literal>:
</literal> character (e.g.
<literal>fd:foobar
</literal>). If no name is specified, the name
2930 <literal>stdin
</literal> is implied (i.e.
<literal>fd
</literal> is equivalent to
<literal>fd:stdin
</literal>).
2931 At least one socket unit defining the specified name must be provided via the
<varname>Sockets=
</varname>
2932 option, and the file descriptor name may differ from the name of its containing socket unit. If multiple
2933 matches are found, the first one will be used. See
<varname>FileDescriptorName=
</varname> in
2934 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry> for more
2935 details about named file descriptors and their ordering.
</para>
2937 <para>This setting defaults to
<option>null
</option>, unless
2938 <varname>StandardInputText=
</varname>/
<varname>StandardInputData=
</varname> are set, in which case it
2939 defaults to
<option>data
</option>.
</para></listitem>
2943 <term><varname>StandardOutput=
</varname></term>
2945 <listitem><para>Controls where file descriptor
1 (stdout) of the executed processes is connected
2946 to. Takes one of
<option>inherit
</option>,
<option>null
</option>,
<option>tty
</option>,
2947 <option>journal
</option>,
<option>kmsg
</option>,
<option>journal+console
</option>,
2948 <option>kmsg+console
</option>,
<option>file:
<replaceable>path
</replaceable></option>,
2949 <option>append:
<replaceable>path
</replaceable></option>,
<option>truncate:
<replaceable>path
</replaceable></option>,
2950 <option>socket
</option> or
<option>fd:
<replaceable>name
</replaceable></option>.
</para>
2952 <para><option>inherit
</option> duplicates the file descriptor of standard input for standard output.
</para>
2954 <para><option>null
</option> connects standard output to
<filename>/dev/null
</filename>, i.e. everything written
2955 to it will be lost.
</para>
2957 <para><option>tty
</option> connects standard output to a tty (as configured via
<varname>TTYPath=
</varname>,
2958 see below). If the TTY is used for output only, the executed process will not become the controlling process of
2959 the terminal, and will not fail or wait for other processes to release the terminal.
</para>
2961 <para><option>journal
</option> connects standard output with the journal, which is accessible via
2962 <citerefentry><refentrytitle>journalctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry>. Note
2963 that everything that is written to kmsg (see below) is implicitly stored in the journal as well, the
2964 specific option listed below is hence a superset of this one. (Also note that any external,
2965 additional syslog daemons receive their log data from the journal, too, hence this is the option to
2966 use when logging shall be processed with such a daemon.)
</para>
2968 <para><option>kmsg
</option> connects standard output with the kernel log buffer which is accessible via
2969 <citerefentry project='man-pages'
><refentrytitle>dmesg
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
2970 in addition to the journal. The journal daemon might be configured to send all logs to kmsg anyway, in which
2971 case this option is no different from
<option>journal
</option>.
</para>
2973 <para><option>journal+console
</option> and
<option>kmsg+console
</option> work in a similar way as the
2974 two options above but copy the output to the system console as well.
</para>
2976 <para>The
<option>file:
<replaceable>path
</replaceable></option> option may be used to connect a specific file
2977 system object to standard output. The semantics are similar to the same option of
2978 <varname>StandardInput=
</varname>, see above. If
<replaceable>path
</replaceable> refers to a regular file
2979 on the filesystem, it is opened (created if it doesn't exist yet) for writing at the beginning of the file,
2980 but without truncating it.
2981 If standard input and output are directed to the same file path, it is opened only once — for reading as well
2982 as writing — and duplicated. This is particularly useful when the specified path refers to an
2983 <constant>AF_UNIX
</constant> socket in the file system, as in that case only a
2984 single stream connection is created for both input and output.
</para>
2986 <para><option>append:
<replaceable>path
</replaceable></option> is similar to
2987 <option>file:
<replaceable>path
</replaceable></option> above, but it opens the file in append mode.
2990 <para><option>truncate:
<replaceable>path
</replaceable></option> is similar to
2991 <option>file:
<replaceable>path
</replaceable></option> above, but it truncates the file when opening
2992 it. For units with multiple command lines, e.g.
<varname>Type=oneshot
</varname> services with
2993 multiple
<varname>ExecStart=
</varname>, or services with
<varname>ExecCondition=
</varname>,
2994 <varname>ExecStartPre=
</varname> or
<varname>ExecStartPost=
</varname>, the output file is reopened
2995 and therefore re-truncated for each command line. If the output file is truncated while another
2996 process still has the file open, e.g. by an
<varname>ExecReload=
</varname> running concurrently with
2997 an
<varname>ExecStart=
</varname>, and the other process continues writing to the file without
2998 adjusting its offset, then the space between the file pointers of the two processes may be filled
2999 with
<constant>NUL
</constant> bytes, producing a sparse file. Thus,
3000 <option>truncate:
<replaceable>path
</replaceable></option> is typically only useful for units where
3001 only one process runs at a time, such as services with a single
<varname>ExecStart=
</varname> and no
3002 <varname>ExecStartPost=
</varname>,
<varname>ExecReload=
</varname>,
<varname>ExecStop=
</varname> or
3005 <para><option>socket
</option> connects standard output to a socket acquired via socket activation. The
3006 semantics are similar to the same option of
<varname>StandardInput=
</varname>, see above.
</para>
3008 <para>The
<option>fd:
<replaceable>name
</replaceable></option> option connects standard output to a
3009 specific, named file descriptor provided by a socket unit. A name may be specified as part of this
3010 option, following a
<literal>:
</literal> character
3011 (e.g.
<literal>fd:
<replaceable>foobar
</replaceable></literal>). If no name is specified, the name
3012 <literal>stdout
</literal> is implied (i.e.
<literal>fd
</literal> is equivalent to
3013 <literal>fd:stdout
</literal>). At least one socket unit defining the specified name must be provided
3014 via the
<varname>Sockets=
</varname> option, and the file descriptor name may differ from the name of
3015 its containing socket unit. If multiple matches are found, the first one will be used. See
3016 <varname>FileDescriptorName=
</varname> in
3017 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
3018 for more details about named descriptors and their ordering.
</para>
3020 <para>If the standard output (or error output, see below) of a unit is connected to the journal or
3021 the kernel log buffer, the unit will implicitly gain a dependency of type
<varname>After=
</varname>
3022 on
<filename>systemd-journald.socket
</filename> (also see the
"Implicit Dependencies" section
3023 above). Also note that in this case stdout (or stderr, see below) will be an
3024 <constant>AF_UNIX
</constant> stream socket, and not a pipe or FIFO that can be reopened. This means
3025 when executing shell scripts the construct
<command>echo
"hello" > /dev/stderr
</command> for
3026 writing text to stderr will not work. To mitigate this use the construct
<command>echo
"hello"
3027 >&2</command> instead, which is mostly equivalent and avoids this pitfall.
</para>
3029 <para>If
<varname>StandardInput=
</varname> is set to one of
<option>tty
</option>,
<option>tty-force
</option>,
3030 <option>tty-fail
</option>,
<option>socket
</option>, or
<option>fd:
<replaceable>name
</replaceable></option>, this
3031 setting defaults to
<option>inherit
</option>.
</para>
3033 <para>In other cases, this setting defaults to the value set with
<varname>DefaultStandardOutput=
</varname> in
3034 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>, which
3035 defaults to
<option>journal
</option>. Note that setting this parameter might result in additional dependencies
3036 to be added to the unit (see above).
</para></listitem>
3040 <term><varname>StandardError=
</varname></term>
3042 <listitem><para>Controls where file descriptor
2 (stderr) of the executed processes is connected to. The
3043 available options are identical to those of
<varname>StandardOutput=
</varname>, with some exceptions: if set to
3044 <option>inherit
</option> the file descriptor used for standard output is duplicated for standard error, while
3045 <option>fd:
<replaceable>name
</replaceable></option> will use a default file descriptor name of
3046 <literal>stderr
</literal>.
</para>
3048 <para>This setting defaults to the value set with
<varname>DefaultStandardError=
</varname> in
3049 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>, which
3050 defaults to
<option>inherit
</option>. Note that setting this parameter might result in additional dependencies
3051 to be added to the unit (see above).
</para></listitem>
3055 <term><varname>StandardInputText=
</varname></term>
3056 <term><varname>StandardInputData=
</varname></term>
3058 <listitem><para>Configures arbitrary textual or binary data to pass via file descriptor
0 (STDIN) to
3059 the executed processes. These settings have no effect unless
<varname>StandardInput=
</varname> is set
3060 to
<option>data
</option> (which is the default if
<varname>StandardInput=
</varname> is not set
3061 otherwise, but
<varname>StandardInputText=
</varname>/
<varname>StandardInputData=
</varname> is). Use
3062 this option to embed process input data directly in the unit file.
</para>
3064 <para><varname>StandardInputText=
</varname> accepts arbitrary textual data. C-style escapes for special
3065 characters as well as the usual
<literal>%
</literal>-specifiers are resolved. Each time this setting is used
3066 the specified text is appended to the per-unit data buffer, followed by a newline character (thus every use
3067 appends a new line to the end of the buffer). Note that leading and trailing whitespace of lines configured
3068 with this option is removed. If an empty line is specified the buffer is cleared (hence, in order to insert an
3069 empty line, add an additional
<literal>\n
</literal> to the end or beginning of a line).
</para>
3071 <para><varname>StandardInputData=
</varname> accepts arbitrary binary data, encoded in
<ulink
3072 url=
"https://tools.ietf.org/html/rfc2045#section-6.8">Base64
</ulink>. No escape sequences or specifiers are
3073 resolved. Any whitespace in the encoded version is ignored during decoding.
</para>
3075 <para>Note that
<varname>StandardInputText=
</varname> and
<varname>StandardInputData=
</varname> operate on the
3076 same data buffer, and may be mixed in order to configure both binary and textual data for the same input
3077 stream. The textual or binary data is joined strictly in the order the settings appear in the unit
3078 file. Assigning an empty string to either will reset the data buffer.
</para>
3080 <para>Please keep in mind that in order to maintain readability long unit file settings may be split into
3081 multiple lines, by suffixing each line (except for the last) with a
<literal>\
</literal> character (see
3082 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
3083 details). This is particularly useful for large data configured with these two options. Example:
</para>
3087 StandardInputData=V2XigLJyZSBubyBzdHJhbmdlcnMgdG8gbG92ZQpZb3Uga25vdyB0aGUgcnVsZXMgYW5kIHNvIGRv \
3088 IEkKQSBmdWxsIGNvbW1pdG1lbnQncyB3aGF0IEnigLJtIHRoaW5raW5nIG9mCllvdSB3b3VsZG4n \
3089 dCBnZXQgdGhpcyBmcm9tIGFueSBvdGhlciBndXkKSSBqdXN0IHdhbm5hIHRlbGwgeW91IGhvdyBJ \
3090 J20gZmVlbGluZwpHb3R0YSBtYWtlIHlvdSB1bmRlcnN0YW5kCgpOZXZlciBnb25uYSBnaXZlIHlv \
3091 dSB1cApOZXZlciBnb25uYSBsZXQgeW91IGRvd24KTmV2ZXIgZ29ubmEgcnVuIGFyb3VuZCBhbmQg \
3092 ZGVzZXJ0IHlvdQpOZXZlciBnb25uYSBtYWtlIHlvdSBjcnkKTmV2ZXIgZ29ubmEgc2F5IGdvb2Ri \
3093 eWUKTmV2ZXIgZ29ubmEgdGVsbCBhIGxpZSBhbmQgaHVydCB5b3UK
3094 …
</programlisting>
3096 <xi:include href=
"version-info.xml" xpointer=
"v236"/></listitem>
3100 <term><varname>LogLevelMax=
</varname></term>
3102 <listitem><para>Configures filtering by log level of log messages generated by this unit. Takes a
3103 <command>syslog
</command> log level, one of
<option>emerg
</option> (lowest log level, only highest priority
3104 messages),
<option>alert
</option>,
<option>crit
</option>,
<option>err
</option>,
<option>warning
</option>,
3105 <option>notice
</option>,
<option>info
</option>,
<option>debug
</option> (highest log level, also lowest priority
3106 messages). See
<citerefentry
3107 project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>3</manvolnum></citerefentry> for
3108 details. By default no filtering is applied (i.e. the default maximum log level is
<option>debug
</option>). Use
3109 this option to configure the logging system to drop log messages of a specific service above the specified
3110 level. For example, set
<varname>LogLevelMax=
</varname><option>info
</option> in order to turn off debug logging
3111 of a particularly chatty unit. Note that the configured level is applied to any log messages written by any
3112 of the processes belonging to this unit, as well as any log messages written by the system manager process
3113 (PID
1) in reference to this unit, sent via any supported logging protocol. The filtering is applied
3114 early in the logging pipeline, before any kind of further processing is done. Moreover, messages which pass
3115 through this filter successfully might still be dropped by filters applied at a later stage in the logging
3116 subsystem. For example,
<varname>MaxLevelStore=
</varname> configured in
3117 <citerefentry><refentrytitle>journald.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry> might
3118 prohibit messages of higher log levels to be stored on disk, even though the per-unit
3119 <varname>LogLevelMax=
</varname> permitted it to be processed.
</para>
3121 <xi:include href=
"version-info.xml" xpointer=
"v236"/></listitem>
3125 <term><varname>LogExtraFields=
</varname></term>
3127 <listitem><para>Configures additional log metadata fields to include in all log records generated by
3128 processes associated with this unit, including systemd. This setting takes one or more journal field
3129 assignments in the format
<literal>FIELD=VALUE
</literal> separated by whitespace. See
3130 <citerefentry><refentrytitle>systemd.journal-fields
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
3131 for details on the journal field concept. Even though the underlying journal implementation permits
3132 binary field values, this setting accepts only valid UTF-
8 values. To include space characters in a
3133 journal field value, enclose the assignment in double quotes (
"). <!-- " fake closing quote for emacs-->
3134 The usual specifiers are expanded in all assignments (see below). Note that this setting is not only
3135 useful for attaching additional metadata to log records of a unit, but given that all fields and
3136 values are indexed may also be used to implement cross-unit log record matching. Assign an empty
3137 string to reset the list.
</para>
3139 <para>Note that this functionality is currently only available in system services, not in per-user
3142 <xi:include href=
"version-info.xml" xpointer=
"v236"/></listitem>
3146 <term><varname>LogRateLimitIntervalSec=
</varname></term>
3147 <term><varname>LogRateLimitBurst=
</varname></term>
3149 <listitem><para>Configures the rate limiting that is applied to log messages generated by this unit.
3150 If, in the time interval defined by
<varname>LogRateLimitIntervalSec=
</varname>, more messages than
3151 specified in
<varname>LogRateLimitBurst=
</varname> are logged by a service, all further messages
3152 within the interval are dropped until the interval is over. A message about the number of dropped
3153 messages is generated. The time specification for
<varname>LogRateLimitIntervalSec=
</varname> may be
3154 specified in the following units:
"s",
"min",
"h",
"ms",
"us". See
3155 <citerefentry><refentrytitle>systemd.time
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
3156 details. The default settings are set by
<varname>RateLimitIntervalSec=
</varname> and
3157 <varname>RateLimitBurst=
</varname> configured in
3158 <citerefentry><refentrytitle>journald.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
3159 Note that this only applies to log messages that are processed by the logging subsystem, i.e. by
3160 <citerefentry><refentrytitle>systemd-journald.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
3161 This means that if you connect a service's stderr directly to a file via
3162 <varname>StandardOutput=file:…
</varname> or a similar setting, the rate limiting will not be applied
3163 to messages written that way (but it will be enforced for messages generated via
3164 <citerefentry project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
3165 and similar functions).
</para>
3167 <xi:include href=
"version-info.xml" xpointer=
"v240"/></listitem>
3171 <term><varname>LogFilterPatterns=
</varname></term>
3173 <listitem><para>Define an extended regular expression to filter log messages based on the
3174 <varname>MESSAGE=
</varname> field of the structured message. If the first character of the pattern is
3175 <literal>~
</literal>, log entries matching the pattern should be discarded. This option takes a single
3176 pattern as an argument but can be used multiple times to create a list of allowed and denied patterns.
3177 If the empty string is assigned, the filter is reset, and all prior assignments will have no effect.
</para>
3179 <para>Because the
<literal>~
</literal> character is used to define denied patterns, it must be replaced
3180 with
<literal>\x7e
</literal> to allow a message starting with
<literal>~
</literal>. For example,
3181 <literal>~foobar
</literal> would add a pattern matching
<literal>foobar
</literal> to the deny list, while
3182 <literal>\x7efoobar
</literal> would add a pattern matching
<literal>~foobar
</literal> to the allow list.
</para>
3184 <para>Log messages are tested against denied patterns (if any), then against allowed patterns
3185 (if any). If a log message matches any of the denied patterns, it is discarded immediately without considering
3186 allowed patterns. Remaining log messages are tested against allowed patterns. Messages matching
3187 against none of the allowed pattern are discarded. If no allowed patterns are defined, then all
3188 messages are processed directly after going through denied filters.
</para>
3190 <para>Filtering is based on the unit for which
<varname>LogFilterPatterns=
</varname> is defined, meaning log
3191 messages coming from
3192 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry> about the
3193 unit are not taken into account. Filtered log messages won't be forwarded to traditional syslog daemons,
3194 the kernel log buffer (kmsg), the systemd console, or sent as wall messages to all logged-in
3197 <para>Note that this functionality is currently only available in system services, not in per-user
3200 <xi:include href=
"version-info.xml" xpointer=
"v253"/></listitem>
3204 <term><varname>LogNamespace=
</varname></term>
3206 <listitem><para>Run the unit's processes in the specified journal namespace. Expects a short
3207 user-defined string identifying the namespace. If not used the processes of the service are run in
3208 the default journal namespace, i.e. their log stream is collected and processed by
3209 <filename>systemd-journald.service
</filename>. If this option is used any log data generated by
3210 processes of this unit (regardless if via the
<function>syslog()
</function>, journal native logging
3211 or stdout/stderr logging) is collected and processed by an instance of the
3212 <filename>systemd-journald@.service
</filename> template unit, which manages the specified
3213 namespace. The log data is stored in a data store independent from the default log namespace's data
3215 <citerefentry><refentrytitle>systemd-journald.service
</refentrytitle><manvolnum>8</manvolnum></citerefentry>
3216 for details about journal namespaces.
</para>
3218 <para>Internally, journal namespaces are implemented through Linux mount namespacing and
3219 over-mounting the directory that contains the relevant
<constant>AF_UNIX
</constant> sockets used for
3220 logging in the unit's mount namespace. Since mount namespaces are used this setting disconnects
3221 propagation of mounts from the unit's processes to the host, similarly to how
3222 <varname>ReadOnlyPaths=
</varname> and similar settings describe above work. Journal namespaces may hence
3223 not be used for services that need to establish mount points on the host.
</para>
3225 <para>When this option is used the unit will automatically gain ordering and requirement dependencies
3226 on the two socket units associated with the
<filename>systemd-journald@.service
</filename> instance
3227 so that they are automatically established prior to the unit starting up. Note that when this option
3228 is used log output of this service does not appear in the regular
3229 <citerefentry><refentrytitle>journalctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry>
3230 output, unless the
<option>--namespace=
</option> option is used.
</para>
3232 <xi:include href=
"system-only.xml" xpointer=
"singular"/>
3234 <xi:include href=
"version-info.xml" xpointer=
"v245"/></listitem>
3238 <term><varname>SyslogIdentifier=
</varname></term>
3240 <listitem><para>Sets the process name (
"<command>syslog</command> tag") to prefix log lines sent to
3241 the logging system or the kernel log buffer with. If not set, defaults to the process name of the
3242 executed process. This option is only useful when
<varname>StandardOutput=
</varname> or
3243 <varname>StandardError=
</varname> are set to
<option>journal
</option> or
<option>kmsg
</option> (or to
3244 the same settings in combination with
<option>+console
</option>) and only applies to log messages
3245 written to stdout or stderr.
</para></listitem>
3249 <term><varname>SyslogFacility=
</varname></term>
3251 <listitem><para>Sets the
<command>syslog
</command> facility identifier to use when logging. One of
3252 <option>kern
</option>,
<option>user
</option>,
<option>mail
</option>,
<option>daemon
</option>,
3253 <option>auth
</option>,
<option>syslog
</option>,
<option>lpr
</option>,
<option>news
</option>,
3254 <option>uucp
</option>,
<option>cron
</option>,
<option>authpriv
</option>,
<option>ftp
</option>,
3255 <option>local0
</option>,
<option>local1
</option>,
<option>local2
</option>,
<option>local3
</option>,
3256 <option>local4
</option>,
<option>local5
</option>,
<option>local6
</option> or
3257 <option>local7
</option>. See
<citerefentry
3258 project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>3</manvolnum></citerefentry> for
3259 details. This option is only useful when
<varname>StandardOutput=
</varname> or
3260 <varname>StandardError=
</varname> are set to
<option>journal
</option> or
<option>kmsg
</option> (or to
3261 the same settings in combination with
<option>+console
</option>), and only applies to log messages
3262 written to stdout or stderr. Defaults to
<option>daemon
</option>.
</para></listitem>
3266 <term><varname>SyslogLevel=
</varname></term>
3268 <listitem><para>The default
<command>syslog
</command> log level to use when logging to the logging system or
3269 the kernel log buffer. One of
<option>emerg
</option>,
<option>alert
</option>,
<option>crit
</option>,
3270 <option>err
</option>,
<option>warning
</option>,
<option>notice
</option>,
<option>info
</option>,
3271 <option>debug
</option>. See
<citerefentry
3272 project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>3</manvolnum></citerefentry> for
3273 details. This option is only useful when
<varname>StandardOutput=
</varname> or
3274 <varname>StandardError=
</varname> are set to
<option>journal
</option> or
3275 <option>kmsg
</option> (or to the same settings in combination with
<option>+console
</option>), and only applies
3276 to log messages written to stdout or stderr. Note that individual lines output by executed processes may be
3277 prefixed with a different log level which can be used to override the default log level specified here. The
3278 interpretation of these prefixes may be disabled with
<varname>SyslogLevelPrefix=
</varname>, see below. For
3279 details, see
<citerefentry><refentrytitle>sd-daemon
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
3280 Defaults to
<option>info
</option>.
</para></listitem>
3284 <term><varname>SyslogLevelPrefix=
</varname></term>
3286 <listitem><para>Takes a boolean argument. If true and
<varname>StandardOutput=
</varname> or
3287 <varname>StandardError=
</varname> are set to
<option>journal
</option> or
<option>kmsg
</option> (or to
3288 the same settings in combination with
<option>+console
</option>), log lines written by the executed
3289 process that are prefixed with a log level will be processed with this log level set but the prefix
3290 removed. If set to false, the interpretation of these prefixes is disabled and the logged lines are
3291 passed on as-is. This only applies to log messages written to stdout or stderr. For details about
3293 <citerefentry><refentrytitle>sd-daemon
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
3294 Defaults to true.
</para></listitem>
3298 <term><varname>TTYPath=
</varname></term>
3300 <listitem><para>Sets the terminal device node to use if standard input, output, or error are connected to a TTY
3301 (see above). Defaults to
<filename>/dev/console
</filename>.
</para></listitem>
3305 <term><varname>TTYReset=
</varname></term>
3307 <listitem><para>Reset the terminal device specified with
<varname>TTYPath=
</varname> before and after
3308 execution. Defaults to
<literal>no
</literal>.
</para></listitem>
3312 <term><varname>TTYVHangup=
</varname></term>
3314 <listitem><para>Disconnect all clients which have opened the terminal device specified with
3315 <varname>TTYPath=
</varname> before and after execution. Defaults to
<literal>no
</literal>.
</para></listitem>
3319 <term><varname>TTYRows=
</varname></term>
3320 <term><varname>TTYColumns=
</varname></term>
3322 <listitem><para>Configure the size of the TTY specified with
<varname>TTYPath=
</varname>. If unset or
3323 set to the empty string, the kernel default is used.
</para>
3325 <xi:include href=
"version-info.xml" xpointer=
"v250"/></listitem>
3329 <term><varname>TTYVTDisallocate=
</varname></term>
3331 <listitem><para>If the terminal device specified with
<varname>TTYPath=
</varname> is a virtual console
3332 terminal, try to deallocate the TTY before and after execution. This ensures that the screen and scrollback
3333 buffer is cleared. Defaults to
<literal>no
</literal>.
</para></listitem>
3339 <title>Credentials
</title>
3341 <variablelist class='unit-directives'
>
3344 <term><varname>LoadCredential=
</varname><replaceable>ID
</replaceable><optional>:
<replaceable>PATH
</replaceable></optional></term>
3345 <term><varname>LoadCredentialEncrypted=
</varname><replaceable>ID
</replaceable><optional>:
<replaceable>PATH
</replaceable></optional></term>
3347 <listitem><para>Pass a credential to the unit. Credentials are limited-size binary or textual objects
3348 that may be passed to unit processes. They are primarily used for passing cryptographic keys (both
3349 public and private) or certificates, user account information or identity information from host to
3350 services. The data is accessible from the unit's processes via the file system, at a read-only
3351 location that (if possible and permitted) is backed by non-swappable memory. The data is only
3352 accessible to the user associated with the unit, via the
3353 <varname>User=
</varname>/
<varname>DynamicUser=
</varname> settings (as well as the superuser). When
3354 available, the location of credentials is exported as the
<varname>$CREDENTIALS_DIRECTORY
</varname>
3355 environment variable to the unit's processes.
</para>
3357 <para>The
<varname>LoadCredential=
</varname> setting takes a textual ID to use as name for a
3358 credential plus a file system path, separated by a colon. The ID must be a short ASCII string
3359 suitable as filename in the filesystem, and may be chosen freely by the user. If the specified path
3360 is absolute it is opened as regular file and the credential data is read from it. If the absolute
3361 path refers to an
<constant>AF_UNIX
</constant> stream socket in the file system a connection is made
3362 to it (only once at unit start-up) and the credential data read from the connection, providing an
3363 easy IPC integration point for dynamically transferring credentials from other services.
</para>
3365 <para>If the specified path is not absolute and itself qualifies as valid credential identifier it is
3366 attempted to find a credential that the service manager itself received under the specified name —
3367 which may be used to propagate credentials from an invoking environment (e.g. a container manager
3368 that invoked the service manager) into a service. If no matching system credential is found, the
3369 directories
<filename>/etc/credstore/
</filename>,
<filename>/run/credstore/
</filename> and
3370 <filename>/usr/lib/credstore/
</filename> are searched for files under the credential's name — which
3371 hence are recommended locations for credential data on disk. If
3372 <varname>LoadCredentialEncrypted=
</varname> is used
<filename>/run/credstore.encrypted/
</filename>,
3373 <filename>/etc/credstore.encrypted/
</filename>, and
3374 <filename>/usr/lib/credstore.encrypted/
</filename> are searched as well.
</para>
3376 <para>If the file system path is omitted it is chosen identical to the credential name, i.e. this is
3377 a terse way to declare credentials to inherit from the service manager into a service. This option
3378 may be used multiple times, each time defining an additional credential to pass to the unit.
</para>
3380 <para>If an absolute path referring to a directory is specified, every file in that directory
3381 (recursively) will be loaded as a separate credential. The ID for each credential will be the
3382 provided ID suffixed with
<literal>_$FILENAME
</literal> (e.g.,
<literal>Key_file1
</literal>). When
3383 loading from a directory, symlinks will be ignored.
</para>
3385 <para>The contents of the file/socket may be arbitrary binary or textual data, including newline
3386 characters and
<constant>NUL
</constant> bytes.
</para>
3388 <para>The
<varname>LoadCredentialEncrypted=
</varname> setting is identical to
3389 <varname>LoadCredential=
</varname>, except that the credential data is decrypted and authenticated
3390 before being passed on to the executed processes. Specifically, the referenced path should refer to a
3391 file or socket with an encrypted credential, as implemented by
3392 <citerefentry><refentrytitle>systemd-creds
</refentrytitle><manvolnum>1</manvolnum></citerefentry>. This
3393 credential is loaded, decrypted, authenticated and then passed to the application in plaintext form,
3394 in the same way a regular credential specified via
<varname>LoadCredential=
</varname> would be. A
3395 credential configured this way may be symmetrically encrypted/authenticated with a secret key derived
3396 from the system's TPM2 security chip, or with a secret key stored in
3397 <filename>/var/lib/systemd/credentials.secret
</filename>, or with both. Using encrypted and
3398 authenticated credentials improves security as credentials are not stored in plaintext and only
3399 authenticated and decrypted into plaintext the moment a service requiring them is started. Moreover,
3400 credentials may be bound to the local hardware and installations, so that they cannot easily be
3401 analyzed offline, or be generated externally. When
<varname>DevicePolicy=
</varname> is set to
3402 <literal>closed
</literal> or
<literal>strict
</literal>, or set to
<literal>auto
</literal> and
3403 <varname>DeviceAllow=
</varname> is set, or
<varname>PrivateDevices=
</varname> is set, then this
3404 setting adds
<filename>/dev/tpmrm0
</filename> with
<constant>rw
</constant> mode to
3405 <varname>DeviceAllow=
</varname>. See
3406 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
3407 for the details about
<varname>DevicePolicy=
</varname> or
<varname>DeviceAllow=
</varname>.
</para>
3409 <para>Note that encrypted credentials targeted for services of the per-user service manager must be
3410 encrypted with
<command>systemd-creds encrypt --user
</command>, and those for the system service
3411 manager without the
<option>--user
</option> switch. Encrypted credentials are always targeted to a
3412 specific user or the system as a whole, and it is ensured that per-user service managers cannot
3413 decrypt secrets intended for the system or for other users.
</para>
3415 <para>The credential files/IPC sockets must be accessible to the service manager, but don't have to
3416 be directly accessible to the unit's processes: the credential data is read and copied into separate,
3417 read-only copies for the unit that are accessible to appropriately privileged processes. This is
3418 particularly useful in combination with
<varname>DynamicUser=
</varname> as this way privileged data
3419 can be made available to processes running under a dynamic UID (i.e. not a previously known one)
3420 without having to open up access to all users.
</para>
3422 <para>In order to reference the path a credential may be read from within a
3423 <varname>ExecStart=
</varname> command line use
<literal>${CREDENTIALS_DIRECTORY}/mycred
</literal>,
3424 e.g.
<literal>ExecStart=cat ${CREDENTIALS_DIRECTORY}/mycred
</literal>. In order to reference the path
3425 a credential may be read from within a
<varname>Environment=
</varname> line use
3426 <literal>%d/mycred
</literal>, e.g.
<literal>Environment=MYCREDPATH=%d/mycred
</literal>. For system
3427 services the path may also be referenced as
3428 <literal>/run/credentials/
<replaceable>UNITNAME
</replaceable></literal> in cases where no
3429 interpolation is possible, e.g. configuration files of software that does not yet support credentials
3430 natively.
<varname>$CREDENTIALS_DIRECTORY
</varname> is considered the primary interface to look for
3431 credentials, though, since it also works for user services.
</para>
3433 <para>Currently, an accumulated credential size limit of
1 MB per unit is enforced.
</para>
3435 <para>The service manager itself may receive system credentials that can be propagated to services
3436 from a hosting container manager or VM hypervisor. See the
<ulink
3437 url=
"https://systemd.io/CONTAINER_INTERFACE">Container Interface
</ulink> documentation for details
3438 about the former. For the latter, pass
<ulink
3439 url=
"https://www.dmtf.org/standards/smbios">DMI/SMBIOS
</ulink> OEM string table entries (field type
3440 11) with a prefix of
<literal>io.systemd.credential:
</literal> or
3441 <literal>io.systemd.credential.binary:
</literal>. In both cases a key/value pair separated by
3442 <literal>=
</literal> is expected, in the latter case the right-hand side is Base64 decoded when
3443 parsed (thus permitting binary data to be passed in). Example
<ulink
3444 url=
"https://www.qemu.org/docs/master/system/index.html">qemu
</ulink> switch:
<literal>-smbios
3445 type=
11,value=io.systemd.credential:xx=yy
</literal>, or
<literal>-smbios
3446 type=
11,value=io.systemd.credential.binary:rick=TmV2ZXIgR29ubmEgR2l2ZSBZb3UgVXA=
</literal>. Alternatively,
3447 use the
<command>qemu
</command> <literal>fw_cfg
</literal> node
3448 <literal>opt/io.systemd.credentials/
</literal>. Example
<command>qemu
</command> switch:
3449 <literal>-fw_cfg name=opt/io.systemd.credentials/mycred,string=supersecret
</literal>. They may also
3450 be passed from the UEFI firmware environment via
3451 <citerefentry><refentrytitle>systemd-stub
</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
3452 from the initrd (see
3453 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry>), or be
3454 specified on the kernel command line using the
<literal>systemd.set_credential=
</literal> and
3455 <literal>systemd.set_credential_binary=
</literal> switches (see
3456 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry> – this is
3457 not recommended since unprivileged userspace can read the kernel command line).
</para>
3459 <para>If referencing an
<constant>AF_UNIX
</constant> stream socket to connect to, the connection will
3460 originate from an abstract namespace socket, that includes information about the unit and the
3461 credential ID in its socket name. Use
<citerefentry
3462 project='man-pages'
><refentrytitle>getpeername
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
3463 to query this information. The returned socket name is formatted as
<constant>NUL
</constant>
3464 <replaceable>RANDOM
</replaceable> <literal>/unit/
</literal> <replaceable>UNIT
</replaceable>
3465 <literal>/
</literal> <replaceable>ID
</replaceable>, i.e. a
<constant>NUL
</constant> byte (as required
3466 for abstract namespace socket names), followed by a random string (consisting of alphadecimal
3467 characters), followed by the literal string
<literal>/unit/
</literal>, followed by the requesting
3468 unit name, followed by the literal character
<literal>/
</literal>, followed by the textual credential
3469 ID requested. Example:
<literal>\
0adf9d86b6eda275e/unit/foobar.service/credx
</literal> in case the
3470 credential
<literal>credx
</literal> is requested for a unit
<literal>foobar.service
</literal>. This
3471 functionality is useful for using a single listening socket to serve credentials to multiple
3474 <para>For further information see
<ulink url=
"https://systemd.io/CREDENTIALS">System and Service
3475 Credentials
</ulink> documentation.
</para>
3477 <xi:include href=
"version-info.xml" xpointer=
"v247"/></listitem>
3481 <term><varname>ImportCredential=
</varname><replaceable>GLOB
</replaceable></term>
3483 <listitem><para>Pass one or more credentials to the unit. Takes a credential name for which we'll
3484 attempt to find a credential that the service manager itself received under the specified name —
3485 which may be used to propagate credentials from an invoking environment (e.g. a container manager
3486 that invoked the service manager) into a service. If the credential name is a glob, all credentials
3487 matching the glob are passed to the unit. Matching credentials are searched for in the system
3488 credentials, the encrypted system credentials, and under
<filename>/etc/credstore/
</filename>,
3489 <filename>/run/credstore/
</filename>,
<filename>/usr/lib/credstore/
</filename>,
3490 <filename>/run/credstore.encrypted/
</filename>,
<filename>/etc/credstore.encrypted/
</filename>, and
3491 <filename>/usr/lib/credstore.encrypted/
</filename> in that order. When multiple credentials of the
3492 same name are found, the first one found is used.
</para>
3494 <para>The globbing expression implements a restrictive subset of
<citerefentry
3495 project='man-pages'
><refentrytitle>glob
</refentrytitle><manvolnum>7</manvolnum></citerefentry>: only
3496 a single trailing
<literal>*
</literal> wildcard may be specified. Both
<literal>?
</literal> and
3497 <literal>[]
</literal> wildcards are not permitted, nor are
<literal>*
</literal> wildcards anywhere
3498 except at the end of the glob expression.
</para>
3500 <para>When multiple credentials of the same name are found, credentials found by
3501 <varname>LoadCredential=
</varname> and
<varname>LoadCredentialEncrypted=
</varname> take priority over
3502 credentials found by
<varname>ImportCredential=
</varname>.
</para>
3504 <xi:include href=
"version-info.xml" xpointer=
"v254"/></listitem>
3508 <term><varname>SetCredential=
</varname><replaceable>ID
</replaceable>:
<replaceable>VALUE
</replaceable></term>
3509 <term><varname>SetCredentialEncrypted=
</varname><replaceable>ID
</replaceable>:
<replaceable>VALUE
</replaceable></term>
3511 <listitem><para>The
<varname>SetCredential=
</varname> setting is similar to
3512 <varname>LoadCredential=
</varname> but accepts a literal value to use as data for the credential,
3513 instead of a file system path to read the data from. Do not use this option for data that is supposed
3514 to be secret, as it is accessible to unprivileged processes via IPC. It's only safe to use this for
3515 user IDs, public key material and similar non-sensitive data. For everything else use
3516 <varname>LoadCredential=
</varname>. In order to embed binary data into the credential data use
3517 C-style escaping (i.e.
<literal>\n
</literal> to embed a newline, or
<literal>\x00
</literal> to embed
3518 a
<constant>NUL
</constant> byte).
</para>
3520 <para>The
<varname>SetCredentialEncrypted=
</varname> setting is identical to
3521 <varname>SetCredential=
</varname> but expects an encrypted credential in literal form as value. This
3522 allows embedding confidential credentials securely directly in unit files. Use
3523 <citerefentry><refentrytitle>systemd-creds
</refentrytitle><manvolnum>1</manvolnum></citerefentry>'
3524 <option>-p
</option> switch to generate suitable
<varname>SetCredentialEncrypted=
</varname> lines
3525 directly from plaintext credentials. For further details see
3526 <varname>LoadCredentialEncrypted=
</varname> above.
</para>
3528 <para>When multiple credentials of the same name are found, credentials found by
3529 <varname>LoadCredential=
</varname>,
<varname>LoadCredentialEncrypted=
</varname> and
3530 <varname>ImportCredential=
</varname> take priority over credentials found by
3531 <varname>SetCredential=
</varname>. As such,
<varname>SetCredential=
</varname> will act as default if
3532 no credentials are found by any of the former. In this case not being able to retrieve the credential
3533 from the path specified in
<varname>LoadCredential=
</varname> or
3534 <varname>LoadCredentialEncrypted=
</varname> is not considered fatal.
</para>
3536 <xi:include href=
"version-info.xml" xpointer=
"v247"/></listitem>
3542 <title>System V Compatibility
</title>
3543 <variablelist class='unit-directives'
>
3546 <term><varname>UtmpIdentifier=
</varname></term>
3548 <listitem><para>Takes a four character identifier string for an
<citerefentry
3549 project='man-pages'
><refentrytitle>utmp
</refentrytitle><manvolnum>5</manvolnum></citerefentry> and wtmp entry
3550 for this service. This should only be set for services such as
<command>getty
</command> implementations (such
3552 project='die-net'
><refentrytitle>agetty
</refentrytitle><manvolnum>8</manvolnum></citerefentry>) where utmp/wtmp
3553 entries must be created and cleared before and after execution, or for services that shall be executed as if
3554 they were run by a
<command>getty
</command> process (see below). If the configured string is longer than four
3555 characters, it is truncated and the terminal four characters are used. This setting interprets %I style string
3556 replacements. This setting is unset by default, i.e. no utmp/wtmp entries are created or cleaned up for this
3557 service.
</para></listitem>
3561 <term><varname>UtmpMode=
</varname></term>
3563 <listitem><para>Takes one of
<literal>init
</literal>,
<literal>login
</literal> or
<literal>user
</literal>. If
3564 <varname>UtmpIdentifier=
</varname> is set, controls which type of
<citerefentry
3565 project='man-pages'
><refentrytitle>utmp
</refentrytitle><manvolnum>5</manvolnum></citerefentry>/wtmp entries
3566 for this service are generated. This setting has no effect unless
<varname>UtmpIdentifier=
</varname> is set
3567 too. If
<literal>init
</literal> is set, only an
<constant>INIT_PROCESS
</constant> entry is generated and the
3568 invoked process must implement a
<command>getty
</command>-compatible utmp/wtmp logic. If
3569 <literal>login
</literal> is set, first an
<constant>INIT_PROCESS
</constant> entry, followed by a
3570 <constant>LOGIN_PROCESS
</constant> entry is generated. In this case, the invoked process must implement a
3572 project='die-net'
><refentrytitle>login
</refentrytitle><manvolnum>1</manvolnum></citerefentry>-compatible
3573 utmp/wtmp logic. If
<literal>user
</literal> is set, first an
<constant>INIT_PROCESS
</constant> entry, then a
3574 <constant>LOGIN_PROCESS
</constant> entry and finally a
<constant>USER_PROCESS
</constant> entry is
3575 generated. In this case, the invoked process may be any process that is suitable to be run as session
3576 leader. Defaults to
<literal>init
</literal>.
</para>
3578 <xi:include href=
"version-info.xml" xpointer=
"v225"/></listitem>
3585 <title>Environment Variables in Spawned Processes
</title>
3587 <para>Processes started by the service manager are executed with an environment variable block assembled from
3588 multiple sources. Processes started by the system service manager generally do not inherit environment variables
3589 set for the service manager itself (but this may be altered via
<varname>PassEnvironment=
</varname>), but processes
3590 started by the user service manager instances generally do inherit all environment variables set for the service
3591 manager itself.
</para>
3593 <para>For each invoked process the list of environment variables set is compiled from the following sources:
</para>
3596 <listitem><para>Variables globally configured for the service manager, using the
3597 <varname>DefaultEnvironment=
</varname> setting in
3598 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
3599 the kernel command line option
<varname>systemd.setenv=
</varname> understood by
3600 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry>, or via
3601 <citerefentry><refentrytitle>systemctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry>
3602 <command>set-environment
</command> verb.
</para></listitem>
3604 <listitem><para>Variables defined by the service manager itself (see the list below).
</para></listitem>
3606 <listitem><para>Variables set in the service manager's own environment variable block (subject to
3607 <varname>PassEnvironment=
</varname> for the system service manager).
</para></listitem>
3609 <listitem><para>Variables set via
<varname>Environment=
</varname> in the unit file.
</para></listitem>
3611 <listitem><para>Variables read from files specified via
<varname>EnvironmentFile=
</varname> in the unit
3612 file.
</para></listitem>
3614 <listitem><para>Variables set by any PAM modules in case
<varname>PAMName=
</varname> is in effect,
3616 project='man-pages'
><refentrytitle>pam_env
</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
3620 <para>If the same environment variable is set by multiple of these sources, the later source — according
3621 to the order of the list above — wins. Note that as the final step all variables listed in
3622 <varname>UnsetEnvironment=
</varname> are removed from the compiled environment variable list, immediately
3623 before it is passed to the executed process.
</para>
3625 <para>The general philosophy is to expose a small curated list of environment variables to processes.
3626 Services started by the system manager (PID
1) will be started, without additional service-specific
3627 configuration, with just a few environment variables. The user manager inherits environment variables as
3628 any other system service, but in addition may receive additional environment variables from PAM, and,
3629 typically, additional imported variables when the user starts a graphical session. It is recommended to
3630 keep the environment blocks in both the system and user managers lean. Importing all variables
3631 inherited by the graphical session or by one of the user shells is strongly discouraged.
</para>
3633 <para>Hint:
<command>systemd-run -P env
</command> and
<command>systemd-run --user -P env
</command> print
3634 the effective system and user service environment blocks.
</para>
3637 <title>Environment Variables Set or Propagated by the Service Manager
</title>
3639 <para>The following environment variables are propagated by the service manager or generated internally
3640 for each invoked process:
</para>
3642 <variablelist class='environment-variables'
>
3644 <term><varname>$PATH
</varname></term>
3646 <listitem><para>Colon-separated list of directories to use when launching
3647 executables.
<command>systemd
</command> uses a fixed value of
3648 <literal><filename>/usr/local/sbin
</filename>:
<filename>/usr/local/bin
</filename>:
<filename>/usr/sbin
</filename>:
<filename>/usr/bin
</filename></literal>
3649 in the system manager. In case of the user manager, a different path may be configured by the
3650 distribution. It is recommended to not rely on the order of entries, and have only one program
3651 with a given name in
<varname>$PATH
</varname>.
</para>
3653 <xi:include href=
"version-info.xml" xpointer=
"v208"/></listitem>
3657 <term><varname>$LANG
</varname></term>
3659 <listitem><para>Locale. Can be set in
<citerefentry
3660 project='man-pages'
><refentrytitle>locale.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
3661 or on the kernel command line (see
3662 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry> and
3663 <citerefentry><refentrytitle>kernel-command-line
</refentrytitle><manvolnum>7</manvolnum></citerefentry>).
3666 <xi:include href=
"version-info.xml" xpointer=
"v208"/></listitem>
3670 <term><varname>$USER
</varname></term>
3671 <term><varname>$LOGNAME
</varname></term>
3672 <term><varname>$HOME
</varname></term>
3673 <term><varname>$SHELL
</varname></term>
3675 <listitem><para>User name (twice), home directory, and the login shell.
<varname>$USER
</varname> is
3676 set unconditionally, while
<varname>$HOME
</varname>,
<varname>$LOGNAME
</varname>, and
<varname>$SHELL
</varname>
3677 are only set for the units that have
<varname>User=
</varname> set and
<varname>SetLoginEnvironment=
</varname>
3678 unset or set to true. For user services, these variables are typically inherited from the user manager itself. See
3679 <citerefentry project='die-net'
><refentrytitle>passwd
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
3682 <xi:include href=
"version-info.xml" xpointer=
"v208"/></listitem>
3686 <term><varname>$INVOCATION_ID
</varname></term>
3688 <listitem><para>Contains a randomized, unique
128-bit ID identifying each runtime cycle of the unit, formatted
3689 as
32 character hexadecimal string. A new ID is assigned each time the unit changes from an inactive state into
3690 an activating or active state, and may be used to identify this specific runtime cycle, in particular in data
3691 stored offline, such as the journal. The same ID is passed to all processes run as part of the
3694 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
3698 <term><varname>$XDG_RUNTIME_DIR
</varname></term>
3700 <listitem><para>The directory to use for runtime objects (such as IPC objects) and volatile state. Set for all
3701 services run by the user
<command>systemd
</command> instance, as well as any system services that use
3702 <varname>PAMName=
</varname> with a PAM stack that includes
<command>pam_systemd
</command>. See below and
3703 <citerefentry><refentrytitle>pam_systemd
</refentrytitle><manvolnum>8</manvolnum></citerefentry> for more
3706 <xi:include href=
"version-info.xml" xpointer=
"v208"/></listitem>
3710 <term><varname>$RUNTIME_DIRECTORY
</varname></term>
3711 <term><varname>$STATE_DIRECTORY
</varname></term>
3712 <term><varname>$CACHE_DIRECTORY
</varname></term>
3713 <term><varname>$LOGS_DIRECTORY
</varname></term>
3714 <term><varname>$CONFIGURATION_DIRECTORY
</varname></term>
3716 <listitem><para>Absolute paths to the directories defined with
3717 <varname>RuntimeDirectory=
</varname>,
<varname>StateDirectory=
</varname>,
3718 <varname>CacheDirectory=
</varname>,
<varname>LogsDirectory=
</varname>, and
3719 <varname>ConfigurationDirectory=
</varname> when those settings are used.
</para>
3721 <xi:include href=
"version-info.xml" xpointer=
"v244"/>
3726 <term><varname>$CREDENTIALS_DIRECTORY
</varname></term>
3728 <listitem><para>An absolute path to the per-unit directory with credentials configured via
3729 <varname>ImportCredential=
</varname>/
<varname>LoadCredential=
</varname>/
<varname>SetCredential=
</varname>.
3730 The directory is marked read-only and is placed in unswappable memory (if supported and permitted),
3731 and is only accessible to the UID associated with the unit via
<varname>User=
</varname> or
3732 <varname>DynamicUser=
</varname> (and the superuser).
</para>
3734 <xi:include href=
"version-info.xml" xpointer=
"v247"/></listitem>
3738 <term><varname>$MAINPID
</varname></term>
3740 <listitem><para>The PID of the unit's main process if it is
3741 known. This is only set for control processes as invoked by
3742 <varname>ExecReload=
</varname> and similar.
</para>
3744 <xi:include href=
"version-info.xml" xpointer=
"v209"/></listitem>
3748 <term><varname>$MANAGERPID
</varname></term>
3750 <listitem><para>The PID of the user
<command>systemd
</command>
3751 instance, set for processes spawned by it.
</para>
3753 <xi:include href=
"version-info.xml" xpointer=
"v208"/></listitem>
3757 <term><varname>$LISTEN_FDS
</varname></term>
3758 <term><varname>$LISTEN_PID
</varname></term>
3759 <term><varname>$LISTEN_FDNAMES
</varname></term>
3761 <listitem><para>Information about file descriptors passed to a
3762 service for socket activation. See
3763 <citerefentry><refentrytitle>sd_listen_fds
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
3766 <xi:include href=
"version-info.xml" xpointer=
"v208"/></listitem>
3770 <term><varname>$NOTIFY_SOCKET
</varname></term>
3772 <listitem><para>The socket
<function>sd_notify()
</function> talks to. See
3773 <citerefentry><refentrytitle>sd_notify
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
3776 <xi:include href=
"version-info.xml" xpointer=
"v229"/></listitem>
3780 <term><varname>$WATCHDOG_PID
</varname></term>
3781 <term><varname>$WATCHDOG_USEC
</varname></term>
3783 <listitem><para>Information about watchdog keep-alive notifications. See
3784 <citerefentry><refentrytitle>sd_watchdog_enabled
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
3787 <xi:include href=
"version-info.xml" xpointer=
"v229"/></listitem>
3791 <term><varname>$SYSTEMD_EXEC_PID
</varname></term>
3793 <listitem><para>The PID of the unit process (e.g. process invoked by
3794 <varname>ExecStart=
</varname>). The child process can use this information to determine
3795 whether the process is directly invoked by the service manager or indirectly as a child of
3796 another process by comparing this value with the current PID (similarly to the scheme used in
3797 <citerefentry><refentrytitle>sd_listen_fds
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
3798 with
<varname>$LISTEN_PID
</varname> and
<varname>$LISTEN_FDS
</varname>).
</para>
3800 <xi:include href=
"version-info.xml" xpointer=
"v248"/></listitem>
3804 <term><varname>$TERM
</varname></term>
3806 <listitem><para>Terminal type, set only for units connected to
3807 a terminal (
<varname>StandardInput=tty
</varname>,
3808 <varname>StandardOutput=tty
</varname>, or
3809 <varname>StandardError=tty
</varname>). See
3810 <citerefentry project='man-pages'
><refentrytitle>termcap
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
3813 <xi:include href=
"version-info.xml" xpointer=
"v209"/></listitem>
3817 <term><varname>$LOG_NAMESPACE
</varname></term>
3819 <listitem><para>Contains the name of the selected logging namespace when the
3820 <varname>LogNamespace=
</varname> service setting is used.
</para>
3822 <xi:include href=
"version-info.xml" xpointer=
"v246"/></listitem>
3826 <term><varname>$JOURNAL_STREAM
</varname></term>
3828 <listitem><para>If the standard output or standard error output of the executed processes are connected to the
3829 journal (for example, by setting
<varname>StandardError=journal
</varname>)
<varname>$JOURNAL_STREAM
</varname>
3830 contains the device and inode numbers of the connection file descriptor, formatted in decimal, separated by a
3831 colon (
<literal>:
</literal>). This permits invoked processes to safely detect whether their standard output or
3832 standard error output are connected to the journal. The device and inode numbers of the file descriptors should
3833 be compared with the values set in the environment variable to determine whether the process output is still
3834 connected to the journal. Note that it is generally not sufficient to only check whether
3835 <varname>$JOURNAL_STREAM
</varname> is set at all as services might invoke external processes replacing their
3836 standard output or standard error output, without unsetting the environment variable.
</para>
3838 <para>If both standard output and standard error of the executed processes are connected to the journal via a
3839 stream socket, this environment variable will contain information about the standard error stream, as that's
3840 usually the preferred destination for log data. (Note that typically the same stream is used for both standard
3841 output and standard error, hence very likely the environment variable contains device and inode information
3842 matching both stream file descriptors.)
</para>
3844 <para>This environment variable is primarily useful to allow services to optionally upgrade their used log
3845 protocol to the native journal protocol (using
3846 <citerefentry><refentrytitle>sd_journal_print
</refentrytitle><manvolnum>3</manvolnum></citerefentry> and other
3847 functions) if their standard output or standard error output is connected to the journal anyway, thus enabling
3848 delivery of structured metadata along with logged messages.
</para>
3850 <xi:include href=
"version-info.xml" xpointer=
"v231"/></listitem>
3854 <term><varname>$SERVICE_RESULT
</varname></term>
3856 <listitem><para>Only used for the service unit type. This environment variable is passed to all
3857 <varname>ExecStop=
</varname> and
<varname>ExecStopPost=
</varname> processes, and encodes the service
3858 "result". Currently, the following values are defined:
</para>
3861 <title>Defined
<varname>$SERVICE_RESULT
</varname> values
</title>
3863 <colspec colname='result'
/>
3864 <colspec colname='meaning'
/>
3867 <entry>Value
</entry>
3868 <entry>Meaning
</entry>
3874 <entry><literal>success
</literal></entry>
3875 <entry>The service ran successfully and exited cleanly.
</entry>
3878 <entry><literal>protocol
</literal></entry>
3879 <entry>A protocol violation occurred: the service did not take the steps required by its unit configuration (specifically what is configured in its
<varname>Type=
</varname> setting).
</entry>
3882 <entry><literal>timeout
</literal></entry>
3883 <entry>One of the steps timed out.
</entry>
3886 <entry><literal>exit-code
</literal></entry>
3887 <entry>Service process exited with a non-zero exit code; see
<varname>$EXIT_CODE
</varname> below for the actual exit code returned.
</entry>
3890 <entry><literal>signal
</literal></entry>
3891 <entry>A service process was terminated abnormally by a signal, without dumping core. See
<varname>$EXIT_CODE
</varname> below for the actual signal causing the termination.
</entry>
3894 <entry><literal>core-dump
</literal></entry>
3895 <entry>A service process terminated abnormally with a signal and dumped core. See
<varname>$EXIT_CODE
</varname> below for the signal causing the termination.
</entry>
3898 <entry><literal>watchdog
</literal></entry>
3899 <entry>Watchdog keep-alive ping was enabled for the service, but the deadline was missed.
</entry>
3902 <entry><literal>exec-condition
</literal></entry>
3903 <entry>Service did not run because
<varname>ExecCondition=
</varname> failed.
</entry>
3906 <entry><literal>oom-kill
</literal></entry>
3907 <entry>A service process was terminated by the Out-Of-Memory (OOM) killer.
</entry>
3910 <entry><literal>start-limit-hit
</literal></entry>
3911 <entry>A start limit was defined for the unit and it was hit, causing the unit to fail to start. See
<citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>'s
<varname>StartLimitIntervalSec=
</varname> and
<varname>StartLimitBurst=
</varname> for details.
</entry>
3914 <entry><literal>resources
</literal></entry>
3915 <entry>A catch-all condition in case a system operation failed.
</entry>
3921 <para>This environment variable is useful to monitor failure or successful termination of a service. Even
3922 though this variable is available in both
<varname>ExecStop=
</varname> and
<varname>ExecStopPost=
</varname>, it
3923 is usually a better choice to place monitoring tools in the latter, as the former is only invoked for services
3924 that managed to start up correctly, and the latter covers both services that failed during their start-up and
3925 those which failed during their runtime.
</para>
3927 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
3931 <term><varname>$EXIT_CODE
</varname></term>
3932 <term><varname>$EXIT_STATUS
</varname></term>
3934 <listitem><para>Only defined for the service unit type. These environment variables are passed to all
3935 <varname>ExecStop=
</varname>,
<varname>ExecStopPost=
</varname> processes and contain exit status/code
3936 information of the main process of the service. For the precise definition of the exit code and status, see
3937 <citerefentry><refentrytitle>wait
</refentrytitle><manvolnum>2</manvolnum></citerefentry>.
<varname>$EXIT_CODE
</varname>
3938 is one of
<literal>exited
</literal>,
<literal>killed
</literal>,
3939 <literal>dumped
</literal>.
<varname>$EXIT_STATUS
</varname> contains the numeric exit code formatted as string
3940 if
<varname>$EXIT_CODE
</varname> is
<literal>exited
</literal>, and the signal name in all other cases. Note
3941 that these environment variables are only set if the service manager succeeded to start and identify the main
3942 process of the service.
</para>
3945 <title>Summary of possible service result variable values
</title>
3947 <colspec colname='result'
/>
3948 <colspec colname='code'
/>
3949 <colspec colname='status'
/>
3952 <entry><varname>$SERVICE_RESULT
</varname></entry>
3953 <entry><varname>$EXIT_CODE
</varname></entry>
3954 <entry><varname>$EXIT_STATUS
</varname></entry>
3960 <entry morerows=
"1" valign=
"top"><literal>success
</literal></entry>
3961 <entry valign=
"top"><literal>killed
</literal></entry>
3962 <entry><literal>HUP
</literal>,
<literal>INT
</literal>,
<literal>TERM
</literal>,
<literal>PIPE
</literal></entry>
3965 <entry valign=
"top"><literal>exited
</literal></entry>
3966 <entry><literal>0</literal></entry>
3969 <entry morerows=
"1" valign=
"top"><literal>protocol
</literal></entry>
3970 <entry valign=
"top">not set
</entry>
3971 <entry>not set
</entry>
3974 <entry><literal>exited
</literal></entry>
3975 <entry><literal>0</literal></entry>
3978 <entry morerows=
"1" valign=
"top"><literal>timeout
</literal></entry>
3979 <entry valign=
"top"><literal>killed
</literal></entry>
3980 <entry><literal>TERM
</literal>,
<literal>KILL
</literal></entry>
3983 <entry valign=
"top"><literal>exited
</literal></entry>
3984 <entry><literal>0</literal>,
<literal>1</literal>,
<literal>2</literal>,
<literal
3985 >3</literal>, …,
<literal>255</literal></entry>
3988 <entry valign=
"top"><literal>exit-code
</literal></entry>
3989 <entry valign=
"top"><literal>exited
</literal></entry>
3990 <entry><literal>1</literal>,
<literal>2</literal>,
<literal
3991 >3</literal>, …,
<literal>255</literal></entry>
3994 <entry valign=
"top"><literal>signal
</literal></entry>
3995 <entry valign=
"top"><literal>killed
</literal></entry>
3996 <entry><literal>HUP
</literal>,
<literal>INT
</literal>,
<literal>KILL
</literal>, …
</entry>
3999 <entry valign=
"top"><literal>core-dump
</literal></entry>
4000 <entry valign=
"top"><literal>dumped
</literal></entry>
4001 <entry><literal>ABRT
</literal>,
<literal>SEGV
</literal>,
<literal>QUIT
</literal>, …
</entry>
4004 <entry morerows=
"2" valign=
"top"><literal>watchdog
</literal></entry>
4005 <entry><literal>dumped
</literal></entry>
4006 <entry><literal>ABRT
</literal></entry>
4009 <entry><literal>killed
</literal></entry>
4010 <entry><literal>TERM
</literal>,
<literal>KILL
</literal></entry>
4013 <entry><literal>exited
</literal></entry>
4014 <entry><literal>0</literal>,
<literal>1</literal>,
<literal>2</literal>,
<literal
4015 >3</literal>, …,
<literal>255</literal></entry>
4018 <entry valign=
"top"><literal>exec-condition
</literal></entry>
4019 <entry><literal>exited
</literal></entry>
4020 <entry><literal>1</literal>,
<literal>2</literal>,
<literal>3</literal>,
<literal
4021 >4</literal>, …,
<literal>254</literal></entry>
4024 <entry valign=
"top"><literal>oom-kill
</literal></entry>
4025 <entry valign=
"top"><literal>killed
</literal></entry>
4026 <entry><literal>TERM
</literal>,
<literal>KILL
</literal></entry>
4029 <entry><literal>start-limit-hit
</literal></entry>
4030 <entry>not set
</entry>
4031 <entry>not set
</entry>
4034 <entry><literal>resources
</literal></entry>
4035 <entry>any of the above
</entry>
4036 <entry>any of the above
</entry>
4039 <entry namest=
"results" nameend=
"status">Note: the process may be also terminated by a signal not sent by systemd. In particular the process may send an arbitrary signal to itself in a handler for any of the non-maskable signals. Nevertheless, in the
<literal>timeout
</literal> and
<literal>watchdog
</literal> rows above only the signals that systemd sends have been included. Moreover, using
<varname>SuccessExitStatus=
</varname> additional exit statuses may be declared to indicate clean termination, which is not reflected by this table.
</entry>
4045 <xi:include href=
"version-info.xml" xpointer=
"v232"/></listitem>
4049 <term><varname>$MONITOR_SERVICE_RESULT
</varname></term>
4050 <term><varname>$MONITOR_EXIT_CODE
</varname></term>
4051 <term><varname>$MONITOR_EXIT_STATUS
</varname></term>
4052 <term><varname>$MONITOR_INVOCATION_ID
</varname></term>
4053 <term><varname>$MONITOR_UNIT
</varname></term>
4055 <listitem><para>Only defined for the service unit type. Those environment variables are passed to
4056 all
<varname>ExecStart=
</varname> and
<varname>ExecStartPre=
</varname> processes which run in
4057 services triggered by
<varname>OnFailure=
</varname> or
<varname>OnSuccess=
</varname> dependencies.
4060 <para>Variables
<varname>$MONITOR_SERVICE_RESULT
</varname>,
<varname>$MONITOR_EXIT_CODE
</varname>
4061 and
<varname>$MONITOR_EXIT_STATUS
</varname> take the same values as for
4062 <varname>ExecStop=
</varname> and
<varname>ExecStopPost=
</varname> processes. Variables
4063 <varname>$MONITOR_INVOCATION_ID
</varname> and
<varname>$MONITOR_UNIT
</varname> are set to the
4064 invocation id and unit name of the service which triggered the dependency.
</para>
4066 <para>Note that when multiple services trigger the same unit, those variables will be
4067 <emphasis>not
</emphasis> be passed. Consider using a template handler unit for that case instead:
4068 <literal>OnFailure=
<replaceable>handler
</replaceable>@%n.service
</literal> for non-templated units,
4069 or
<literal>OnFailure=
<replaceable>handler
</replaceable>@%p-%i.service
</literal> for templated
4072 <xi:include href=
"version-info.xml" xpointer=
"v251"/></listitem>
4076 <term><varname>$PIDFILE
</varname></term>
4078 <listitem><para>The path to the configured PID file, in case the process is forked off on behalf of
4079 a service that uses the
<varname>PIDFile=
</varname> setting, see
4080 <citerefentry><refentrytitle>systemd.service
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
4081 for details. Service code may use this environment variable to automatically generate a PID file at
4082 the location configured in the unit file. This field is set to an absolute path in the file
4085 <xi:include href=
"version-info.xml" xpointer=
"v242"/></listitem>
4089 <term><varname>$REMOTE_ADDR
</varname></term>
4090 <term><varname>$REMOTE_PORT
</varname></term>
4092 <listitem><para>If this is a unit started via per-connection socket activation (i.e. via a socket
4093 unit with
<varname>Accept=yes
</varname>), these environment variables contain the IP address and
4094 port number of the remote peer of the socket connection.
</para>
4096 <xi:include href=
"version-info.xml" xpointer=
"v254"/></listitem>
4100 <term><varname>$TRIGGER_UNIT
</varname></term>
4101 <term><varname>$TRIGGER_PATH
</varname></term>
4102 <term><varname>$TRIGGER_TIMER_REALTIME_USEC
</varname></term>
4103 <term><varname>$TRIGGER_TIMER_MONOTONIC_USEC
</varname></term>
4105 <listitem><para>If the unit was activated dynamically (e.g.: a corresponding path unit or timer unit), the
4106 unit that triggered it and other type-dependent information will be passed via these variables. Note that
4107 this information is provided in a best-effort way. For example, multiple triggers happening one after
4108 another will be coalesced and only one will be reported, with no guarantee as to which one it will be.
4109 Because of this, in most cases this variable will be primarily informational, i.e. useful for debugging
4110 purposes, is lossy, and should not be relied upon to propagate a comprehensive reason for activation.
4113 <xi:include href=
"version-info.xml" xpointer=
"v252"/></listitem>
4117 <term><varname>$MEMORY_PRESSURE_WATCH
</varname></term>
4118 <term><varname>$MEMORY_PRESSURE_WRITE
</varname></term>
4120 <listitem><para>If memory pressure monitoring is enabled for this service unit, the path to watch
4121 and the data to write into it. See
<ulink url=
"https://systemd.io/MEMORY_PRESSURE">Memory Pressure
4122 Handling
</ulink> for details about these variables and the service protocol data they
4125 <xi:include href=
"version-info.xml" xpointer=
"v254"/></listitem>
4129 <term><varname>$FDSTORE
</varname></term>
4131 <listitem><para>The maximum number of file descriptors that may be stored in the manager for the
4132 service. This variable is set when the file descriptor store is enabled for the service, i.e.
4133 <varname>FileDescriptorStoreMax=
</varname> is set to a non-zero value (see
4134 <citerefentry><refentrytitle>systemd.service
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
4135 for details). Applications may check this environment variable before sending file descriptors to
4136 the service manager via
4137 <citerefentry><refentrytitle>sd_pid_notify_with_fds
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
4140 <xi:include href=
"version-info.xml" xpointer=
"v254"/></listitem>
4145 <para>For system services, when
<varname>PAMName=
</varname> is enabled and
<command>pam_systemd
</command> is part
4146 of the selected PAM stack, additional environment variables defined by systemd may be set for
4147 services. Specifically, these are
<varname>$XDG_SEAT
</varname>,
<varname>$XDG_VTNR
</varname>, see
4148 <citerefentry><refentrytitle>pam_systemd
</refentrytitle><manvolnum>8</manvolnum></citerefentry> for details.
</para>
4154 <title>Process Exit Codes
</title>
4156 <para>When invoking a unit process the service manager possibly fails to apply the execution parameters configured
4157 with the settings above. In that case the already created service process will exit with a non-zero exit code
4158 before the configured command line is executed. (Or in other words, the child process possibly exits with these
4159 error codes, after having been created by the
<citerefentry
4160 project='man-pages'
><refentrytitle>fork
</refentrytitle><manvolnum>2</manvolnum></citerefentry> system call, but
4161 before the matching
<citerefentry
4162 project='man-pages'
><refentrytitle>execve
</refentrytitle><manvolnum>2</manvolnum></citerefentry> system call is
4163 called.) Specifically, exit codes defined by the C library, by the LSB specification and by the systemd service
4164 manager itself are used.
</para>
4166 <para>The following basic service exit codes are defined by the C library.
</para>
4169 <title>Basic C library exit codes
</title>
4173 <entry>Exit Code
</entry>
4174 <entry>Symbolic Name
</entry>
4175 <entry>Description
</entry>
4181 <entry><constant>EXIT_SUCCESS
</constant></entry>
4182 <entry>Generic success code.
</entry>
4186 <entry><constant>EXIT_FAILURE
</constant></entry>
4187 <entry>Generic failure or unspecified error.
</entry>
4193 <para>The following service exit codes are defined by the
<ulink
4194 url=
"https://refspecs.linuxbase.org/LSB_5.0.0/LSB-Core-generic/LSB-Core-generic/iniscrptact.html">LSB specification
</ulink>.
4198 <title>LSB service exit codes
</title>
4202 <entry>Exit Code
</entry>
4203 <entry>Symbolic Name
</entry>
4204 <entry>Description
</entry>
4210 <entry><constant>EXIT_INVALIDARGUMENT
</constant></entry>
4211 <entry>Invalid or excess arguments.
</entry>
4215 <entry><constant>EXIT_NOTIMPLEMENTED
</constant></entry>
4216 <entry>Unimplemented feature.
</entry>
4220 <entry><constant>EXIT_NOPERMISSION
</constant></entry>
4221 <entry>The user has insufficient privileges.
</entry>
4225 <entry><constant>EXIT_NOTINSTALLED
</constant></entry>
4226 <entry>The program is not installed.
</entry>
4230 <entry><constant>EXIT_NOTCONFIGURED
</constant></entry>
4231 <entry>The program is not configured.
</entry>
4235 <entry><constant>EXIT_NOTRUNNING
</constant></entry>
4236 <entry>The program is not running.
</entry>
4243 The LSB specification suggests that error codes
200 and above are reserved for implementations. Some of them are
4244 used by the service manager to indicate problems during process invocation:
4247 <title>systemd-specific exit codes
</title>
4251 <entry>Exit Code
</entry>
4252 <entry>Symbolic Name
</entry>
4253 <entry>Description
</entry>
4259 <entry><constant>EXIT_CHDIR
</constant></entry>
4260 <entry>Changing to the requested working directory failed. See
<varname>WorkingDirectory=
</varname> above.
</entry>
4264 <entry><constant>EXIT_NICE
</constant></entry>
4265 <entry>Failed to set up process scheduling priority (nice level). See
<varname>Nice=
</varname> above.
</entry>
4269 <entry><constant>EXIT_FDS
</constant></entry>
4270 <entry>Failed to close unwanted file descriptors, or to adjust passed file descriptors.
</entry>
4274 <entry><constant>EXIT_EXEC
</constant></entry>
4275 <entry>The actual process execution failed (specifically, the
<citerefentry project='man-pages'
><refentrytitle>execve
</refentrytitle><manvolnum>2</manvolnum></citerefentry> system call). Most likely this is caused by a missing or non-accessible executable file.
</entry>
4279 <entry><constant>EXIT_MEMORY
</constant></entry>
4280 <entry>Failed to perform an action due to memory shortage.
</entry>
4284 <entry><constant>EXIT_LIMITS
</constant></entry>
4285 <entry>Failed to adjust resource limits. See
<varname>LimitCPU=
</varname> and related settings above.
</entry>
4289 <entry><constant>EXIT_OOM_ADJUST
</constant></entry>
4290 <entry>Failed to adjust the OOM setting. See
<varname>OOMScoreAdjust=
</varname> above.
</entry>
4294 <entry><constant>EXIT_SIGNAL_MASK
</constant></entry>
4295 <entry>Failed to set process signal mask.
</entry>
4299 <entry><constant>EXIT_STDIN
</constant></entry>
4300 <entry>Failed to set up standard input. See
<varname>StandardInput=
</varname> above.
</entry>
4304 <entry><constant>EXIT_STDOUT
</constant></entry>
4305 <entry>Failed to set up standard output. See
<varname>StandardOutput=
</varname> above.
</entry>
4309 <entry><constant>EXIT_CHROOT
</constant></entry>
4310 <entry>Failed to change root directory (
<citerefentry project='man-pages'
><refentrytitle>chroot
</refentrytitle><manvolnum>2</manvolnum></citerefentry>). See
<varname>RootDirectory=
</varname>/
<varname>RootImage=
</varname> above.
</entry>
4314 <entry><constant>EXIT_IOPRIO
</constant></entry>
4315 <entry>Failed to set up IO scheduling priority. See
<varname>IOSchedulingClass=
</varname>/
<varname>IOSchedulingPriority=
</varname> above.
</entry>
4319 <entry><constant>EXIT_TIMERSLACK
</constant></entry>
4320 <entry>Failed to set up timer slack. See
<varname>TimerSlackNSec=
</varname> above.
</entry>
4324 <entry><constant>EXIT_SECUREBITS
</constant></entry>
4325 <entry>Failed to set process secure bits. See
<varname>SecureBits=
</varname> above.
</entry>
4329 <entry><constant>EXIT_SETSCHEDULER
</constant></entry>
4330 <entry>Failed to set up CPU scheduling. See
<varname>CPUSchedulingPolicy=
</varname>/
<varname>CPUSchedulingPriority=
</varname> above.
</entry>
4334 <entry><constant>EXIT_CPUAFFINITY
</constant></entry>
4335 <entry>Failed to set up CPU affinity. See
<varname>CPUAffinity=
</varname> above.
</entry>
4339 <entry><constant>EXIT_GROUP
</constant></entry>
4340 <entry>Failed to determine or change group credentials. See
<varname>Group=
</varname>/
<varname>SupplementaryGroups=
</varname> above.
</entry>
4344 <entry><constant>EXIT_USER
</constant></entry>
4345 <entry>Failed to determine or change user credentials, or to set up user namespacing. See
<varname>User=
</varname>/
<varname>PrivateUsers=
</varname> above.
</entry>
4349 <entry><constant>EXIT_CAPABILITIES
</constant></entry>
4350 <entry>Failed to drop capabilities, or apply ambient capabilities. See
<varname>CapabilityBoundingSet=
</varname>/
<varname>AmbientCapabilities=
</varname> above.
</entry>
4354 <entry><constant>EXIT_CGROUP
</constant></entry>
4355 <entry>Setting up the service control group failed.
</entry>
4359 <entry><constant>EXIT_SETSID
</constant></entry>
4360 <entry>Failed to create new process session.
</entry>
4364 <entry><constant>EXIT_CONFIRM
</constant></entry>
4365 <entry>Execution has been cancelled by the user. See the
<varname>systemd.confirm_spawn=
</varname> kernel command line setting on
<citerefentry><refentrytitle>kernel-command-line
</refentrytitle><manvolnum>7</manvolnum></citerefentry> for details.
</entry>
4369 <entry><constant>EXIT_STDERR
</constant></entry>
4370 <entry>Failed to set up standard error output. See
<varname>StandardError=
</varname> above.
</entry>
4374 <entry><constant>EXIT_PAM
</constant></entry>
4375 <entry>Failed to set up PAM session. See
<varname>PAMName=
</varname> above.
</entry>
4379 <entry><constant>EXIT_NETWORK
</constant></entry>
4380 <entry>Failed to set up network namespacing. See
<varname>PrivateNetwork=
</varname> above.
</entry>
4384 <entry><constant>EXIT_NAMESPACE
</constant></entry>
4385 <entry>Failed to set up mount, UTS, or IPC namespacing. See
<varname>ReadOnlyPaths=
</varname>,
<varname>ProtectHostname=
</varname>,
<varname>PrivateIPC=
</varname>, and related settings above.
</entry>
4389 <entry><constant>EXIT_NO_NEW_PRIVILEGES
</constant></entry>
4390 <entry>Failed to disable new privileges. See
<varname>NoNewPrivileges=yes
</varname> above.
</entry>
4394 <entry><constant>EXIT_SECCOMP
</constant></entry>
4395 <entry>Failed to apply system call filters. See
<varname>SystemCallFilter=
</varname> and related settings above.
</entry>
4399 <entry><constant>EXIT_SELINUX_CONTEXT
</constant></entry>
4400 <entry>Determining or changing SELinux context failed. See
<varname>SELinuxContext=
</varname> above.
</entry>
4404 <entry><constant>EXIT_PERSONALITY
</constant></entry>
4405 <entry>Failed to set up an execution domain (personality). See
<varname>Personality=
</varname> above.
</entry>
4409 <entry><constant>EXIT_APPARMOR_PROFILE
</constant></entry>
4410 <entry>Failed to prepare changing AppArmor profile. See
<varname>AppArmorProfile=
</varname> above.
</entry>
4414 <entry><constant>EXIT_ADDRESS_FAMILIES
</constant></entry>
4415 <entry>Failed to restrict address families. See
<varname>RestrictAddressFamilies=
</varname> above.
</entry>
4419 <entry><constant>EXIT_RUNTIME_DIRECTORY
</constant></entry>
4420 <entry>Setting up runtime directory failed. See
<varname>RuntimeDirectory=
</varname> and related settings above.
</entry>
4424 <entry><constant>EXIT_CHOWN
</constant></entry>
4425 <entry>Failed to adjust socket ownership. Used for socket units only.
</entry>
4429 <entry><constant>EXIT_SMACK_PROCESS_LABEL
</constant></entry>
4430 <entry>Failed to set SMACK label. See
<varname>SmackProcessLabel=
</varname> above.
</entry>
4434 <entry><constant>EXIT_KEYRING
</constant></entry>
4435 <entry>Failed to set up kernel keyring.
</entry>
4439 <entry><constant>EXIT_STATE_DIRECTORY
</constant></entry>
4440 <entry>Failed to set up unit's state directory. See
<varname>StateDirectory=
</varname> above.
</entry>
4444 <entry><constant>EXIT_CACHE_DIRECTORY
</constant></entry>
4445 <entry>Failed to set up unit's cache directory. See
<varname>CacheDirectory=
</varname> above.
</entry>
4449 <entry><constant>EXIT_LOGS_DIRECTORY
</constant></entry>
4450 <entry>Failed to set up unit's logging directory. See
<varname>LogsDirectory=
</varname> above.
</entry>
4454 <entry><constant>EXIT_CONFIGURATION_DIRECTORY
</constant></entry>
4455 <entry>Failed to set up unit's configuration directory. See
<varname>ConfigurationDirectory=
</varname> above.
</entry>
4459 <entry><constant>EXIT_NUMA_POLICY
</constant></entry>
4460 <entry>Failed to set up unit's NUMA memory policy. See
<varname>NUMAPolicy=
</varname> and
<varname>NUMAMask=
</varname> above.
</entry>
4464 <entry><constant>EXIT_CREDENTIALS
</constant></entry>
4465 <entry>Failed to set up unit's credentials. See
<varname>ImportCredential=
</varname>,
<varname>LoadCredential=
</varname> and
<varname>SetCredential=
</varname> above.
</entry>
4469 <entry><constant>EXIT_BPF
</constant></entry>
4470 <entry>Failed to apply BPF restrictions. See
<varname>RestrictFileSystems=
</varname> above.
</entry>
4476 <para>Finally, the BSD operating systems define a set of exit codes, typically defined on Linux systems too:
</para>
4479 <title>BSD exit codes
</title>
4483 <entry>Exit Code
</entry>
4484 <entry>Symbolic Name
</entry>
4485 <entry>Description
</entry>
4491 <entry><constant>EX_USAGE
</constant></entry>
4492 <entry>Command line usage error
</entry>
4496 <entry><constant>EX_DATAERR
</constant></entry>
4497 <entry>Data format error
</entry>
4501 <entry><constant>EX_NOINPUT
</constant></entry>
4502 <entry>Cannot open input
</entry>
4506 <entry><constant>EX_NOUSER
</constant></entry>
4507 <entry>Addressee unknown
</entry>
4511 <entry><constant>EX_NOHOST
</constant></entry>
4512 <entry>Host name unknown
</entry>
4516 <entry><constant>EX_UNAVAILABLE
</constant></entry>
4517 <entry>Service unavailable
</entry>
4521 <entry><constant>EX_SOFTWARE
</constant></entry>
4522 <entry>internal software error
</entry>
4526 <entry><constant>EX_OSERR
</constant></entry>
4527 <entry>System error (e.g., can't fork)
</entry>
4531 <entry><constant>EX_OSFILE
</constant></entry>
4532 <entry>Critical OS file missing
</entry>
4536 <entry><constant>EX_CANTCREAT
</constant></entry>
4537 <entry>Can't create (user) output file
</entry>
4541 <entry><constant>EX_IOERR
</constant></entry>
4542 <entry>Input/output error
</entry>
4546 <entry><constant>EX_TEMPFAIL
</constant></entry>
4547 <entry>Temporary failure; user is invited to retry
</entry>
4551 <entry><constant>EX_PROTOCOL
</constant></entry>
4552 <entry>Remote error in protocol
</entry>
4556 <entry><constant>EX_NOPERM
</constant></entry>
4557 <entry>Permission denied
</entry>
4561 <entry><constant>EX_CONFIG
</constant></entry>
4562 <entry>Configuration error
</entry>
4570 <title>Examples
</title>
4573 <title><varname>$MONITOR_
<replaceable>*
</replaceable></varname> usage
</title>
4575 <para>A service
<filename index=
"false">myfailer.service
</filename> which can trigger an
4576 <varname>OnFailure=
</varname> dependency.
</para>
4580 Description=Service which can trigger an OnFailure= dependency
4581 OnFailure=myhandler.service
4584 ExecStart=/bin/myprogram
4587 <para>A service
<filename index=
"false">mysuccess.service
</filename> which can trigger an
4588 <varname>OnSuccess=
</varname> dependency.
</para>
4592 Description=Service which can trigger an OnSuccess= dependency
4593 OnSuccess=myhandler.service
4596 ExecStart=/bin/mysecondprogram
4599 <para>A service
<filename index=
"false">myhandler.service
</filename> which can be triggered
4600 by any of the above services.
</para>
4604 Description=Acts on service failing or succeeding
4607 ExecStart=/bin/bash -c
"echo $MONITOR_SERVICE_RESULT $MONITOR_EXIT_CODE $MONITOR_EXIT_STATUS $MONITOR_INVOCATION_ID $MONITOR_UNIT"
4610 <para>If
<filename index=
"false">myfailer.service
</filename> were to run and exit in failure,
4611 then
<filename index=
"false">myhandler.service
</filename> would be triggered and the
4612 monitor variables would be set as follows:
</para>
4615 MONITOR_SERVICE_RESULT=exit-code
4616 MONITOR_EXIT_CODE=exited
4617 MONITOR_EXIT_STATUS=
1
4618 MONITOR_INVOCATION_ID=cc8fdc149b2b4ca698d4f259f4054236
4619 MONITOR_UNIT=myfailer.service
4622 <para>If
<filename index=
"false">mysuccess.service
</filename> were to run and exit in success,
4623 then
<filename index=
"false">myhandler.service
</filename> would be triggered and the
4624 monitor variables would be set as follows:
</para>
4627 MONITOR_SERVICE_RESULT=success
4628 MONITOR_EXIT_CODE=exited
4629 MONITOR_EXIT_STATUS=
0
4630 MONITOR_INVOCATION_ID=
6ab9af147b8c4a3ebe36e7a5f8611697
4631 MONITOR_UNIT=mysuccess.service
4639 <title>See Also
</title>
4640 <para><simplelist type=
"inline">
4641 <member><citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
4642 <member><citerefentry><refentrytitle>systemctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
4643 <member><citerefentry><refentrytitle>systemd-analyze
</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
4644 <member><citerefentry><refentrytitle>journalctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
4645 <member><citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
4646 <member><citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
4647 <member><citerefentry><refentrytitle>systemd.service
</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
4648 <member><citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
4649 <member><citerefentry><refentrytitle>systemd.swap
</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
4650 <member><citerefentry><refentrytitle>systemd.mount
</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
4651 <member><citerefentry><refentrytitle>systemd.kill
</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
4652 <member><citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
4653 <member><citerefentry><refentrytitle>systemd.time
</refentrytitle><manvolnum>7</manvolnum></citerefentry></member>
4654 <member><citerefentry><refentrytitle>systemd.directives
</refentrytitle><manvolnum>7</manvolnum></citerefentry></member>
4655 <member><citerefentry><refentrytitle>tmpfiles.d
</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
4656 <member><citerefentry project='man-pages'
><refentrytitle>exec
</refentrytitle><manvolnum>3</manvolnum></citerefentry></member>
4657 <member><citerefentry project='man-pages'
><refentrytitle>fork
</refentrytitle><manvolnum>2</manvolnum></citerefentry></member>
4658 </simplelist></para>