man/systemd.nspawn.xml

   1 <?xml version='1.0'?> <!--*- Mode: nxml; nxml-child-indent: 2; indent-tabs-mode: nil -*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
   4 <!ENTITY % entities SYSTEM "custom-entities.ent" >
   5 %entities;
   6 ]>
   7
   8 <!--
   9   SPDX-License-Identifier: LGPL-2.1+
  10
  11   This file is part of systemd.
  12
  13   Copyright 2015 Lennart Poettering
  14 -->
  15
  16 <refentry id="systemd.nspawn">
  17
  18   <refentryinfo>
  19     <title>systemd.nspawn</title>
  20     <productname>systemd</productname>
  21
  22     <authorgroup>
  23       <author>
  24         <contrib>Developer</contrib>
  25         <firstname>Lennart</firstname>
  26         <surname>Poettering</surname>
  27         <email>lennart@poettering.net</email>
  28       </author>
  29     </authorgroup>
  30   </refentryinfo>
  31
  32   <refmeta>
  33     <refentrytitle>systemd.nspawn</refentrytitle>
  34     <manvolnum>5</manvolnum>
  35   </refmeta>
  36
  37   <refnamediv>
  38     <refname>systemd.nspawn</refname>
  39     <refpurpose>Container settings</refpurpose>
  40   </refnamediv>
  41
  42   <refsynopsisdiv>
  43     <para><filename>/etc/systemd/nspawn/<replaceable>machine</replaceable>.nspawn</filename></para>
  44     <para><filename>/run/systemd/nspawn/<replaceable>machine</replaceable>.nspawn</filename></para>
  45     <para><filename>/var/lib/machines/<replaceable>machine</replaceable>.nspawn</filename></para>
  46   </refsynopsisdiv>
  47
  48   <refsect1>
  49     <title>Description</title>
  50
  51     <para>An nspawn container settings file (suffix
  52     <filename>.nspawn</filename>) encodes additional runtime
  53     information about a local container, and is searched, read and
  54     used by
  55     <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
  56     when starting a container. Files of this type are named after the
  57     containers they define settings for. They are optional, and only
  58     required for containers whose execution environment shall differ
  59     from the defaults. Files of this type mostly contain settings that
  60     may also be set on the <command>systemd-nspawn</command> command
  61     line, and make it easier to persistently attach specific settings
  62     to specific containers. The syntax of these files is inspired by
  63     <filename>.desktop</filename> files following the <ulink
  64     url="http://standards.freedesktop.org/desktop-entry-spec/latest/">XDG
  65     Desktop Entry Specification</ulink>, which in turn are inspired by
  66     Microsoft Windows <filename>.ini</filename> files.</para>
  67
  68     <para>Boolean arguments used in these settings files can be
  69     written in various formats. For positive settings, the strings
  70     <option>1</option>, <option>yes</option>, <option>true</option>
  71     and <option>on</option> are equivalent. For negative settings, the
  72     strings <option>0</option>, <option>no</option>,
  73     <option>false</option> and <option>off</option> are
  74     equivalent.</para>
  75
  76     <para>Empty lines and lines starting with # or ; are
  77     ignored. This may be used for commenting. Lines ending
  78     in a backslash are concatenated with the following
  79     line while reading and the backslash is replaced by a
  80     space character. This may be used to wrap long lines.</para>
  81
  82   </refsect1>
  83
  84   <refsect1>
  85     <title><filename>.nspawn</filename> File Discovery</title>
  86
  87     <para>Files are searched by appending the
  88     <filename>.nspawn</filename> suffix to the machine name of the
  89     container, as specified with the <option>--machine=</option>
  90     switch of <command>systemd-nspawn</command>, or derived from the
  91     directory or image file name. This file is first searched in
  92     <filename>/etc/systemd/nspawn/</filename> and
  93     <filename>/run/systemd/nspawn/</filename>. If found in these
  94     directories, its settings are read and all of them take full effect
  95     (but are possibly overridden by corresponding command line
  96     arguments). If not found, the file will then be searched next to
  97     the image file or in the immediate parent of the root directory of
  98     the container. If the file is found there, only a subset of the
  99     settings will take effect however. All settings that possibly
 100     elevate privileges or grant additional access to resources of the
 101     host (such as files or directories) are ignored. To which options
 102     this applies is documented below.</para>
 103
 104     <para>Persistent settings files created and maintained by the
 105     administrator (and thus trusted) should be placed in
 106     <filename>/etc/systemd/nspawn/</filename>, while automatically
 107     downloaded (and thus potentially untrusted) settings files are
 108     placed in <filename>/var/lib/machines/</filename> instead (next to
 109     the container images), where their security impact is limited. In
 110     order to add privileged settings to <filename>.nspawn</filename>
 111     files acquired from the image vendor, it is recommended to copy the
 112     settings files into <filename>/etc/systemd/nspawn/</filename> and
 113     edit them there, so that the privileged options become
 114     available. The precise algorithm for how the files are searched and
 115     interpreted may be configured with
 116     <command>systemd-nspawn</command>'s <option>--settings=</option>
 117     switch, see
 118     <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 119     for details.</para>
 120   </refsect1>
 121
 122   <refsect1>
 123     <title>[Exec] Section Options</title>
 124
 125     <para>Settings files may include an <literal>[Exec]</literal>
 126     section, which carries various execution parameters:</para>
 127
 128     <variablelist>
 129
 130       <varlistentry>
 131         <term><varname>Boot=</varname></term>
 132
 133         <listitem><para>Takes a boolean argument, which defaults to off. If enabled, <command>systemd-nspawn</command>
 134         will automatically search for an <filename>init</filename> executable and invoke it. In this case, the
 135         specified parameters using <varname>Parameters=</varname> are passed as additional arguments to the
 136         <filename>init</filename> process. This setting corresponds to the <option>--boot</option> switch on the
 137         <command>systemd-nspawn</command> command line. This option may not be combined with
 138         <varname>ProcessTwo=yes</varname>. This option is the default if the
 139         <filename>systemd-nspawn@.service</filename> template unit file is used.</para></listitem>
 140       </varlistentry>
 141
 142       <varlistentry>
 143         <term><varname>ProcessTwo=</varname></term>
 144
 145         <listitem><para>Takes a boolean argument, which defaults to off. If enabled, the specified program is run as
 146         PID 2. A stub init process is run as PID 1. This setting corresponds to the <option>--as-pid2</option> switch
 147         on the <command>systemd-nspawn</command> command line. This option may not be combined with
 148         <varname>Boot=yes</varname>.</para></listitem>
 149       </varlistentry>
 150
 151       <varlistentry>
 152         <term><varname>Parameters=</varname></term>
 153
 154         <listitem><para>Takes a space-separated list of
 155         arguments. This is either a command line, beginning with the
 156         binary name to execute, or – if <varname>Boot=</varname> is
 157         enabled – the list of arguments to pass to the init
 158         process. This setting corresponds to the command line
 159         parameters passed on the <command>systemd-nspawn</command>
 160         command line.</para></listitem>
 161       </varlistentry>
 162
 163       <varlistentry>
 164         <term><varname>Environment=</varname></term>
 165
 166         <listitem><para>Takes an environment variable assignment
 167         consisting of key and value, separated by
 168         <literal>=</literal>. Sets an environment variable for the
 169         main process invoked in the container. This setting may be
 170         used multiple times to set multiple environment variables. It
 171         corresponds to the <option>--setenv=</option> command line
 172         switch.</para></listitem>
 173       </varlistentry>
 174
 175       <varlistentry>
 176         <term><varname>User=</varname></term>
 177
 178         <listitem><para>Takes a UNIX user name. Specifies the user
 179         name to invoke the main process of the container as. This user
 180         must be known in the container's user database. This
 181         corresponds to the <option>--user=</option> command line
 182         switch.</para></listitem>
 183       </varlistentry>
 184
 185       <varlistentry>
 186         <term><varname>WorkingDirectory=</varname></term>
 187
 188         <listitem><para>Selects the working directory for the process invoked in the container. Expects an absolute
 189         path in the container's file system namespace. This corresponds to the <option>--chdir=</option> command line
 190         switch.</para></listitem>
 191       </varlistentry>
 192
 193       <varlistentry>
 194         <term><varname>PivotRoot=</varname></term>
 195
 196         <listitem><para>Selects a directory to pivot to <filename>/</filename> inside the container when starting up.
 197         Takes a single path, or a pair of two paths separated by a colon. Both paths must be absolute, and are resolved
 198         in the container's file system namespace. This corresponds to the <option>--pivot-root=</option> command line
 199         switch.</para></listitem>
 200       </varlistentry>
 201
 202       <varlistentry>
 203         <term><varname>Capability=</varname></term>
 204         <term><varname>DropCapability=</varname></term>
 205
 206         <listitem><para>Takes a space-separated list of Linux process
 207         capabilities (see
 208         <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 209         for details). The <varname>Capability=</varname> setting
 210         specifies additional capabilities to pass on top of the
 211         default set of capabilities. The
 212         <varname>DropCapability=</varname> setting specifies
 213         capabilities to drop from the default set. These settings
 214         correspond to the <option>--capability=</option> and
 215         <option>--drop-capability=</option> command line
 216         switches. Note that <varname>Capability=</varname> is a
 217         privileged setting, and only takes effect in
 218         <filename>.nspawn</filename> files in
 219         <filename>/etc/systemd/nspawn/</filename> and
 220         <filename>/run/system/nspawn/</filename> (see above). On the
 221         other hand, <varname>DropCapability=</varname> takes effect in
 222         all cases.</para></listitem>
 223       </varlistentry>
 224
 225       <varlistentry>
 226         <term><varname>NoNewPrivileges=</varname></term>
 227
 228         <listitem><para>Takes a boolean argument that controls the <constant>PR_SET_NO_NEW_PRIVS</constant> flag for
 229         the container payload. This is equivalent to the
 230         <option>--no-new-privileges=</option> command line switch. See
 231         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 232         details.</para>
 233         </listitem>
 234       </varlistentry>
 235
 236       <varlistentry>
 237         <term><varname>KillSignal=</varname></term>
 238
 239         <listitem><para>Specify the process signal to send to the
 240         container's PID 1 when nspawn itself receives SIGTERM, in
 241         order to trigger an orderly shutdown of the container.
 242         Defaults to SIGRTMIN+3 if <option>Boot=</option> is used
 243         (on systemd-compatible init systems SIGRTMIN+3 triggers an
 244         orderly shutdown). For a list of valid signals, see
 245         <citerefentry project='man-pages'><refentrytitle>signal</refentrytitle><manvolnum>7</manvolnum></citerefentry>.</para></listitem>
 246       </varlistentry>
 247
 248       <varlistentry>
 249         <term><varname>Personality=</varname></term>
 250
 251         <listitem><para>Configures the kernel personality for the
 252         container. This is equivalent to the
 253         <option>--personality=</option> switch.</para></listitem>
 254       </varlistentry>
 255
 256       <varlistentry>
 257         <term><varname>MachineID=</varname></term>
 258
 259         <listitem><para>Configures the 128-bit machine ID (UUID) to pass to
 260         the container. This is equivalent to the
 261         <option>--uuid=</option> command line switch. This option is
 262         privileged (see above). </para></listitem>
 263       </varlistentry>
 264
 265       <varlistentry>
 266         <term><varname>PrivateUsers=</varname></term>
 267
 268         <listitem><para>Configures support for usernamespacing. This is equivalent to the
 269         <option>--private-users=</option> command line switch, and takes the same options. This option is privileged
 270         (see above). This option is the default if the <filename>systemd-nspawn@.service</filename> template unit file
 271         is used.</para></listitem>
 272       </varlistentry>
 273
 274       <varlistentry>
 275         <term><varname>NotifyReady=</varname></term>
 276
 277         <listitem><para>Configures support for notifications from the container's init process.  This is equivalent to
 278         the <option>--notify-ready=</option> command line switch, and takes the same parameters. See
 279         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for details
 280         about the specific options supported.</para></listitem>
 281       </varlistentry>
 282
 283       <varlistentry>
 284         <term><varname>SystemCallFilter=</varname></term>
 285
 286         <listitem><para>Configures the system call filter applied to containers. This is equivalent to the
 287         <option>--system-call-filter=</option> command line switch, and takes the same list parameter. See
 288         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 289         details.</para></listitem>
 290       </varlistentry>
 291
 292       <varlistentry>
 293         <term><varname>LimitCPU=</varname></term>
 294         <term><varname>LimitFSIZE=</varname></term>
 295         <term><varname>LimitDATA=</varname></term>
 296         <term><varname>LimitSTACK=</varname></term>
 297         <term><varname>LimitCORE=</varname></term>
 298         <term><varname>LimitRSS=</varname></term>
 299         <term><varname>LimitNOFILE=</varname></term>
 300         <term><varname>LimitAS=</varname></term>
 301         <term><varname>LimitNPROC=</varname></term>
 302         <term><varname>LimitMEMLOCK=</varname></term>
 303         <term><varname>LimitLOCKS=</varname></term>
 304         <term><varname>LimitSIGPENDING=</varname></term>
 305         <term><varname>LimitMSGQUEUE=</varname></term>
 306         <term><varname>LimitNICE=</varname></term>
 307         <term><varname>LimitRTPRIO=</varname></term>
 308         <term><varname>LimitRTTIME=</varname></term>
 309
 310         <listitem><para>Configures various types of resource limits applied to containers. This is equivalent to the
 311         <option>--rlimit=</option> command line switch, and takes the same arguments. See
 312         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 313         details.</para></listitem>
 314       </varlistentry>
 315
 316       <varlistentry>
 317         <term><varname>OOMScoreAdjust=</varname></term>
 318
 319         <listitem><para>Configures the OOM score adjustment value. This is equivalent to the
 320         <option>--oom-score-adjust=</option> command line switch, and takes the same argument. See
 321         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 322         details.</para></listitem>
 323       </varlistentry>
 324
 325       <varlistentry>
 326         <term><varname>CPUAffinity=</varname></term>
 327
 328         <listitem><para>Configures the CPU affinity. This is equivalent to the <option>--cpu-affinity=</option> command
 329         line switch, and takes the same argument. See
 330         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 331         details.</para></listitem>
 332       </varlistentry>
 333
 334       <varlistentry>
 335         <term><varname>Hostname=</varname></term>
 336
 337         <listitem><para>Configures the kernel hostname set for the container. This is equivalent to the
 338         <option>--hostname=</option> command line switch, and takes the same argument. See
 339         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 340         details.</para></listitem>
 341       </varlistentry>
 342
 343       <varlistentry>
 344         <term><varname>ResolvConf=</varname></term>
 345
 346         <listitem><para>Configures how <filename>/etc/resolv.conf</filename> in the container shall be handled. This is
 347         equivalent to the <option>--resolv-conf=</option> command line switch, and takes the same argument. See
 348         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
 349         details.</para></listitem>
 350       </varlistentry>
 351
 352     </variablelist>
 353   </refsect1>
 354
 355   <refsect1>
 356     <title>[Files] Section Options</title>
 357
 358     <para>Settings files may include a <literal>[Files]</literal>
 359     section, which carries various parameters configuring the file
 360     system of the container:</para>
 361
 362     <variablelist>
 363
 364       <varlistentry>
 365         <term><varname>ReadOnly=</varname></term>
 366
 367         <listitem><para>Takes a boolean argument, which defaults to off. If
 368         specified, the container will be run with a read-only file
 369         system. This setting corresponds to the
 370         <option>--read-only</option> command line
 371         switch.</para></listitem>
 372       </varlistentry>
 373
 374       <varlistentry>
 375         <term><varname>Volatile=</varname></term>
 376
 377         <listitem><para>Takes a boolean argument, or the special value
 378         <literal>state</literal>. This configures whether to run the
 379         container with volatile state and/or configuration. This
 380         option is equivalent to <option>--volatile=</option>, see
 381         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 382         for details about the specific options
 383         supported.</para></listitem>
 384       </varlistentry>
 385
 386       <varlistentry>
 387         <term><varname>Bind=</varname></term>
 388         <term><varname>BindReadOnly=</varname></term>
 389
 390         <listitem><para>Adds a bind mount from the host into the
 391         container. Takes a single path, a pair of two paths separated
 392         by a colon, or a triplet of two paths plus an option string
 393         separated by colons. This option may be used multiple times to
 394         configure multiple bind mounts. This option is equivalent to
 395         the command line switches <option>--bind=</option> and
 396         <option>--bind-ro=</option>, see
 397         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 398         for details about the specific options supported. This setting
 399         is privileged (see above).</para></listitem>
 400       </varlistentry>
 401
 402       <varlistentry>
 403         <term><varname>TemporaryFileSystem=</varname></term>
 404
 405         <listitem><para>Adds a <literal>tmpfs</literal> mount to the
 406         container. Takes a path or a pair of path and option string,
 407         separated by a colon. This option may be used multiple times to
 408         configure multiple <literal>tmpfs</literal> mounts. This
 409         option is equivalent to the command line switch
 410         <option>--tmpfs=</option>, see
 411         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 412         for details about the specific options supported. This setting
 413         is privileged (see above).</para></listitem>
 414       </varlistentry>
 415
 416       <varlistentry>
 417         <term><varname>Overlay=</varname></term>
 418         <term><varname>OverlayReadOnly=</varname></term>
 419
 420         <listitem><para>Adds an overlay mount point. Takes a colon-separated list of paths.  This option may be used
 421         multiple times to configure multiple overlay mounts. This option is equivalent to the command line switches
 422         <option>--overlay=</option> and <option>--overlay-ro=</option>, see
 423         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry> for details
 424         about the specific options supported. This setting is privileged (see above).</para></listitem>
 425       </varlistentry>
 426
 427       <varlistentry>
 428         <term><varname>PrivateUsersChown=</varname></term>
 429
 430         <listitem><para>Configures whether the ownership of the files and directories in the container tree shall be
 431         adjusted to the UID/GID range used, if necessary and user namespacing is enabled. This is equivalent to the
 432         <option>--private-users-chown</option> command line switch. This option is privileged (see
 433         above). </para></listitem>
 434       </varlistentry>
 435
 436     </variablelist>
 437   </refsect1>
 438
 439   <refsect1>
 440     <title>[Network] Section Options</title>
 441
 442     <para>Settings files may include a <literal>[Network]</literal>
 443     section, which carries various parameters configuring the network
 444     connectivity of the container:</para>
 445
 446     <variablelist>
 447
 448       <varlistentry>
 449         <term><varname>Private=</varname></term>
 450
 451         <listitem><para>Takes a boolean argument, which defaults to off. If
 452         enabled, the container will run in its own network namespace
 453         and not share network interfaces and configuration with the
 454         host. This setting corresponds to the
 455         <option>--private-network</option> command line
 456         switch.</para></listitem>
 457       </varlistentry>
 458
 459       <varlistentry>
 460         <term><varname>VirtualEthernet=</varname></term>
 461
 462         <listitem><para>Takes a boolean argument. Configures whether to create a virtual Ethernet connection
 463         (<literal>veth</literal>) between host and the container. This setting implies
 464         <varname>Private=yes</varname>. This setting corresponds to the <option>--network-veth</option> command line
 465         switch. This option is privileged (see above). This option is the default if the
 466         <filename>systemd-nspawn@.service</filename> template unit file is used.</para></listitem>
 467       </varlistentry>
 468
 469       <varlistentry>
 470         <term><varname>VirtualEthernetExtra=</varname></term>
 471
 472         <listitem><para>Takes a colon-separated pair of interface
 473         names. Configures an additional virtual Ethernet connection
 474         (<literal>veth</literal>) between host and the container. The
 475         first specified name is the interface name on the host, the
 476         second the interface name in the container. The latter may be
 477         omitted in which case it is set to the same name as the host
 478         side interface. This setting implies
 479         <varname>Private=yes</varname>. This setting corresponds to
 480         the <option>--network-veth-extra=</option> command line
 481         switch, and maybe be used multiple times. It is independent of
 482         <varname>VirtualEthernet=</varname>. This option is privileged
 483         (see above).</para></listitem>
 484       </varlistentry>
 485
 486       <varlistentry>
 487         <term><varname>Interface=</varname></term>
 488
 489         <listitem><para>Takes a space-separated list of interfaces to
 490         add to the container. This option corresponds to the
 491         <option>--network-interface=</option> command line switch and
 492         implies <varname>Private=yes</varname>. This option is
 493         privileged (see above).</para></listitem>
 494       </varlistentry>
 495
 496       <varlistentry>
 497         <term><varname>MACVLAN=</varname></term>
 498         <term><varname>IPVLAN=</varname></term>
 499
 500         <listitem><para>Takes a space-separated list of interfaces to
 501         add MACLVAN or IPVLAN interfaces to, which are then added to
 502         the container. These options correspond to the
 503         <option>--network-macvlan=</option> and
 504         <option>--network-ipvlan=</option> command line switches and
 505         imply <varname>Private=yes</varname>. These options are
 506         privileged (see above).</para></listitem>
 507       </varlistentry>
 508
 509       <varlistentry>
 510         <term><varname>Bridge=</varname></term>
 511
 512         <listitem><para>Takes an interface name. This setting implies
 513         <varname>VirtualEthernet=yes</varname> and
 514         <varname>Private=yes</varname> and has the effect that the
 515         host side of the created virtual Ethernet link is connected to
 516         the specified bridge interface. This option corresponds to the
 517         <option>--network-bridge=</option> command line switch. This
 518         option is privileged (see above).</para></listitem>
 519       </varlistentry>
 520
 521       <varlistentry>
 522         <term><varname>Zone=</varname></term>
 523
 524         <listitem><para>Takes a network zone name. This setting implies <varname>VirtualEthernet=yes</varname> and
 525         <varname>Private=yes</varname> and has the effect that the host side of the created virtual Ethernet link is
 526         connected to an automatically managed bridge interface named after the passed argument, prefixed with
 527         <literal>vz-</literal>. This option corresponds to the <option>--network-zone=</option> command line
 528         switch. This option is privileged (see above).</para></listitem>
 529       </varlistentry>
 530
 531       <varlistentry>
 532         <term><varname>Port=</varname></term>
 533
 534         <listitem><para>Exposes a TCP or UDP port of the container on
 535         the host. This option corresponds to the
 536         <option>--port=</option> command line switch, see
 537         <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 538         for the precise syntax of the argument this option takes. This
 539         option is privileged (see above).</para></listitem>
 540       </varlistentry>
 541     </variablelist>
 542   </refsect1>
 543
 544   <refsect1>
 545     <title>See Also</title>
 546     <para>
 547       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 548       <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 549       <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 550     </para>
 551   </refsect1>
 552
 553 </refentry>