]>
Commit | Line | Data |
---|---|---|
359deb60 | 1 | <?xml version='1.0'?> <!--*-nxml-*--> |
3a54a157 | 2 | <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" |
eea10b26 | 3 | "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd"> |
db9ecf05 | 4 | <!-- SPDX-License-Identifier: LGPL-2.1-or-later --> |
359deb60 | 5 | |
bb5a34fb | 6 | <refentry id="systemd-analyze" conditional='ENABLE_ANALYZE' |
798d3a52 ZJS |
7 | xmlns:xi="http://www.w3.org/2001/XInclude"> |
8 | ||
9 | <refentryinfo> | |
10 | <title>systemd-analyze</title> | |
11 | <productname>systemd</productname> | |
798d3a52 ZJS |
12 | </refentryinfo> |
13 | ||
14 | <refmeta> | |
15 | <refentrytitle>systemd-analyze</refentrytitle> | |
16 | <manvolnum>1</manvolnum> | |
17 | </refmeta> | |
18 | ||
19 | <refnamediv> | |
20 | <refname>systemd-analyze</refname> | |
889d695d | 21 | <refpurpose>Analyze and debug system manager</refpurpose> |
798d3a52 ZJS |
22 | </refnamediv> |
23 | ||
24 | <refsynopsisdiv> | |
25 | <cmdsynopsis> | |
26 | <command>systemd-analyze</command> | |
27 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
28 | <arg>time</arg> | |
29 | </cmdsynopsis> | |
30 | <cmdsynopsis> | |
31 | <command>systemd-analyze</command> | |
32 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
33 | <arg choice="plain">blame</arg> | |
34 | </cmdsynopsis> | |
35 | <cmdsynopsis> | |
36 | <command>systemd-analyze</command> | |
37 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
38 | <arg choice="plain">critical-chain</arg> | |
39 | <arg choice="opt" rep="repeat"><replaceable>UNIT</replaceable></arg> | |
40 | </cmdsynopsis> | |
d323a990 | 41 | |
854a42fb ZJS |
42 | <cmdsynopsis> |
43 | <command>systemd-analyze</command> | |
44 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
d323a990 | 45 | <arg choice="plain">dump</arg> |
d1d8786c | 46 | <arg choice="opt" rep="repeat"><replaceable>PATTERN</replaceable></arg> |
854a42fb | 47 | </cmdsynopsis> |
d323a990 | 48 | |
31a5924e ZJS |
49 | <cmdsynopsis> |
50 | <command>systemd-analyze</command> | |
51 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
d323a990 ZJS |
52 | <arg choice="plain">plot</arg> |
53 | <arg choice="opt">>file.svg</arg> | |
31a5924e | 54 | </cmdsynopsis> |
798d3a52 ZJS |
55 | <cmdsynopsis> |
56 | <command>systemd-analyze</command> | |
57 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
d323a990 ZJS |
58 | <arg choice="plain">dot</arg> |
59 | <arg choice="opt" rep="repeat"><replaceable>PATTERN</replaceable></arg> | |
60 | <arg choice="opt">>file.dot</arg> | |
798d3a52 | 61 | </cmdsynopsis> |
d323a990 | 62 | |
aff13177 LP |
63 | <cmdsynopsis> |
64 | <command>systemd-analyze</command> | |
65 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
66 | <arg choice="plain">unit-files</arg> | |
67 | </cmdsynopsis> | |
213cf5b1 LP |
68 | <cmdsynopsis> |
69 | <command>systemd-analyze</command> | |
70 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
d323a990 | 71 | <arg choice="plain">unit-paths</arg> |
ef5a8cb1 | 72 | </cmdsynopsis> |
76ed04d9 ZJS |
73 | <cmdsynopsis> |
74 | <command>systemd-analyze</command> | |
75 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
5238d9a8 LP |
76 | <arg choice="plain">exit-status</arg> |
77 | <arg choice="opt" rep="repeat"><replaceable>STATUS</replaceable></arg> | |
76ed04d9 | 78 | </cmdsynopsis> |
b2af819b LP |
79 | <cmdsynopsis> |
80 | <command>systemd-analyze</command> | |
81 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
82 | <arg choice="plain">capability</arg> | |
83 | <arg choice="opt" rep="repeat"><replaceable>CAPABILITY</replaceable></arg> | |
84 | </cmdsynopsis> | |
edfea9fe ZJS |
85 | <cmdsynopsis> |
86 | <command>systemd-analyze</command> | |
87 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
88 | <arg choice="plain">condition</arg> | |
89 | <arg choice="plain"><replaceable>CONDITION</replaceable>…</arg> | |
90 | </cmdsynopsis> | |
869feb33 ZJS |
91 | <cmdsynopsis> |
92 | <command>systemd-analyze</command> | |
93 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
94 | <arg choice="plain">syscall-filter</arg> | |
1eecafb8 | 95 | <arg choice="opt"><replaceable>SET</replaceable>…</arg> |
869feb33 | 96 | </cmdsynopsis> |
20080622 ILG |
97 | <cmdsynopsis> |
98 | <command>systemd-analyze</command> | |
99 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
100 | <arg choice="plain">filesystems</arg> | |
101 | <arg choice="opt"><replaceable>SET</replaceable>…</arg> | |
102 | </cmdsynopsis> | |
798d3a52 ZJS |
103 | <cmdsynopsis> |
104 | <command>systemd-analyze</command> | |
105 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
d323a990 | 106 | <arg choice="plain">calendar</arg> |
2cae4711 ZJS |
107 | <arg choice="plain" rep="repeat"><replaceable>SPEC</replaceable></arg> |
108 | </cmdsynopsis> | |
109 | <cmdsynopsis> | |
110 | <command>systemd-analyze</command> | |
111 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
112 | <arg choice="plain">timestamp</arg> | |
113 | <arg choice="plain" rep="repeat"><replaceable>TIMESTAMP</replaceable></arg> | |
798d3a52 | 114 | </cmdsynopsis> |
6d86f4bd LP |
115 | <cmdsynopsis> |
116 | <command>systemd-analyze</command> | |
117 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
d323a990 ZJS |
118 | <arg choice="plain">timespan</arg> |
119 | <arg choice="plain" rep="repeat"><replaceable>SPAN</replaceable></arg> | |
6d86f4bd | 120 | </cmdsynopsis> |
889d695d JK |
121 | <cmdsynopsis> |
122 | <command>systemd-analyze</command> | |
123 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
d323a990 ZJS |
124 | <arg choice="plain">cat-config</arg> |
125 | <arg choice="plain" rep="repeat"><replaceable>NAME</replaceable>|<replaceable>PATH</replaceable></arg> | |
889d695d | 126 | </cmdsynopsis> |
bc012a3e ZJS |
127 | <cmdsynopsis> |
128 | <command>systemd-analyze</command> | |
129 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
130 | <arg choice="plain">compare-versions</arg> | |
131 | <arg choice="plain"><replaceable>VERSION1</replaceable></arg> | |
132 | <arg choice="opt"><replaceable>OP</replaceable></arg> | |
133 | <arg choice="plain"><replaceable>VERSION2</replaceable></arg> | |
134 | </cmdsynopsis> | |
3f1c1287 CD |
135 | <cmdsynopsis> |
136 | <command>systemd-analyze</command> | |
137 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
d323a990 | 138 | <arg choice="plain">verify</arg> |
ca029693 | 139 | <arg choice="plain" rep="repeat"><replaceable>FILE</replaceable></arg> |
3f1c1287 | 140 | </cmdsynopsis> |
ee93c1e6 LP |
141 | <cmdsynopsis> |
142 | <command>systemd-analyze</command> | |
143 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
144 | <arg choice="plain">security</arg> | |
ca029693 | 145 | <arg choice="opt" rep="repeat"><replaceable>UNIT</replaceable></arg> |
ee93c1e6 | 146 | </cmdsynopsis> |
aff13177 LP |
147 | <cmdsynopsis> |
148 | <command>systemd-analyze</command> | |
149 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
150 | <arg choice="plain">inspect-elf</arg> | |
151 | <arg choice="plain" rep="repeat"><replaceable>FILE</replaceable></arg> | |
152 | </cmdsynopsis> | |
f50535af LB |
153 | <cmdsynopsis> |
154 | <command>systemd-analyze</command> | |
155 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
156 | <arg choice="plain">malloc</arg> | |
157 | <arg choice="opt" rep="repeat"><replaceable>D-BUS SERVICE</replaceable></arg> | |
158 | </cmdsynopsis> | |
5f43c97c LP |
159 | <cmdsynopsis> |
160 | <command>systemd-analyze</command> | |
161 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
162 | <arg choice="plain">fdstore</arg> | |
ca029693 | 163 | <arg choice="plain" rep="repeat"><replaceable>UNIT</replaceable></arg> |
5f43c97c | 164 | </cmdsynopsis> |
9ea81191 LP |
165 | <cmdsynopsis> |
166 | <command>systemd-analyze</command> | |
167 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
168 | <arg choice="plain">image-policy</arg> | |
169 | <arg choice="plain" rep="repeat"><replaceable>POLICY</replaceable></arg> | |
170 | </cmdsynopsis> | |
f70c90f5 LP |
171 | <cmdsynopsis> |
172 | <command>systemd-analyze</command> | |
173 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
174 | <arg choice="plain">pcrs</arg> | |
175 | <arg choice="opt" rep="repeat"><replaceable>PCR</replaceable></arg> | |
176 | </cmdsynopsis> | |
d30693f3 LP |
177 | <cmdsynopsis> |
178 | <command>systemd-analyze</command> | |
179 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
df93996f | 180 | <arg choice="plain">srk</arg> |
0615abef | 181 | <arg choice="opt"><replaceable>>FILE</replaceable></arg> |
d30693f3 | 182 | </cmdsynopsis> |
fb8cc599 LP |
183 | <cmdsynopsis> |
184 | <command>systemd-analyze</command> | |
185 | <arg choice="opt" rep="repeat">OPTIONS</arg> | |
186 | <arg choice="plain">architectures</arg> | |
187 | <arg choice="opt" rep="repeat"><replaceable>NAME</replaceable></arg> | |
188 | </cmdsynopsis> | |
798d3a52 ZJS |
189 | </refsynopsisdiv> |
190 | ||
191 | <refsect1> | |
192 | <title>Description</title> | |
193 | ||
194 | <para><command>systemd-analyze</command> may be used to determine | |
195 | system boot-up performance statistics and retrieve other state and | |
196 | tracing information from the system and service manager, and to | |
889d695d JK |
197 | verify the correctness of unit files. It is also used to access |
198 | special functions useful for advanced system manager debugging.</para> | |
798d3a52 | 199 | |
d323a990 ZJS |
200 | <para>If no command is passed, <command>systemd-analyze |
201 | time</command> is implied.</para> | |
854a42fb | 202 | |
d323a990 ZJS |
203 | <refsect2> |
204 | <title><command>systemd-analyze time</command></title> | |
205 | ||
206 | <para>This command prints the time spent in the kernel before userspace has been reached, the time | |
55c041b4 LP |
207 | spent in the initrd before normal system userspace has been reached, and the time normal system |
208 | userspace took to initialize. Note that these measurements simply measure the time passed up to the | |
209 | point where all system services have been spawned, but not necessarily until they fully finished | |
210 | initialization or the disk is idle.</para> | |
d323a990 ZJS |
211 | |
212 | <example> | |
213 | <title><command>Show how long the boot took</command></title> | |
214 | ||
215 | <programlisting># in a container | |
216 | $ systemd-analyze time | |
217 | Startup finished in 296ms (userspace) | |
218 | multi-user.target reached after 275ms in userspace | |
219 | ||
220 | # on a real machine | |
221 | $ systemd-analyze time | |
222 | Startup finished in 2.584s (kernel) + 19.176s (initrd) + 47.847s (userspace) = 1min 9.608s | |
223 | multi-user.target reached after 47.820s in userspace | |
224 | </programlisting> | |
225 | </example> | |
226 | </refsect2> | |
227 | ||
228 | <refsect2> | |
229 | <title><command>systemd-analyze blame</command></title> | |
230 | ||
231 | <para>This command prints a list of all running units, ordered by the time they took to initialize. | |
232 | This information may be used to optimize boot-up times. Note that the output might be misleading as the | |
233 | initialization of one service might be slow simply because it waits for the initialization of another | |
234 | service to complete. Also note: <command>systemd-analyze blame</command> doesn't display results for | |
235 | services with <varname>Type=simple</varname>, because systemd considers such services to be started | |
15b0fdd5 LP |
236 | immediately, hence no measurement of the initialization delays can be done. Also note that this command |
237 | only shows the time units took for starting up, it does not show how long unit jobs spent in the | |
238 | execution queue. In particular it shows the time units spent in <literal>activating</literal> state, | |
239 | which is not defined for units such as device units that transition directly from | |
240 | <literal>inactive</literal> to <literal>active</literal>. This command hence gives an impression of the | |
241 | performance of program code, but cannot accurately reflect latency introduced by waiting for | |
242 | hardware and similar events.</para> | |
d323a990 ZJS |
243 | |
244 | <example> | |
245 | <title><command>Show which units took the most time during boot</command></title> | |
246 | ||
247 | <programlisting>$ systemd-analyze blame | |
248 | 32.875s pmlogger.service | |
249 | 20.905s systemd-networkd-wait-online.service | |
250 | 13.299s dev-vda1.device | |
251 | ... | |
252 | 23ms sysroot.mount | |
253 | 11ms initrd-udevadm-cleanup-db.service | |
254 | 3ms sys-kernel-config.mount | |
255 | </programlisting> | |
256 | </example> | |
257 | </refsect2> | |
258 | ||
259 | <refsect2> | |
260 | <title><command>systemd-analyze critical-chain <optional><replaceable>UNIT</replaceable>...</optional></command></title> | |
261 | ||
262 | <para>This command prints a tree of the time-critical chain of units (for each of the specified | |
263 | <replaceable>UNIT</replaceable>s or for the default target otherwise). The time after the unit is | |
264 | active or started is printed after the "@" character. The time the unit takes to start is printed after | |
265 | the "+" character. Note that the output might be misleading as the initialization of services might | |
15102ced | 266 | depend on socket activation and because of the parallel execution of units. Also, similarly to the |
15b0fdd5 LP |
267 | <command>blame</command> command, this only takes into account the time units spent in |
268 | <literal>activating</literal> state, and hence does not cover units that never went through an | |
269 | <literal>activating</literal> state (such as device units that transition directly from | |
270 | <literal>inactive</literal> to <literal>active</literal>). Moreover it does not show information on | |
271 | jobs (and in particular not jobs that timed out).</para> | |
d323a990 ZJS |
272 | |
273 | <example> | |
be78e0f0 | 274 | <title><command>systemd-analyze critical-chain</command></title> |
d323a990 ZJS |
275 | |
276 | <programlisting>$ systemd-analyze critical-chain | |
277 | multi-user.target @47.820s | |
278 | └─pmie.service @35.968s +548ms | |
279 | └─pmcd.service @33.715s +2.247s | |
280 | └─network-online.target @33.712s | |
281 | └─systemd-networkd-wait-online.service @12.804s +20.905s | |
282 | └─systemd-networkd.service @11.109s +1.690s | |
283 | └─systemd-udevd.service @9.201s +1.904s | |
284 | └─systemd-tmpfiles-setup-dev.service @7.306s +1.776s | |
285 | └─kmod-static-nodes.service @6.976s +177ms | |
286 | └─systemd-journald.socket | |
287 | └─system.slice | |
288 | └─-.slice | |
289 | </programlisting> | |
290 | </example> | |
291 | </refsect2> | |
292 | ||
d323a990 | 293 | <refsect2> |
d1d8786c | 294 | <title><command>systemd-analyze dump [<replaceable>pattern</replaceable>…]</command></title> |
d323a990 | 295 | |
d1d8786c FB |
296 | <para>Without any parameter, this command outputs a (usually very long) human-readable serialization of |
297 | the complete service manager state. Optional glob pattern may be specified, causing the output to be | |
298 | limited to units whose names match one of the patterns. The output format is subject to change without | |
d9365956 | 299 | notice and should not be parsed by applications. This command is rate limited for unprivileged users.</para> |
d323a990 ZJS |
300 | |
301 | <example> | |
302 | <title>Show the internal state of user manager</title> | |
303 | ||
304 | <programlisting>$ systemd-analyze --user dump | |
305 | Timestamp userspace: Thu 2019-03-14 23:28:07 CET | |
306 | Timestamp finish: Thu 2019-03-14 23:28:07 CET | |
307 | Timestamp generators-start: Thu 2019-03-14 23:28:07 CET | |
308 | Timestamp generators-finish: Thu 2019-03-14 23:28:07 CET | |
309 | Timestamp units-load-start: Thu 2019-03-14 23:28:07 CET | |
310 | Timestamp units-load-finish: Thu 2019-03-14 23:28:07 CET | |
311 | -> Unit proc-timer_list.mount: | |
312 | Description: /proc/timer_list | |
313 | ... | |
314 | -> Unit default.target: | |
315 | Description: Main user target | |
316 | ... | |
317 | </programlisting> | |
318 | </example> | |
319 | </refsect2> | |
320 | ||
f50535af LB |
321 | <refsect2> |
322 | <title><command>systemd-analyze malloc [<replaceable>D-Bus service</replaceable>…]</command></title> | |
323 | ||
324 | <para>This command can be used to request the output of the internal memory state (as returned by | |
9140404a ZJS |
325 | <citerefentry project='man-pages'><refentrytitle>malloc_info</refentrytitle><manvolnum>3</manvolnum></citerefentry>) |
326 | of a D-Bus service. If no service is specified, the query will be sent to | |
f50535af | 327 | <filename>org.freedesktop.systemd1</filename> (the system or user service manager). The output format |
9140404a ZJS |
328 | is not guaranteed to be stable and should not be parsed by applications.</para> |
329 | ||
330 | <para>The service must implement the <filename>org.freedesktop.MemoryAllocation1</filename> interface. | |
331 | In the systemd suite, it is currently only implemented by the manager.</para> | |
f50535af LB |
332 | </refsect2> |
333 | ||
d323a990 ZJS |
334 | <refsect2> |
335 | <title><command>systemd-analyze plot</command></title> | |
336 | ||
dc57a338 | 337 | <para>This command prints either an SVG graphic, detailing which system services have been started at what |
338 | time, highlighting the time they spent on initialization, or the raw time data in JSON or table format.</para> | |
d323a990 ZJS |
339 | |
340 | <example> | |
341 | <title><command>Plot a bootchart</command></title> | |
342 | ||
343 | <programlisting>$ systemd-analyze plot >bootup.svg | |
344 | $ eog bootup.svg& | |
345 | </programlisting> | |
346 | </example> | |
c96ec630 LP |
347 | |
348 | <para>Note that this plot is based on the most recent per-unit timing data of loaded units. This means | |
349 | that if a unit gets started, then stopped and then started again the information shown will cover the | |
350 | most recent start cycle, not the first one. Thus it's recommended to consult this information only | |
351 | shortly after boot, so that this distinction doesn't matter. Moreover, units that are not referenced by | |
352 | any other unit through a dependency might be unloaded by the service manager once they terminate (and | |
353 | did not fail). Such units will not show up in the plot.</para> | |
d323a990 ZJS |
354 | </refsect2> |
355 | ||
356 | <refsect2> | |
357 | <title><command>systemd-analyze dot [<replaceable>pattern</replaceable>...]</command></title> | |
358 | ||
359 | <para>This command generates textual dependency graph description in dot format for further processing | |
360 | with the GraphViz | |
361 | <citerefentry project='die-net'><refentrytitle>dot</refentrytitle><manvolnum>1</manvolnum></citerefentry> | |
362 | tool. Use a command line like <command>systemd-analyze dot | dot -Tsvg >systemd.svg</command> to | |
363 | generate a graphical dependency tree. Unless <option>--order</option> or <option>--require</option> is | |
364 | passed, the generated graph will show both ordering and requirement dependencies. Optional pattern | |
365 | globbing style specifications (e.g. <filename>*.target</filename>) may be given at the end. A unit | |
366 | dependency is included in the graph if any of these patterns match either the origin or destination | |
367 | node.</para> | |
368 | ||
369 | <example> | |
370 | <title>Plot all dependencies of any unit whose name starts with <literal>avahi-daemon</literal> | |
371 | </title> | |
372 | ||
373 | <programlisting>$ systemd-analyze dot 'avahi-daemon.*' | dot -Tsvg >avahi.svg | |
374 | $ eog avahi.svg</programlisting> | |
375 | </example> | |
376 | ||
377 | <example> | |
378 | <title>Plot the dependencies between all known target units</title> | |
379 | ||
380 | <programlisting>$ systemd-analyze dot --to-pattern='*.target' --from-pattern='*.target' \ | |
381 | | dot -Tsvg >targets.svg | |
382 | $ eog targets.svg</programlisting> | |
383 | </example> | |
384 | </refsect2> | |
385 | ||
386 | <refsect2> | |
387 | <title><command>systemd-analyze unit-paths</command></title> | |
388 | ||
389 | <para>This command outputs a list of all directories from which unit files, <filename>.d</filename> | |
390 | overrides, and <filename>.wants</filename>, <filename>.requires</filename> symlinks may be | |
391 | loaded. Combine with <option>--user</option> to retrieve the list for the user manager instance, and | |
392 | <option>--global</option> for the global configuration of user manager instances.</para> | |
393 | ||
394 | <example> | |
395 | <title><command>Show all paths for generated units</command></title> | |
396 | ||
397 | <programlisting>$ systemd-analyze unit-paths | grep '^/run' | |
398 | /run/systemd/system.control | |
399 | /run/systemd/transient | |
400 | /run/systemd/generator.early | |
401 | /run/systemd/system | |
402 | /run/systemd/system.attached | |
403 | /run/systemd/generator | |
404 | /run/systemd/generator.late | |
405 | </programlisting> | |
406 | </example> | |
407 | ||
408 | <para>Note that this verb prints the list that is compiled into <command>systemd-analyze</command> | |
5238e957 | 409 | itself, and does not communicate with the running manager. Use |
d323a990 ZJS |
410 | <programlisting>systemctl [--user] [--global] show -p UnitPath --value</programlisting> |
411 | to retrieve the actual list that the manager uses, with any empty directories omitted.</para> | |
412 | </refsect2> | |
413 | ||
76ed04d9 | 414 | <refsect2> |
5238d9a8 | 415 | <title><command>systemd-analyze exit-status <optional><replaceable>STATUS</replaceable>...</optional></command></title> |
76ed04d9 | 416 | |
5238d9a8 | 417 | <para>This command prints a list of exit statuses along with their "class", i.e. the source of the |
76ed04d9 ZJS |
418 | definition (one of <literal>glibc</literal>, <literal>systemd</literal>, <literal>LSB</literal>, or |
419 | <literal>BSD</literal>), see the Process Exit Codes section in | |
420 | <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>. | |
fa027117 | 421 | If no additional arguments are specified, all known statuses are shown. Otherwise, only the |
76ed04d9 ZJS |
422 | definitions for the specified codes are shown.</para> |
423 | ||
424 | <example> | |
5238d9a8 LP |
425 | <title><command>Show some example exit status names</command></title> |
426 | ||
427 | <programlisting>$ systemd-analyze exit-status 0 1 {63..65} | |
428 | NAME STATUS CLASS | |
429 | SUCCESS 0 glibc | |
430 | FAILURE 1 glibc | |
431 | - 63 - | |
432 | USAGE 64 BSD | |
433 | DATAERR 65 BSD | |
76ed04d9 ZJS |
434 | </programlisting> |
435 | </example> | |
436 | </refsect2> | |
437 | ||
b2af819b LP |
438 | <refsect2> |
439 | <title><command>systemd-analyze capability <optional><replaceable>CAPABILITY</replaceable>...</optional></command></title> | |
440 | ||
441 | <para>This command prints a list of Linux capabilities along with their numeric IDs. See <citerefentry | |
442 | project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry> | |
443 | for details. If no argument is specified the full list of capabilities known to the service manager and | |
444 | the kernel is shown. Capabilities defined by the kernel but not known to the service manager are shown | |
445 | as <literal>cap_???</literal>. Optionally, if arguments are specified they may refer to specific | |
446 | cabilities by name or numeric ID, in which case only the indicated capabilities are shown in the | |
447 | table.</para> | |
448 | ||
449 | <example> | |
450 | <title><command>Show some example capability names</command></title> | |
451 | ||
452 | <programlisting>$ systemd-analyze capability 0 1 {30..32} | |
453 | NAME NUMBER | |
454 | cap_chown 0 | |
455 | cap_dac_override 1 | |
456 | cap_audit_control 30 | |
457 | cap_setfcap 31 | |
458 | cap_mac_override 32</programlisting> | |
459 | </example> | |
460 | </refsect2> | |
461 | ||
edfea9fe ZJS |
462 | <refsect2> |
463 | <title><command>systemd-analyze condition <replaceable>CONDITION</replaceable>...</command></title> | |
464 | ||
b0343f8c ZJS |
465 | <para>This command will evaluate <varname index="false">Condition*=...</varname> and |
466 | <varname index="false">Assert*=...</varname> assignments, and print their values, and | |
edfea9fe ZJS |
467 | the resulting value of the combined condition set. See |
468 | <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry> | |
469 | for a list of available conditions and asserts.</para> | |
470 | ||
471 | <example> | |
472 | <title>Evaluate conditions that check kernel versions</title> | |
473 | ||
474 | <programlisting>$ systemd-analyze condition 'ConditionKernelVersion = ! <4.0' \ | |
475 | 'ConditionKernelVersion = >=5.1' \ | |
476 | 'ConditionACPower=|false' \ | |
477 | 'ConditionArchitecture=|!arm' \ | |
478 | 'AssertPathExists=/etc/os-release' | |
479 | test.service: AssertPathExists=/etc/os-release succeeded. | |
480 | Asserts succeeded. | |
481 | test.service: ConditionArchitecture=|!arm succeeded. | |
482 | test.service: ConditionACPower=|false failed. | |
483 | test.service: ConditionKernelVersion=>=5.1 succeeded. | |
484 | test.service: ConditionKernelVersion=!<4.0 succeeded. | |
485 | Conditions succeeded.</programlisting> | |
486 | </example> | |
487 | </refsect2> | |
488 | ||
d323a990 ZJS |
489 | <refsect2> |
490 | <title><command>systemd-analyze syscall-filter <optional><replaceable>SET</replaceable>...</optional></command></title> | |
491 | ||
492 | <para>This command will list system calls contained in the specified system call set | |
493 | <replaceable>SET</replaceable>, or all known sets if no sets are specified. Argument | |
494 | <replaceable>SET</replaceable> must include the <literal>@</literal> prefix.</para> | |
495 | </refsect2> | |
496 | ||
20080622 ILG |
497 | <refsect2> |
498 | <title><command>systemd-analyze filesystems <optional><replaceable>SET</replaceable>...</optional></command></title> | |
499 | ||
500 | <para>This command will list filesystems in the specified filesystem set | |
501 | <replaceable>SET</replaceable>, or all known sets if no sets are specified. Argument | |
502 | <replaceable>SET</replaceable> must include the <literal>@</literal> prefix.</para> | |
503 | </refsect2> | |
504 | ||
d323a990 ZJS |
505 | <refsect2> |
506 | <title><command>systemd-analyze calendar <replaceable>EXPRESSION</replaceable>...</command></title> | |
507 | ||
508 | <para>This command will parse and normalize repetitive calendar time events, and will calculate when | |
509 | they elapse next. This takes the same input as the <varname>OnCalendar=</varname> setting in | |
510 | <citerefentry><refentrytitle>systemd.timer</refentrytitle><manvolnum>5</manvolnum></citerefentry>, | |
511 | following the syntax described in | |
512 | <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>. By | |
513 | default, only the next time the calendar expression will elapse is shown; use | |
514 | <option>--iterations=</option> to show the specified number of next times the expression | |
2cae4711 ZJS |
515 | elapses. Each time the expression elapses forms a timestamp, see the <command>timestamp</command> |
516 | verb below.</para> | |
d323a990 ZJS |
517 | |
518 | <example> | |
519 | <title>Show leap days in the near future</title> | |
520 | ||
521 | <programlisting>$ systemd-analyze calendar --iterations=5 '*-2-29 0:0:0' | |
522 | Original form: *-2-29 0:0:0 | |
523 | Normalized form: *-02-29 00:00:00 | |
524 | Next elapse: Sat 2020-02-29 00:00:00 UTC | |
525 | From now: 11 months 15 days left | |
526 | Iter. #2: Thu 2024-02-29 00:00:00 UTC | |
527 | From now: 4 years 11 months left | |
528 | Iter. #3: Tue 2028-02-29 00:00:00 UTC | |
529 | From now: 8 years 11 months left | |
530 | Iter. #4: Sun 2032-02-29 00:00:00 UTC | |
531 | From now: 12 years 11 months left | |
532 | Iter. #5: Fri 2036-02-29 00:00:00 UTC | |
533 | From now: 16 years 11 months left | |
534 | </programlisting> | |
535 | </example> | |
536 | </refsect2> | |
537 | ||
2cae4711 ZJS |
538 | <refsect2> |
539 | <title><command>systemd-analyze timestamp <replaceable>TIMESTAMP</replaceable>...</command></title> | |
540 | ||
541 | <para>This command parses a timestamp (i.e. a single point in time) and outputs the normalized form and | |
542 | the difference between this timestamp and now. The timestamp should adhere to the syntax documented in | |
543 | <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>, | |
544 | section "PARSING TIMESTAMPS".</para> | |
545 | ||
546 | <example> | |
547 | <title>Show parsing of timestamps</title> | |
548 | ||
549 | <programlisting>$ systemd-analyze timestamp yesterday now tomorrow | |
550 | Original form: yesterday | |
ea62aa24 ZJS |
551 | Normalized form: Mon 2019-05-20 00:00:00 CEST |
552 | (in UTC): Sun 2019-05-19 22:00:00 UTC | |
553 | UNIX seconds: @15583032000 | |
2cae4711 ZJS |
554 | From now: 1 day 9h ago |
555 | ||
556 | Original form: now | |
ea62aa24 ZJS |
557 | Normalized form: Tue 2019-05-21 09:48:39 CEST |
558 | (in UTC): Tue 2019-05-21 07:48:39 UTC | |
559 | UNIX seconds: @1558424919.659757 | |
560 | From now: 43us ago | |
2cae4711 ZJS |
561 | |
562 | Original form: tomorrow | |
ea62aa24 ZJS |
563 | Normalized form: Wed 2019-05-22 00:00:00 CEST |
564 | (in UTC): Tue 2019-05-21 22:00:00 UTC | |
565 | UNIX seconds: @15584760000 | |
2cae4711 ZJS |
566 | From now: 14h left |
567 | </programlisting> | |
568 | </example> | |
569 | </refsect2> | |
570 | ||
d323a990 ZJS |
571 | <refsect2> |
572 | <title><command>systemd-analyze timespan <replaceable>EXPRESSION</replaceable>...</command></title> | |
573 | ||
2cae4711 ZJS |
574 | <para>This command parses a time span (i.e. a difference between two timestamps) and outputs the |
575 | normalized form and the equivalent value in microseconds. The time span should adhere to the syntax | |
576 | documented in | |
577 | <citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry>, | |
578 | section "PARSING TIME SPANS". Values without units are parsed as seconds.</para> | |
d323a990 ZJS |
579 | |
580 | <example> | |
581 | <title>Show parsing of timespans</title> | |
582 | ||
583 | <programlisting>$ systemd-analyze timespan 1s 300s '1year 0.000001s' | |
584 | Original: 1s | |
585 | μs: 1000000 | |
586 | Human: 1s | |
587 | ||
588 | Original: 300s | |
589 | μs: 300000000 | |
590 | Human: 5min | |
591 | ||
592 | Original: 1year 0.000001s | |
593 | μs: 31557600000001 | |
594 | Human: 1y 1us | |
595 | </programlisting> | |
596 | </example> | |
597 | </refsect2> | |
598 | ||
599 | <refsect2> | |
600 | <title><command>systemd-analyze cat-config</command> | |
601 | <replaceable>NAME</replaceable>|<replaceable>PATH</replaceable>...</title> | |
602 | ||
603 | <para>This command is similar to <command>systemctl cat</command>, but operates on config files. It | |
604 | will copy the contents of a config file and any drop-ins to standard output, using the usual systemd | |
605 | set of directories and rules for precedence. Each argument must be either an absolute path including | |
606 | the prefix (such as <filename>/etc/systemd/logind.conf</filename> or | |
607 | <filename>/usr/lib/systemd/logind.conf</filename>), or a name relative to the prefix (such as | |
608 | <filename>systemd/logind.conf</filename>).</para> | |
609 | ||
610 | <example> | |
611 | <title>Showing logind configuration</title> | |
612 | <programlisting>$ systemd-analyze cat-config systemd/logind.conf | |
854a42fb | 613 | # /etc/systemd/logind.conf |
854a42fb ZJS |
614 | ... |
615 | [Login] | |
616 | NAutoVTs=8 | |
617 | ... | |
618 | ||
619 | # /usr/lib/systemd/logind.conf.d/20-test.conf | |
620 | ... some override from another package | |
621 | ||
622 | # /etc/systemd/logind.conf.d/50-override.conf | |
1b2ad5d9 | 623 | ... some administrator override |
d323a990 ZJS |
624 | </programlisting> |
625 | </example> | |
626 | </refsect2> | |
ee93c1e6 | 627 | |
bc012a3e ZJS |
628 | <refsect2> |
629 | <title><command>systemd-analyze compare-versions | |
630 | <replaceable>VERSION1</replaceable> | |
631 | <optional><replaceable>OP</replaceable></optional> | |
632 | <replaceable>VERSION2</replaceable></command></title> | |
633 | ||
634 | <para>This command has two distinct modes of operation, depending on whether the operator | |
635 | <replaceable>OP</replaceable> is specified.</para> | |
636 | ||
637 | <para>In the first mode — when <replaceable>OP</replaceable> is not specified — it will compare the two | |
638 | version strings and print either <literal><replaceable>VERSION1</replaceable> < | |
639 | <replaceable>VERSION2</replaceable></literal>, or <literal><replaceable>VERSION1</replaceable> == | |
640 | <replaceable>VERSION2</replaceable></literal>, or <literal><replaceable>VERSION1</replaceable> > | |
641 | <replaceable>VERSION2</replaceable></literal> as appropriate.</para> | |
642 | ||
643 | <para>The exit status is <constant>0</constant> if the versions are equal, <constant>11</constant> if | |
644 | the version of the right is smaller, and <constant>12</constant> if the version of the left is | |
645 | smaller. (This matches the convention used by <command>rpmdev-vercmp</command>.)</para> | |
646 | ||
647 | <para>In the second mode — when <replaceable>OP</replaceable> is specified — it will compare the two | |
648 | version strings using the operation <replaceable>OP</replaceable> and return <constant>0</constant> | |
649 | (success) if they condition is satisfied, and <constant>1</constant> (failure) | |
650 | otherwise. <constant>OP</constant> may be <command>lt</command>, <command>le</command>, | |
651 | <command>eq</command>, <command>ne</command>, <command>ge</command>, <command>gt</command>. In this | |
652 | mode, no output is printed. | |
653 | (This matches the convention used by | |
654 | <citerefentry project='die-net'><refentrytitle>dpkg</refentrytitle><manvolnum>1</manvolnum></citerefentry> | |
655 | <option>--compare-versions</option>.)</para> | |
656 | ||
657 | <example> | |
658 | <title>Compare versions of a package</title> | |
659 | ||
660 | <programlisting> | |
661 | $ systemd-analyze compare-versions systemd-250~rc1.fc36.aarch64 systemd-251.fc36.aarch64 | |
662 | systemd-250~rc1.fc36.aarch64 < systemd-251.fc36.aarch64 | |
663 | $ echo $? | |
664 | 12 | |
665 | ||
666 | $ systemd-analyze compare-versions 1 lt 2; echo $? | |
667 | 0 | |
668 | $ systemd-analyze compare-versions 1 ge 2; echo $? | |
669 | 1 | |
670 | </programlisting> | |
671 | </example> | |
672 | </refsect2> | |
673 | ||
d323a990 ZJS |
674 | <refsect2> |
675 | <title><command>systemd-analyze verify <replaceable>FILE</replaceable>...</command></title> | |
676 | ||
677 | <para>This command will load unit files and print warnings if any errors are detected. Files specified | |
da845dab AB |
678 | on the command line will be loaded, but also any other units referenced by them. A unit's name on disk |
679 | can be overridden by specifying an alias after a colon; see below for an example. The full unit search | |
d323a990 | 680 | path is formed by combining the directories for all command line arguments, and the usual unit load |
e9dd6984 | 681 | paths. The variable <varname>$SYSTEMD_UNIT_PATH</varname> is supported, and may be used to replace or |
d323a990 | 682 | augment the compiled in set of unit load paths; see |
e9dd6984 | 683 | <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>. All |
d323a990 ZJS |
684 | units files present in the directories containing the command line arguments will be used in preference |
685 | to the other paths.</para> | |
798d3a52 | 686 | |
d323a990 ZJS |
687 | <para>The following errors are currently detected:</para> |
688 | <itemizedlist> | |
689 | <listitem><para>unknown sections and directives,</para></listitem> | |
690 | ||
691 | <listitem><para>missing dependencies which are required to start the given unit,</para></listitem> | |
692 | ||
693 | <listitem><para>man pages listed in <varname>Documentation=</varname> which are not found in the | |
694 | system,</para></listitem> | |
695 | ||
696 | <listitem><para>commands listed in <varname>ExecStart=</varname> and similar which are not found in | |
697 | the system or not executable.</para></listitem> | |
698 | </itemizedlist> | |
699 | ||
700 | <example> | |
701 | <title>Misspelt directives</title> | |
702 | ||
703 | <programlisting>$ cat ./user.slice | |
704 | [Unit] | |
705 | WhatIsThis=11 | |
706 | Documentation=man:nosuchfile(1) | |
707 | Requires=different.service | |
708 | ||
709 | [Service] | |
710 | Description=x | |
711 | ||
712 | $ systemd-analyze verify ./user.slice | |
713 | [./user.slice:9] Unknown lvalue 'WhatIsThis' in section 'Unit' | |
714 | [./user.slice:13] Unknown section 'Service'. Ignoring. | |
715 | Error: org.freedesktop.systemd1.LoadFailed: | |
716 | Unit different.service failed to load: | |
717 | No such file or directory. | |
718 | Failed to create user.slice/start: Invalid argument | |
719 | user.slice: man nosuchfile(1) command failed with code 16 | |
720 | </programlisting> | |
721 | </example> | |
722 | ||
723 | <example> | |
724 | <title>Missing service units</title> | |
725 | ||
726 | <programlisting>$ tail ./a.socket ./b.socket | |
727 | ==> ./a.socket <== | |
728 | [Socket] | |
729 | ListenStream=100 | |
730 | ||
731 | ==> ./b.socket <== | |
732 | [Socket] | |
733 | ListenStream=100 | |
734 | Accept=yes | |
735 | ||
736 | $ systemd-analyze verify ./a.socket ./b.socket | |
737 | Service a.service not loaded, a.socket cannot be started. | |
738 | Service b@0.service not loaded, b.socket cannot be started. | |
739 | </programlisting> | |
740 | </example> | |
da845dab AB |
741 | |
742 | <example> | |
743 | <title>Aliasing a unit</title> | |
744 | ||
745 | <programlisting>$ cat /tmp/source | |
746 | [Unit] | |
747 | Description=Hostname printer | |
748 | ||
749 | [Service] | |
750 | Type=simple | |
751 | ExecStart=/usr/bin/echo %H | |
752 | MysteryKey=true | |
753 | ||
754 | $ systemd-analyze verify /tmp/source | |
755 | Failed to prepare filename /tmp/source: Invalid argument | |
756 | ||
757 | $ systemd-analyze verify /tmp/source:alias.service | |
706a297c | 758 | alias.service:7: Unknown key name 'MysteryKey' in section 'Service', ignoring. |
da845dab AB |
759 | </programlisting> |
760 | </example> | |
761 | ||
d323a990 ZJS |
762 | </refsect2> |
763 | ||
764 | <refsect2> | |
765 | <title><command>systemd-analyze security <optional><replaceable>UNIT</replaceable>...</optional></command></title> | |
766 | ||
767 | <para>This command analyzes the security and sandboxing settings of one or more specified service | |
768 | units. If at least one unit name is specified the security settings of the specified service units are | |
769 | inspected and a detailed analysis is shown. If no unit name is specified, all currently loaded, | |
770 | long-running service units are inspected and a terse table with results shown. The command checks for | |
771 | various security-related service settings, assigning each a numeric "exposure level" value, depending | |
772 | on how important a setting is. It then calculates an overall exposure level for the whole unit, which | |
773 | is an estimation in the range 0.0…10.0 indicating how exposed a service is security-wise. High exposure | |
774 | levels indicate very little applied sandboxing. Low exposure levels indicate tight sandboxing and | |
775 | strongest security restrictions. Note that this only analyzes the per-service security features systemd | |
776 | itself implements. This means that any additional security mechanisms applied by the service code | |
777 | itself are not accounted for. The exposure level determined this way should not be misunderstood: a | |
778 | high exposure level neither means that there is no effective sandboxing applied by the service code | |
779 | itself, nor that the service is actually vulnerable to remote or local attacks. High exposure levels do | |
780 | indicate however that most likely the service might benefit from additional settings applied to | |
781 | them.</para> | |
782 | ||
783 | <para>Please note that many of the security and sandboxing settings individually can be circumvented — | |
784 | unless combined with others. For example, if a service retains the privilege to establish or undo mount | |
785 | points many of the sandboxing options can be undone by the service code itself. Due to that is | |
786 | essential that each service uses the most comprehensive and strict sandboxing and security settings | |
787 | possible. The tool will take into account some of these combinations and relationships between the | |
788 | settings, but not all. Also note that the security and sandboxing settings analyzed here only apply to | |
789 | the operations executed by the service code itself. If a service has access to an IPC system (such as | |
790 | D-Bus) it might request operations from other services that are not subject to the same | |
791 | restrictions. Any comprehensive security and sandboxing analysis is hence incomplete if the IPC access | |
792 | policy is not validated too.</para> | |
793 | ||
794 | <example> | |
b0343f8c | 795 | <title>Analyze <filename index="false">systemd-logind.service</filename></title> |
d323a990 ZJS |
796 | |
797 | <programlisting>$ systemd-analyze security --no-pager systemd-logind.service | |
798 | NAME DESCRIPTION EXPOSURE | |
799 | ✗ PrivateNetwork= Service has access to the host's network 0.5 | |
800 | ✗ User=/DynamicUser= Service runs as root user 0.4 | |
801 | ✗ DeviceAllow= Service has no device ACL 0.2 | |
802 | ✓ IPAddressDeny= Service blocks all IP address ranges | |
803 | ... | |
804 | → Overall exposure level for systemd-logind.service: 4.1 OK 🙂 | |
805 | </programlisting> | |
806 | </example> | |
807 | </refsect2> | |
917e6554 LB |
808 | |
809 | <refsect2> | |
810 | <title><command>systemd-analyze inspect-elf <replaceable>FILE</replaceable>...</command></title> | |
811 | ||
0923b425 | 812 | <para>This command will load the specified files, and if they are ELF objects (executables, |
917e6554 LB |
813 | libraries, core files, etc.) it will parse the embedded packaging metadata, if any, and print |
814 | it in a table or json format. See the <ulink url="https://systemd.io/COREDUMP_PACKAGE_METADATA/"> | |
815 | Packaging Metadata</ulink> documentation for more information.</para> | |
816 | ||
817 | <example> | |
706a297c | 818 | <title>Print information about a core file as JSON</title> |
917e6554 | 819 | |
706a297c ZJS |
820 | <programlisting>$ systemd-analyze inspect-elf --json=pretty \ |
821 | core.fsverity.1000.f77dac5dc161402aa44e15b7dd9dcf97.58561.1637106137000000 | |
917e6554 LB |
822 | { |
823 | "elfType" : "coredump", | |
824 | "elfArchitecture" : "AMD x86-64", | |
825 | "/home/bluca/git/fsverity-utils/fsverity" : { | |
826 | "type" : "deb", | |
827 | "name" : "fsverity-utils", | |
828 | "version" : "1.3-1", | |
829 | "buildId" : "7c895ecd2a271f93e96268f479fdc3c64a2ec4ee" | |
830 | }, | |
831 | "/home/bluca/git/fsverity-utils/libfsverity.so.0" : { | |
832 | "type" : "deb", | |
833 | "name" : "fsverity-utils", | |
834 | "version" : "1.3-1", | |
835 | "buildId" : "b5e428254abf14237b0ae70ed85fffbb98a78f88" | |
836 | } | |
837 | } | |
838 | </programlisting> | |
839 | </example> | |
5f43c97c LP |
840 | </refsect2> |
841 | ||
842 | <refsect2> | |
ca029693 | 843 | <title><command>systemd-analyze fdstore <replaceable>UNIT</replaceable>...</command></title> |
5f43c97c LP |
844 | |
845 | <para>Lists the current contents of the specified service unit's file descriptor store. This shows | |
846 | names, inode types, device numbers, inode numbers, paths and open modes of the open file | |
847 | descriptors. The specified units must have <varname>FileDescriptorStoreMax=</varname> enabled, see | |
848 | <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry> for | |
849 | details.</para> | |
850 | ||
851 | <example> | |
852 | <title>Table output</title> | |
853 | <programlisting>$ systemd-analyze fdstore systemd-journald.service | |
854 | FDNAME TYPE DEVNO INODE RDEVNO PATH FLAGS | |
855 | stored sock 0:8 4218620 - socket:[4218620] ro | |
856 | stored sock 0:8 4213198 - socket:[4213198] ro | |
857 | stored sock 0:8 4213190 - socket:[4213190] ro | |
858 | …</programlisting> | |
859 | </example> | |
917e6554 | 860 | |
5f43c97c LP |
861 | <para>Note: the "DEVNO" column refers to the major/minor numbers of the device node backing the file |
862 | system the file descriptor's inode is on. The "RDEVNO" column refers to the major/minor numbers of the | |
863 | device node itself if the file descriptor refers to one. Compare with corresponding | |
864 | <varname>.st_dev</varname> and <varname>.st_rdev</varname> fields in <type>struct stat</type> (see | |
865 | <citerefentry | |
866 | project='man-pages'><refentrytitle>stat</refentrytitle><manvolnum>2</manvolnum></citerefentry> for | |
867 | details). The listed inode numbers in the "INODE" column are on the file system indicated by | |
868 | "DEVNO".</para> | |
917e6554 | 869 | </refsect2> |
5f43c97c | 870 | |
9ea81191 | 871 | <refsect2> |
ca029693 | 872 | <title><command>systemd-analyze image-policy <replaceable>POLICY</replaceable>…</command></title> |
9ea81191 LP |
873 | |
874 | <para>This command analyzes the specified image policy string, as per | |
875 | <citerefentry><refentrytitle>systemd.image-policy</refentrytitle><manvolnum>7</manvolnum></citerefentry>. The | |
876 | policy is normalized and simplified. For each currently defined partition identifier (as per the <ulink | |
877 | url="https://uapi-group.org/specifications/specs/discoverable_partitions_specification">Discoverable | |
bf63dadb | 878 | Partitions Specification</ulink>) the effect of the image policy string is shown in tabular form.</para> |
9ea81191 LP |
879 | |
880 | <example> | |
881 | <title>Example Output</title> | |
882 | ||
883 | <programlisting>$ systemd-analyze image-policy swap=encrypted:usr=read-only-on+verity:root=encrypted | |
884 | Analyzing policy: root=encrypted:usr=verity+read-only-on:swap=encrypted | |
885 | Long form: root=encrypted:usr=verity+read-only-on:swap=encrypted:=unused+absent | |
886 | ||
887 | PARTITION MODE READ-ONLY GROWFS | |
888 | root encrypted - - | |
889 | usr verity yes - | |
890 | home ignore - - | |
891 | srv ignore - - | |
892 | esp ignore - - | |
893 | xbootldr ignore - - | |
894 | swap encrypted - - | |
895 | root-verity ignore - - | |
896 | usr-verity unprotected yes - | |
897 | root-verity-sig ignore - - | |
898 | usr-verity-sig ignore - - | |
899 | tmp ignore - - | |
900 | var ignore - - | |
901 | default ignore - -</programlisting> | |
902 | </example> | |
f70c90f5 LP |
903 | </refsect2> |
904 | ||
905 | <refsect2> | |
906 | <title><command>systemd-analyze pcrs <optional><replaceable>PCR</replaceable>…</optional></command></title> | |
907 | ||
908 | <para>This command shows the known TPM2 PCRs along with their identifying names and current values.</para> | |
909 | ||
910 | <example> | |
911 | <title>Example Output</title> | |
912 | ||
913 | <programlisting>$ systemd-analyze pcrs | |
914 | NR NAME SHA256 | |
915 | 0 platform-code bcd2eb527108bbb1f5528409bcbe310aa9b74f687854cc5857605993f3d9eb11 | |
916 | 1 platform-config b60622856eb7ce52637b80f30a520e6e87c347daa679f3335f4f1a600681bb01 | |
917 | 2 external-code 1471262403e9a62f9c392941300b4807fbdb6f0bfdd50abfab752732087017dd | |
918 | 3 external-config 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969 | |
919 | 4 boot-loader-code 939f7fa1458e1f7ce968874d908e524fc0debf890383d355e4ce347b7b78a95c | |
920 | 5 boot-loader-config 864c61c5ea5ecbdb6951e6cb6d9c1f4b4eac79772f7fe13b8bece569d83d3768 | |
921 | 6 - 3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969 | |
922 | 7 secure-boot-policy 9c905bd9b9891bfb889b90a54c4b537b889cfa817c4389cc25754823a9443255 | |
923 | 8 - 0000000000000000000000000000000000000000000000000000000000000000 | |
924 | 9 kernel-initrd 9caa29b128113ef42aa53d421f03437be57211e5ebafc0fa8b5d4514ee37ff0c | |
925 | 10 ima 5ea9e3dab53eb6b483b6ec9e3b2c712bea66bca1b155637841216e0094387400 | |
926 | 11 kernel-boot 0000000000000000000000000000000000000000000000000000000000000000 | |
927 | 12 kernel-config 627ffa4b405e911902fe1f1a8b0164693b31acab04f805f15bccfe2209c7eace | |
928 | 13 sysexts 0000000000000000000000000000000000000000000000000000000000000000 | |
929 | 14 shim-policy 0000000000000000000000000000000000000000000000000000000000000000 | |
930 | 15 system-identity 0000000000000000000000000000000000000000000000000000000000000000 | |
931 | 16 debug 0000000000000000000000000000000000000000000000000000000000000000 | |
932 | 17 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff | |
933 | 18 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff | |
934 | 19 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff | |
935 | 20 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff | |
936 | 21 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff | |
937 | 22 - ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff | |
938 | 23 application-support 0000000000000000000000000000000000000000000000000000000000000000</programlisting> | |
939 | </example> | |
9ea81191 | 940 | </refsect2> |
d30693f3 LP |
941 | |
942 | <refsect2> | |
0615abef | 943 | <title><command>systemd-analyze srk <optional>><replaceable>FILE</replaceable></optional></command></title> |
d30693f3 LP |
944 | |
945 | <para>This command reads the Storage Root Key (SRK) from the TPM2 device, and writes it in marshalled | |
0615abef ZJS |
946 | TPM2B_PUBLIC format to stdout. The output is non-printable data, so it should be redirected to a file |
947 | or into a pipe.</para> | |
d30693f3 | 948 | |
0615abef ZJS |
949 | <example> |
950 | <title>Save the Storage Root Key to <filename>srk.tpm2b_public</filename></title> | |
951 | ||
952 | <programlisting>systemd-analyze srk >srk.tpm2b_public</programlisting> | |
953 | </example> | |
d30693f3 LP |
954 | </refsect2> |
955 | ||
fb8cc599 LP |
956 | <refsect2> |
957 | <title><command>systemd-analyze architectures <optional><replaceable>NAME</replaceable>...</optional></command></title> | |
958 | ||
959 | <para>Lists all known CPU architectures, and which ones are native. The listed architecture names are | |
960 | those <varname>ConditionArchitecture=</varname> supports, see | |
961 | <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry> for | |
962 | details. If architecture names are specified only those specified are listed.</para> | |
963 | ||
964 | <example> | |
965 | <title>Table output</title> | |
966 | <programlisting>$ systemd-analyze architectures | |
967 | NAME SUPPORT | |
968 | alpha foreign | |
969 | arc foreign | |
970 | arc-be foreign | |
971 | arm foreign | |
972 | arm64 foreign | |
973 | … | |
974 | sparc foreign | |
975 | sparc64 foreign | |
976 | tilegx foreign | |
977 | x86 secondary | |
978 | x86-64 native</programlisting> | |
979 | </example> | |
980 | </refsect2> | |
981 | ||
798d3a52 ZJS |
982 | </refsect1> |
983 | ||
984 | <refsect1> | |
985 | <title>Options</title> | |
986 | ||
987 | <para>The following options are understood:</para> | |
988 | ||
989 | <variablelist> | |
28b35ef2 ZJS |
990 | <varlistentry> |
991 | <term><option>--system</option></term> | |
992 | ||
993 | <listitem><para>Operates on the system systemd instance. This | |
ec07c3c8 AK |
994 | is the implied default.</para> |
995 | ||
996 | <xi:include href="version-info.xml" xpointer="v209"/></listitem> | |
28b35ef2 ZJS |
997 | </varlistentry> |
998 | ||
798d3a52 ZJS |
999 | <varlistentry> |
1000 | <term><option>--user</option></term> | |
1001 | ||
1002 | <listitem><para>Operates on the user systemd | |
ec07c3c8 AK |
1003 | instance.</para> |
1004 | ||
1005 | <xi:include href="version-info.xml" xpointer="v186"/></listitem> | |
798d3a52 ZJS |
1006 | </varlistentry> |
1007 | ||
1008 | <varlistentry> | |
28b35ef2 | 1009 | <term><option>--global</option></term> |
798d3a52 | 1010 | |
28b35ef2 | 1011 | <listitem><para>Operates on the system-wide configuration for |
ec07c3c8 AK |
1012 | user systemd instance.</para> |
1013 | ||
1014 | <xi:include href="version-info.xml" xpointer="v238"/></listitem> | |
798d3a52 ZJS |
1015 | </varlistentry> |
1016 | ||
1017 | <varlistentry> | |
1018 | <term><option>--order</option></term> | |
1019 | <term><option>--require</option></term> | |
1020 | ||
147e7b44 MY |
1021 | <listitem><para>When used in conjunction with the <command>dot</command> command (see above), |
1022 | selects which dependencies are shown in the dependency graph. If <option>--order</option> is passed, | |
1023 | only dependencies of type <varname>After=</varname> or <varname>Before=</varname> are shown. | |
1024 | If <option>--require</option> is passed, only dependencies of type <varname>Requires=</varname>, | |
1025 | <varname>Requisite=</varname>, <varname>BindsTo=</varname>, <varname>Wants=</varname>, and | |
1026 | <varname>Conflicts=</varname> are shown. If neither is passed, this shows dependencies of | |
ec07c3c8 AK |
1027 | all these types.</para> |
1028 | ||
1029 | <xi:include href="version-info.xml" xpointer="v198"/></listitem> | |
798d3a52 ZJS |
1030 | </varlistentry> |
1031 | ||
1032 | <varlistentry> | |
1033 | <term><option>--from-pattern=</option></term> | |
1034 | <term><option>--to-pattern=</option></term> | |
1035 | ||
1036 | <listitem><para>When used in conjunction with the | |
1037 | <command>dot</command> command (see above), this selects which | |
6ecb6cec ZJS |
1038 | relationships are shown in the dependency graph. Both options |
1039 | require a | |
b7a47345 | 1040 | <citerefentry project='man-pages'><refentrytitle>glob</refentrytitle><manvolnum>7</manvolnum></citerefentry> |
6ecb6cec ZJS |
1041 | pattern as an argument, which will be matched against the |
1042 | left-hand and the right-hand, respectively, nodes of a | |
1043 | relationship.</para> | |
1044 | ||
1045 | <para>Each of these can be used more than once, in which case | |
1046 | the unit name must match one of the values. When tests for | |
1047 | both sides of the relation are present, a relation must pass | |
1048 | both tests to be shown. When patterns are also specified as | |
1049 | positional arguments, they must match at least one side of the | |
1050 | relation. In other words, patterns specified with those two | |
1051 | options will trim the list of edges matched by the positional | |
1052 | arguments, if any are given, and fully determine the list of | |
ec07c3c8 AK |
1053 | edges shown otherwise.</para> |
1054 | ||
1055 | <xi:include href="version-info.xml" xpointer="v201"/></listitem> | |
798d3a52 ZJS |
1056 | </varlistentry> |
1057 | ||
1058 | <varlistentry> | |
9bfabe14 | 1059 | <term><option>--fuzz=<replaceable>timespan</replaceable></option></term> |
798d3a52 ZJS |
1060 | |
1061 | <listitem><para>When used in conjunction with the | |
1062 | <command>critical-chain</command> command (see above), also | |
1063 | show units, which finished <replaceable>timespan</replaceable> | |
1064 | earlier, than the latest unit in the same level. The unit of | |
1065 | <replaceable>timespan</replaceable> is seconds unless | |
1066 | specified with a different unit, e.g. | |
ec07c3c8 AK |
1067 | "50ms".</para> |
1068 | ||
1069 | <xi:include href="version-info.xml" xpointer="v203"/></listitem> | |
798d3a52 ZJS |
1070 | </varlistentry> |
1071 | ||
1072 | <varlistentry> | |
641c0fd1 | 1073 | <term><option>--man=no</option></term> |
798d3a52 | 1074 | |
e9dd6984 ZJS |
1075 | <listitem><para>Do not invoke |
1076 | <citerefentry project='man-pages'><refentrytitle>man</refentrytitle><manvolnum>1</manvolnum></citerefentry> | |
ec07c3c8 AK |
1077 | to verify the existence of man pages listed in <varname>Documentation=</varname>.</para> |
1078 | ||
1079 | <xi:include href="version-info.xml" xpointer="v235"/></listitem> | |
798d3a52 ZJS |
1080 | </varlistentry> |
1081 | ||
641c0fd1 ZJS |
1082 | <varlistentry> |
1083 | <term><option>--generators</option></term> | |
1084 | ||
1085 | <listitem><para>Invoke unit generators, see | |
1086 | <citerefentry><refentrytitle>systemd.generator</refentrytitle><manvolnum>7</manvolnum></citerefentry>. | |
06815764 | 1087 | Some generators require root privileges. Under a normal user, running with |
ec07c3c8 AK |
1088 | generators enabled will generally result in some warnings.</para> |
1089 | ||
1090 | <xi:include href="version-info.xml" xpointer="v235"/></listitem> | |
641c0fd1 ZJS |
1091 | </varlistentry> |
1092 | ||
3cc3dc77 MG |
1093 | <varlistentry> |
1094 | <term><option>--recursive-errors=<replaceable>MODE</replaceable></option></term> | |
1095 | ||
1096 | <listitem><para>Control verification of units and their dependencies and whether | |
1097 | <command>systemd-analyze verify</command> exits with a non-zero process exit status or not. With | |
1098 | <command>yes</command>, return a non-zero process exit status when warnings arise during verification | |
cae7c282 DDM |
1099 | of either the specified unit or any of its associated dependencies. With <command>no</command>, |
1100 | return a non-zero process exit status when warnings arise during verification of only the specified | |
1101 | unit. With <command>one</command>, return a non-zero process exit status when warnings arise during | |
1102 | verification of either the specified unit or its immediate dependencies. If this option is not | |
1103 | specified, zero is returned as the exit status regardless whether warnings arise during verification | |
ec07c3c8 AK |
1104 | or not.</para> |
1105 | ||
1106 | <xi:include href="version-info.xml" xpointer="v250"/></listitem> | |
3cc3dc77 MG |
1107 | </varlistentry> |
1108 | ||
46d8646a ZJS |
1109 | <varlistentry> |
1110 | <term><option>--root=<replaceable>PATH</replaceable></option></term> | |
1111 | ||
5e163285 AAF |
1112 | <listitem><para>With <command>cat-config</command>, <command>verify</command>, |
1113 | <command>condition</command> and <command>security</command> when used with | |
1114 | <option>--offline=</option>, operate on files underneath the specified root path | |
1115 | <replaceable>PATH</replaceable>.</para> | |
ec07c3c8 AK |
1116 | |
1117 | <xi:include href="version-info.xml" xpointer="v239"/></listitem> | |
46d8646a ZJS |
1118 | </varlistentry> |
1119 | ||
e5ea5c3a MG |
1120 | <varlistentry> |
1121 | <term><option>--image=<replaceable>PATH</replaceable></option></term> | |
1122 | ||
5e163285 AAF |
1123 | <listitem><para>With <command>cat-config</command>, <command>verify</command>, |
1124 | <command>condition</command> and <command>security</command> when used with | |
1125 | <option>--offline=</option>, operate on files inside the specified image path | |
1126 | <replaceable>PATH</replaceable>.</para> | |
ec07c3c8 AK |
1127 | |
1128 | <xi:include href="version-info.xml" xpointer="v250"/></listitem> | |
e5ea5c3a MG |
1129 | </varlistentry> |
1130 | ||
9ea81191 LP |
1131 | <xi:include href="standard-options.xml" xpointer="image-policy-open" /> |
1132 | ||
bb43d853 MG |
1133 | <varlistentry> |
1134 | <term><option>--offline=<replaceable>BOOL</replaceable></option></term> | |
1135 | ||
1136 | <listitem><para>With <command>security</command>, perform an offline security review | |
0923b425 | 1137 | of the specified unit files, i.e. does not have to rely on PID 1 to acquire security |
bb43d853 MG |
1138 | information for the files like the <command>security</command> verb when used by itself does. |
1139 | This means that <option>--offline=</option> can be used with <option>--root=</option> and | |
1140 | <option>--image=</option> as well. If a unit's overall exposure level is above that set by | |
1141 | <option>--threshold=</option> (default value is 100), <option>--offline=</option> will return | |
ec07c3c8 AK |
1142 | an error.</para> |
1143 | ||
1144 | <xi:include href="version-info.xml" xpointer="v250"/></listitem> | |
bb43d853 MG |
1145 | </varlistentry> |
1146 | ||
04469211 LB |
1147 | <varlistentry> |
1148 | <term><option>--profile=<replaceable>PATH</replaceable></option></term> | |
1149 | ||
1150 | <listitem><para>With <command>security</command> <option>--offline=</option>, takes into | |
0923b425 | 1151 | consideration the specified portable profile when assessing unit settings. |
04469211 | 1152 | The profile can be passed by name, in which case the well-known system locations will |
ec07c3c8 AK |
1153 | be searched, or it can be the full path to a specific drop-in file.</para> |
1154 | ||
1155 | <xi:include href="version-info.xml" xpointer="v250"/></listitem> | |
04469211 LB |
1156 | </varlistentry> |
1157 | ||
dfbda879 MG |
1158 | <varlistentry> |
1159 | <term><option>--threshold=<replaceable>NUMBER</replaceable></option></term> | |
1160 | ||
1161 | <listitem><para>With <command>security</command>, allow the user to set a custom value | |
0923b425 | 1162 | to compare the overall exposure level with, for the specified unit files. If a unit's |
dfbda879 MG |
1163 | overall exposure level, is greater than that set by the user, <command>security</command> |
1164 | will return an error. <option>--threshold=</option> can be used with <option>--offline=</option> | |
ec07c3c8 AK |
1165 | as well and its default value is 100.</para> |
1166 | ||
1167 | <xi:include href="version-info.xml" xpointer="v250"/></listitem> | |
dfbda879 MG |
1168 | </varlistentry> |
1169 | ||
ecfd082b MG |
1170 | <varlistentry> |
1171 | <term><option>--security-policy=<replaceable>PATH</replaceable></option></term> | |
1172 | ||
1173 | <listitem><para>With <command>security</command>, allow the user to define a custom set of | |
1174 | requirements formatted as a JSON file against which to compare the specified unit file(s) | |
1175 | and determine their overall exposure level to security threats.</para> | |
1176 | ||
1177 | <table> | |
1178 | <title>Accepted Assessment Test Identifiers</title> | |
1179 | ||
1180 | <tgroup cols='1'> | |
1181 | <colspec colname='directive' /> | |
1182 | <thead> | |
1183 | <row> | |
1184 | <entry>Assessment Test Identifier</entry> | |
1185 | </row> | |
1186 | </thead> | |
1187 | <tbody> | |
1188 | <row> | |
1189 | <entry>UserOrDynamicUser</entry> | |
1190 | </row> | |
1191 | <row> | |
1192 | <entry>SupplementaryGroups</entry> | |
1193 | </row> | |
1194 | <row> | |
1195 | <entry>PrivateMounts</entry> | |
1196 | </row> | |
1197 | <row> | |
1198 | <entry>PrivateDevices</entry> | |
1199 | </row> | |
1200 | <row> | |
1201 | <entry>PrivateTmp</entry> | |
1202 | </row> | |
1203 | <row> | |
1204 | <entry>PrivateNetwork</entry> | |
1205 | </row> | |
1206 | <row> | |
1207 | <entry>PrivateUsers</entry> | |
1208 | </row> | |
1209 | <row> | |
1210 | <entry>ProtectControlGroups</entry> | |
1211 | </row> | |
1212 | <row> | |
1213 | <entry>ProtectKernelModules</entry> | |
1214 | </row> | |
1215 | <row> | |
1216 | <entry>ProtectKernelTunables</entry> | |
1217 | </row> | |
1218 | <row> | |
1219 | <entry>ProtectKernelLogs</entry> | |
1220 | </row> | |
1221 | <row> | |
1222 | <entry>ProtectClock</entry> | |
1223 | </row> | |
1224 | <row> | |
1225 | <entry>ProtectHome</entry> | |
1226 | </row> | |
1227 | <row> | |
1228 | <entry>ProtectHostname</entry> | |
1229 | </row> | |
1230 | <row> | |
1231 | <entry>ProtectSystem</entry> | |
1232 | </row> | |
1233 | <row> | |
1234 | <entry>RootDirectoryOrRootImage</entry> | |
1235 | </row> | |
1236 | <row> | |
1237 | <entry>LockPersonality</entry> | |
1238 | </row> | |
1239 | <row> | |
1240 | <entry>MemoryDenyWriteExecute</entry> | |
1241 | </row> | |
1242 | <row> | |
1243 | <entry>NoNewPrivileges</entry> | |
1244 | </row> | |
1245 | <row> | |
1246 | <entry>CapabilityBoundingSet_CAP_SYS_ADMIN</entry> | |
1247 | </row> | |
1248 | <row> | |
1249 | <entry>CapabilityBoundingSet_CAP_SET_UID_GID_PCAP</entry> | |
1250 | </row> | |
1251 | <row> | |
1252 | <entry>CapabilityBoundingSet_CAP_SYS_PTRACE</entry> | |
1253 | </row> | |
1254 | <row> | |
1255 | <entry>CapabilityBoundingSet_CAP_SYS_TIME</entry> | |
1256 | </row> | |
1257 | <row> | |
1258 | <entry>CapabilityBoundingSet_CAP_NET_ADMIN</entry> | |
1259 | </row> | |
1260 | <row> | |
1261 | <entry>CapabilityBoundingSet_CAP_SYS_RAWIO</entry> | |
1262 | </row> | |
1263 | <row> | |
1264 | <entry>CapabilityBoundingSet_CAP_SYS_MODULE</entry> | |
1265 | </row> | |
1266 | <row> | |
1267 | <entry>CapabilityBoundingSet_CAP_AUDIT</entry> | |
1268 | </row> | |
1269 | <row> | |
1270 | <entry>CapabilityBoundingSet_CAP_SYSLOG</entry> | |
1271 | </row> | |
1272 | <row> | |
1273 | <entry>CapabilityBoundingSet_CAP_SYS_NICE_RESOURCE</entry> | |
1274 | </row> | |
1275 | <row> | |
1276 | <entry>CapabilityBoundingSet_CAP_MKNOD</entry> | |
1277 | </row> | |
1278 | <row> | |
1279 | <entry>CapabilityBoundingSet_CAP_CHOWN_FSETID_SETFCAP</entry> | |
1280 | </row> | |
1281 | <row> | |
1282 | <entry>CapabilityBoundingSet_CAP_DAC_FOWNER_IPC_OWNER</entry> | |
1283 | </row> | |
1284 | <row> | |
1285 | <entry>CapabilityBoundingSet_CAP_KILL</entry> | |
1286 | </row> | |
1287 | <row> | |
1288 | <entry>CapabilityBoundingSet_CAP_NET_BIND_SERVICE_BROADCAST_RAW</entry> | |
1289 | </row> | |
1290 | <row> | |
1291 | <entry>CapabilityBoundingSet_CAP_SYS_BOOT</entry> | |
1292 | </row> | |
1293 | <row> | |
1294 | <entry>CapabilityBoundingSet_CAP_MAC</entry> | |
1295 | </row> | |
1296 | <row> | |
1297 | <entry>CapabilityBoundingSet_CAP_LINUX_IMMUTABLE</entry> | |
1298 | </row> | |
1299 | <row> | |
1300 | <entry>CapabilityBoundingSet_CAP_IPC_LOCK</entry> | |
1301 | </row> | |
1302 | <row> | |
1303 | <entry>CapabilityBoundingSet_CAP_SYS_CHROOT</entry> | |
1304 | </row> | |
1305 | <row> | |
1306 | <entry>CapabilityBoundingSet_CAP_BLOCK_SUSPEND</entry> | |
1307 | </row> | |
1308 | <row> | |
1309 | <entry>CapabilityBoundingSet_CAP_WAKE_ALARM</entry> | |
1310 | </row> | |
1311 | <row> | |
1312 | <entry>CapabilityBoundingSet_CAP_LEASE</entry> | |
1313 | </row> | |
1314 | <row> | |
1315 | <entry>CapabilityBoundingSet_CAP_SYS_TTY_CONFIG</entry> | |
1316 | </row> | |
4f7a629e PH |
1317 | <row> |
1318 | <entry>CapabilityBoundingSet_CAP_BPF</entry> | |
1319 | </row> | |
ecfd082b MG |
1320 | <row> |
1321 | <entry>UMask</entry> | |
1322 | </row> | |
1323 | <row> | |
1324 | <entry>KeyringMode</entry> | |
1325 | </row> | |
1326 | <row> | |
1327 | <entry>ProtectProc</entry> | |
1328 | </row> | |
1329 | <row> | |
1330 | <entry>ProcSubset</entry> | |
1331 | </row> | |
1332 | <row> | |
1333 | <entry>NotifyAccess</entry> | |
1334 | </row> | |
1335 | <row> | |
1336 | <entry>RemoveIPC</entry> | |
1337 | </row> | |
1338 | <row> | |
1339 | <entry>Delegate</entry> | |
1340 | </row> | |
1341 | <row> | |
1342 | <entry>RestrictRealtime</entry> | |
1343 | </row> | |
1344 | <row> | |
1345 | <entry>RestrictSUIDSGID</entry> | |
1346 | </row> | |
1347 | <row> | |
c1e6f215 | 1348 | <entry>RestrictNamespaces_user</entry> |
ecfd082b MG |
1349 | </row> |
1350 | <row> | |
c1e6f215 | 1351 | <entry>RestrictNamespaces_mnt</entry> |
ecfd082b MG |
1352 | </row> |
1353 | <row> | |
c1e6f215 | 1354 | <entry>RestrictNamespaces_ipc</entry> |
ecfd082b MG |
1355 | </row> |
1356 | <row> | |
c1e6f215 | 1357 | <entry>RestrictNamespaces_pid</entry> |
ecfd082b MG |
1358 | </row> |
1359 | <row> | |
c1e6f215 | 1360 | <entry>RestrictNamespaces_cgroup</entry> |
ecfd082b MG |
1361 | </row> |
1362 | <row> | |
c1e6f215 | 1363 | <entry>RestrictNamespaces_uts</entry> |
ecfd082b MG |
1364 | </row> |
1365 | <row> | |
c1e6f215 | 1366 | <entry>RestrictNamespaces_net</entry> |
ecfd082b MG |
1367 | </row> |
1368 | <row> | |
1369 | <entry>RestrictAddressFamilies_AF_INET_INET6</entry> | |
1370 | </row> | |
1371 | <row> | |
1372 | <entry>RestrictAddressFamilies_AF_UNIX</entry> | |
1373 | </row> | |
1374 | <row> | |
1375 | <entry>RestrictAddressFamilies_AF_NETLINK</entry> | |
1376 | </row> | |
1377 | <row> | |
1378 | <entry>RestrictAddressFamilies_AF_PACKET</entry> | |
1379 | </row> | |
1380 | <row> | |
1381 | <entry>RestrictAddressFamilies_OTHER</entry> | |
1382 | </row> | |
1383 | <row> | |
1384 | <entry>SystemCallArchitectures</entry> | |
1385 | </row> | |
1386 | <row> | |
1387 | <entry>SystemCallFilter_swap</entry> | |
1388 | </row> | |
1389 | <row> | |
1390 | <entry>SystemCallFilter_obsolete</entry> | |
1391 | </row> | |
1392 | <row> | |
1393 | <entry>SystemCallFilter_clock</entry> | |
1394 | </row> | |
1395 | <row> | |
1396 | <entry>SystemCallFilter_cpu_emulation</entry> | |
1397 | </row> | |
1398 | <row> | |
1399 | <entry>SystemCallFilter_debug</entry> | |
1400 | </row> | |
1401 | <row> | |
1402 | <entry>SystemCallFilter_mount</entry> | |
1403 | </row> | |
1404 | <row> | |
1405 | <entry>SystemCallFilter_module</entry> | |
1406 | </row> | |
1407 | <row> | |
1408 | <entry>SystemCallFilter_raw_io</entry> | |
1409 | </row> | |
1410 | <row> | |
1411 | <entry>SystemCallFilter_reboot</entry> | |
1412 | </row> | |
1413 | <row> | |
1414 | <entry>SystemCallFilter_privileged</entry> | |
1415 | </row> | |
1416 | <row> | |
1417 | <entry>SystemCallFilter_resources</entry> | |
1418 | </row> | |
1419 | <row> | |
1420 | <entry>IPAddressDeny</entry> | |
1421 | </row> | |
1422 | <row> | |
1423 | <entry>DeviceAllow</entry> | |
1424 | </row> | |
1425 | <row> | |
1426 | <entry>AmbientCapabilities</entry> | |
1427 | </row> | |
1428 | </tbody> | |
1429 | </tgroup> | |
1430 | </table> | |
1431 | ||
ec07c3c8 AK |
1432 | <para>See example "JSON Policy" below.</para> |
1433 | ||
1434 | <xi:include href="version-info.xml" xpointer="v250"/></listitem> | |
ecfd082b MG |
1435 | </varlistentry> |
1436 | ||
4b4a8ef7 MG |
1437 | <varlistentry> |
1438 | <term><option>--json=<replaceable>MODE</replaceable></option></term> | |
1439 | ||
1440 | <listitem><para>With the <command>security</command> command, generate a JSON formatted | |
1441 | output of the security analysis table. The format is a JSON array with objects | |
1442 | containing the following fields: <varname>set</varname> which indicates if the setting has | |
1443 | been enabled or not, <varname>name</varname> which is what is used to refer to the setting, | |
1444 | <varname>json_field</varname> which is the JSON compatible identifier of the setting, | |
1445 | <varname>description</varname> which is an outline of the setting state, and | |
1446 | <varname>exposure</varname> which is a number in the range 0.0…10.0, where a higher value | |
1447 | corresponds to a higher security threat. The JSON version of the table is printed to standard | |
1448 | output. The <replaceable>MODE</replaceable> passed to the option can be one of three: | |
1449 | <option>off</option> which is the default, <option>pretty</option> and <option>short</option> | |
dc57a338 | 1450 | which respectively output a prettified or shorted JSON version of the security table. |
1451 | ||
d09df6b9 | 1452 | With the <command>plot</command> command, generate a JSON formatted output of the raw time data. |
dc57a338 | 1453 | The format is a JSON array with objects containing the following fields: <varname>name</varname> |
1454 | which is the unit name, <varname>activated</varname> which is the time after startup the | |
1455 | service was activated, <varname>activating</varname> which is how long after startup the service | |
1456 | was initially started, <varname>time</varname> which is how long the service took to activate | |
1457 | from when it was initially started, <varname>deactivated</varname> which is the time after startup | |
d09df6b9 | 1458 | that the service was deactivated, <varname>deactivating</varname> which is the time after startup |
dc57a338 | 1459 | that the service was initially told to deactivate. |
ec07c3c8 AK |
1460 | </para> |
1461 | ||
1462 | <xi:include href="version-info.xml" xpointer="v250"/></listitem> | |
4b4a8ef7 MG |
1463 | </varlistentry> |
1464 | ||
f2ccf832 LP |
1465 | <varlistentry> |
1466 | <term><option>--iterations=<replaceable>NUMBER</replaceable></option></term> | |
1467 | ||
1468 | <listitem><para>When used with the <command>calendar</command> command, show the specified number of | |
ec07c3c8 AK |
1469 | iterations the specified calendar expression will elapse next. Defaults to 1.</para> |
1470 | ||
1471 | <xi:include href="version-info.xml" xpointer="v242"/></listitem> | |
f2ccf832 LP |
1472 | </varlistentry> |
1473 | ||
92e6a99d LP |
1474 | <varlistentry> |
1475 | <term><option>--base-time=<replaceable>TIMESTAMP</replaceable></option></term> | |
1476 | ||
1477 | <listitem><para>When used with the <command>calendar</command> command, show next iterations relative | |
ec07c3c8 AK |
1478 | to the specified point in time. If not specified defaults to the current time.</para> |
1479 | ||
1480 | <xi:include href="version-info.xml" xpointer="v244"/></listitem> | |
92e6a99d LP |
1481 | </varlistentry> |
1482 | ||
8de7929d DDM |
1483 | <varlistentry> |
1484 | <term><option>--unit=<replaceable>UNIT</replaceable></option></term> | |
1485 | ||
1486 | <listitem><para>When used with the <command>condition</command> command, evaluate all the | |
1487 | <varname index="false">Condition*=...</varname> and <varname index="false">Assert*=...</varname> | |
1488 | assignments in the specified unit file. The full unit search path is formed by combining the | |
1489 | directories for the specified unit with the usual unit load paths. The variable | |
1490 | <varname>$SYSTEMD_UNIT_PATH</varname> is supported, and may be used to replace or augment the | |
1491 | compiled in set of unit load paths; see | |
1492 | <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>. All | |
1493 | units files present in the directory containing the specified unit will be used in preference to the | |
ec07c3c8 AK |
1494 | other paths.</para> |
1495 | ||
1496 | <xi:include href="version-info.xml" xpointer="v250"/></listitem> | |
8de7929d DDM |
1497 | </varlistentry> |
1498 | ||
dc57a338 | 1499 | <varlistentry> |
1500 | <term><option>--table</option></term> | |
1501 | ||
1502 | <listitem><para>When used with the <command>plot</command> command, the raw time data is output in a table. | |
ec07c3c8 AK |
1503 | </para> |
1504 | ||
1505 | <xi:include href="version-info.xml" xpointer="v253"/></listitem> | |
dc57a338 | 1506 | </varlistentry> |
1507 | ||
1508 | <varlistentry> | |
1509 | <term><option>--no-legend</option></term> | |
1510 | ||
1511 | <listitem><para>When used with the <command>plot</command> command in combination with either | |
1512 | <option>--table</option> or <option>--json=</option>, no legends or hints are included in the output. | |
ec07c3c8 AK |
1513 | </para> |
1514 | ||
1515 | <xi:include href="version-info.xml" xpointer="v253"/></listitem> | |
dc57a338 | 1516 | </varlistentry> |
1517 | ||
798d3a52 ZJS |
1518 | <xi:include href="user-system-options.xml" xpointer="host" /> |
1519 | <xi:include href="user-system-options.xml" xpointer="machine" /> | |
1520 | ||
52117f5a | 1521 | <varlistentry> |
7c0e0bbb | 1522 | <term><option>-q</option></term> |
52117f5a ZJS |
1523 | <term><option>--quiet</option></term> |
1524 | ||
ec07c3c8 AK |
1525 | <listitem><para>Suppress hints and other non-essential output.</para> |
1526 | ||
1527 | <xi:include href="version-info.xml" xpointer="v250"/></listitem> | |
52117f5a ZJS |
1528 | </varlistentry> |
1529 | ||
063c8382 ZJS |
1530 | <varlistentry> |
1531 | <term><option>--tldr</option></term> | |
1532 | ||
1533 | <listitem><para>With <command>cat-config</command>, only print the "interesting" parts of the | |
1534 | configuration files, skipping comments and empty lines and section headers followed only by | |
1535 | comments and empty lines.</para> | |
1536 | ||
1537 | <xi:include href="version-info.xml" xpointer="v255"/></listitem> | |
1538 | </varlistentry> | |
1539 | ||
798d3a52 ZJS |
1540 | <xi:include href="standard-options.xml" xpointer="help" /> |
1541 | <xi:include href="standard-options.xml" xpointer="version" /> | |
1542 | <xi:include href="standard-options.xml" xpointer="no-pager" /> | |
1543 | </variablelist> | |
1544 | ||
1545 | </refsect1> | |
1546 | ||
1547 | <refsect1> | |
1548 | <title>Exit status</title> | |
1549 | ||
bc012a3e ZJS |
1550 | <para>For most commands, 0 is returned on success, and a non-zero failure code otherwise.</para> |
1551 | ||
1552 | <para>With the verb <command>compare-versions</command>, in the two-argument form, | |
1553 | <constant>12</constant>, <constant>0</constant>, <constant>11</constant> is returned if the second | |
1554 | version string is respectively larger, equal, or smaller to the first. In the three-argument form, | |
1555 | <constant>0</constant> or <constant>1</constant> if the condition is respectively true or false.</para> | |
798d3a52 ZJS |
1556 | </refsect1> |
1557 | ||
4ef3ca34 | 1558 | <xi:include href="common-variables.xml" /> |
798d3a52 | 1559 | |
e6ce1951 ZJS |
1560 | <refsect1> |
1561 | <title>Examples</title> | |
1562 | ||
1563 | <example> | |
1564 | <title>JSON Policy</title> | |
1565 | ||
1566 | <para>The JSON file passed as a path parameter to <option>--security-policy=</option> has a top-level | |
1567 | JSON object, with keys being the assessment test identifiers mentioned above. The values in the file | |
1568 | should be JSON objects with one or more of the following fields: <option>description_na</option> | |
1569 | (string), <option>description_good</option> (string), <option>description_bad</option> (string), | |
1570 | <option>weight</option> (unsigned integer), and <option>range</option> (unsigned integer). If any of | |
1571 | these fields corresponding to a specific id of the unit file is missing from the JSON object, the | |
1572 | default built-in field value corresponding to that same id is used for security analysis as default. | |
1573 | The weight and range fields are used in determining the overall exposure level of the unit files: the | |
1574 | value of each setting is assigned a badness score, which is multiplied by the policy weight and divided | |
1575 | by the policy range to determine the overall exposure that the setting implies. The computed badness is | |
1576 | summed across all settings in the unit file, normalized to the 1…100 range, and used to determine the | |
1577 | overall exposure level of the unit. By allowing users to manipulate these fields, the 'security' verb | |
1578 | gives them the option to decide for themself which ids are more important and hence should have a | |
1579 | greater effect on the exposure level. A weight of <literal>0</literal> means the setting will not be | |
1580 | checked.</para> | |
1581 | ||
1582 | <programlisting> | |
1583 | { | |
1584 | "PrivateDevices": | |
1585 | { | |
1586 | "description_good": "Service has no access to hardware devices", | |
1587 | "description_bad": "Service potentially has access to hardware devices", | |
1588 | "weight": 1000, | |
1589 | "range": 1 | |
1590 | }, | |
1591 | "PrivateMounts": | |
1592 | { | |
1593 | "description_good": "Service cannot install system mounts", | |
1594 | "description_bad": "Service may install system mounts", | |
1595 | "weight": 1000, | |
1596 | "range": 1 | |
1597 | }, | |
1598 | "PrivateNetwork": | |
1599 | { | |
1600 | "description_good": "Service has no access to the host's network", | |
1601 | "description_bad": "Service has access to the host's network", | |
1602 | "weight": 2500, | |
1603 | "range": 1 | |
1604 | }, | |
1605 | "PrivateTmp": | |
1606 | { | |
1607 | "description_good": "Service has no access to other software's temporary files", | |
1608 | "description_bad": "Service has access to other software's temporary files", | |
1609 | "weight": 1000, | |
1610 | "range": 1 | |
1611 | }, | |
1612 | "PrivateUsers": | |
1613 | { | |
1614 | "description_good": "Service does not have access to other users", | |
1615 | "description_bad": "Service has access to other users", | |
1616 | "weight": 1000, | |
1617 | "range": 1 | |
1618 | } | |
1619 | } | |
1620 | </programlisting> | |
1621 | </example> | |
1622 | </refsect1> | |
1623 | ||
798d3a52 ZJS |
1624 | <refsect1> |
1625 | <title>See Also</title> | |
13a69c12 DT |
1626 | <para><simplelist type="inline"> |
1627 | <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member> | |
1628 | <member><citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry></member> | |
1629 | </simplelist></para> | |
798d3a52 | 1630 | </refsect1> |
359deb60 LP |
1631 | |
1632 | </refentry> |