| | 1 | <?xml-stylesheet type="text/xsl" href="http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl"?> |
| | 2 | <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" |
| | 3 | "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"> |
| | 4 | |
| | 5 | <!-- |
| | 6 | This file is part of systemd. |
| | 7 | |
| | 8 | Copyright 2010 Lennart Poettering |
| | 9 | |
| | 10 | systemd is free software; you can redistribute it and/or modify it |
| | 11 | under the terms of the GNU Lesser General Public License as published by |
| | 12 | the Free Software Foundation; either version 2.1 of the License, or |
| | 13 | (at your option) any later version. |
| | 14 | |
| | 15 | systemd is distributed in the hope that it will be useful, but |
| | 16 | WITHOUT ANY WARRANTY; without even the implied warranty of |
| | 17 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| | 18 | Lesser General Public License for more details. |
| | 19 | |
| | 20 | You should have received a copy of the GNU Lesser General Public License |
| | 21 | along with systemd; If not, see <http://www.gnu.org/licenses/>. |
| | 22 | --> |
| | 23 | |
| | 24 | <refentry id="systemd.exec"> |
| | 25 | <refentryinfo> |
| | 26 | <title>systemd.exec</title> |
| | 27 | <productname>systemd</productname> |
| | 28 | |
| | 29 | <authorgroup> |
| | 30 | <author> |
| | 31 | <contrib>Developer</contrib> |
| | 32 | <firstname>Lennart</firstname> |
| | 33 | <surname>Poettering</surname> |
| | 34 | <email>lennart@poettering.net</email> |
| | 35 | </author> |
| | 36 | </authorgroup> |
| | 37 | </refentryinfo> |
| | 38 | |
| | 39 | <refmeta> |
| | 40 | <refentrytitle>systemd.exec</refentrytitle> |
| | 41 | <manvolnum>5</manvolnum> |
| | 42 | </refmeta> |
| | 43 | |
| | 44 | <refnamediv> |
| | 45 | <refname>systemd.exec</refname> |
| | 46 | <refpurpose>Execution environment configuration</refpurpose> |
| | 47 | </refnamediv> |
| | 48 | |
| | 49 | <refsynopsisdiv> |
| | 50 | <para><filename><replaceable>service</replaceable>.service</filename>, |
| | 51 | <filename><replaceable>socket</replaceable>.socket</filename>, |
| | 52 | <filename><replaceable>mount</replaceable>.mount</filename>, |
| | 53 | <filename><replaceable>swap</replaceable>.swap</filename></para> |
| | 54 | </refsynopsisdiv> |
| | 55 | |
| | 56 | <refsect1> |
| | 57 | <title>Description</title> |
| | 58 | |
| | 59 | <para>Unit configuration files for services, sockets, |
| | 60 | mount points, and swap devices share a subset of |
| | 61 | configuration options which define the execution |
| | 62 | environment of spawned processes.</para> |
| | 63 | |
| | 64 | <para>This man page lists the configuration options |
| | 65 | shared by these four unit types. See |
| | 66 | <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry> |
| | 67 | for the common options of all unit configuration |
| | 68 | files, and |
| | 69 | <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>, |
| | 70 | <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>, |
| | 71 | <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>, |
| | 72 | and |
| | 73 | <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry> |
| | 74 | for more information on the specific unit |
| | 75 | configuration files. The execution specific |
| | 76 | configuration options are configured in the [Service], |
| | 77 | [Socket], [Mount], or [Swap] sections, depending on the unit |
| | 78 | type.</para> |
| | 79 | </refsect1> |
| | 80 | |
| | 81 | <refsect1> |
| | 82 | <title>Options</title> |
| | 83 | |
| | 84 | <variablelist class='unit-directives'> |
| | 85 | |
| | 86 | <varlistentry> |
| | 87 | <term><varname>WorkingDirectory=</varname></term> |
| | 88 | |
| | 89 | <listitem><para>Takes an absolute |
| | 90 | directory path. Sets the working |
| | 91 | directory for executed processes. If |
| | 92 | not set, defaults to the root directory |
| | 93 | when systemd is running as a system |
| | 94 | instance and the respective user's |
| | 95 | home directory if run as |
| | 96 | user.</para></listitem> |
| | 97 | </varlistentry> |
| | 98 | |
| | 99 | <varlistentry> |
| | 100 | <term><varname>RootDirectory=</varname></term> |
| | 101 | |
| | 102 | <listitem><para>Takes an absolute |
| | 103 | directory path. Sets the root |
| | 104 | directory for executed processes, with |
| | 105 | the |
| | 106 | <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry> |
| | 107 | system call. If this is used, it must |
| | 108 | be ensured that the process and all |
| | 109 | its auxiliary files are available in |
| | 110 | the <function>chroot()</function> |
| | 111 | jail.</para></listitem> |
| | 112 | </varlistentry> |
| | 113 | |
| | 114 | <varlistentry> |
| | 115 | <term><varname>User=</varname></term> |
| | 116 | <term><varname>Group=</varname></term> |
| | 117 | |
| | 118 | <listitem><para>Sets the Unix user |
| | 119 | or group that the processes are executed |
| | 120 | as, respectively. Takes a single user or group |
| | 121 | name or ID as argument. If no group is |
| | 122 | set, the default group of the user is |
| | 123 | chosen.</para></listitem> |
| | 124 | </varlistentry> |
| | 125 | |
| | 126 | <varlistentry> |
| | 127 | <term><varname>SupplementaryGroups=</varname></term> |
| | 128 | |
| | 129 | <listitem><para>Sets the supplementary |
| | 130 | Unix groups the processes are executed |
| | 131 | as. This takes a space-separated list |
| | 132 | of group names or IDs. This option may |
| | 133 | be specified more than once in which |
| | 134 | case all listed groups are set as |
| | 135 | supplementary groups. When the empty |
| | 136 | string is assigned the list of |
| | 137 | supplementary groups is reset, and all |
| | 138 | assignments prior to this one will |
| | 139 | have no effect. In any way, this |
| | 140 | option does not override, but extends |
| | 141 | the list of supplementary groups |
| | 142 | configured in the system group |
| | 143 | database for the |
| | 144 | user.</para></listitem> |
| | 145 | </varlistentry> |
| | 146 | |
| | 147 | <varlistentry> |
| | 148 | <term><varname>Nice=</varname></term> |
| | 149 | |
| | 150 | <listitem><para>Sets the default nice |
| | 151 | level (scheduling priority) for |
| | 152 | executed processes. Takes an integer |
| | 153 | between -20 (highest priority) and 19 |
| | 154 | (lowest priority). See |
| | 155 | <citerefentry><refentrytitle>setpriority</refentrytitle><manvolnum>2</manvolnum></citerefentry> |
| | 156 | for details.</para></listitem> |
| | 157 | </varlistentry> |
| | 158 | |
| | 159 | <varlistentry> |
| | 160 | <term><varname>OOMScoreAdjust=</varname></term> |
| | 161 | |
| | 162 | <listitem><para>Sets the adjustment |
| | 163 | level for the Out-Of-Memory killer for |
| | 164 | executed processes. Takes an integer |
| | 165 | between -1000 (to disable OOM killing |
| | 166 | for this process) and 1000 (to make |
| | 167 | killing of this process under memory |
| | 168 | pressure very likely). See <ulink |
| | 169 | url="https://www.kernel.org/doc/Documentation/filesystems/proc.txt">proc.txt</ulink> |
| | 170 | for details.</para></listitem> |
| | 171 | </varlistentry> |
| | 172 | |
| | 173 | <varlistentry> |
| | 174 | <term><varname>IOSchedulingClass=</varname></term> |
| | 175 | |
| | 176 | <listitem><para>Sets the IO scheduling |
| | 177 | class for executed processes. Takes an |
| | 178 | integer between 0 and 3 or one of the |
| | 179 | strings <option>none</option>, |
| | 180 | <option>realtime</option>, |
| | 181 | <option>best-effort</option> or |
| | 182 | <option>idle</option>. See |
| | 183 | <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry> |
| | 184 | for details.</para></listitem> |
| | 185 | </varlistentry> |
| | 186 | |
| | 187 | <varlistentry> |
| | 188 | <term><varname>IOSchedulingPriority=</varname></term> |
| | 189 | |
| | 190 | <listitem><para>Sets the IO scheduling |
| | 191 | priority for executed processes. Takes |
| | 192 | an integer between 0 (highest |
| | 193 | priority) and 7 (lowest priority). The |
| | 194 | available priorities depend on the |
| | 195 | selected IO scheduling class (see |
| | 196 | above). See |
| | 197 | <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry> |
| | 198 | for details.</para></listitem> |
| | 199 | </varlistentry> |
| | 200 | |
| | 201 | <varlistentry> |
| | 202 | <term><varname>CPUSchedulingPolicy=</varname></term> |
| | 203 | |
| | 204 | <listitem><para>Sets the CPU |
| | 205 | scheduling policy for executed |
| | 206 | processes. Takes one of |
| | 207 | <option>other</option>, |
| | 208 | <option>batch</option>, |
| | 209 | <option>idle</option>, |
| | 210 | <option>fifo</option> or |
| | 211 | <option>rr</option>. See |
| | 212 | <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry> |
| | 213 | for details.</para></listitem> |
| | 214 | </varlistentry> |
| | 215 | |
| | 216 | <varlistentry> |
| | 217 | <term><varname>CPUSchedulingPriority=</varname></term> |
| | 218 | |
| | 219 | <listitem><para>Sets the CPU |
| | 220 | scheduling priority for executed |
| | 221 | processes. The available priority |
| | 222 | range depends on the selected CPU |
| | 223 | scheduling policy (see above). For |
| | 224 | real-time scheduling policies an |
| | 225 | integer between 1 (lowest priority) |
| | 226 | and 99 (highest priority) can be used. |
| | 227 | See <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry> |
| | 228 | for details. |
| | 229 | </para></listitem> |
| | 230 | </varlistentry> |
| | 231 | |
| | 232 | <varlistentry> |
| | 233 | <term><varname>CPUSchedulingResetOnFork=</varname></term> |
| | 234 | |
| | 235 | <listitem><para>Takes a boolean |
| | 236 | argument. If true, elevated CPU |
| | 237 | scheduling priorities and policies |
| | 238 | will be reset when the executed |
| | 239 | processes fork, and can hence not leak |
| | 240 | into child processes. See |
| | 241 | <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry> |
| | 242 | for details. Defaults to false.</para></listitem> |
| | 243 | </varlistentry> |
| | 244 | |
| | 245 | <varlistentry> |
| | 246 | <term><varname>CPUAffinity=</varname></term> |
| | 247 | |
| | 248 | <listitem><para>Controls the CPU |
| | 249 | affinity of the executed |
| | 250 | processes. Takes a space-separated |
| | 251 | list of CPU indexes. This option may |
| | 252 | be specified more than once in which |
| | 253 | case the specificed CPU affinity masks |
| | 254 | are merged. If the empty string is |
| | 255 | assigned, the mask is reset, all |
| | 256 | assignments prior to this will have no |
| | 257 | effect. See |
| | 258 | <citerefentry><refentrytitle>sched_setaffinity</refentrytitle><manvolnum>2</manvolnum></citerefentry> |
| | 259 | for details.</para></listitem> |
| | 260 | </varlistentry> |
| | 261 | |
| | 262 | <varlistentry> |
| | 263 | <term><varname>UMask=</varname></term> |
| | 264 | |
| | 265 | <listitem><para>Controls the file mode |
| | 266 | creation mask. Takes an access mode in |
| | 267 | octal notation. See |
| | 268 | <citerefentry><refentrytitle>umask</refentrytitle><manvolnum>2</manvolnum></citerefentry> |
| | 269 | for details. Defaults to |
| | 270 | 0022.</para></listitem> |
| | 271 | </varlistentry> |
| | 272 | |
| | 273 | <varlistentry> |
| | 274 | <term><varname>Environment=</varname></term> |
| | 275 | |
| | 276 | <listitem><para>Sets environment |
| | 277 | variables for executed |
| | 278 | processes. Takes a space-separated |
| | 279 | list of variable assignments. This |
| | 280 | option may be specified more than once |
| | 281 | in which case all listed variables |
| | 282 | will be set. If the same variable is |
| | 283 | set twice, the later setting will |
| | 284 | override the earlier setting. If the |
| | 285 | empty string is assigned to this |
| | 286 | option, the list of environment |
| | 287 | variables is reset, all prior |
| | 288 | assignments have no effect. |
| | 289 | Variable expansion is not performed |
| | 290 | inside the strings, however, specifier |
| | 291 | expansion is possible. The $ character has |
| | 292 | no special meaning. |
| | 293 | If you need to assign a value containing spaces |
| | 294 | to a variable, use double quotes (") |
| | 295 | for the assignment.</para> |
| | 296 | |
| | 297 | <para>Example: |
| | 298 | <programlisting>Environment="VAR1=word1 word2" VAR2=word3 "VAR3=$word 5 6"</programlisting> |
| | 299 | gives three variables <literal>VAR1</literal>, |
| | 300 | <literal>VAR2</literal>, <literal>VAR3</literal> |
| | 301 | with the values <literal>word1 word2</literal>, |
| | 302 | <literal>word3</literal>, <literal>$word 5 6</literal>. |
| | 303 | </para> |
| | 304 | |
| | 305 | <para> |
| | 306 | See |
| | 307 | <citerefentry><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry> |
| | 308 | for details about environment variables.</para></listitem> |
| | 309 | </varlistentry> |
| | 310 | <varlistentry> |
| | 311 | <term><varname>EnvironmentFile=</varname></term> |
| | 312 | <listitem><para>Similar to |
| | 313 | <varname>Environment=</varname> but |
| | 314 | reads the environment variables from a |
| | 315 | text file. The text file should |
| | 316 | contain new-line-separated variable |
| | 317 | assignments. Empty lines and lines |
| | 318 | starting with ; or # will be ignored, |
| | 319 | which may be used for commenting. A line |
| | 320 | ending with a backslash will be concatenated |
| | 321 | with the following one, allowing multiline variable |
| | 322 | definitions. The parser strips leading |
| | 323 | and trailing whitespace from the values |
| | 324 | of assignments, unless you use |
| | 325 | double quotes (").</para> |
| | 326 | |
| | 327 | <para>The argument passed should be an |
| | 328 | absolute filename or wildcard |
| | 329 | expression, optionally prefixed with |
| | 330 | <literal>-</literal>, which indicates |
| | 331 | that if the file does not exist, it |
| | 332 | will not be read and no error or warning |
| | 333 | message is logged. This option may be |
| | 334 | specified more than once in which case |
| | 335 | all specified files are read. If the |
| | 336 | empty string is assigned to this |
| | 337 | option, the list of file to read is |
| | 338 | reset, all prior assignments have no |
| | 339 | effect.</para> |
| | 340 | |
| | 341 | <para>The files listed with this |
| | 342 | directive will be read shortly before |
| | 343 | the process is executed. Settings from |
| | 344 | these files override settings made |
| | 345 | with |
| | 346 | <varname>Environment=</varname>. If |
| | 347 | the same variable is set twice from |
| | 348 | these files, the files will be read in |
| | 349 | the order they are specified and the |
| | 350 | later setting will override the |
| | 351 | earlier setting.</para></listitem> |
| | 352 | </varlistentry> |
| | 353 | |
| | 354 | <varlistentry> |
| | 355 | <term><varname>StandardInput=</varname></term> |
| | 356 | <listitem><para>Controls where file |
| | 357 | descriptor 0 (STDIN) of the executed |
| | 358 | processes is connected to. Takes one |
| | 359 | of <option>null</option>, |
| | 360 | <option>tty</option>, |
| | 361 | <option>tty-force</option>, |
| | 362 | <option>tty-fail</option> or |
| | 363 | <option>socket</option>. If |
| | 364 | <option>null</option> is selected, |
| | 365 | standard input will be connected to |
| | 366 | <filename>/dev/null</filename>, |
| | 367 | i.e. all read attempts by the process |
| | 368 | will result in immediate EOF. If |
| | 369 | <option>tty</option> is selected, |
| | 370 | standard input is connected to a TTY |
| | 371 | (as configured by |
| | 372 | <varname>TTYPath=</varname>, see |
| | 373 | below) and the executed process |
| | 374 | becomes the controlling process of the |
| | 375 | terminal. If the terminal is already |
| | 376 | being controlled by another process, the |
| | 377 | executed process waits until the current |
| | 378 | controlling process releases the |
| | 379 | terminal. |
| | 380 | <option>tty-force</option> |
| | 381 | is similar to <option>tty</option>, |
| | 382 | but the executed process is forcefully |
| | 383 | and immediately made the controlling |
| | 384 | process of the terminal, potentially |
| | 385 | removing previous controlling |
| | 386 | processes from the |
| | 387 | terminal. <option>tty-fail</option> is |
| | 388 | similar to <option>tty</option> but if |
| | 389 | the terminal already has a controlling |
| | 390 | process start-up of the executed |
| | 391 | process fails. The |
| | 392 | <option>socket</option> option is only |
| | 393 | valid in socket-activated services, |
| | 394 | and only when the socket configuration |
| | 395 | file (see |
| | 396 | <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry> |
| | 397 | for details) specifies a single socket |
| | 398 | only. If this option is set, standard |
| | 399 | input will be connected to the socket |
| | 400 | the service was activated from, which |
| | 401 | is primarily useful for compatibility |
| | 402 | with daemons designed for use with the |
| | 403 | traditional |
| | 404 | <citerefentry><refentrytitle>inetd</refentrytitle><manvolnum>8</manvolnum></citerefentry> |
| | 405 | daemon. This setting defaults to |
| | 406 | <option>null</option>.</para></listitem> |
| | 407 | </varlistentry> |
| | 408 | <varlistentry> |
| | 409 | <term><varname>StandardOutput=</varname></term> |
| | 410 | <listitem><para>Controls where file |
| | 411 | descriptor 1 (STDOUT) of the executed |
| | 412 | processes is connected to. Takes one |
| | 413 | of <option>inherit</option>, |
| | 414 | <option>null</option>, |
| | 415 | <option>tty</option>, |
| | 416 | <option>syslog</option>, |
| | 417 | <option>kmsg</option>, |
| | 418 | <option>journal</option>, |
| | 419 | <option>syslog+console</option>, |
| | 420 | <option>kmsg+console</option>, |
| | 421 | <option>journal+console</option> or |
| | 422 | <option>socket</option>. If set to |
| | 423 | <option>inherit</option>, the file |
| | 424 | descriptor of standard input is |
| | 425 | duplicated for standard output. If set |
| | 426 | to <option>null</option>, standard |
| | 427 | output will be connected to |
| | 428 | <filename>/dev/null</filename>, |
| | 429 | i.e. everything written to it will be |
| | 430 | lost. If set to <option>tty</option>, |
| | 431 | standard output will be connected to a |
| | 432 | tty (as configured via |
| | 433 | <varname>TTYPath=</varname>, see |
| | 434 | below). If the TTY is used for output |
| | 435 | only, the executed process will not |
| | 436 | become the controlling process of the |
| | 437 | terminal, and will not fail or wait |
| | 438 | for other processes to release the |
| | 439 | terminal. <option>syslog</option> |
| | 440 | connects standard output to the |
| | 441 | <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry> |
| | 442 | system syslog |
| | 443 | service. <option>kmsg</option> |
| | 444 | connects it with the kernel log buffer |
| | 445 | which is accessible via |
| | 446 | <citerefentry><refentrytitle>dmesg</refentrytitle><manvolnum>1</manvolnum></citerefentry>. <option>journal</option> |
| | 447 | connects it with the journal which is |
| | 448 | accessible via |
| | 449 | <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry> |
| | 450 | (Note that everything that is written |
| | 451 | to syslog or kmsg is implicitly stored |
| | 452 | in the journal as well, those options |
| | 453 | are hence supersets of this |
| | 454 | one). <option>syslog+console</option>, |
| | 455 | <option>journal+console</option> and |
| | 456 | <option>kmsg+console</option> work |
| | 457 | similarly but copy the output to the |
| | 458 | system console as |
| | 459 | well. <option>socket</option> connects |
| | 460 | standard output to a socket from |
| | 461 | socket activation, semantics are |
| | 462 | similar to the respective option of |
| | 463 | <varname>StandardInput=</varname>. |
| | 464 | This setting defaults to the value set |
| | 465 | with |
| | 466 | <option>DefaultStandardOutput=</option> |
| | 467 | in |
| | 468 | <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>, |
| | 469 | which defaults to |
| | 470 | <option>journal</option>.</para></listitem> |
| | 471 | </varlistentry> |
| | 472 | <varlistentry> |
| | 473 | <term><varname>StandardError=</varname></term> |
| | 474 | <listitem><para>Controls where file |
| | 475 | descriptor 2 (STDERR) of the executed |
| | 476 | processes is connected to. The |
| | 477 | available options are identical to |
| | 478 | those of |
| | 479 | <varname>StandardOutput=</varname>, |
| | 480 | with one exception: if set to |
| | 481 | <option>inherit</option> the file |
| | 482 | descriptor used for standard output is |
| | 483 | duplicated for standard error. This |
| | 484 | setting defaults to the value set with |
| | 485 | <option>DefaultStandardError=</option> |
| | 486 | in |
| | 487 | <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>, |
| | 488 | which defaults to |
| | 489 | <option>inherit</option>.</para></listitem> |
| | 490 | </varlistentry> |
| | 491 | <varlistentry> |
| | 492 | <term><varname>TTYPath=</varname></term> |
| | 493 | <listitem><para>Sets the terminal |
| | 494 | device node to use if STDIN, STDOUT, |
| | 495 | or STDERR are connected to a |
| | 496 | TTY (see above). Defaults to |
| | 497 | <filename>/dev/console</filename>.</para></listitem> |
| | 498 | </varlistentry> |
| | 499 | <varlistentry> |
| | 500 | <term><varname>TTYReset=</varname></term> |
| | 501 | <listitem><para>Reset the terminal |
| | 502 | device specified with |
| | 503 | <varname>TTYPath=</varname> before and |
| | 504 | after execution. Defaults to |
| | 505 | <literal>no</literal>.</para></listitem> |
| | 506 | </varlistentry> |
| | 507 | <varlistentry> |
| | 508 | <term><varname>TTYVHangup=</varname></term> |
| | 509 | <listitem><para>Disconnect all clients |
| | 510 | which have opened the terminal device |
| | 511 | specified with |
| | 512 | <varname>TTYPath=</varname> |
| | 513 | before and after execution. Defaults |
| | 514 | to |
| | 515 | <literal>no</literal>.</para></listitem> |
| | 516 | </varlistentry> |
| | 517 | <varlistentry> |
| | 518 | <term><varname>TTYVTDisallocate=</varname></term> |
| | 519 | <listitem><para>If the terminal |
| | 520 | device specified with |
| | 521 | <varname>TTYPath=</varname> is a |
| | 522 | virtual console terminal, try to |
| | 523 | deallocate the TTY before and after |
| | 524 | execution. This ensures that the |
| | 525 | screen and scrollback buffer is |
| | 526 | cleared. Defaults to |
| | 527 | <literal>no</literal>.</para></listitem> |
| | 528 | </varlistentry> |
| | 529 | <varlistentry> |
| | 530 | <term><varname>SyslogIdentifier=</varname></term> |
| | 531 | <listitem><para>Sets the process name |
| | 532 | to prefix log lines sent to syslog or |
| | 533 | the kernel log buffer with. If not set, |
| | 534 | defaults to the process name of the |
| | 535 | executed process. This option is only |
| | 536 | useful when |
| | 537 | <varname>StandardOutput=</varname> or |
| | 538 | <varname>StandardError=</varname> are |
| | 539 | set to <option>syslog</option> or |
| | 540 | <option>kmsg</option>.</para></listitem> |
| | 541 | </varlistentry> |
| | 542 | <varlistentry> |
| | 543 | <term><varname>SyslogFacility=</varname></term> |
| | 544 | <listitem><para>Sets the syslog |
| | 545 | facility to use when logging to |
| | 546 | syslog. One of <option>kern</option>, |
| | 547 | <option>user</option>, |
| | 548 | <option>mail</option>, |
| | 549 | <option>daemon</option>, |
| | 550 | <option>auth</option>, |
| | 551 | <option>syslog</option>, |
| | 552 | <option>lpr</option>, |
| | 553 | <option>news</option>, |
| | 554 | <option>uucp</option>, |
| | 555 | <option>cron</option>, |
| | 556 | <option>authpriv</option>, |
| | 557 | <option>ftp</option>, |
| | 558 | <option>local0</option>, |
| | 559 | <option>local1</option>, |
| | 560 | <option>local2</option>, |
| | 561 | <option>local3</option>, |
| | 562 | <option>local4</option>, |
| | 563 | <option>local5</option>, |
| | 564 | <option>local6</option> or |
| | 565 | <option>local7</option>. See |
| | 566 | <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry> |
| | 567 | for details. This option is only |
| | 568 | useful when |
| | 569 | <varname>StandardOutput=</varname> or |
| | 570 | <varname>StandardError=</varname> are |
| | 571 | set to <option>syslog</option>. |
| | 572 | Defaults to |
| | 573 | <option>daemon</option>.</para></listitem> |
| | 574 | </varlistentry> |
| | 575 | <varlistentry> |
| | 576 | <term><varname>SyslogLevel=</varname></term> |
| | 577 | <listitem><para>Default syslog level |
| | 578 | to use when logging to syslog or the |
| | 579 | kernel log buffer. One of |
| | 580 | <option>emerg</option>, |
| | 581 | <option>alert</option>, |
| | 582 | <option>crit</option>, |
| | 583 | <option>err</option>, |
| | 584 | <option>warning</option>, |
| | 585 | <option>notice</option>, |
| | 586 | <option>info</option>, |
| | 587 | <option>debug</option>. See |
| | 588 | <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry> |
| | 589 | for details. This option is only |
| | 590 | useful when |
| | 591 | <varname>StandardOutput=</varname> or |
| | 592 | <varname>StandardError=</varname> are |
| | 593 | set to <option>syslog</option> or |
| | 594 | <option>kmsg</option>. Note that |
| | 595 | individual lines output by the daemon |
| | 596 | might be prefixed with a different log |
| | 597 | level which can be used to override |
| | 598 | the default log level specified |
| | 599 | here. The interpretation of these |
| | 600 | prefixes may be disabled with |
| | 601 | <varname>SyslogLevelPrefix=</varname>, |
| | 602 | see below. For details see |
| | 603 | <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>. |
| | 604 | |
| | 605 | Defaults to |
| | 606 | <option>info</option>.</para></listitem> |
| | 607 | </varlistentry> |
| | 608 | |
| | 609 | <varlistentry> |
| | 610 | <term><varname>SyslogLevelPrefix=</varname></term> |
| | 611 | <listitem><para>Takes a boolean |
| | 612 | argument. If true and |
| | 613 | <varname>StandardOutput=</varname> or |
| | 614 | <varname>StandardError=</varname> are |
| | 615 | set to <option>syslog</option>, |
| | 616 | <option>kmsg</option> or |
| | 617 | <option>journal</option>, log lines |
| | 618 | written by the executed process that |
| | 619 | are prefixed with a log level will be |
| | 620 | passed on to syslog with this log |
| | 621 | level set but the prefix removed. If |
| | 622 | set to false, the interpretation of |
| | 623 | these prefixes is disabled and the |
| | 624 | logged lines are passed on as-is. For |
| | 625 | details about this prefixing see |
| | 626 | <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>. |
| | 627 | Defaults to true.</para></listitem> |
| | 628 | </varlistentry> |
| | 629 | |
| | 630 | <varlistentry> |
| | 631 | <term><varname>TimerSlackNSec=</varname></term> |
| | 632 | <listitem><para>Sets the timer slack |
| | 633 | in nanoseconds for the executed |
| | 634 | processes. The timer slack controls |
| | 635 | the accuracy of wake-ups triggered by |
| | 636 | timers. See |
| | 637 | <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry> |
| | 638 | for more information. Note that in |
| | 639 | contrast to most other time span |
| | 640 | definitions this parameter takes an |
| | 641 | integer value in nano-seconds if no |
| | 642 | unit is specified. The usual time |
| | 643 | units are understood |
| | 644 | too.</para></listitem> |
| | 645 | </varlistentry> |
| | 646 | |
| | 647 | <varlistentry> |
| | 648 | <term><varname>LimitCPU=</varname></term> |
| | 649 | <term><varname>LimitFSIZE=</varname></term> |
| | 650 | <term><varname>LimitDATA=</varname></term> |
| | 651 | <term><varname>LimitSTACK=</varname></term> |
| | 652 | <term><varname>LimitCORE=</varname></term> |
| | 653 | <term><varname>LimitRSS=</varname></term> |
| | 654 | <term><varname>LimitNOFILE=</varname></term> |
| | 655 | <term><varname>LimitAS=</varname></term> |
| | 656 | <term><varname>LimitNPROC=</varname></term> |
| | 657 | <term><varname>LimitMEMLOCK=</varname></term> |
| | 658 | <term><varname>LimitLOCKS=</varname></term> |
| | 659 | <term><varname>LimitSIGPENDING=</varname></term> |
| | 660 | <term><varname>LimitMSGQUEUE=</varname></term> |
| | 661 | <term><varname>LimitNICE=</varname></term> |
| | 662 | <term><varname>LimitRTPRIO=</varname></term> |
| | 663 | <term><varname>LimitRTTIME=</varname></term> |
| | 664 | <listitem><para>These settings control |
| | 665 | various resource limits for executed |
| | 666 | processes. See |
| | 667 | <citerefentry><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry> |
| | 668 | for details. Use the string |
| | 669 | <varname>infinity</varname> to |
| | 670 | configure no limit on a specific |
| | 671 | resource.</para></listitem> |
| | 672 | </varlistentry> |
| | 673 | |
| | 674 | <varlistentry> |
| | 675 | <term><varname>PAMName=</varname></term> |
| | 676 | <listitem><para>Sets the PAM service |
| | 677 | name to set up a session as. If set, |
| | 678 | the executed process will be |
| | 679 | registered as a PAM session under the |
| | 680 | specified service name. This is only |
| | 681 | useful in conjunction with the |
| | 682 | <varname>User=</varname> setting. If |
| | 683 | not set, no PAM session will be opened |
| | 684 | for the executed processes. See |
| | 685 | <citerefentry><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry> |
| | 686 | for details.</para></listitem> |
| | 687 | </varlistentry> |
| | 688 | |
| | 689 | <varlistentry> |
| | 690 | <term><varname>TCPWrapName=</varname></term> |
| | 691 | <listitem><para>If this is a |
| | 692 | socket-activated service, this sets the |
| | 693 | tcpwrap service name to check the |
| | 694 | permission for the current connection |
| | 695 | with. This is only useful in |
| | 696 | conjunction with socket-activated |
| | 697 | services, and stream sockets (TCP) in |
| | 698 | particular. It has no effect on other |
| | 699 | socket types (e.g. datagram/UDP) and |
| | 700 | on processes unrelated to socket-based |
| | 701 | activation. If the tcpwrap |
| | 702 | verification fails, daemon start-up |
| | 703 | will fail and the connection is |
| | 704 | terminated. See |
| | 705 | <citerefentry><refentrytitle>tcpd</refentrytitle><manvolnum>8</manvolnum></citerefentry> |
| | 706 | for details. Note that this option may |
| | 707 | be used to do access control checks |
| | 708 | only. Shell commands and commands |
| | 709 | described in |
| | 710 | <citerefentry><refentrytitle>hosts_options</refentrytitle><manvolnum>5</manvolnum></citerefentry> |
| | 711 | are not supported.</para></listitem> |
| | 712 | </varlistentry> |
| | 713 | |
| | 714 | <varlistentry> |
| | 715 | <term><varname>CapabilityBoundingSet=</varname></term> |
| | 716 | |
| | 717 | <listitem><para>Controls which |
| | 718 | capabilities to include in the |
| | 719 | capability bounding set for the |
| | 720 | executed process. See |
| | 721 | <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry> |
| | 722 | for details. Takes a whitespace-separated |
| | 723 | list of capability names as read by |
| | 724 | <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>, |
| | 725 | e.g. <constant>CAP_SYS_ADMIN</constant>, |
| | 726 | <constant>CAP_DAC_OVERRIDE</constant>, |
| | 727 | <constant>CAP_SYS_PTRACE</constant>. |
| | 728 | Capabilities listed will be included |
| | 729 | in the bounding set, all others are |
| | 730 | removed. If the list of capabilities |
| | 731 | is prefixed with <literal>~</literal>, |
| | 732 | all but the listed capabilities will |
| | 733 | be included, the effect of the |
| | 734 | assignment inverted. Note that this |
| | 735 | option also affects the respective |
| | 736 | capabilities in the effective, |
| | 737 | permitted and inheritable capability |
| | 738 | sets, on top of what |
| | 739 | <varname>Capabilities=</varname> |
| | 740 | does. If this option is not used, the |
| | 741 | capability bounding set is not |
| | 742 | modified on process execution, hence |
| | 743 | no limits on the capabilities of the |
| | 744 | process are enforced. This option may |
| | 745 | appear more than once in which case |
| | 746 | the bounding sets are merged. If the |
| | 747 | empty string is assigned to this |
| | 748 | option, the bounding set is reset to |
| | 749 | the empty capability set, and all |
| | 750 | prior settings have no effect. If set |
| | 751 | to <literal>~</literal> (without any |
| | 752 | further argument), the bounding set is |
| | 753 | reset to the full set of available |
| | 754 | capabilities, also undoing any |
| | 755 | previous settings.</para></listitem> |
| | 756 | </varlistentry> |
| | 757 | |
| | 758 | <varlistentry> |
| | 759 | <term><varname>SecureBits=</varname></term> |
| | 760 | <listitem><para>Controls the secure |
| | 761 | bits set for the executed process. See |
| | 762 | <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry> |
| | 763 | for details. Takes a list of strings: |
| | 764 | <option>keep-caps</option>, |
| | 765 | <option>keep-caps-locked</option>, |
| | 766 | <option>no-setuid-fixup</option>, |
| | 767 | <option>no-setuid-fixup-locked</option>, |
| | 768 | <option>noroot</option> and/or |
| | 769 | <option>noroot-locked</option>. This |
| | 770 | option may appear more than once in |
| | 771 | which case the secure bits are |
| | 772 | ORed. If the empty string is assigned |
| | 773 | to this option, the bits are reset to |
| | 774 | 0.</para></listitem> |
| | 775 | </varlistentry> |
| | 776 | |
| | 777 | <varlistentry> |
| | 778 | <term><varname>Capabilities=</varname></term> |
| | 779 | <listitem><para>Controls the |
| | 780 | <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry> |
| | 781 | set for the executed process. Take a |
| | 782 | capability string describing the |
| | 783 | effective, permitted and inherited |
| | 784 | capability sets as documented in |
| | 785 | <citerefentry><refentrytitle>cap_from_text</refentrytitle><manvolnum>3</manvolnum></citerefentry>. |
| | 786 | Note that these capability sets are |
| | 787 | usually influenced by the capabilities |
| | 788 | attached to the executed file. Due to |
| | 789 | that |
| | 790 | <varname>CapabilityBoundingSet=</varname> |
| | 791 | is probably the much more useful |
| | 792 | setting.</para></listitem> |
| | 793 | </varlistentry> |
| | 794 | |
| | 795 | <varlistentry> |
| | 796 | <term><varname>ReadWriteDirectories=</varname></term> |
| | 797 | <term><varname>ReadOnlyDirectories=</varname></term> |
| | 798 | <term><varname>InaccessibleDirectories=</varname></term> |
| | 799 | |
| | 800 | <listitem><para>Sets up a new |
| | 801 | file system namespace for executed |
| | 802 | processes. These options may be used |
| | 803 | to limit access a process might have |
| | 804 | to the main file system |
| | 805 | hierarchy. Each setting takes a |
| | 806 | space-separated list of absolute |
| | 807 | directory paths. Directories listed in |
| | 808 | <varname>ReadWriteDirectories=</varname> |
| | 809 | are accessible from within the |
| | 810 | namespace with the same access rights |
| | 811 | as from outside. Directories listed in |
| | 812 | <varname>ReadOnlyDirectories=</varname> |
| | 813 | are accessible for reading only, |
| | 814 | writing will be refused even if the |
| | 815 | usual file access controls would |
| | 816 | permit this. Directories listed in |
| | 817 | <varname>InaccessibleDirectories=</varname> |
| | 818 | will be made inaccessible for |
| | 819 | processes inside the namespace. Note |
| | 820 | that restricting access with these |
| | 821 | options does not extend to submounts |
| | 822 | of a directory. You must list |
| | 823 | submounts separately in these settings |
| | 824 | to ensure the same limited |
| | 825 | access. These options may be specified |
| | 826 | more than once in which case all |
| | 827 | directories listed will have limited |
| | 828 | access from within the namespace. If |
| | 829 | the empty string is assigned to this |
| | 830 | option, the specific list is reset, and |
| | 831 | all prior assignments have no |
| | 832 | effect.</para> |
| | 833 | <para>Paths in |
| | 834 | <varname>ReadOnlyDirectories=</varname> |
| | 835 | and |
| | 836 | <varname>InaccessibleDirectories=</varname> |
| | 837 | may be prefixed with |
| | 838 | <literal>-</literal>, in which case |
| | 839 | they will be ignored when they do not |
| | 840 | exist.</para></listitem> |
| | 841 | </varlistentry> |
| | 842 | |
| | 843 | <varlistentry> |
| | 844 | <term><varname>PrivateTmp=</varname></term> |
| | 845 | |
| | 846 | <listitem><para>Takes a boolean |
| | 847 | argument. If true, sets up a new file |
| | 848 | system namespace for the executed |
| | 849 | processes and mounts private |
| | 850 | <filename>/tmp</filename> and |
| | 851 | <filename>/var/tmp</filename> |
| | 852 | directories inside it that is not |
| | 853 | shared by processes outside of the |
| | 854 | namespace. This is useful to secure |
| | 855 | access to temporary files of the |
| | 856 | process, but makes sharing between |
| | 857 | processes via |
| | 858 | <filename>/tmp</filename> or |
| | 859 | <filename>/var/tmp</filename> |
| | 860 | impossible. All temporary data created |
| | 861 | by service will be removed after |
| | 862 | the service is stopped. Defaults to |
| | 863 | false. Note that it is possible to run |
| | 864 | two or more units within the same |
| | 865 | private <filename>/tmp</filename> and |
| | 866 | <filename>/var/tmp</filename> |
| | 867 | namespace by using the |
| | 868 | <varname>JoinsNamespaceOf=</varname> |
| | 869 | directive, see |
| | 870 | <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry> |
| | 871 | for details.</para></listitem> |
| | 872 | </varlistentry> |
| | 873 | |
| | 874 | <varlistentry> |
| | 875 | <term><varname>PrivateNetwork=</varname></term> |
| | 876 | |
| | 877 | <listitem><para>Takes a boolean |
| | 878 | argument. If true, sets up a new |
| | 879 | network namespace for the executed |
| | 880 | processes and configures only the |
| | 881 | loopback network device |
| | 882 | <literal>lo</literal> inside it. No |
| | 883 | other network devices will be |
| | 884 | available to the executed process. |
| | 885 | This is useful to securely turn off |
| | 886 | network access by the executed |
| | 887 | process. Defaults to false. Note that |
| | 888 | it is possible to run two or more |
| | 889 | units within the same private network |
| | 890 | namespace by using the |
| | 891 | <varname>JoinsNamespaceOf=</varname> |
| | 892 | directive, see |
| | 893 | <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry> |
| | 894 | for details.</para></listitem> |
| | 895 | </varlistentry> |
| | 896 | |
| | 897 | <varlistentry> |
| | 898 | <term><varname>PrivateDevices=</varname></term> |
| | 899 | |
| | 900 | <listitem><para>Takes a boolean |
| | 901 | argument. If true, sets up a new /dev |
| | 902 | namespace for the executed processes |
| | 903 | and only adds API pseudo devices such |
| | 904 | as <filename>/dev/null</filename>, |
| | 905 | <filename>/dev/zero</filename> or |
| | 906 | <filename>/dev/random</filename> to |
| | 907 | it, but no physical devices such as |
| | 908 | <filename>/dev/sda</filename>. This is |
| | 909 | useful to securely turn off physical |
| | 910 | device access by the executed |
| | 911 | process. Defaults to |
| | 912 | false.</para></listitem> |
| | 913 | </varlistentry> |
| | 914 | |
| | 915 | <varlistentry> |
| | 916 | <term><varname>MountFlags=</varname></term> |
| | 917 | |
| | 918 | <listitem><para>Takes a mount |
| | 919 | propagation flag: |
| | 920 | <option>shared</option>, |
| | 921 | <option>slave</option> or |
| | 922 | <option>private</option>, which |
| | 923 | control whether the file system |
| | 924 | namespace set up for this unit's |
| | 925 | processes will receive or propagate |
| | 926 | new mounts. See |
| | 927 | <citerefentry><refentrytitle>mount</refentrytitle><manvolnum>2</manvolnum></citerefentry> |
| | 928 | for details. Default to |
| | 929 | <option>shared</option>.</para></listitem> |
| | 930 | </varlistentry> |
| | 931 | |
| | 932 | <varlistentry> |
| | 933 | <term><varname>UtmpIdentifier=</varname></term> |
| | 934 | |
| | 935 | <listitem><para>Takes a four |
| | 936 | character identifier string for an |
| | 937 | utmp/wtmp entry for this service. This |
| | 938 | should only be set for services such |
| | 939 | as <command>getty</command> |
| | 940 | implementations where utmp/wtmp |
| | 941 | entries must be created and cleared |
| | 942 | before and after execution. If the |
| | 943 | configured string is longer than four |
| | 944 | characters, it is truncated and the |
| | 945 | terminal four characters are |
| | 946 | used. This setting interprets %I style |
| | 947 | string replacements. This setting is |
| | 948 | unset by default, i.e. no utmp/wtmp |
| | 949 | entries are created or cleaned up for |
| | 950 | this service.</para></listitem> |
| | 951 | </varlistentry> |
| | 952 | |
| | 953 | <varlistentry> |
| | 954 | <term><varname>SELinuxContext=</varname></term> |
| | 955 | |
| | 956 | <listitem><para>Set the SELinux |
| | 957 | security context of the executed |
| | 958 | process. If set, this will override |
| | 959 | the automated domain |
| | 960 | transition. However, the policy still |
| | 961 | needs to autorize the transition. This |
| | 962 | directive is ignored if SELinux is |
| | 963 | disabled. If prefixed by |
| | 964 | <literal>-</literal>, all errors will |
| | 965 | be ignored. See |
| | 966 | <citerefentry><refentrytitle>setexeccon</refentrytitle><manvolnum>3</manvolnum></citerefentry> |
| | 967 | for details.</para></listitem> |
| | 968 | </varlistentry> |
| | 969 | |
| | 970 | <varlistentry> |
| | 971 | <term><varname>IgnoreSIGPIPE=</varname></term> |
| | 972 | |
| | 973 | <listitem><para>Takes a boolean |
| | 974 | argument. If true, causes <constant>SIGPIPE</constant> to be |
| | 975 | ignored in the executed |
| | 976 | process. Defaults to true because |
| | 977 | <constant>SIGPIPE</constant> generally is useful only in |
| | 978 | shell pipelines.</para></listitem> |
| | 979 | </varlistentry> |
| | 980 | |
| | 981 | <varlistentry> |
| | 982 | <term><varname>NoNewPrivileges=</varname></term> |
| | 983 | |
| | 984 | <listitem><para>Takes a boolean |
| | 985 | argument. If true, ensures that the |
| | 986 | service process and all its children |
| | 987 | can never gain new privileges. This |
| | 988 | option is more powerful than the respective |
| | 989 | secure bits flags (see above), as it |
| | 990 | also prohibits UID changes of any |
| | 991 | kind. This is the simplest, most |
| | 992 | effective way to ensure that a process |
| | 993 | and its children can never elevate |
| | 994 | privileges again.</para></listitem> |
| | 995 | </varlistentry> |
| | 996 | |
| | 997 | <varlistentry> |
| | 998 | <term><varname>SystemCallFilter=</varname></term> |
| | 999 | |
| | 1000 | <listitem><para>Takes a space-separated |
| | 1001 | list of system call |
| | 1002 | names. If this setting is used, all |
| | 1003 | system calls executed by the unit |
| | 1004 | processes except for the listed ones |
| | 1005 | will result in immediate process |
| | 1006 | termination with the |
| | 1007 | <constant>SIGSYS</constant> signal |
| | 1008 | (whitelisting). If the first character |
| | 1009 | of the list is <literal>~</literal>, |
| | 1010 | the effect is inverted: only the |
| | 1011 | listed system calls will result in |
| | 1012 | immediate process termination |
| | 1013 | (blacklisting). If this option is used, |
| | 1014 | <varname>NoNewPrivileges=yes</varname> |
| | 1015 | is implied. This feature makes use of |
| | 1016 | the Secure Computing Mode 2 interfaces |
| | 1017 | of the kernel ('seccomp filtering') |
| | 1018 | and is useful for enforcing a minimal |
| | 1019 | sandboxing environment. Note that the |
| | 1020 | <function>execve</function>, |
| | 1021 | <function>rt_sigreturn</function>, |
| | 1022 | <function>sigreturn</function>, |
| | 1023 | <function>exit_group</function>, |
| | 1024 | <function>exit</function> system calls |
| | 1025 | are implicitly whitelisted and do not |
| | 1026 | need to be listed explicitly. This |
| | 1027 | option may be specified more than once |
| | 1028 | in which case the filter masks are |
| | 1029 | merged. If the empty string is |
| | 1030 | assigned, the filter is reset, all |
| | 1031 | prior assignments will have no |
| | 1032 | effect.</para> |
| | 1033 | |
| | 1034 | <para>If you specify both types of |
| | 1035 | this option (i.e. whitelisting and |
| | 1036 | blacklisting) the first encountered |
| | 1037 | will take precedence and will dictate |
| | 1038 | the default action (termination or |
| | 1039 | approval of a system call). Then the |
| | 1040 | next occurrences of this option will |
| | 1041 | add or delete the listed system calls |
| | 1042 | from the set of the filtered system |
| | 1043 | calls, depending of its type and the |
| | 1044 | default action (e.g. You have started |
| | 1045 | with a whitelisting of |
| | 1046 | <function>read</function> and |
| | 1047 | <function>write</function> and right |
| | 1048 | after it add a blacklisting of |
| | 1049 | <function>write</function>, then |
| | 1050 | <function>write</function> will be |
| | 1051 | removed from the set). |
| | 1052 | </para></listitem> |
| | 1053 | |
| | 1054 | <para>Note that setting |
| | 1055 | <varname>SystemCallFilter=</varname> |
| | 1056 | implies a |
| | 1057 | <varname>SystemCallArchitectures=</varname> |
| | 1058 | setting of <literal>native</literal> |
| | 1059 | (see below), unless that option is |
| | 1060 | configured otherwise.</para> |
| | 1061 | </varlistentry> |
| | 1062 | |
| | 1063 | <varlistentry> |
| | 1064 | <term><varname>SystemCallErrorNumber=</varname></term> |
| | 1065 | |
| | 1066 | <listitem><para>Takes an |
| | 1067 | <literal>errno</literal> error number |
| | 1068 | name to return when the system call |
| | 1069 | filter configured with |
| | 1070 | <varname>SystemCallFilter=</varname> |
| | 1071 | is triggered, instead of terminating |
| | 1072 | the process immediately. Takes an |
| | 1073 | error name such as |
| | 1074 | <literal>EPERM</literal>, |
| | 1075 | <literal>EACCES</literal> or |
| | 1076 | <literal>EUCLEAN</literal>. When this |
| | 1077 | setting is not used, or when the empty |
| | 1078 | string is assigned the process will be |
| | 1079 | terminated immediately when the filter |
| | 1080 | is triggered.</para></listitem> |
| | 1081 | </varlistentry> |
| | 1082 | |
| | 1083 | <varlistentry> |
| | 1084 | <term><varname>SystemCallArchitectures=</varname></term> |
| | 1085 | |
| | 1086 | <listitem><para>Takes a space |
| | 1087 | separated list of architecture |
| | 1088 | identifiers to include in the system |
| | 1089 | call filter. The known architecture |
| | 1090 | identifiers are |
| | 1091 | <literal>x86</literal>, |
| | 1092 | <literal>x86-64</literal>, |
| | 1093 | <literal>x32</literal>, |
| | 1094 | <literal>arm</literal> as well as the |
| | 1095 | special identifier |
| | 1096 | <literal>native</literal>. Only system |
| | 1097 | calls of the specified architectures |
| | 1098 | will be permitted to processes of this |
| | 1099 | unit. This is an effective way to |
| | 1100 | disable compatibility with non-native |
| | 1101 | architectures for processes, for |
| | 1102 | example to prohibit execution of 32bit |
| | 1103 | x86 binaries on 64bit x86-64 |
| | 1104 | systems. The special |
| | 1105 | <literal>native</literal> identifier |
| | 1106 | implicitly maps to the native |
| | 1107 | architecture of the system (or more |
| | 1108 | strictly: to the architecture the |
| | 1109 | system manager is compiled for). Note |
| | 1110 | that setting this option to a |
| | 1111 | non-empty list implies that |
| | 1112 | <literal>native</literal> is included |
| | 1113 | too. By default this option is set to |
| | 1114 | the empty list, i.e. no architecture |
| | 1115 | system call filtering is applied. Note |
| | 1116 | that configuring a system call filter |
| | 1117 | with |
| | 1118 | <varname>SystemCallFilter=</varname> |
| | 1119 | (above) implies a |
| | 1120 | <literal>native</literal> architecture |
| | 1121 | list, unless configured |
| | 1122 | otherwise.</para></listitem> |
| | 1123 | </varlistentry> |
| | 1124 | |
| | 1125 | </variablelist> |
| | 1126 | </refsect1> |
| | 1127 | |
| | 1128 | <refsect1> |
| | 1129 | <title>Environment variables in spawned processes</title> |
| | 1130 | |
| | 1131 | <para>Processes started by the system are executed in |
| | 1132 | a clean environment in which select variables |
| | 1133 | listed below are set. System processes started by systemd |
| | 1134 | do not inherit variables from PID 1, but processes |
| | 1135 | started by user systemd instances inherit all |
| | 1136 | environment variables from the user systemd instance. |
| | 1137 | </para> |
| | 1138 | |
| | 1139 | <variablelist class='environment-variables'> |
| | 1140 | <varlistentry> |
| | 1141 | <term><varname>$PATH</varname></term> |
| | 1142 | |
| | 1143 | <listitem><para>Colon-separated list |
| | 1144 | of directiories to use when launching |
| | 1145 | executables. Systemd uses a fixed |
| | 1146 | value of |
| | 1147 | <filename>/usr/local/sbin</filename>:<filename>/usr/local/bin</filename>:<filename>/usr/sbin</filename>:<filename>/usr/bin</filename>:<filename>/sbin</filename>:<filename>/bin</filename>. |
| | 1148 | </para></listitem> |
| | 1149 | </varlistentry> |
| | 1150 | |
| | 1151 | <varlistentry> |
| | 1152 | <term><varname>$LANG</varname></term> |
| | 1153 | |
| | 1154 | <listitem><para>Locale. Can be set in |
| | 1155 | <citerefentry><refentrytitle>locale.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry> |
| | 1156 | or on the kernel command line (see |
| | 1157 | <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry> |
| | 1158 | and |
| | 1159 | <citerefentry><refentrytitle>kernel-command-line</refentrytitle><manvolnum>7</manvolnum></citerefentry>). |
| | 1160 | </para></listitem> |
| | 1161 | </varlistentry> |
| | 1162 | |
| | 1163 | <varlistentry> |
| | 1164 | <term><varname>$USER</varname></term> |
| | 1165 | <term><varname>$LOGNAME</varname></term> |
| | 1166 | <term><varname>$HOME</varname></term> |
| | 1167 | <term><varname>$SHELL</varname></term> |
| | 1168 | |
| | 1169 | <listitem><para>User name (twice), home |
| | 1170 | directory, and the login shell. |
| | 1171 | The variables are set for the units that |
| | 1172 | have <varname>User=</varname> set, |
| | 1173 | which includes user |
| | 1174 | <command>systemd</command> instances. |
| | 1175 | See |
| | 1176 | <citerefentry><refentrytitle>passwd</refentrytitle><manvolnum>5</manvolnum></citerefentry>. |
| | 1177 | </para></listitem> |
| | 1178 | </varlistentry> |
| | 1179 | |
| | 1180 | <varlistentry> |
| | 1181 | <term><varname>$XDG_RUNTIME_DIR</varname></term> |
| | 1182 | |
| | 1183 | <listitem><para>The directory for volatile |
| | 1184 | state. Set for the user <command>systemd</command> |
| | 1185 | instance, and also in user sessions. |
| | 1186 | See |
| | 1187 | <citerefentry><refentrytitle>pam_systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry>. |
| | 1188 | </para></listitem> |
| | 1189 | </varlistentry> |
| | 1190 | |
| | 1191 | <varlistentry> |
| | 1192 | <term><varname>$XDG_SESSION_ID</varname></term> |
| | 1193 | <term><varname>$XDG_SEAT</varname></term> |
| | 1194 | <term><varname>$XDG_VTNR</varname></term> |
| | 1195 | |
| | 1196 | <listitem><para>The identifier of the |
| | 1197 | session, the seat name, and |
| | 1198 | virtual terminal of the session. Set |
| | 1199 | by |
| | 1200 | <citerefentry><refentrytitle>pam_systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry> |
| | 1201 | for login sessions. |
| | 1202 | <varname>$XDG_SEAT</varname> and |
| | 1203 | <varname>$XDG_VTNR</varname> will |
| | 1204 | only be set when attached to a seat and a |
| | 1205 | tty.</para></listitem> |
| | 1206 | </varlistentry> |
| | 1207 | |
| | 1208 | <varlistentry> |
| | 1209 | <term><varname>$MANAGERPID</varname></term> |
| | 1210 | |
| | 1211 | <listitem><para>The PID of the user |
| | 1212 | <command>systemd</command> instance, |
| | 1213 | set for processes spawned by it. |
| | 1214 | </para></listitem> |
| | 1215 | </varlistentry> |
| | 1216 | |
| | 1217 | <varlistentry> |
| | 1218 | <term><varname>$LISTEN_FDS</varname></term> |
| | 1219 | <term><varname>$LISTEN_PID</varname></term> |
| | 1220 | |
| | 1221 | <listitem><para>Information about file |
| | 1222 | descriptors passed to a service for |
| | 1223 | socket activation. See |
| | 1224 | <citerefentry><refentrytitle>sd_listen_fds</refentrytitle><manvolnum>3</manvolnum></citerefentry>. |
| | 1225 | </para></listitem> |
| | 1226 | </varlistentry> |
| | 1227 | |
| | 1228 | <varlistentry> |
| | 1229 | <term><varname>$TERM</varname></term> |
| | 1230 | |
| | 1231 | <listitem><para>Terminal type, set |
| | 1232 | only for units connected to a terminal |
| | 1233 | (<varname>StandardInput=tty</varname>, |
| | 1234 | <varname>StandardOutput=tty</varname>, |
| | 1235 | or |
| | 1236 | <varname>StandardError=tty</varname>). |
| | 1237 | See |
| | 1238 | <citerefentry><refentrytitle>termcap</refentrytitle><manvolnum>5</manvolnum></citerefentry>. |
| | 1239 | </para></listitem> |
| | 1240 | </varlistentry> |
| | 1241 | </variablelist> |
| | 1242 | |
| | 1243 | <para>Additional variables may be configured by the |
| | 1244 | following means: for processes spawned in specific |
| | 1245 | units, use the <varname>Environment=</varname> and |
| | 1246 | <varname>EnvironmentFile=</varname> options above; to |
| | 1247 | specify variables globally, use |
| | 1248 | <varname>DefaultEnvironment=</varname> (see |
| | 1249 | <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>) |
| | 1250 | or the kernel option |
| | 1251 | <varname>systemd.setenv=</varname> (see |
| | 1252 | <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>). Additional |
| | 1253 | variables may also be set through PAM, |
| | 1254 | c.f. <citerefentry><refentrytitle>pam_env</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para> |
| | 1255 | </refsect1> |
| | 1256 | |
| | 1257 | <refsect1> |
| | 1258 | <title>See Also</title> |
| | 1259 | <para> |
| | 1260 | <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>, |
| | 1261 | <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>, |
| | 1262 | <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>, |
| | 1263 | <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>, |
| | 1264 | <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>, |
| | 1265 | <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>, |
| | 1266 | <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>, |
| | 1267 | <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>, |
| | 1268 | <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>, |
| | 1269 | <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>, |
| | 1270 | <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>, |
| | 1271 | <citerefentry><refentrytitle>exec</refentrytitle><manvolnum>3</manvolnum></citerefentry> |
| | 1272 | </para> |
| | 1273 | </refsect1> |
| | 1274 | |
| | 1275 | </refentry> |
projects / thirdparty / systemd.git / blame_incremental