man/sysctl.d.xml

   1 <?xml version="1.0"?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   3 <!--
   4   SPDX-License-Identifier: LGPL-2.1+
   5 -->
   6 <refentry id="sysctl.d"
   7     xmlns:xi="http://www.w3.org/2001/XInclude">
   8
   9   <refentryinfo>
  10     <title>sysctl.d</title>
  11     <productname>systemd</productname>
  12   </refentryinfo>
  13
  14   <refmeta>
  15     <refentrytitle>sysctl.d</refentrytitle>
  16     <manvolnum>5</manvolnum>
  17   </refmeta>
  18
  19   <refnamediv>
  20     <refname>sysctl.d</refname>
  21     <refpurpose>Configure kernel parameters at boot</refpurpose>
  22   </refnamediv>
  23
  24   <refsynopsisdiv>
  25     <para><filename>/etc/sysctl.d/*.conf</filename></para>
  26     <para><filename>/run/sysctl.d/*.conf</filename></para>
  27     <para><filename>/usr/lib/sysctl.d/*.conf</filename></para>
  28   </refsynopsisdiv>
  29
  30   <refsect1>
  31     <title>Description</title>
  32
  33     <para>At boot,
  34     <citerefentry><refentrytitle>systemd-sysctl.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
  35     reads configuration files from the above directories to configure
  36     <citerefentry project='man-pages'><refentrytitle>sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>
  37     kernel parameters.</para>
  38   </refsect1>
  39
  40   <refsect1>
  41     <title>Configuration Format</title>
  42
  43     <para>The configuration files contain a list of variable
  44     assignments, separated by newlines. Empty lines and lines whose
  45     first non-whitespace character is <literal>#</literal> or
  46     <literal>;</literal> are ignored.</para>
  47
  48     <para>Note that either <literal>/</literal> or
  49     <literal>.</literal> may be used as separators within sysctl
  50     variable names. If the first separator is a slash, remaining
  51     slashes and dots are left intact. If the first separator is a dot,
  52     dots and slashes are interchanged.
  53     <literal>kernel.domainname=foo</literal> and
  54     <literal>kernel/domainname=foo</literal> are equivalent and will
  55     cause <literal>foo</literal> to be written to
  56     <filename>/proc/sys/kernel/domainname</filename>. Either
  57     <literal>net.ipv4.conf.enp3s0/200.forwarding</literal> or
  58     <literal>net/ipv4/conf/enp3s0.200/forwarding</literal> may be used
  59     to refer to
  60     <filename>/proc/sys/net/ipv4/conf/enp3s0.200/forwarding</filename>.
  61     </para>
  62
  63     <para>The settings configured with <filename>sysctl.d</filename>
  64     files will be applied early on boot. The network
  65     interface-specific options will also be applied individually for
  66     each network interface as it shows up in the system. (More
  67     specifically, <filename>net.ipv4.conf.*</filename>,
  68     <filename>net.ipv6.conf.*</filename>,
  69     <filename>net.ipv4.neigh.*</filename> and
  70     <filename>net.ipv6.neigh.*</filename>).</para>
  71
  72     <para>Many sysctl parameters only become available when certain
  73     kernel modules are loaded. Modules are usually loaded on demand,
  74     e.g. when certain hardware is plugged in or network brought up.
  75     This means that
  76     <citerefentry><refentrytitle>systemd-sysctl.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
  77     which runs during early boot will not configure such parameters if
  78     they become available after it has run. To set such parameters, it
  79     is recommended to add an
  80     <citerefentry><refentrytitle>udev</refentrytitle><manvolnum>7</manvolnum></citerefentry>
  81     rule to set those parameters when they become available.
  82     Alternatively, a slightly simpler and less efficient option is to
  83     add the module to
  84     <citerefentry><refentrytitle>modules-load.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
  85     causing it to be loaded statically before sysctl settings are
  86     applied (see example below).</para>
  87   </refsect1>
  88
  89   <xi:include href="standard-conf.xml" xpointer="confd" />
  90
  91   <refsect1>
  92     <title>Examples</title>
  93     <example>
  94       <title>Set kernel YP domain name</title>
  95       <para><filename>/etc/sysctl.d/domain-name.conf</filename>:
  96       </para>
  97
  98       <programlisting>kernel.domainname=example.com</programlisting>
  99     </example>
 100
 101     <example>
 102       <title>Apply settings available only when a certain module is loaded (method one)</title>
 103       <para><filename>/etc/udev/rules.d/99-bridge.rules</filename>:
 104       </para>
 105
 106       <programlisting>ACTION=="add", SUBSYSTEM=="module", KERNEL=="br_netfilter", \
 107       RUN+="/usr/lib/systemd/systemd-sysctl --prefix=/net/bridge"
 108 </programlisting>
 109
 110       <para><filename>/etc/sysctl.d/bridge.conf</filename>:
 111       </para>
 112
 113       <programlisting>net.bridge.bridge-nf-call-ip6tables = 0
 114 net.bridge.bridge-nf-call-iptables = 0
 115 net.bridge.bridge-nf-call-arptables = 0
 116 </programlisting>
 117
 118       <para>This method applies settings when the module is
 119       loaded. Please note that, unless the <filename>br_netfilter</filename>
 120       module is loaded, bridged packets will not be filtered by
 121       Netfilter (starting with kernel 3.18), so simply not loading the
 122       module is sufficient to avoid filtering.</para>
 123     </example>
 124
 125     <example>
 126       <title>Apply settings available only when a certain module is loaded (method two)</title>
 127       <para><filename>/etc/modules-load.d/bridge.conf</filename>:
 128       </para>
 129
 130       <programlisting>br_netfilter</programlisting>
 131
 132       <para><filename>/etc/sysctl.d/bridge.conf</filename>:
 133       </para>
 134
 135       <programlisting>net.bridge.bridge-nf-call-ip6tables = 0
 136 net.bridge.bridge-nf-call-iptables = 0
 137 net.bridge.bridge-nf-call-arptables = 0
 138 </programlisting>
 139
 140       <para>This method forces the module to be always loaded. Please
 141       note that, unless the <filename>br_netfilter</filename> module is
 142       loaded, bridged packets will not be filtered with Netfilter
 143       (starting with kernel 3.18), so simply not loading the module is
 144       sufficient to avoid filtering.</para>
 145     </example>
 146   </refsect1>
 147
 148   <refsect1>
 149     <title>See Also</title>
 150     <para>
 151       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 152       <citerefentry><refentrytitle>systemd-sysctl.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 153       <citerefentry><refentrytitle>systemd-delta</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 154       <citerefentry project='man-pages'><refentrytitle>sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 155       <citerefentry project='man-pages'><refentrytitle>sysctl.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 156       <citerefentry project='man-pages'><refentrytitle>modprobe</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 157     </para>
 158   </refsect1>
 159
 160 </refentry>