1 <?xml version='
1.0'
?> <!--*- Mode: nxml; nxml-child-indent: 2; indent-tabs-mode: nil -*-->
2 <!DOCTYPE refentry PUBLIC
"-//OASIS//DTD DocBook XML V4.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
6 This file is part of systemd.
8 Copyright 2010 Lennart Poettering
10 systemd is free software; you can redistribute it and/or modify it
11 under the terms of the GNU Lesser General Public License as published by
12 the Free Software Foundation; either version 2.1 of the License, or
13 (at your option) any later version.
15 systemd is distributed in the hope that it will be useful, but
16 WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Lesser General Public License for more details.
20 You should have received a copy of the GNU Lesser General Public License
21 along with systemd; If not, see <http://www.gnu.org/licenses/>.
24 <refentry id=
"systemd.exec">
26 <title>systemd.exec
</title>
27 <productname>systemd
</productname>
31 <contrib>Developer
</contrib>
32 <firstname>Lennart
</firstname>
33 <surname>Poettering
</surname>
34 <email>lennart@poettering.net
</email>
40 <refentrytitle>systemd.exec
</refentrytitle>
41 <manvolnum>5</manvolnum>
45 <refname>systemd.exec
</refname>
46 <refpurpose>Execution environment configuration
</refpurpose>
50 <para><filename><replaceable>service
</replaceable>.service
</filename>,
51 <filename><replaceable>socket
</replaceable>.socket
</filename>,
52 <filename><replaceable>mount
</replaceable>.mount
</filename>,
53 <filename><replaceable>swap
</replaceable>.swap
</filename></para>
57 <title>Description
</title>
59 <para>Unit configuration files for services, sockets, mount
60 points, and swap devices share a subset of configuration options
61 which define the execution environment of spawned
64 <para>This man page lists the configuration options shared by
65 these four unit types. See
66 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
67 for the common options of all unit configuration files, and
68 <citerefentry><refentrytitle>systemd.service
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
69 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
70 <citerefentry><refentrytitle>systemd.swap
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
72 <citerefentry><refentrytitle>systemd.mount
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
73 for more information on the specific unit configuration files. The
74 execution specific configuration options are configured in the
75 [Service], [Socket], [Mount], or [Swap] sections, depending on the
80 <title>Options
</title>
82 <variablelist class='unit-directives'
>
85 <term><varname>WorkingDirectory=
</varname></term>
87 <listitem><para>Takes an absolute directory path, or the
88 special value
<literal>~
</literal>. Sets the working directory
89 for executed processes. If set to
<literal>~
</literal> the
90 home directory of the user specified in
91 <varname>User=
</varname> is used. If not set, defaults to the
92 root directory when systemd is running as a system instance
93 and the respective user's home directory if run as user. If
94 the setting is prefixed with the
<literal>-
</literal>
95 character, a missing working directory is not considered
96 fatal.
</para></listitem>
100 <term><varname>RootDirectory=
</varname></term>
102 <listitem><para>Takes an absolute directory path. Sets the
103 root directory for executed processes, with the
<citerefentry
104 project='man-pages'
><refentrytitle>chroot
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
105 system call. If this is used, it must be ensured that the
106 process binary and all its auxiliary files are available in
107 the
<function>chroot()
</function> jail.
</para></listitem>
111 <term><varname>User=
</varname></term>
112 <term><varname>Group=
</varname></term>
114 <listitem><para>Sets the Unix user or group that the processes
115 are executed as, respectively. Takes a single user or group
116 name or ID as argument. If no group is set, the default group
117 of the user is chosen.
</para></listitem>
121 <term><varname>SupplementaryGroups=
</varname></term>
123 <listitem><para>Sets the supplementary Unix groups the
124 processes are executed as. This takes a space-separated list
125 of group names or IDs. This option may be specified more than
126 once in which case all listed groups are set as supplementary
127 groups. When the empty string is assigned the list of
128 supplementary groups is reset, and all assignments prior to
129 this one will have no effect. In any way, this option does not
130 override, but extends the list of supplementary groups
131 configured in the system group database for the
132 user.
</para></listitem>
136 <term><varname>Nice=
</varname></term>
138 <listitem><para>Sets the default nice level (scheduling
139 priority) for executed processes. Takes an integer between -
20
140 (highest priority) and
19 (lowest priority). See
141 <citerefentry><refentrytitle>setpriority
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
142 for details.
</para></listitem>
146 <term><varname>OOMScoreAdjust=
</varname></term>
148 <listitem><para>Sets the adjustment level for the
149 Out-Of-Memory killer for executed processes. Takes an integer
150 between -
1000 (to disable OOM killing for this process) and
151 1000 (to make killing of this process under memory pressure
152 very likely). See
<ulink
153 url=
"https://www.kernel.org/doc/Documentation/filesystems/proc.txt">proc.txt
</ulink>
154 for details.
</para></listitem>
158 <term><varname>IOSchedulingClass=
</varname></term>
160 <listitem><para>Sets the IO scheduling class for executed
161 processes. Takes an integer between
0 and
3 or one of the
162 strings
<option>none
</option>,
<option>realtime
</option>,
163 <option>best-effort
</option> or
<option>idle
</option>. See
164 <citerefentry><refentrytitle>ioprio_set
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
165 for details.
</para></listitem>
169 <term><varname>IOSchedulingPriority=
</varname></term>
171 <listitem><para>Sets the IO scheduling priority for executed
172 processes. Takes an integer between
0 (highest priority) and
7
173 (lowest priority). The available priorities depend on the
174 selected IO scheduling class (see above). See
175 <citerefentry><refentrytitle>ioprio_set
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
176 for details.
</para></listitem>
180 <term><varname>CPUSchedulingPolicy=
</varname></term>
182 <listitem><para>Sets the CPU scheduling policy for executed
183 processes. Takes one of
184 <option>other
</option>,
185 <option>batch
</option>,
186 <option>idle
</option>,
187 <option>fifo
</option> or
188 <option>rr
</option>. See
189 <citerefentry><refentrytitle>sched_setscheduler
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
190 for details.
</para></listitem>
194 <term><varname>CPUSchedulingPriority=
</varname></term>
196 <listitem><para>Sets the CPU scheduling priority for executed
197 processes. The available priority range depends on the
198 selected CPU scheduling policy (see above). For real-time
199 scheduling policies an integer between
1 (lowest priority) and
200 99 (highest priority) can be used. See
201 <citerefentry><refentrytitle>sched_setscheduler
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
202 for details.
</para></listitem>
206 <term><varname>CPUSchedulingResetOnFork=
</varname></term>
208 <listitem><para>Takes a boolean argument. If true, elevated
209 CPU scheduling priorities and policies will be reset when the
210 executed processes fork, and can hence not leak into child
212 <citerefentry><refentrytitle>sched_setscheduler
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
213 for details. Defaults to false.
</para></listitem>
217 <term><varname>CPUAffinity=
</varname></term>
219 <listitem><para>Controls the CPU affinity of the executed
220 processes. Takes a space-separated list of CPU indices. This
221 option may be specified more than once in which case the
222 specified CPU affinity masks are merged. If the empty string
223 is assigned, the mask is reset, all assignments prior to this
224 will have no effect. See
225 <citerefentry><refentrytitle>sched_setaffinity
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
226 for details.
</para></listitem>
230 <term><varname>UMask=
</varname></term>
232 <listitem><para>Controls the file mode creation mask. Takes an
233 access mode in octal notation. See
234 <citerefentry><refentrytitle>umask
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
235 for details. Defaults to
0022.
</para></listitem>
239 <term><varname>Environment=
</varname></term>
241 <listitem><para>Sets environment variables for executed
242 processes. Takes a space-separated list of variable
243 assignments. This option may be specified more than once in
244 which case all listed variables will be set. If the same
245 variable is set twice, the later setting will override the
246 earlier setting. If the empty string is assigned to this
247 option, the list of environment variables is reset, all prior
248 assignments have no effect. Variable expansion is not
249 performed inside the strings, however, specifier expansion is
250 possible. The $ character has no special meaning. If you need
251 to assign a value containing spaces to a variable, use double
252 quotes (
") for the assignment.</para>
255 <programlisting>Environment="VAR1=word1 word2
" VAR2=word3 "VAR3=$word
5 6"</programlisting>
256 gives three variables <literal>VAR1</literal>,
257 <literal>VAR2</literal>, <literal>VAR3</literal>
258 with the values <literal>word1 word2</literal>,
259 <literal>word3</literal>, <literal>$word 5 6</literal>.
264 <citerefentry project='man-pages'><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>
265 for details about environment variables.</para></listitem>
268 <term><varname>EnvironmentFile=</varname></term>
269 <listitem><para>Similar to <varname>Environment=</varname> but
270 reads the environment variables from a text file. The text
271 file should contain new-line-separated variable assignments.
272 Empty lines, lines without an <literal>=</literal> separator,
273 or lines starting with ; or # will be ignored,
274 which may be used for commenting. A line ending with a
275 backslash will be concatenated with the following one,
276 allowing multiline variable definitions. The parser strips
277 leading and trailing whitespace from the values of
278 assignments, unless you use double quotes (").
</para>
280 <para>The argument passed should be an absolute filename or
281 wildcard expression, optionally prefixed with
282 <literal>-
</literal>, which indicates that if the file does
283 not exist, it will not be read and no error or warning message
284 is logged. This option may be specified more than once in
285 which case all specified files are read. If the empty string
286 is assigned to this option, the list of file to read is reset,
287 all prior assignments have no effect.
</para>
289 <para>The files listed with this directive will be read
290 shortly before the process is executed (more specifically,
291 after all processes from a previous unit state terminated.
292 This means you can generate these files in one unit state, and
293 read it with this option in the next).
</para>
295 <para>Settings from these
296 files override settings made with
297 <varname>Environment=
</varname>. If the same variable is set
298 twice from these files, the files will be read in the order
299 they are specified and the later setting will override the
300 earlier setting.
</para></listitem>
304 <term><varname>StandardInput=
</varname></term>
305 <listitem><para>Controls where file descriptor
0 (STDIN) of
306 the executed processes is connected to. Takes one of
307 <option>null
</option>,
308 <option>tty
</option>,
309 <option>tty-force
</option>,
310 <option>tty-fail
</option> or
311 <option>socket
</option>.
</para>
313 <para>If
<option>null
</option> is selected, standard input
314 will be connected to
<filename>/dev/null
</filename>, i.e. all
315 read attempts by the process will result in immediate
318 <para>If
<option>tty
</option> is selected, standard input is
319 connected to a TTY (as configured by
320 <varname>TTYPath=
</varname>, see below) and the executed
321 process becomes the controlling process of the terminal. If
322 the terminal is already being controlled by another process,
323 the executed process waits until the current controlling
324 process releases the terminal.
</para>
326 <para><option>tty-force
</option> is similar to
327 <option>tty
</option>, but the executed process is forcefully
328 and immediately made the controlling process of the terminal,
329 potentially removing previous controlling processes from the
332 <para><option>tty-fail
</option> is similar to
333 <option>tty
</option> but if the terminal already has a
334 controlling process start-up of the executed process
337 <para>The
<option>socket
</option> option is only valid in
338 socket-activated services, and only when the socket
339 configuration file (see
340 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
341 for details) specifies a single socket only. If this option is
342 set, standard input will be connected to the socket the
343 service was activated from, which is primarily useful for
344 compatibility with daemons designed for use with the
346 <citerefentry project='freebsd'
><refentrytitle>inetd
</refentrytitle><manvolnum>8</manvolnum></citerefentry>
349 <para>This setting defaults to
350 <option>null
</option>.
</para></listitem>
353 <term><varname>StandardOutput=
</varname></term>
354 <listitem><para>Controls where file descriptor
1 (STDOUT) of
355 the executed processes is connected to. Takes one of
356 <option>inherit
</option>,
357 <option>null
</option>,
358 <option>tty
</option>,
359 <option>journal
</option>,
360 <option>syslog
</option>,
361 <option>kmsg
</option>,
362 <option>journal+console
</option>,
363 <option>syslog+console
</option>,
364 <option>kmsg+console
</option> or
365 <option>socket
</option>.
</para>
367 <para><option>inherit
</option> duplicates the file descriptor
368 of standard input for standard output.
</para>
370 <para><option>null
</option> connects standard output to
371 <filename>/dev/null
</filename>, i.e. everything written to it
374 <para><option>tty
</option> connects standard output to a tty
375 (as configured via
<varname>TTYPath=
</varname>, see below). If
376 the TTY is used for output only, the executed process will not
377 become the controlling process of the terminal, and will not
378 fail or wait for other processes to release the
381 <para><option>journal
</option> connects standard output with
382 the journal which is accessible via
383 <citerefentry><refentrytitle>journalctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
384 Note that everything that is written to syslog or kmsg (see
385 below) is implicitly stored in the journal as well, the
386 specific two options listed below are hence supersets of this
389 <para><option>syslog
</option> connects standard output to the
390 <citerefentry project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
391 system syslog service, in addition to the journal. Note that
392 the journal daemon is usually configured to forward everything
393 it receives to syslog anyway, in which case this option is no
394 different from
<option>journal
</option>.
</para>
396 <para><option>kmsg
</option> connects standard output with the
397 kernel log buffer which is accessible via
398 <citerefentry project='man-pages'
><refentrytitle>dmesg
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
399 in addition to the journal. The journal daemon might be
400 configured to send all logs to kmsg anyway, in which case this
401 option is no different from
<option>journal
</option>.
</para>
403 <para><option>journal+console
</option>,
404 <option>syslog+console
</option> and
405 <option>kmsg+console
</option> work in a similar way as the
406 three options above but copy the output to the system console
409 <para><option>socket
</option> connects standard output to a
410 socket acquired via socket activation. The semantics are
411 similar to the same option of
412 <varname>StandardInput=
</varname>.
</para>
414 <para>This setting defaults to the value set with
415 <option>DefaultStandardOutput=
</option> in
416 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
417 which defaults to
<option>journal
</option>.
</para></listitem>
420 <term><varname>StandardError=
</varname></term>
421 <listitem><para>Controls where file descriptor
2 (STDERR) of
422 the executed processes is connected to. The available options
423 are identical to those of
<varname>StandardOutput=
</varname>,
424 with one exception: if set to
<option>inherit
</option> the
425 file descriptor used for standard output is duplicated for
426 standard error. This setting defaults to the value set with
427 <option>DefaultStandardError=
</option> in
428 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
429 which defaults to
<option>inherit
</option>.
</para></listitem>
432 <term><varname>TTYPath=
</varname></term>
433 <listitem><para>Sets the terminal device node to use if
434 standard input, output, or error are connected to a TTY (see
436 <filename>/dev/console
</filename>.
</para></listitem>
439 <term><varname>TTYReset=
</varname></term>
440 <listitem><para>Reset the terminal device specified with
441 <varname>TTYPath=
</varname> before and after execution.
442 Defaults to
<literal>no
</literal>.
</para></listitem>
445 <term><varname>TTYVHangup=
</varname></term>
446 <listitem><para>Disconnect all clients which have opened the
447 terminal device specified with
<varname>TTYPath=
</varname>
448 before and after execution. Defaults to
449 <literal>no
</literal>.
</para></listitem>
452 <term><varname>TTYVTDisallocate=
</varname></term>
453 <listitem><para>If the terminal device specified with
454 <varname>TTYPath=
</varname> is a virtual console terminal, try
455 to deallocate the TTY before and after execution. This ensures
456 that the screen and scrollback buffer is cleared. Defaults to
457 <literal>no
</literal>.
</para></listitem>
460 <term><varname>SyslogIdentifier=
</varname></term>
461 <listitem><para>Sets the process name to prefix log lines sent
462 to the logging system or the kernel log buffer with. If not
463 set, defaults to the process name of the executed process.
464 This option is only useful when
465 <varname>StandardOutput=
</varname> or
466 <varname>StandardError=
</varname> are set to
467 <option>syslog
</option>,
<option>journal
</option> or
468 <option>kmsg
</option> (or to the same settings in combination
469 with
<option>+console
</option>).
</para></listitem>
472 <term><varname>SyslogFacility=
</varname></term>
473 <listitem><para>Sets the syslog facility to use when logging
474 to syslog. One of
<option>kern
</option>,
475 <option>user
</option>,
<option>mail
</option>,
476 <option>daemon
</option>,
<option>auth
</option>,
477 <option>syslog
</option>,
<option>lpr
</option>,
478 <option>news
</option>,
<option>uucp
</option>,
479 <option>cron
</option>,
<option>authpriv
</option>,
480 <option>ftp
</option>,
<option>local0
</option>,
481 <option>local1
</option>,
<option>local2
</option>,
482 <option>local3
</option>,
<option>local4
</option>,
483 <option>local5
</option>,
<option>local6
</option> or
484 <option>local7
</option>. See
485 <citerefentry project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
486 for details. This option is only useful when
487 <varname>StandardOutput=
</varname> or
488 <varname>StandardError=
</varname> are set to
489 <option>syslog
</option>. Defaults to
490 <option>daemon
</option>.
</para></listitem>
493 <term><varname>SyslogLevel=
</varname></term>
494 <listitem><para>Default syslog level to use when logging to
495 syslog or the kernel log buffer. One of
496 <option>emerg
</option>,
497 <option>alert
</option>,
498 <option>crit
</option>,
499 <option>err
</option>,
500 <option>warning
</option>,
501 <option>notice
</option>,
502 <option>info
</option>,
503 <option>debug
</option>. See
504 <citerefentry project='man-pages'
><refentrytitle>syslog
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
505 for details. This option is only useful when
506 <varname>StandardOutput=
</varname> or
507 <varname>StandardError=
</varname> are set to
508 <option>syslog
</option> or
<option>kmsg
</option>. Note that
509 individual lines output by the daemon might be prefixed with a
510 different log level which can be used to override the default
511 log level specified here. The interpretation of these prefixes
512 may be disabled with
<varname>SyslogLevelPrefix=
</varname>,
513 see below. For details see
514 <citerefentry><refentrytitle>sd-daemon
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
517 <option>info
</option>.
</para></listitem>
521 <term><varname>SyslogLevelPrefix=
</varname></term>
522 <listitem><para>Takes a boolean argument. If true and
523 <varname>StandardOutput=
</varname> or
524 <varname>StandardError=
</varname> are set to
525 <option>syslog
</option>,
<option>kmsg
</option> or
526 <option>journal
</option>, log lines written by the executed
527 process that are prefixed with a log level will be passed on
528 to syslog with this log level set but the prefix removed. If
529 set to false, the interpretation of these prefixes is disabled
530 and the logged lines are passed on as-is. For details about
532 <citerefentry><refentrytitle>sd-daemon
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
533 Defaults to true.
</para></listitem>
537 <term><varname>TimerSlackNSec=
</varname></term>
538 <listitem><para>Sets the timer slack in nanoseconds for the
539 executed processes. The timer slack controls the accuracy of
540 wake-ups triggered by timers. See
541 <citerefentry><refentrytitle>prctl
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
542 for more information. Note that in contrast to most other time
543 span definitions this parameter takes an integer value in
544 nano-seconds if no unit is specified. The usual time units are
545 understood too.
</para></listitem>
549 <term><varname>LimitCPU=
</varname></term>
550 <term><varname>LimitFSIZE=
</varname></term>
551 <term><varname>LimitDATA=
</varname></term>
552 <term><varname>LimitSTACK=
</varname></term>
553 <term><varname>LimitCORE=
</varname></term>
554 <term><varname>LimitRSS=
</varname></term>
555 <term><varname>LimitNOFILE=
</varname></term>
556 <term><varname>LimitAS=
</varname></term>
557 <term><varname>LimitNPROC=
</varname></term>
558 <term><varname>LimitMEMLOCK=
</varname></term>
559 <term><varname>LimitLOCKS=
</varname></term>
560 <term><varname>LimitSIGPENDING=
</varname></term>
561 <term><varname>LimitMSGQUEUE=
</varname></term>
562 <term><varname>LimitNICE=
</varname></term>
563 <term><varname>LimitRTPRIO=
</varname></term>
564 <term><varname>LimitRTTIME=
</varname></term>
565 <listitem><para>These settings set both soft and hard limits
566 of various resources for executed processes. See
567 <citerefentry><refentrytitle>setrlimit
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
568 for details. Use the string
<varname>infinity
</varname> to
569 configure no limit on a specific resource.
</para></listitem>
572 <title>Limit directives and their equivalent with ulimit
</title>
575 <colspec colname='directive'
/>
576 <colspec colname='equivalent'
/>
579 <entry>Directive
</entry>
580 <entry>ulimit equivalent
</entry>
585 <entry>LimitCPU
</entry>
586 <entry>ulimit -t
</entry>
589 <entry>LimitFSIZE
</entry>
590 <entry>ulimit -f
</entry>
593 <entry>LimitDATA
</entry>
594 <entry>ulimit -d
</entry>
597 <entry>LimitSTACK
</entry>
598 <entry>ulimit -s
</entry>
601 <entry>LimitCORE
</entry>
602 <entry>ulimit -c
</entry>
605 <entry>LimitRSS
</entry>
606 <entry>ulimit -m
</entry>
609 <entry>LimitNOFILE
</entry>
610 <entry>ulimit -n
</entry>
613 <entry>LimitAS
</entry>
614 <entry>ulimit -v
</entry>
617 <entry>LimitNPROC
</entry>
618 <entry>ulimit -u
</entry>
621 <entry>LimitMEMLOCK
</entry>
622 <entry>ulimit -l
</entry>
625 <entry>LimitLOCKS
</entry>
626 <entry>ulimit -x
</entry>
629 <entry>LimitSIGPENDING
</entry>
630 <entry>ulimit -i
</entry>
633 <entry>LimitMSGQUEUE
</entry>
634 <entry>ulimit -q
</entry>
637 <entry>LimitNICE
</entry>
638 <entry>ulimit -e
</entry>
641 <entry>LimitRTPRIO
</entry>
642 <entry>ulimit -r
</entry>
645 <entry>LimitRTTIME
</entry>
646 <entry>No equivalent
</entry>
654 <term><varname>PAMName=
</varname></term>
655 <listitem><para>Sets the PAM service name to set up a session
656 as. If set, the executed process will be registered as a PAM
657 session under the specified service name. This is only useful
658 in conjunction with the
<varname>User=
</varname> setting. If
659 not set, no PAM session will be opened for the executed
661 <citerefentry project='man-pages'
><refentrytitle>pam
</refentrytitle><manvolnum>8</manvolnum></citerefentry>
662 for details.
</para></listitem>
666 <term><varname>CapabilityBoundingSet=
</varname></term>
668 <listitem><para>Controls which capabilities to include in the
669 capability bounding set for the executed process. See
670 <citerefentry project='man-pages'
><refentrytitle>capabilities
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
671 for details. Takes a whitespace-separated list of capability
673 <citerefentry project='mankier'
><refentrytitle>cap_from_name
</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
674 e.g.
<constant>CAP_SYS_ADMIN
</constant>,
675 <constant>CAP_DAC_OVERRIDE
</constant>,
676 <constant>CAP_SYS_PTRACE
</constant>. Capabilities listed will
677 be included in the bounding set, all others are removed. If
678 the list of capabilities is prefixed with
679 <literal>~
</literal>, all but the listed capabilities will be
680 included, the effect of the assignment inverted. Note that
681 this option also affects the respective capabilities in the
682 effective, permitted and inheritable capability sets, on top
683 of what
<varname>Capabilities=
</varname> does. If this option
684 is not used, the capability bounding set is not modified on
685 process execution, hence no limits on the capabilities of the
686 process are enforced. This option may appear more than once in
687 which case the bounding sets are merged. If the empty string
688 is assigned to this option, the bounding set is reset to the
689 empty capability set, and all prior settings have no effect.
690 If set to
<literal>~
</literal> (without any further argument),
691 the bounding set is reset to the full set of available
692 capabilities, also undoing any previous
693 settings.
</para></listitem>
697 <term><varname>SecureBits=
</varname></term>
698 <listitem><para>Controls the secure bits set for the executed
699 process. Takes a space-separated combination of options from
701 <option>keep-caps
</option>,
702 <option>keep-caps-locked
</option>,
703 <option>no-setuid-fixup
</option>,
704 <option>no-setuid-fixup-locked
</option>,
705 <option>noroot
</option>, and
706 <option>noroot-locked
</option>.
707 This option may appear more than once in which case the secure
708 bits are ORed. If the empty string is assigned to this option,
709 the bits are reset to
0. See
710 <citerefentry project='man-pages'
><refentrytitle>capabilities
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
711 for details.
</para></listitem>
715 <term><varname>Capabilities=
</varname></term>
716 <listitem><para>Controls the
717 <citerefentry project='man-pages'
><refentrytitle>capabilities
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
718 set for the executed process. Take a capability string
719 describing the effective, permitted and inherited capability
720 sets as documented in
721 <citerefentry project='mankier'
><refentrytitle>cap_from_text
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
722 Note that these capability sets are usually influenced (and
723 filtered) by the capabilities attached to the executed file.
724 Due to that
<varname>CapabilityBoundingSet=
</varname> is
725 probably a much more useful setting.
</para></listitem>
729 <term><varname>ReadWriteDirectories=
</varname></term>
730 <term><varname>ReadOnlyDirectories=
</varname></term>
731 <term><varname>InaccessibleDirectories=
</varname></term>
733 <listitem><para>Sets up a new file system namespace for
734 executed processes. These options may be used to limit access
735 a process might have to the main file system hierarchy. Each
736 setting takes a space-separated list of absolute directory
737 paths. Directories listed in
738 <varname>ReadWriteDirectories=
</varname> are accessible from
739 within the namespace with the same access rights as from
740 outside. Directories listed in
741 <varname>ReadOnlyDirectories=
</varname> are accessible for
742 reading only, writing will be refused even if the usual file
743 access controls would permit this. Directories listed in
744 <varname>InaccessibleDirectories=
</varname> will be made
745 inaccessible for processes inside the namespace. Note that
746 restricting access with these options does not extend to
747 submounts of a directory that are created later on. These
748 options may be specified more than once in which case all
749 directories listed will have limited access from within the
750 namespace. If the empty string is assigned to this option, the
751 specific list is reset, and all prior assignments have no
754 <varname>ReadOnlyDirectories=
</varname>
756 <varname>InaccessibleDirectories=
</varname>
758 <literal>-
</literal>, in which case
759 they will be ignored when they do not
760 exist. Note that using this
761 setting will disconnect propagation of
762 mounts from the service to the host
763 (propagation in the opposite direction
764 continues to work). This means that
765 this setting may not be used for
766 services which shall be able to
767 install mount points in the main mount
768 namespace.
</para></listitem>
772 <term><varname>PrivateTmp=
</varname></term>
774 <listitem><para>Takes a boolean argument. If true, sets up a
775 new file system namespace for the executed processes and
776 mounts private
<filename>/tmp
</filename> and
777 <filename>/var/tmp
</filename> directories inside it that is
778 not shared by processes outside of the namespace. This is
779 useful to secure access to temporary files of the process, but
780 makes sharing between processes via
<filename>/tmp
</filename>
781 or
<filename>/var/tmp
</filename> impossible. If this is
782 enabled, all temporary files created by a service in these
783 directories will be removed after the service is stopped.
784 Defaults to false. It is possible to run two or more units
785 within the same private
<filename>/tmp
</filename> and
786 <filename>/var/tmp
</filename> namespace by using the
787 <varname>JoinsNamespaceOf=
</varname> directive, see
788 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
789 for details. Note that using this setting will disconnect
790 propagation of mounts from the service to the host
791 (propagation in the opposite direction continues to work).
792 This means that this setting may not be used for services
793 which shall be able to install mount points in the main mount
794 namespace.
</para></listitem>
798 <term><varname>PrivateDevices=
</varname></term>
800 <listitem><para>Takes a boolean argument. If true, sets up a
801 new /dev namespace for the executed processes and only adds
802 API pseudo devices such as
<filename>/dev/null
</filename>,
803 <filename>/dev/zero
</filename> or
804 <filename>/dev/random
</filename> (as well as the pseudo TTY
805 subsystem) to it, but no physical devices such as
806 <filename>/dev/sda
</filename>. This is useful to securely turn
807 off physical device access by the executed process. Defaults
808 to false. Enabling this option will also remove
809 <constant>CAP_MKNOD
</constant> from the capability bounding
810 set for the unit (see above), and set
811 <varname>DevicePolicy=closed
</varname> (see
812 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
813 for details). Note that using this setting will disconnect
814 propagation of mounts from the service to the host
815 (propagation in the opposite direction continues to work).
816 This means that this setting may not be used for services
817 which shall be able to install mount points in the main mount
818 namespace.
</para></listitem>
822 <term><varname>PrivateNetwork=
</varname></term>
824 <listitem><para>Takes a boolean argument. If true, sets up a
825 new network namespace for the executed processes and
826 configures only the loopback network device
827 <literal>lo
</literal> inside it. No other network devices will
828 be available to the executed process. This is useful to
829 securely turn off network access by the executed process.
830 Defaults to false. It is possible to run two or more units
831 within the same private network namespace by using the
832 <varname>JoinsNamespaceOf=
</varname> directive, see
833 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
834 for details. Note that this option will disconnect all socket
835 families from the host, this includes AF_NETLINK and AF_UNIX.
836 The latter has the effect that AF_UNIX sockets in the abstract
837 socket namespace will become unavailable to the processes
838 (however, those located in the file system will continue to be
839 accessible).
</para></listitem>
843 <term><varname>ProtectSystem=
</varname></term>
845 <listitem><para>Takes a boolean argument or
846 <literal>full
</literal>. If true, mounts the
847 <filename>/usr
</filename> and
<filename>/boot
</filename>
848 directories read-only for processes invoked by this unit. If
849 set to
<literal>full
</literal>, the
<filename>/etc
</filename>
850 directory is mounted read-only, too. This setting ensures that
851 any modification of the vendor supplied operating system (and
852 optionally its configuration) is prohibited for the service.
853 It is recommended to enable this setting for all long-running
854 services, unless they are involved with system updates or need
855 to modify the operating system in other ways. Note however
856 that processes retaining the CAP_SYS_ADMIN capability can undo
857 the effect of this setting. This setting is hence particularly
858 useful for daemons which have this capability removed, for
859 example with
<varname>CapabilityBoundingSet=
</varname>.
860 Defaults to off.
</para></listitem>
864 <term><varname>ProtectHome=
</varname></term>
866 <listitem><para>Takes a boolean argument or
867 <literal>read-only
</literal>. If true, the directories
868 <filename>/home
</filename>,
<filename>/root
</filename> and
869 <filename>/run/user
</filename>
870 are made inaccessible and empty for processes invoked by this
871 unit. If set to
<literal>read-only
</literal>, the three
872 directories are made read-only instead. It is recommended to
873 enable this setting for all long-running services (in
874 particular network-facing ones), to ensure they cannot get
875 access to private user data, unless the services actually
876 require access to the user's private data. Note however that
877 processes retaining the CAP_SYS_ADMIN capability can undo the
878 effect of this setting. This setting is hence particularly
879 useful for daemons which have this capability removed, for
880 example with
<varname>CapabilityBoundingSet=
</varname>.
881 Defaults to off.
</para></listitem>
885 <term><varname>MountFlags=
</varname></term>
887 <listitem><para>Takes a mount propagation flag:
888 <option>shared
</option>,
<option>slave
</option> or
889 <option>private
</option>, which control whether mounts in the
890 file system namespace set up for this unit's processes will
891 receive or propagate mounts or unmounts. See
892 <citerefentry project='man-pages'
><refentrytitle>mount
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
893 for details. Defaults to
<option>shared
</option>. Use
894 <option>shared
</option> to ensure that mounts and unmounts are
895 propagated from the host to the container and vice versa. Use
896 <option>slave
</option> to run processes so that none of their
897 mounts and unmounts will propagate to the host. Use
898 <option>private
</option> to also ensure that no mounts and
899 unmounts from the host will propagate into the unit processes'
900 namespace. Note that
<option>slave
</option> means that file
901 systems mounted on the host might stay mounted continuously in
902 the unit's namespace, and thus keep the device busy. Note that
903 the file system namespace related options
904 (
<varname>PrivateTmp=
</varname>,
905 <varname>PrivateDevices=
</varname>,
906 <varname>ProtectSystem=
</varname>,
907 <varname>ProtectHome=
</varname>,
908 <varname>ReadOnlyDirectories=
</varname>,
909 <varname>InaccessibleDirectories=
</varname> and
910 <varname>ReadWriteDirectories=
</varname>) require that mount
911 and unmount propagation from the unit's file system namespace
912 is disabled, and hence downgrade
<option>shared
</option> to
913 <option>slave
</option>.
</para></listitem>
917 <term><varname>UtmpIdentifier=
</varname></term>
919 <listitem><para>Takes a four character identifier string for
921 project='man-pages'
><refentrytitle>utmp
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
922 and wtmp entry for this service. This should only be
923 set for services such as
<command>getty
</command>
924 implementations (such as
<citerefentry
925 project='die-net'
><refentrytitle>agetty
</refentrytitle><manvolnum>8</manvolnum></citerefentry>)
926 where utmp/wtmp entries must be created and cleared before and
927 after execution, or for services that shall be executed as if
928 they were run by a
<command>getty
</command> process (see
929 below). If the configured string is longer than four
930 characters, it is truncated and the terminal four characters
931 are used. This setting interprets %I style string
932 replacements. This setting is unset by default, i.e. no
933 utmp/wtmp entries are created or cleaned up for this
934 service.
</para></listitem>
938 <term><varname>UtmpMode=
</varname></term>
940 <listitem><para>Takes one of
<literal>init
</literal>,
941 <literal>login
</literal> or
<literal>user
</literal>. If
942 <varname>UtmpIdentifier=
</varname> is set, controls which
943 type of
<citerefentry
944 project='man-pages'
><refentrytitle>utmp
</refentrytitle><manvolnum>5</manvolnum></citerefentry>/wtmp
945 entries for this service are generated. This setting has no
946 effect unless
<varname>UtmpIdentifier=
</varname> is set
947 too. If
<literal>init
</literal> is set, only an
948 <constant>INIT_PROCESS
</constant> entry is generated and the
949 invoked process must implement a
950 <command>getty
</command>-compatible utmp/wtmp logic. If
951 <literal>login
</literal> is set, first an
952 <constant>INIT_PROCESS
</constant> entry, followed by an
953 <constant>LOGIN_PROCESS
</constant> entry is generated. In
954 this case the invoked process must implement a
<citerefentry
955 project='die-net'
><refentrytitle>login
</refentrytitle><manvolnum>1</manvolnum></citerefentry>-compatible
956 utmp/wtmp logic. If
<literal>user
</literal> is set, first an
957 <constant>INIT_PROCESS
</constant> entry, then a
958 <constant>LOGIN_PROCESS
</constant> entry and finally an
959 <constant>USER_PROCESS
</constant> entry is generated. In this
960 case the invoked process may be any process that is suitable
961 to be run as session leader. Defaults to
962 <literal>init
</literal>.
</para></listitem>
966 <term><varname>SELinuxContext=
</varname></term>
968 <listitem><para>Set the SELinux security context of the
969 executed process. If set, this will override the automated
970 domain transition. However, the policy still needs to
971 authorize the transition. This directive is ignored if SELinux
972 is disabled. If prefixed by
<literal>-
</literal>, all errors
974 <citerefentry project='die-net'
><refentrytitle>setexeccon
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
975 for details.
</para></listitem>
979 <term><varname>AppArmorProfile=
</varname></term>
981 <listitem><para>Takes a profile name as argument. The process
982 executed by the unit will switch to this profile when started.
983 Profiles must already be loaded in the kernel, or the unit
984 will fail. This result in a non operation if AppArmor is not
985 enabled. If prefixed by
<literal>-
</literal>, all errors will
986 be ignored.
</para></listitem>
990 <term><varname>SmackProcessLabel=
</varname></term>
992 <listitem><para>Takes a
<option>SMACK64
</option> security
993 label as argument. The process executed by the unit will be
994 started under this label and SMACK will decide whether the
995 processes is allowed to run or not based on it. The process
996 will continue to run under the label specified here unless the
997 executable has its own
<option>SMACK64EXEC
</option> label, in
998 which case the process will transition to run under that
999 label. When not specified, the label that systemd is running
1000 under is used. This directive is ignored if SMACK is
1003 <para>The value may be prefixed by
<literal>-
</literal>, in
1004 which case all errors will be ignored. An empty value may be
1005 specified to unset previous assignments.
</para>
1010 <term><varname>IgnoreSIGPIPE=
</varname></term>
1012 <listitem><para>Takes a boolean argument. If true, causes
1013 <constant>SIGPIPE
</constant> to be ignored in the executed
1014 process. Defaults to true because
<constant>SIGPIPE
</constant>
1015 generally is useful only in shell pipelines.
</para></listitem>
1019 <term><varname>NoNewPrivileges=
</varname></term>
1021 <listitem><para>Takes a boolean argument. If true, ensures
1022 that the service process and all its children can never gain
1023 new privileges. This option is more powerful than the
1024 respective secure bits flags (see above), as it also prohibits
1025 UID changes of any kind. This is the simplest, most effective
1026 way to ensure that a process and its children can never
1027 elevate privileges again.
</para></listitem>
1031 <term><varname>SystemCallFilter=
</varname></term>
1033 <listitem><para>Takes a space-separated list of system call
1034 names. If this setting is used, all system calls executed by
1035 the unit processes except for the listed ones will result in
1036 immediate process termination with the
1037 <constant>SIGSYS
</constant> signal (whitelisting). If the
1038 first character of the list is
<literal>~
</literal>, the
1039 effect is inverted: only the listed system calls will result
1040 in immediate process termination (blacklisting). If running in
1041 user mode and this option is used,
1042 <varname>NoNewPrivileges=yes
</varname> is implied. This
1043 feature makes use of the Secure Computing Mode
2 interfaces of
1044 the kernel ('seccomp filtering') and is useful for enforcing a
1045 minimal sandboxing environment. Note that the
1046 <function>execve
</function>,
1047 <function>rt_sigreturn
</function>,
1048 <function>sigreturn
</function>,
1049 <function>exit_group
</function>,
<function>exit
</function>
1050 system calls are implicitly whitelisted and do not need to be
1051 listed explicitly. This option may be specified more than once
1052 in which case the filter masks are merged. If the empty string
1053 is assigned, the filter is reset, all prior assignments will
1054 have no effect.
</para>
1056 <para>If you specify both types of this option (i.e.
1057 whitelisting and blacklisting), the first encountered will
1058 take precedence and will dictate the default action
1059 (termination or approval of a system call). Then the next
1060 occurrences of this option will add or delete the listed
1061 system calls from the set of the filtered system calls,
1062 depending of its type and the default action. (For example, if
1063 you have started with a whitelisting of
1064 <function>read
</function> and
<function>write
</function>, and
1065 right after it add a blacklisting of
1066 <function>write
</function>, then
<function>write
</function>
1067 will be removed from the set.)
</para></listitem>
1071 <term><varname>SystemCallErrorNumber=
</varname></term>
1073 <listitem><para>Takes an
<literal>errno
</literal> error number
1074 name to return when the system call filter configured with
1075 <varname>SystemCallFilter=
</varname> is triggered, instead of
1076 terminating the process immediately. Takes an error name such
1077 as
<constant>EPERM
</constant>,
<constant>EACCES
</constant> or
1078 <constant>EUCLEAN
</constant>. When this setting is not used,
1079 or when the empty string is assigned, the process will be
1080 terminated immediately when the filter is
1081 triggered.
</para></listitem>
1085 <term><varname>SystemCallArchitectures=
</varname></term>
1087 <listitem><para>Takes a space separated list of architecture
1088 identifiers to include in the system call filter. The known
1089 architecture identifiers are
<constant>x86
</constant>,
1090 <constant>x86-
64</constant>,
<constant>x32
</constant>,
1091 <constant>arm
</constant> as well as the special identifier
1092 <constant>native
</constant>. Only system calls of the
1093 specified architectures will be permitted to processes of this
1094 unit. This is an effective way to disable compatibility with
1095 non-native architectures for processes, for example to
1096 prohibit execution of
32-bit x86 binaries on
64-bit x86-
64
1097 systems. The special
<constant>native
</constant> identifier
1098 implicitly maps to the native architecture of the system (or
1099 more strictly: to the architecture the system manager is
1100 compiled for). If running in user mode and this option is
1101 used,
<varname>NoNewPrivileges=yes
</varname> is implied. Note
1102 that setting this option to a non-empty list implies that
1103 <constant>native
</constant> is included too. By default, this
1104 option is set to the empty list, i.e. no architecture system
1105 call filtering is applied.
</para></listitem>
1109 <term><varname>RestrictAddressFamilies=
</varname></term>
1111 <listitem><para>Restricts the set of socket address families
1112 accessible to the processes of this unit. Takes a
1113 space-separated list of address family names to whitelist,
1115 <constant>AF_UNIX
</constant>,
1116 <constant>AF_INET
</constant> or
1117 <constant>AF_INET6
</constant>. When
1118 prefixed with
<constant>~
</constant> the listed address
1119 families will be applied as blacklist, otherwise as whitelist.
1120 Note that this restricts access to the
1121 <citerefentry project='man-pages'
><refentrytitle>socket
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1122 system call only. Sockets passed into the process by other
1123 means (for example, by using socket activation with socket
1125 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry>)
1126 are unaffected. Also, sockets created with
1127 <function>socketpair()
</function> (which creates connected
1128 AF_UNIX sockets only) are unaffected. Note that this option
1129 has no effect on
32-bit x86 and is ignored (but works
1130 correctly on x86-
64). If running in user mode and this option
1131 is used,
<varname>NoNewPrivileges=yes
</varname> is implied. By
1132 default, no restriction applies, all address families are
1133 accessible to processes. If assigned the empty string, any
1134 previous list changes are undone.
</para>
1136 <para>Use this option to limit exposure of processes to remote
1137 systems, in particular via exotic network protocols. Note that
1138 in most cases, the local
<constant>AF_UNIX
</constant> address
1139 family should be included in the configured whitelist as it is
1140 frequently used for local communication, including for
1141 <citerefentry><refentrytitle>syslog
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1142 logging.
</para></listitem>
1146 <term><varname>Personality=
</varname></term>
1148 <listitem><para>Controls which kernel architecture
1149 <citerefentry project='man-pages'
><refentrytitle>uname
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1150 shall report, when invoked by unit processes. Takes one of
1151 <constant>x86
</constant> and
<constant>x86-
64</constant>. This
1152 is useful when running
32-bit services on a
64-bit host
1153 system. If not specified, the personality is left unmodified
1154 and thus reflects the personality of the host system's
1155 kernel.
</para></listitem>
1159 <term><varname>RuntimeDirectory=
</varname></term>
1160 <term><varname>RuntimeDirectoryMode=
</varname></term>
1162 <listitem><para>Takes a list of directory names. If set, one
1163 or more directories by the specified names will be created
1164 below
<filename>/run
</filename> (for system services) or below
1165 <varname>$XDG_RUNTIME_DIR
</varname> (for user services) when
1166 the unit is started, and removed when the unit is stopped. The
1167 directories will have the access mode specified in
1168 <varname>RuntimeDirectoryMode=
</varname>, and will be owned by
1169 the user and group specified in
<varname>User=
</varname> and
1170 <varname>Group=
</varname>. Use this to manage one or more
1171 runtime directories of the unit and bind their lifetime to the
1172 daemon runtime. The specified directory names must be
1173 relative, and may not include a
<literal>/
</literal>, i.e.
1174 must refer to simple directories to create or remove. This is
1175 particularly useful for unprivileged daemons that cannot
1176 create runtime directories in
<filename>/run
</filename> due to
1177 lack of privileges, and to make sure the runtime directory is
1178 cleaned up automatically after use. For runtime directories
1179 that require more complex or different configuration or
1180 lifetime guarantees, please consider using
1181 <citerefentry><refentrytitle>tmpfiles.d
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
</para></listitem>
1188 <title>Environment variables in spawned processes
</title>
1190 <para>Processes started by the system are executed in a clean
1191 environment in which select variables listed below are set. System
1192 processes started by systemd do not inherit variables from PID
1,
1193 but processes started by user systemd instances inherit all
1194 environment variables from the user systemd instance.
1197 <variablelist class='environment-variables'
>
1199 <term><varname>$PATH
</varname></term>
1201 <listitem><para>Colon-separated list of directories to use
1202 when launching executables. Systemd uses a fixed value of
1203 <filename>/usr/local/sbin
</filename>:
<filename>/usr/local/bin
</filename>:
<filename>/usr/sbin
</filename>:
<filename>/usr/bin
</filename>:
<filename>/sbin
</filename>:
<filename>/bin
</filename>.
1208 <term><varname>$LANG
</varname></term>
1210 <listitem><para>Locale. Can be set in
1211 <citerefentry project='man-pages'
><refentrytitle>locale.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1212 or on the kernel command line (see
1213 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry>
1215 <citerefentry><refentrytitle>kernel-command-line
</refentrytitle><manvolnum>7</manvolnum></citerefentry>).
1220 <term><varname>$USER
</varname></term>
1221 <term><varname>$LOGNAME
</varname></term>
1222 <term><varname>$HOME
</varname></term>
1223 <term><varname>$SHELL
</varname></term>
1225 <listitem><para>User name (twice), home directory, and the
1226 login shell. The variables are set for the units that have
1227 <varname>User=
</varname> set, which includes user
1228 <command>systemd
</command> instances. See
1229 <citerefentry project='die-net'
><refentrytitle>passwd
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
1234 <term><varname>$XDG_RUNTIME_DIR
</varname></term>
1236 <listitem><para>The directory for volatile state. Set for the
1237 user
<command>systemd
</command> instance, and also in user
1239 <citerefentry><refentrytitle>pam_systemd
</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
1244 <term><varname>$XDG_SESSION_ID
</varname></term>
1245 <term><varname>$XDG_SEAT
</varname></term>
1246 <term><varname>$XDG_VTNR
</varname></term>
1248 <listitem><para>The identifier of the session, the seat name,
1249 and virtual terminal of the session. Set by
1250 <citerefentry><refentrytitle>pam_systemd
</refentrytitle><manvolnum>8</manvolnum></citerefentry>
1251 for login sessions.
<varname>$XDG_SEAT
</varname> and
1252 <varname>$XDG_VTNR
</varname> will only be set when attached to
1253 a seat and a tty.
</para></listitem>
1257 <term><varname>$MAINPID
</varname></term>
1259 <listitem><para>The PID of the units main process if it is
1260 known. This is only set for control processes as invoked by
1261 <varname>ExecReload=
</varname> and similar.
</para></listitem>
1265 <term><varname>$MANAGERPID
</varname></term>
1267 <listitem><para>The PID of the user
<command>systemd
</command>
1268 instance, set for processes spawned by it.
</para></listitem>
1272 <term><varname>$LISTEN_FDS
</varname></term>
1273 <term><varname>$LISTEN_PID
</varname></term>
1275 <listitem><para>Information about file descriptors passed to a
1276 service for socket activation. See
1277 <citerefentry><refentrytitle>sd_listen_fds
</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
1282 <term><varname>$TERM
</varname></term>
1284 <listitem><para>Terminal type, set only for units connected to
1285 a terminal (
<varname>StandardInput=tty
</varname>,
1286 <varname>StandardOutput=tty
</varname>, or
1287 <varname>StandardError=tty
</varname>). See
1288 <citerefentry project='man-pages'
><refentrytitle>termcap
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
1293 <para>Additional variables may be configured by the following
1294 means: for processes spawned in specific units, use the
1295 <varname>Environment=
</varname> and
1296 <varname>EnvironmentFile=
</varname> options above; to specify
1297 variables globally, use
<varname>DefaultEnvironment=
</varname>
1299 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>)
1300 or the kernel option
<varname>systemd.setenv=
</varname> (see
1301 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry>).
1302 Additional variables may also be set through PAM,
1303 cf.
<citerefentry project='man-pages'
><refentrytitle>pam_env
</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
</para>
1307 <title>See Also
</title>
1309 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1310 <citerefentry><refentrytitle>systemctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1311 <citerefentry><refentrytitle>journalctl
</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1312 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1313 <citerefentry><refentrytitle>systemd.service
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1314 <citerefentry><refentrytitle>systemd.socket
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1315 <citerefentry><refentrytitle>systemd.swap
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1316 <citerefentry><refentrytitle>systemd.mount
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1317 <citerefentry><refentrytitle>systemd.kill
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1318 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1319 <citerefentry><refentrytitle>systemd.directives
</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
1320 <citerefentry><refentrytitle>tmpfiles.d
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1321 <citerefentry project='man-pages'
><refentrytitle>exec
</refentrytitle><manvolnum>3</manvolnum></citerefentry>