1 <?xml version='
1.0'
?> <!--*-nxml-*-->
2 <!DOCTYPE refentry PUBLIC
"-//OASIS//DTD DocBook XML V4.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
6 This file is part of systemd.
8 Copyright 2010 Lennart Poettering
10 systemd is free software; you can redistribute it and/or modify it
11 under the terms of the GNU Lesser General Public License as published by
12 the Free Software Foundation; either version 2.1 of the License, or
13 (at your option) any later version.
15 systemd is distributed in the hope that it will be useful, but
16 WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Lesser General Public License for more details.
20 You should have received a copy of the GNU Lesser General Public License
21 along with systemd; If not, see <http://www.gnu.org/licenses/>.
24 <refentry id=
"systemd.socket">
26 <title>systemd.socket
</title>
27 <productname>systemd
</productname>
31 <contrib>Developer
</contrib>
32 <firstname>Lennart
</firstname>
33 <surname>Poettering
</surname>
34 <email>lennart@poettering.net
</email>
40 <refentrytitle>systemd.socket
</refentrytitle>
41 <manvolnum>5</manvolnum>
45 <refname>systemd.socket
</refname>
46 <refpurpose>Socket unit configuration
</refpurpose>
50 <para><filename><replaceable>socket
</replaceable>.socket
</filename></para>
54 <title>Description
</title>
56 <para>A unit configuration file whose name ends in
57 <literal>.socket
</literal> encodes information about an IPC or
58 network socket or a file system FIFO controlled and supervised by
59 systemd, for socket-based activation.
</para>
61 <para>This man page lists the configuration options specific to
63 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
64 for the common options of all unit configuration files. The common
65 configuration items are configured in the generic [Unit] and
66 [Install] sections. The socket specific configuration options are
67 configured in the [Socket] section.
</para>
69 <para>Additional options are listed in
70 <citerefentry><refentrytitle>systemd.exec
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
71 which define the execution environment the
72 <option>ExecStartPre=
</option>,
<option>ExecStartPost=
</option>,
73 <option>ExecStopPre=
</option> and
<option>ExecStopPost=
</option>
74 commands are executed in, and in
75 <citerefentry><refentrytitle>systemd.kill
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
76 which define the way the processes are terminated, and in
77 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
78 which configure resource control settings for the processes of the
81 <para>For each socket file, a matching service file must exist,
82 describing the service to start on incoming traffic on the socket
84 <citerefentry><refentrytitle>systemd.service
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
85 for more information about .service files). The name of the
86 .service unit is by default the same as the name of the .socket
87 unit, but can be altered with the
<option>Service=
</option> option
88 described below. Depending on the setting of the
89 <option>Accept=
</option> option described below, this .service
90 unit must either be named like the .socket unit, but with the
91 suffix replaced, unless overridden with
<option>Service=
</option>;
92 or it must be a template unit named the same way. Example: a
93 socket file
<filename>foo.socket
</filename> needs a matching
94 service
<filename>foo.service
</filename> if
95 <option>Accept=false
</option> is set. If
96 <option>Accept=true
</option> is set, a service template file
97 <filename>foo@.service
</filename> must exist from which services
98 are instantiated for each incoming connection.
</para>
100 <para>Unless
<varname>DefaultDependencies=
</varname> is set to
101 <option>false
</option>, socket units will implicitly have
102 dependencies of type
<varname>Requires=
</varname> and
103 <varname>After=
</varname> on
<filename>sysinit.target
</filename>
104 as well as dependencies of type
<varname>Conflicts=
</varname> and
105 <varname>Before=
</varname> on
106 <filename>shutdown.target
</filename>. These ensure that socket
107 units pull in basic system initialization, and are terminated
108 cleanly prior to system shutdown. Only sockets involved with early
109 boot or late system shutdown should disable this option.
</para>
111 <para>Socket units will have a
<varname>Before=
</varname>
112 dependency on the service which they trigger added implicitly. No
113 implicit
<varname>WantedBy=
</varname> or
114 <varname>RequiredBy=
</varname> dependency from the socket to the
115 service is added. This means that the service may be started
116 without the socket, in which case it must be able to open sockets
117 by itself. To prevent this, an explicit
118 <varname>Requires=
</varname> dependency may be added.
</para>
120 <para>Socket units may be used to implement on-demand starting of
121 services, as well as parallelized starting of services. See the
122 blog stories linked at the end for an introduction.
</para>
124 <para>Note that the daemon software configured for socket
125 activation with socket units needs to be able to accept sockets
126 from systemd, either via systemd's native socket passing interface
128 <citerefentry><refentrytitle>sd_listen_fds
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
129 for details) or via the traditional
130 <citerefentry project='freebsd'
><refentrytitle>inetd
</refentrytitle><manvolnum>8</manvolnum></citerefentry>-style
131 socket passing (i.e. sockets passed in via standard input and
132 output, using
<varname>StandardInput=socket
</varname> in the
133 service file).
</para>
137 <title>Options
</title>
139 <para>Socket files must include a [Socket] section, which carries
140 information about the socket or FIFO it supervises. A number of
141 options that may be used in this section are shared with other
142 unit types. These options are documented in
143 <citerefentry><refentrytitle>systemd.exec
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
145 <citerefentry><refentrytitle>systemd.kill
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
146 The options specific to the [Socket] section of socket units are
147 the following:
</para>
149 <variablelist class='unit-directives'
>
151 <term><varname>ListenStream=
</varname></term>
152 <term><varname>ListenDatagram=
</varname></term>
153 <term><varname>ListenSequentialPacket=
</varname></term>
154 <listitem><para>Specifies an address to listen on for a stream
155 (
<constant>SOCK_STREAM
</constant>), datagram
156 (
<constant>SOCK_DGRAM
</constant>), or sequential packet
157 (
<constant>SOCK_SEQPACKET
</constant>) socket, respectively.
158 The address can be written in various formats:
</para>
160 <para>If the address starts with a slash
161 (
<literal>/
</literal>), it is read as file system socket in
162 the
<constant>AF_UNIX
</constant> socket family.
</para>
164 <para>If the address starts with an at symbol
165 (
<literal>@
</literal>), it is read as abstract namespace
166 socket in the
<constant>AF_UNIX
</constant> family. The
167 <literal>@
</literal> is replaced with a
168 <constant>NUL
</constant> character before binding. For
170 <citerefentry project='man-pages'
><refentrytitle>unix
</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
</para>
172 <para>If the address string is a single number, it is read as
173 port number to listen on via IPv6. Depending on the value of
174 <varname>BindIPv6Only=
</varname> (see below) this might result
175 in the service being available via both IPv6 and IPv4
176 (default) or just via IPv6.
179 <para>If the address string is a string in the format
180 v.w.x.y:z, it is read as IPv4 specifier for listening on an
181 address v.w.x.y on a port z.
</para>
183 <para>If the address string is a string in the format [x]:y,
184 it is read as IPv6 address x on a port y. Note that this might
185 make the service available via IPv4, too, depending on the
186 <varname>BindIPv6Only=
</varname> setting (see below).
189 <para>Note that
<constant>SOCK_SEQPACKET
</constant> (i.e.
190 <varname>ListenSequentialPacket=
</varname>) is only available
191 for
<constant>AF_UNIX
</constant> sockets.
192 <constant>SOCK_STREAM
</constant> (i.e.
193 <varname>ListenStream=
</varname>) when used for IP sockets
194 refers to TCP sockets,
<constant>SOCK_DGRAM
</constant> (i.e.
195 <varname>ListenDatagram=
</varname>) to UDP.
</para>
197 <para>These options may be specified more than once in which
198 case incoming traffic on any of the sockets will trigger
199 service activation, and all listed sockets will be passed to
200 the service, regardless of whether there is incoming traffic
201 on them or not. If the empty string is assigned to any of
202 these options, the list of addresses to listen on is reset,
203 all prior uses of any of these options will have no
206 <para>It is also possible to have more than one socket unit
207 for the same service when using
<varname>Service=
</varname>,
208 and the service will receive all the sockets configured in all
209 the socket units. Sockets configured in one unit are passed in
210 the order of configuration, but no ordering between socket
211 units is specified.
</para>
213 <para>If an IP address is used here, it is often desirable to
214 listen on it before the interface it is configured on is up
215 and running, and even regardless of whether it will be up and
216 running at any point. To deal with this, it is recommended to
217 set the
<varname>FreeBind=
</varname> option described
218 below.
</para></listitem>
222 <term><varname>ListenFIFO=
</varname></term>
223 <listitem><para>Specifies a file system FIFO to listen on.
224 This expects an absolute file system path as argument.
225 Behavior otherwise is very similar to the
226 <varname>ListenDatagram=
</varname> directive
227 above.
</para></listitem>
231 <term><varname>ListenSpecial=
</varname></term>
232 <listitem><para>Specifies a special file in the file system to
233 listen on. This expects an absolute file system path as
234 argument. Behavior otherwise is very similar to the
235 <varname>ListenFIFO=
</varname> directive above. Use this to
236 open character device nodes as well as special files in
237 <filename>/proc
</filename> and
238 <filename>/sys
</filename>.
</para></listitem>
242 <term><varname>ListenNetlink=
</varname></term>
243 <listitem><para>Specifies a Netlink family to create a socket
244 for to listen on. This expects a short string referring to the
245 <constant>AF_NETLINK
</constant> family name (such as
246 <varname>audit
</varname> or
<varname>kobject-uevent
</varname>)
247 as argument, optionally suffixed by a whitespace followed by a
248 multicast group integer. Behavior otherwise is very similar to
249 the
<varname>ListenDatagram=
</varname> directive
250 above.
</para></listitem>
254 <term><varname>ListenMessageQueue=
</varname></term>
255 <listitem><para>Specifies a POSIX message queue name to listen
256 on. This expects a valid message queue name (i.e. beginning
257 with /). Behavior otherwise is very similar to the
258 <varname>ListenFIFO=
</varname> directive above. On Linux
259 message queue descriptors are actually file descriptors and
260 can be inherited between processes.
</para></listitem>
264 <term><varname>ListenUSBFunction=
</varname></term>
265 <listitem><para>Specifies a functionfs endpoint location
266 to listen on. This expects an absolute file system path as
267 argument. Behavior otherwise is very similar to the
268 <varname>ListenFIFO=
</varname> directive above. Use this to
269 open functionfs endpoint ep0. When using this option, activated
270 service has to have
<varname>USBFunctionDescriptors
</varname>
271 and
<varname>USBFunctionStrings
</varname> options set.
</para></listitem>
275 <term><varname>BindIPv6Only=
</varname></term>
276 <listitem><para>Takes a one of
<option>default
</option>,
277 <option>both
</option> or
<option>ipv6-only
</option>. Controls
278 the IPV6_V6ONLY socket option (see
279 <citerefentry project='die-net'
><refentrytitle>ipv6
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
280 for details). If
<option>both
</option>, IPv6 sockets bound
281 will be accessible via both IPv4 and IPv6. If
282 <option>ipv6-only
</option>, they will be accessible via IPv6
283 only. If
<option>default
</option> (which is the default,
284 surprise!), the system wide default setting is used, as
286 <filename>/proc/sys/net/ipv6/bindv6only
</filename>, which in
287 turn defaults to the equivalent of
288 <option>both
</option>.
</para>
293 <term><varname>Backlog=
</varname></term>
294 <listitem><para>Takes an unsigned integer argument. Specifies
295 the number of connections to queue that have not been accepted
296 yet. This setting matters only for stream and sequential
298 <citerefentry><refentrytitle>listen
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
299 for details. Defaults to SOMAXCONN (
128).
</para></listitem>
303 <term><varname>BindToDevice=
</varname></term>
304 <listitem><para>Specifies a network interface name to bind
305 this socket to. If set, traffic will only be accepted from the
306 specified network interfaces. This controls the
307 SO_BINDTODEVICE socket option (see
308 <citerefentry project='man-pages'
><refentrytitle>socket
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
309 for details). If this option is used, an automatic dependency
310 from this socket unit on the network interface device unit
311 (
<citerefentry><refentrytitle>systemd.device
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
312 is created.
</para></listitem>
316 <term><varname>SocketUser=
</varname></term>
317 <term><varname>SocketGroup=
</varname></term>
319 <listitem><para>Takes a UNIX user/group name. When specified,
320 all AF_UNIX sockets and FIFO nodes in the file system are
321 owned by the specified user and group. If unset (the default),
322 the nodes are owned by the root user/group (if run in system
323 context) or the invoking user/group (if run in user context).
324 If only a user is specified but no group, then the group is
325 derived from the user's default group.
</para></listitem>
329 <term><varname>SocketMode=
</varname></term>
330 <listitem><para>If listening on a file system socket or FIFO,
331 this option specifies the file system access mode used when
332 creating the file node. Takes an access mode in octal
333 notation. Defaults to
0666.
</para></listitem>
337 <term><varname>DirectoryMode=
</varname></term>
338 <listitem><para>If listening on a file system socket or FIFO,
339 the parent directories are automatically created if needed.
340 This option specifies the file system access mode used when
341 creating these directories. Takes an access mode in octal
342 notation. Defaults to
0755.
</para></listitem>
346 <term><varname>Accept=
</varname></term>
347 <listitem><para>Takes a boolean argument. If true, a service
348 instance is spawned for each incoming connection and only the
349 connection socket is passed to it. If false, all listening
350 sockets themselves are passed to the started service unit, and
351 only one service unit is spawned for all connections (also see
352 above). This value is ignored for datagram sockets and FIFOs
353 where a single service unit unconditionally handles all
354 incoming traffic. Defaults to
<option>false
</option>. For
355 performance reasons, it is recommended to write new daemons
356 only in a way that is suitable for
357 <option>Accept=false
</option>. A daemon listening on an
358 <constant>AF_UNIX
</constant> socket may, but does not need to,
360 <citerefentry><refentrytitle>close
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
361 on the received socket before exiting. However, it must not
362 unlink the socket from a file system. It should not invoke
363 <citerefentry><refentrytitle>shutdown
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
364 on sockets it got with
<varname>Accept=false
</varname>, but it
365 may do so for sockets it got with
366 <varname>Accept=true
</varname> set. Setting
367 <varname>Accept=true
</varname> is mostly useful to allow
368 daemons designed for usage with
369 <citerefentry project='freebsd'
><refentrytitle>inetd
</refentrytitle><manvolnum>8</manvolnum></citerefentry>
370 to work unmodified with systemd socket
373 <para>For IPv4 and IPv6 connections the
<varname>REMOTE_ADDR
</varname>
374 environment variable will contain the remote IP, and
<varname>REMOTE_PORT
</varname>
375 will contain the remote port. This is the same as the format used by CGI.
376 For SOCK_RAW the port is the IP protocol.
</para></listitem>
380 <term><varname>MaxConnections=
</varname></term>
381 <listitem><para>The maximum number of connections to
382 simultaneously run services instances for, when
383 <option>Accept=true
</option> is set. If more concurrent
384 connections are coming in, they will be refused until at least
385 one existing connection is terminated. This setting has no
386 effect on sockets configured with
387 <option>Accept=false
</option> or datagram sockets. Defaults to
388 64.
</para></listitem>
392 <term><varname>KeepAlive=
</varname></term>
393 <listitem><para>Takes a boolean argument. If true, the TCP/IP
394 stack will send a keep alive message after
2h (depending on
396 <filename>/proc/sys/net/ipv4/tcp_keepalive_time
</filename>)
397 for all TCP streams accepted on this socket. This controls the
398 SO_KEEPALIVE socket option (see
399 <citerefentry project='man-pages'
><refentrytitle>socket
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
401 url=
"http://www.tldp.org/HOWTO/html_single/TCP-Keepalive-HOWTO/">TCP
402 Keepalive HOWTO
</ulink> for details.) Defaults to
403 <option>false
</option>.
</para></listitem>
407 <term><varname>KeepAliveTimeSec=
</varname></term>
408 <listitem><para>Takes time (in seconds) as argument . The connection needs to remain
409 idle before TCP starts sending keepalive probes. This controls the TCP_KEEPIDLE
411 <citerefentry project='man-pages'
><refentrytitle>socket
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
413 url=
"http://www.tldp.org/HOWTO/html_single/TCP-Keepalive-HOWTO/">TCP
414 Keepalive HOWTO
</ulink> for details.)
415 Defaults value is
7200 seconds (
2 hours).
</para></listitem>
419 <term><varname>KeepAliveIntervalSec=
</varname></term>
420 <listitem><para>Takes time (in seconds) as argument between
421 individual keepalive probes, if the socket option SO_KEEPALIVE
422 has been set on this socket seconds as argument. This controls
423 the TCP_KEEPINTVL socket option (see
424 <citerefentry project='man-pages'
><refentrytitle>socket
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
426 url=
"http://www.tldp.org/HOWTO/html_single/TCP-Keepalive-HOWTO/">TCP
427 Keepalive HOWTO
</ulink> for details.) Defaults value is
75
428 seconds.
</para></listitem>
432 <term><varname>KeepAliveProbes=
</varname></term>
433 <listitem><para>Takes integer as argument. It's the number of
434 unacknowledged probes to send before considering the
435 connection dead and notifying the application layer. This
436 controls the TCP_KEEPCNT socket option (see
437 <citerefentry project='man-pages'
><refentrytitle>socket
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
439 url=
"http://www.tldp.org/HOWTO/html_single/TCP-Keepalive-HOWTO/">TCP
440 Keepalive HOWTO
</ulink> for details.) Defaults value is
445 <term><varname>NoDelay=
</varname></term>
446 <listitem><para>Takes a boolean argument. TCP Nagle's
447 algorithm works by combining a number of small outgoing
448 messages, and sending them all at once. This controls the
449 TCP_NODELAY socket option (see
450 <citerefentry project='die-net'
><refentrytitle>tcp
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
451 Defaults to
<option>false
</option>.
</para></listitem>
455 <term><varname>Priority=
</varname></term>
456 <listitem><para>Takes an integer argument controlling the
457 priority for all traffic sent from this socket. This controls
458 the SO_PRIORITY socket option (see
459 <citerefentry project='man-pages'
><refentrytitle>socket
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
460 for details.).
</para></listitem>
464 <term><varname>DeferAcceptSec=
</varname></term>
466 <listitem><para>Takes time (in seconds) as argument. If set,
467 the listening process will be awakened only when data arrives
468 on the socket, and not immediately when connection is
469 established. When this option is set, the
470 <constant>TCP_DEFER_ACCEPT
</constant> socket option will be
472 <citerefentry project='die-net'
><refentrytitle>tcp
</refentrytitle><manvolnum>7</manvolnum></citerefentry>),
473 and the kernel will ignore initial ACK packets without any
474 data. The argument specifies the approximate amount of time
475 the kernel should wait for incoming data before falling back
476 to the normal behavior of honouring empty ACK packets. This
477 option is beneficial for protocols where the client sends the
478 data first (e.g. HTTP, in contrast to SMTP), because the
479 server process will not be woken up unnecessarily before it
483 <para>If the client also uses the
484 <constant>TCP_DEFER_ACCEPT
</constant> option, the latency of
485 the initial connection may be reduced, because the kernel will
486 send data in the final packet establishing the connection (the
487 third packet in the
"three-way handshake").
</para>
489 <para>Disabled by default.
</para>
494 <term><varname>ReceiveBuffer=
</varname></term>
495 <term><varname>SendBuffer=
</varname></term>
496 <listitem><para>Takes an integer argument controlling the
497 receive or send buffer sizes of this socket, respectively.
498 This controls the SO_RCVBUF and SO_SNDBUF socket options (see
499 <citerefentry project='man-pages'
><refentrytitle>socket
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
500 for details.). The usual suffixes K, M, G are supported and
501 are understood to the base of
1024.
</para></listitem>
505 <term><varname>IPTOS=
</varname></term>
506 <listitem><para>Takes an integer argument controlling the IP
507 Type-Of-Service field for packets generated from this socket.
508 This controls the IP_TOS socket option (see
509 <citerefentry project='die-net'
><refentrytitle>ip
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
510 for details.). Either a numeric string or one of
511 <option>low-delay
</option>,
<option>throughput
</option>,
512 <option>reliability
</option> or
<option>low-cost
</option> may
513 be specified.
</para></listitem>
517 <term><varname>IPTTL=
</varname></term>
518 <listitem><para>Takes an integer argument controlling the IPv4
519 Time-To-Live/IPv6 Hop-Count field for packets generated from
520 this socket. This sets the IP_TTL/IPV6_UNICAST_HOPS socket
522 <citerefentry project='die-net'
><refentrytitle>ip
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
524 <citerefentry project='die-net'
><refentrytitle>ipv6
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
525 for details.)
</para></listitem>
529 <term><varname>Mark=
</varname></term>
530 <listitem><para>Takes an integer value. Controls the firewall
531 mark of packets generated by this socket. This can be used in
532 the firewall logic to filter packets from this socket. This
533 sets the SO_MARK socket option. See
534 <citerefentry project='die-net'
><refentrytitle>iptables
</refentrytitle><manvolnum>8</manvolnum></citerefentry>
535 for details.
</para></listitem>
539 <term><varname>ReusePort=
</varname></term>
540 <listitem><para>Takes a boolean value. If true, allows
542 <citerefentry><refentrytitle>bind
</refentrytitle><manvolnum>2</manvolnum></citerefentry>s
543 to this TCP or UDP port. This controls the SO_REUSEPORT socket
545 <citerefentry project='man-pages'
><refentrytitle>socket
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
546 for details.
</para></listitem>
550 <term><varname>SmackLabel=
</varname></term>
551 <term><varname>SmackLabelIPIn=
</varname></term>
552 <term><varname>SmackLabelIPOut=
</varname></term>
553 <listitem><para>Takes a string value. Controls the extended
554 attributes
<literal>security.SMACK64
</literal>,
555 <literal>security.SMACK64IPIN
</literal> and
556 <literal>security.SMACK64IPOUT
</literal>, respectively, i.e.
557 the security label of the FIFO, or the security label for the
558 incoming or outgoing connections of the socket, respectively.
560 url=
"https://www.kernel.org/doc/Documentation/security/Smack.txt">Smack.txt
</ulink>
561 for details.
</para></listitem>
565 <term><varname>SELinuxContextFromNet=
</varname></term>
566 <listitem><para>Takes a boolean argument. When true, systemd
567 will attempt to figure out the SELinux label used for the
568 instantiated service from the information handed by the peer
569 over the network. Note that only the security level is used
570 from the information provided by the peer. Other parts of the
571 resulting SELinux context originate from either the target
572 binary that is effectively triggered by socket unit or from
573 the value of the
<varname>SELinuxContext=
</varname> option.
574 This configuration option only affects sockets with
575 <varname>Accept=
</varname> mode set to
576 <literal>true
</literal>. Also note that this option is useful
577 only when MLS/MCS SELinux policy is deployed. Defaults to
578 <literal>false
</literal>.
</para></listitem>
582 <term><varname>PipeSize=
</varname></term>
583 <listitem><para>Takes a size in bytes. Controls the pipe
584 buffer size of FIFOs configured in this socket unit. See
585 <citerefentry><refentrytitle>fcntl
</refentrytitle><manvolnum>2</manvolnum></citerefentry>
586 for details. The usual suffixes K, M, G are supported and are
587 understood to the base of
1024.
</para></listitem>
591 <term><varname>MessageQueueMaxMessages=
</varname>,
592 <varname>MessageQueueMessageSize=
</varname></term>
593 <listitem><para>These two settings take integer values and
594 control the mq_maxmsg field or the mq_msgsize field,
595 respectively, when creating the message queue. Note that
596 either none or both of these variables need to be set. See
597 <citerefentry project='die-net'
><refentrytitle>mq_setattr
</refentrytitle><manvolnum>3</manvolnum></citerefentry>
598 for details.
</para></listitem>
602 <term><varname>FreeBind=
</varname></term>
603 <listitem><para>Takes a boolean value. Controls whether the
604 socket can be bound to non-local IP addresses. This is useful
605 to configure sockets listening on specific IP addresses before
606 those IP addresses are successfully configured on a network
607 interface. This sets the IP_FREEBIND socket option. For
608 robustness reasons it is recommended to use this option
609 whenever you bind a socket to a specific IP address. Defaults
610 to
<option>false
</option>.
</para></listitem>
614 <term><varname>Transparent=
</varname></term>
615 <listitem><para>Takes a boolean value. Controls the
616 IP_TRANSPARENT socket option. Defaults to
617 <option>false
</option>.
</para></listitem>
621 <term><varname>Broadcast=
</varname></term>
622 <listitem><para>Takes a boolean value. This controls the
623 SO_BROADCAST socket option, which allows broadcast datagrams
624 to be sent from this socket. Defaults to
625 <option>false
</option>.
</para></listitem>
629 <term><varname>PassCredentials=
</varname></term>
630 <listitem><para>Takes a boolean value. This controls the
631 SO_PASSCRED socket option, which allows
632 <constant>AF_UNIX
</constant> sockets to receive the
633 credentials of the sending process in an ancillary message.
634 Defaults to
<option>false
</option>.
</para></listitem>
638 <term><varname>PassSecurity=
</varname></term>
639 <listitem><para>Takes a boolean value. This controls the
640 SO_PASSSEC socket option, which allows
641 <constant>AF_UNIX
</constant> sockets to receive the security
642 context of the sending process in an ancillary message.
643 Defaults to
<option>false
</option>.
</para></listitem>
647 <term><varname>TCPCongestion=
</varname></term>
648 <listitem><para>Takes a string value. Controls the TCP
649 congestion algorithm used by this socket. Should be one of
650 "westwood",
"veno",
"cubic",
"lp" or any other available
651 algorithm supported by the IP stack. This setting applies only
652 to stream sockets.
</para></listitem>
656 <term><varname>ExecStartPre=
</varname></term>
657 <term><varname>ExecStartPost=
</varname></term>
658 <listitem><para>Takes one or more command lines, which are
659 executed before or after the listening sockets/FIFOs are
660 created and bound, respectively. The first token of the
661 command line must be an absolute filename, then followed by
662 arguments for the process. Multiple command lines may be
663 specified following the same scheme as used for
664 <varname>ExecStartPre=
</varname> of service unit
665 files.
</para></listitem>
669 <term><varname>ExecStopPre=
</varname></term>
670 <term><varname>ExecStopPost=
</varname></term>
671 <listitem><para>Additional commands that are executed before
672 or after the listening sockets/FIFOs are closed and removed,
673 respectively. Multiple command lines may be specified
674 following the same scheme as used for
675 <varname>ExecStartPre=
</varname> of service unit
676 files.
</para></listitem>
680 <term><varname>TimeoutSec=
</varname></term>
681 <listitem><para>Configures the time to wait for the commands
682 specified in
<varname>ExecStartPre=
</varname>,
683 <varname>ExecStartPost=
</varname>,
684 <varname>ExecStopPre=
</varname> and
685 <varname>ExecStopPost=
</varname> to finish. If a command does
686 not exit within the configured time, the socket will be
687 considered failed and be shut down again. All commands still
688 running will be terminated forcibly via
689 <constant>SIGTERM
</constant>, and after another delay of this
690 time with
<constant>SIGKILL
</constant>. (See
691 <option>KillMode=
</option> in
692 <citerefentry><refentrytitle>systemd.kill
</refentrytitle><manvolnum>5</manvolnum></citerefentry>.)
693 Takes a unit-less value in seconds, or a time span value such
694 as
"5min 20s". Pass
<literal>0</literal> to disable the
695 timeout logic. Defaults to
696 <varname>DefaultTimeoutStartSec=
</varname> from the manager
697 configuration file (see
698 <citerefentry><refentrytitle>systemd-system.conf
</refentrytitle><manvolnum>5</manvolnum></citerefentry>).
703 <term><varname>Service=
</varname></term>
704 <listitem><para>Specifies the service unit name to activate on
705 incoming traffic. This setting is only allowed for sockets
706 with
<varname>Accept=no
</varname>. It defaults to the service
707 that bears the same name as the socket (with the suffix
708 replaced). In most cases, it should not be necessary to use
709 this option.
</para></listitem>
713 <term><varname>RemoveOnStop=
</varname></term>
714 <listitem><para>Takes a boolean argument. If enabled, any file
715 nodes created by this socket unit are removed when it is
716 stopped. This applies to AF_UNIX sockets in the file system,
717 POSIX message queues, FIFOs, as well as any symlinks to them
718 configured with
<varname>Symlinks=
</varname>. Normally, it
719 should not be necessary to use this option, and is not
720 recommended as services might continue to run after the socket
721 unit has been terminated and it should still be possible to
722 communicate with them via their file system node. Defaults to
723 off.
</para></listitem>
727 <term><varname>Symlinks=
</varname></term>
728 <listitem><para>Takes a list of file system paths. The
729 specified paths will be created as symlinks to the AF_UNIX
730 socket path or FIFO path of this socket unit. If this setting
731 is used, only one AF_UNIX socket in the file system or one
732 FIFO may be configured for the socket unit. Use this option to
733 manage one or more symlinked alias names for a socket, binding
734 their lifecycle together. Defaults to the empty
735 list.
</para></listitem>
741 <citerefentry><refentrytitle>systemd.exec
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
743 <citerefentry><refentrytitle>systemd.kill
</refentrytitle><manvolnum>5</manvolnum></citerefentry>
744 for more settings.
</para>
749 <title>See Also
</title>
751 <citerefentry><refentrytitle>systemd
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
752 <citerefentry><refentrytitle>systemctl
</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
753 <citerefentry><refentrytitle>systemd.unit
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
754 <citerefentry><refentrytitle>systemd.exec
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
755 <citerefentry><refentrytitle>systemd.kill
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
756 <citerefentry><refentrytitle>systemd.resource-control
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
757 <citerefentry><refentrytitle>systemd.service
</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
758 <citerefentry><refentrytitle>systemd.directives
</refentrytitle><manvolnum>7</manvolnum></citerefentry>
762 For more extensive descriptions see the
"systemd for Developers" series:
763 <ulink url=
"http://0pointer.de/blog/projects/socket-activation.html">Socket Activation
</ulink>,
764 <ulink url=
"http://0pointer.de/blog/projects/socket-activation2.html">Socket Activation, part II
</ulink>,
765 <ulink url=
"http://0pointer.de/blog/projects/inetd.html">Converting inetd Services
</ulink>,
766 <ulink url=
"http://0pointer.de/blog/projects/socket-activated-containers.html">Socket Activated Internet Services and OS Containers
</ulink>.