</varlistentry>
<varlistentry>
- <term><option>--json=</option><replaceable>MODE</replaceable></term>
+ <term><option>--json=<replaceable>MODE</replaceable></option></term>
<listitem>
<para>When used with the <command>call</command> or <command>get-property</command> command, shows output
</varlistentry>
<varlistentry>
- <term><option>--expect-reply=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--expect-reply=<replaceable>BOOL</replaceable></option></term>
<listitem>
<para>When used with the <command>call</command> command,
</varlistentry>
<varlistentry>
- <term><option>--auto-start=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--auto-start=<replaceable>BOOL</replaceable></option></term>
<listitem>
<para>When used with the <command>call</command> or <command>emit</command> command, specifies
</varlistentry>
<varlistentry>
- <term><option>--allow-interactive-authorization=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--allow-interactive-authorization=<replaceable>BOOL</replaceable></option></term>
<listitem>
<para>When used with the <command>call</command> command,
</varlistentry>
<varlistentry>
- <term><option>--timeout=</option><replaceable>SECS</replaceable></term>
+ <term><option>--timeout=<replaceable>SECS</replaceable></option></term>
<listitem>
<para>When used with the <command>call</command> command,
</varlistentry>
<varlistentry>
- <term><option>--augment-creds=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--augment-creds=<replaceable>BOOL</replaceable></option></term>
<listitem>
<para>Controls whether credential data reported by
</varlistentry>
<varlistentry>
- <term><option>--watch-bind=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--watch-bind=<replaceable>BOOL</replaceable></option></term>
<listitem>
<para>Controls whether to wait for the specified <constant>AF_UNIX</constant> bus socket to appear in the
</varlistentry>
<varlistentry>
- <term><option>--destination=</option><replaceable>SERVICE</replaceable></term>
+ <term><option>--destination=<replaceable>SERVICE</replaceable></option></term>
<listitem>
<para>Takes a service name. When used with the <command>emit</command> command, a signal is
<varlistentry>
<term><option>-F</option> <replaceable>FIELD</replaceable></term>
- <term><option>--field=</option><replaceable>FIELD</replaceable></term>
+ <term><option>--field=<replaceable>FIELD</replaceable></option></term>
<listitem><para>Print all possible data values the specified
field takes in matching core dump entries of the
<varlistentry>
<term><option>-o</option> <replaceable>FILE</replaceable></term>
- <term><option>--output=</option><replaceable>FILE</replaceable></term>
+ <term><option>--output=<replaceable>FILE</replaceable></option></term>
<listitem><para>Write the core to <option>FILE</option>.
</para>
</varlistentry>
<varlistentry>
- <term><option>--debugger=</option><replaceable>DEBUGGER</replaceable></term>
+ <term><option>--debugger=<replaceable>DEBUGGER</replaceable></option></term>
<listitem><para>Use the given debugger for the <command>debug</command>
command. If not given and <varname>$SYSTEMD_DEBUGGER</varname> is unset, then
<varlistentry>
<term><option>-A</option> <replaceable>ARGS</replaceable></term>
- <term><option>--debugger-arguments=</option><replaceable>ARGS</replaceable></term>
+ <term><option>--debugger-arguments=<replaceable>ARGS</replaceable></option></term>
<listitem><para>Pass the given <replaceable>ARGS</replaceable> as extra command line arguments
to the debugger. Quote as appropriate when <replaceable>ARGS</replaceable> contain whitespace.
<varlistentry>
<term><option>-D</option> <replaceable>DIR</replaceable></term>
- <term><option>--directory=</option><replaceable>DIR</replaceable></term>
+ <term><option>--directory=<replaceable>DIR</replaceable></option></term>
<listitem><para>Use the journal files in the specified <option>DIR</option>.
</para>
<variablelist>
<varlistentry>
- <term><option>--identity=</option><replaceable>FILE</replaceable></term>
+ <term><option>--identity=<replaceable>FILE</replaceable></option></term>
<listitem><para>Read the user's JSON record from the specified file. If passed as
<literal>-</literal> read the user record from standard input. The supplied JSON object must follow
</varlistentry>
<varlistentry>
- <term><option>--json=</option><replaceable>FORMAT</replaceable></term>
+ <term><option>--json=<replaceable>FORMAT</replaceable></option></term>
<term><option>-j</option></term>
<listitem><para>Controls whether to output the user record in JSON format, if the
</varlistentry>
<varlistentry>
- <term><option>--export-format=</option><replaceable>FORMAT</replaceable></term>
+ <term><option>--export-format=<replaceable>FORMAT</replaceable></option></term>
<term><option>-E</option></term>
<term><option>-EE</option></term>
<variablelist>
<varlistentry>
- <term><option>--real-name=</option><replaceable>NAME</replaceable></term>
+ <term><option>--real-name=<replaceable>NAME</replaceable></option></term>
<term><option>-c</option> <replaceable>NAME</replaceable></term>
<listitem><para>The real name for the user. This corresponds with the GECOS field on classic UNIX NSS
</varlistentry>
<varlistentry>
- <term><option>--realm=</option><replaceable>REALM</replaceable></term>
+ <term><option>--realm=<replaceable>REALM</replaceable></option></term>
<listitem><para>The realm for the user. The realm associates a user with a specific organization or
installation, and allows distinguishing users of the same name defined in different contexts. The
</varlistentry>
<varlistentry>
- <term><option>--email-address=</option><replaceable>EMAIL</replaceable></term>
+ <term><option>--email-address=<replaceable>EMAIL</replaceable></option></term>
<listitem><para>Takes an electronic mail address to associate with the user. On log-in the
<varname>$EMAIL</varname> environment variable is initialized from this value.</para>
</varlistentry>
<varlistentry>
- <term><option>--location=</option><replaceable>TEXT</replaceable></term>
+ <term><option>--location=<replaceable>TEXT</replaceable></option></term>
<listitem><para>Takes location specification for this user. This is free-form text, which might or
might not be usable by geo-location applications. Example: <option>--location="Berlin,
</varlistentry>
<varlistentry>
- <term><option>--icon-name=</option><replaceable>ICON</replaceable></term>
+ <term><option>--icon-name=<replaceable>ICON</replaceable></option></term>
<listitem><para>Takes an icon name to associate with the user, following the scheme defined by the <ulink
url="https://standards.freedesktop.org/icon-naming-spec/icon-naming-spec-latest.html">Icon Naming
</varlistentry>
<varlistentry>
- <term><option>--home-dir=</option><replaceable>PATH</replaceable></term>
- <term><option>-d</option><replaceable>PATH</replaceable></term>
+ <term><option>--home-dir=<replaceable>PATH</replaceable></option></term>
+ <term><option>-d<replaceable>PATH</replaceable></option></term>
<listitem><para>Takes a path to use as home directory for the user. Note that this is the directory
the user's home directory is mounted to while the user is logged in. This is not where the user's
</varlistentry>
<varlistentry>
- <term><option>--uid=</option><replaceable>UID</replaceable></term>
+ <term><option>--uid=<replaceable>UID</replaceable></option></term>
<listitem><para>Takes a preferred numeric UNIX UID to assign this user. If a user is to be created
with the specified UID and it is already taken by a different user on the local system then creation
</varlistentry>
<varlistentry>
- <term><option>--member-of=</option><replaceable>GROUP</replaceable></term>
+ <term><option>--member-of=<replaceable>GROUP</replaceable></option></term>
<term><option>-G</option> <replaceable>GROUP</replaceable></term>
<listitem><para>Takes a comma-separated list of auxiliary UNIX groups this user shall belong
</varlistentry>
<varlistentry>
- <term><option>--capability-bounding-set=</option><replaceable>CAPABILITIES</replaceable></term>
- <term><option>--capability-ambient-set=</option><replaceable>CAPABILITIES</replaceable></term>
+ <term><option>--capability-bounding-set=<replaceable>CAPABILITIES</replaceable></option></term>
+ <term><option>--capability-ambient-set=<replaceable>CAPABILITIES</replaceable></option></term>
<listitem><para>These options take a space separated list of process capabilities
(e.g. <constant>CAP_WAKE_ALARM</constant>, <constant>CAP_BLOCK_SUSPEND</constant>, …) that shall be
</varlistentry>
<varlistentry>
- <term><option>--skel=</option><replaceable>PATH</replaceable></term>
+ <term><option>--skel=<replaceable>PATH</replaceable></option></term>
<listitem><para>Takes a file system path to a directory. Specifies the skeleton directory to
initialize the home directory with. All files and directories in the specified path are copied into
</varlistentry>
<varlistentry>
- <term><option>--shell=</option><replaceable>SHELL</replaceable></term>
+ <term><option>--shell=<replaceable>SHELL</replaceable></option></term>
<listitem><para>Takes a file system path. Specifies the shell binary to execute on terminal
logins. If not specified defaults to <filename>/bin/bash</filename>.</para>
</varlistentry>
<varlistentry>
- <term><option>--setenv=</option><replaceable>VARIABLE</replaceable>[=<replaceable>VALUE</replaceable>]</term>
+ <term><option>--setenv=<replaceable>VARIABLE</replaceable>[=<replaceable>VALUE</replaceable>]</option></term>
<listitem><para>Takes an environment variable assignment to set for all user processes. May be used
multiple times to set multiple environment variables. When <literal>=</literal> and
</varlistentry>
<varlistentry>
- <term><option>--timezone=</option><replaceable>TIMEZONE</replaceable></term>
+ <term><option>--timezone=<replaceable>TIMEZONE</replaceable></option></term>
<listitem><para>Takes a time zone location name that sets the timezone for the specified user. When
the user logs in the <varname>$TZ</varname> environment variable is initialized from this
</varlistentry>
<varlistentry>
- <term><option>--language=</option><replaceable>LANG</replaceable></term>
+ <term><option>--language=<replaceable>LANG</replaceable></option></term>
<listitem><para>Takes a comma- or colon-separated list of languages preferred by the user, ordered
by descending priority. The <varname>$LANG</varname> and <varname>$LANGUAGE</varname> environment
</varlistentry>
<varlistentry>
- <term><option>--ssh-authorized-keys=</option><replaceable>KEYS</replaceable></term>
+ <term><option>--ssh-authorized-keys=<replaceable>KEYS</replaceable></option></term>
<listitem><para>Either takes a SSH authorized key line to associate with the user record or a
<literal>@</literal> character followed by a path to a file to read one or more such lines from. SSH
keys configured this way are made available to SSH to permit access to this home directory and user
</varlistentry>
<varlistentry>
- <term><option>--pkcs11-token-uri=</option><replaceable>URI</replaceable></term>
+ <term><option>--pkcs11-token-uri=<replaceable>URI</replaceable></option></term>
<listitem><para>Takes an RFC 7512 PKCS#11 URI referencing a security token (e.g. YubiKey or PIV
smartcard) that shall be able to unlock the user account. The security token URI should reference a
security token with exactly one pair of X.509 certificate and private key. A random secret key is
</varlistentry>
<varlistentry>
- <term><option>--fido2-credential-algorithm=</option><replaceable>STRING</replaceable></term>
+ <term><option>--fido2-credential-algorithm=<replaceable>STRING</replaceable></option></term>
<listitem><para>Specify COSE algorithm used in credential generation. The default value is
<literal>es256</literal>. Supported values are <literal>es256</literal>, <literal>rs256</literal>
and <literal>eddsa</literal>.</para>
</varlistentry>
<varlistentry>
- <term><option>--fido2-device=</option><replaceable>PATH</replaceable></term>
+ <term><option>--fido2-device=<replaceable>PATH</replaceable></option></term>
<listitem><para>Takes a path to a Linux <literal>hidraw</literal> device
(e.g. <filename>/dev/hidraw1</filename>), referring to a FIDO2 security token implementing the
</varlistentry>
<varlistentry>
- <term><option>--fido2-with-client-pin=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--fido2-with-client-pin=<replaceable>BOOL</replaceable></option></term>
<listitem><para>When enrolling a FIDO2 security token, controls whether to require the user to enter
a PIN when unlocking the account (the FIDO2 <literal>clientPin</literal> feature). Defaults to
</varlistentry>
<varlistentry>
- <term><option>--fido2-with-user-presence=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--fido2-with-user-presence=<replaceable>BOOL</replaceable></option></term>
<listitem><para>When enrolling a FIDO2 security token, controls whether to require the user to
verify presence (tap the token, the FIDO2 <literal>up</literal> feature) when unlocking the account.
</varlistentry>
<varlistentry>
- <term><option>--fido2-with-user-verification=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--fido2-with-user-verification=<replaceable>BOOL</replaceable></option></term>
<listitem><para>When enrolling a FIDO2 security token, controls whether to require user verification
when unlocking the account (the FIDO2 <literal>uv</literal> feature). Defaults to
</varlistentry>
<varlistentry>
- <term><option>--recovery-key=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--recovery-key=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Accepts a boolean argument. If enabled a recovery key is configured for the
account. A recovery key is a computer generated access key that may be used to regain access to an
</varlistentry>
<varlistentry>
- <term><option>--blob=</option><replaceable>PATH</replaceable></term>
+ <term><option>--blob=<replaceable>PATH</replaceable></option></term>
<term><option>-b</option> <replaceable>PATH</replaceable></term>
- <term><option>--blob=</option><replaceable>FILENAME</replaceable>=<replaceable>PATH</replaceable></term>
+ <term><option>--blob=<replaceable>FILENAME</replaceable>=<replaceable>PATH</replaceable></option></term>
<term><option>-b</option> <replaceable>FILENAME</replaceable>=<replaceable>PATH</replaceable></term>
<listitem><para>Accepts either a directory path, or a file name followed by a file path. If just a
</varlistentry>
<varlistentry>
- <term><option>--avatar=</option><replaceable>PATH</replaceable></term>
- <term><option>--login-background=</option><replaceable>PATH</replaceable></term>
+ <term><option>--avatar=<replaceable>PATH</replaceable></option></term>
+ <term><option>--login-background=<replaceable>PATH</replaceable></option></term>
<listitem><para>Accept a file path. If set, the specified file is used to overwrite the
corresponding file in the user's blob directory. If blank, the corresponding file is deleted
from the blob directory. Essentially, these options are shortcuts to
- <option>--blob=</option><replaceable>FILENAME</replaceable>=<replaceable>PATH</replaceable>
+ <option>--blob=<replaceable>FILENAME</replaceable>=<replaceable>PATH</replaceable></option>
for the known filenames defined in
<ulink url="https://systemd.io/USER_RECORD_BLOB_DIRS">User Record Blob Directories</ulink>.</para>
</varlistentry>
<varlistentry>
- <term><option>--locked=</option><replaceable>BOOLEAN</replaceable></term>
+ <term><option>--locked=<replaceable>BOOLEAN</replaceable></option></term>
<listitem><para>Takes a boolean argument. Specifies whether this user account shall be locked. If
true logins into this account are prohibited, if false (the default) they are permitted (of course,
</varlistentry>
<varlistentry>
- <term><option>--not-before=</option><replaceable>TIMESTAMP</replaceable></term>
- <term><option>--not-after=</option><replaceable>TIMESTAMP</replaceable></term>
+ <term><option>--not-before=<replaceable>TIMESTAMP</replaceable></option></term>
+ <term><option>--not-after=<replaceable>TIMESTAMP</replaceable></option></term>
<listitem><para>These options take a timestamp string, in the format documented in
<citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry> and
</varlistentry>
<varlistentry>
- <term><option>--rate-limit-interval=</option><replaceable>SECS</replaceable></term>
- <term><option>--rate-limit-burst=</option><replaceable>NUMBER</replaceable></term>
+ <term><option>--rate-limit-interval=<replaceable>SECS</replaceable></option></term>
+ <term><option>--rate-limit-burst=<replaceable>NUMBER</replaceable></option></term>
<listitem><para>Configures a rate limit on authentication attempts for this user. If the user
attempts to authenticate more often than the specified number, on a specific system, within the
</varlistentry>
<varlistentry>
- <term><option>--password-hint=</option><replaceable>TEXT</replaceable></term>
+ <term><option>--password-hint=<replaceable>TEXT</replaceable></option></term>
<listitem><para>Takes a password hint to store alongside the user record. This string is stored
accessible only to privileged users and the user itself and may not be queried by other users.
</varlistentry>
<varlistentry>
- <term><option>--enforce-password-policy=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--enforce-password-policy=<replaceable>BOOL</replaceable></option></term>
<term><option>-P</option></term>
<listitem><para>Takes a boolean argument. Configures whether to enforce the system's password policy
</varlistentry>
<varlistentry>
- <term><option>--password-change-now=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--password-change-now=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Takes a boolean argument. If true the user is asked to change their password on next
login.</para>
</varlistentry>
<varlistentry>
- <term><option>--password-change-min=</option><replaceable>TIME</replaceable></term>
- <term><option>--password-change-max=</option><replaceable>TIME</replaceable></term>
- <term><option>--password-change-warn=</option><replaceable>TIME</replaceable></term>
- <term><option>--password-change-inactive=</option><replaceable>TIME</replaceable></term>
+ <term><option>--password-change-min=<replaceable>TIME</replaceable></option></term>
+ <term><option>--password-change-max=<replaceable>TIME</replaceable></option></term>
+ <term><option>--password-change-warn=<replaceable>TIME</replaceable></option></term>
+ <term><option>--password-change-inactive=<replaceable>TIME</replaceable></option></term>
<listitem><para>Each of these options takes a time span specification as argument (in the syntax
documented in
</varlistentry>
<varlistentry>
- <term><option>--disk-size=</option><replaceable>BYTES</replaceable></term>
+ <term><option>--disk-size=<replaceable>BYTES</replaceable></option></term>
<listitem><para>Either takes a size in bytes as argument (possibly using the usual K, M, G, …
suffixes for 1024 base values), a percentage value, or the special strings <literal>min</literal> or
<literal>max</literal>, and configures the disk space to assign to the user. If a percentage value is
</varlistentry>
<varlistentry>
- <term><option>--access-mode=</option><replaceable>MODE</replaceable></term>
+ <term><option>--access-mode=<replaceable>MODE</replaceable></option></term>
<listitem><para>Takes a UNIX file access mode written in octal. Configures the access mode of the
home directory itself. Note that this is only used when the directory is first created, and the user
</varlistentry>
<varlistentry>
- <term><option>--umask=</option><replaceable>MASK</replaceable></term>
+ <term><option>--umask=<replaceable>MASK</replaceable></option></term>
<listitem><para>Takes the access mode mask (in octal syntax) to apply to newly created files and
directories of the user ("umask"). If set this controls the initial umask set for all login sessions of
</varlistentry>
<varlistentry>
- <term><option>--nice=</option><replaceable>NICE</replaceable></term>
+ <term><option>--nice=<replaceable>NICE</replaceable></option></term>
<listitem><para>Takes the numeric scheduling priority ("nice level") to apply to the processes of the user at login
time. Takes a numeric value in the range -20 (highest priority) to 19 (lowest priority).</para>
</varlistentry>
<varlistentry>
- <term><option>--rlimit=</option><replaceable>LIMIT</replaceable>=<replaceable>VALUE</replaceable><optional>:<replaceable>VALUE</replaceable></optional></term>
+ <term><option>--rlimit=<replaceable>LIMIT</replaceable>=<replaceable>VALUE</replaceable><optional>:<replaceable>VALUE</replaceable></optional></option></term>
<listitem><para>Allows configuration of resource limits for processes of this user, see <citerefentry
project='man-pages'><refentrytitle>getrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry>
</varlistentry>
<varlistentry>
- <term><option>--tasks-max=</option><replaceable>TASKS</replaceable></term>
+ <term><option>--tasks-max=<replaceable>TASKS</replaceable></option></term>
<listitem><para>Takes a non-zero unsigned integer as argument. Configures the maximum number of tasks
(i.e. threads, where each process is at least one thread) the user may have at any given time. This
</varlistentry>
<varlistentry>
- <term><option>--memory-high=</option><replaceable>BYTES</replaceable></term>
- <term><option>--memory-max=</option><replaceable>BYTES</replaceable></term>
+ <term><option>--memory-high=<replaceable>BYTES</replaceable></option></term>
+ <term><option>--memory-max=<replaceable>BYTES</replaceable></option></term>
<listitem><para>Set a limit on the memory a user may take up on a system at any given time in bytes
(the usual K, M, G, … suffixes are supported, to the base of 1024). This includes all memory used by
</varlistentry>
<varlistentry>
- <term><option>--cpu-weight=</option><replaceable>WEIGHT</replaceable></term>
- <term><option>--io-weight=</option><replaceable>WEIGHT</replaceable></term>
+ <term><option>--cpu-weight=<replaceable>WEIGHT</replaceable></option></term>
+ <term><option>--io-weight=<replaceable>WEIGHT</replaceable></option></term>
<listitem><para>Set CPU and IO scheduling weights of the processes of the user, including those of
processes forked off by the user that changed user credentials. Takes a numeric value in the range
</varlistentry>
<varlistentry>
- <term><option>--storage=</option><replaceable>STORAGE</replaceable></term>
+ <term><option>--storage=<replaceable>STORAGE</replaceable></option></term>
<listitem><para>Selects the storage mechanism to use for this home directory. Takes one of
<literal>luks</literal>, <literal>fscrypt</literal>, <literal>directory</literal>,
</varlistentry>
<varlistentry>
- <term><option>--image-path=</option><replaceable>PATH</replaceable></term>
+ <term><option>--image-path=<replaceable>PATH</replaceable></option></term>
<listitem><para>Takes a file system path. Configures where to place the user's home directory. When
LUKS2 storage is used refers to the path to the loopback file, otherwise to the path to the home
</varlistentry>
<varlistentry>
- <term><option>--drop-caches=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--drop-caches=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Automatically flush OS file system caches on logout. This is useful in combination
with the fscrypt storage backend to ensure the OS does not keep decrypted versions of the files and
</varlistentry>
<varlistentry>
- <term><option>--fs-type=</option><replaceable>TYPE</replaceable></term>
+ <term><option>--fs-type=<replaceable>TYPE</replaceable></option></term>
<listitem><para>When LUKS2 storage is used configures the file system type to use inside the home
directory LUKS2 container. One of <literal>btrfs</literal>, <literal>ext4</literal>,
</varlistentry>
<varlistentry>
- <term><option>--luks-discard=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--luks-discard=<replaceable>BOOL</replaceable></option></term>
<listitem><para>When LUKS2 storage is used configures whether to enable the
<literal>discard</literal> feature of the file system. If enabled the file system on top of the LUKS2
</varlistentry>
<varlistentry>
- <term><option>--luks-offline-discard=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--luks-offline-discard=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Similar to <option>--luks-discard=</option>, controls the trimming of the file
system. However, while <option>--luks-discard=</option> controls what happens when the home directory
</varlistentry>
<varlistentry>
- <term><option>--luks-extra-mount-options=</option><replaceable>OPTIONS</replaceable></term>
+ <term><option>--luks-extra-mount-options=<replaceable>OPTIONS</replaceable></option></term>
<listitem><para>Takes a string containing additional mount options to use when mounting the LUKS
volume. If specified, this string will be appended to the default, built-in mount
</varlistentry>
<varlistentry>
- <term><option>--luks-cipher=</option><replaceable>CIPHER</replaceable></term>
- <term><option>--luks-cipher-mode=</option><replaceable>MODE</replaceable></term>
- <term><option>--luks-volume-key-size=</option><replaceable>BYTES</replaceable></term>
- <term><option>--luks-pbkdf-type=</option><replaceable>TYPE</replaceable></term>
- <term><option>--luks-pbkdf-hash-algorithm=</option><replaceable>ALGORITHM</replaceable></term>
- <term><option>--luks-pbkdf-force-iterations=</option><replaceable>ITERATIONS</replaceable></term>
- <term><option>--luks-pbkdf-time-cost=</option><replaceable>SECONDS</replaceable></term>
- <term><option>--luks-pbkdf-memory-cost=</option><replaceable>BYTES</replaceable></term>
- <term><option>--luks-pbkdf-parallel-threads=</option><replaceable>THREADS</replaceable></term>
- <term><option>--luks-sector-size=</option><replaceable>BYTES</replaceable></term>
+ <term><option>--luks-cipher=<replaceable>CIPHER</replaceable></option></term>
+ <term><option>--luks-cipher-mode=<replaceable>MODE</replaceable></option></term>
+ <term><option>--luks-volume-key-size=<replaceable>BYTES</replaceable></option></term>
+ <term><option>--luks-pbkdf-type=<replaceable>TYPE</replaceable></option></term>
+ <term><option>--luks-pbkdf-hash-algorithm=<replaceable>ALGORITHM</replaceable></option></term>
+ <term><option>--luks-pbkdf-force-iterations=<replaceable>ITERATIONS</replaceable></option></term>
+ <term><option>--luks-pbkdf-time-cost=<replaceable>SECONDS</replaceable></option></term>
+ <term><option>--luks-pbkdf-memory-cost=<replaceable>BYTES</replaceable></option></term>
+ <term><option>--luks-pbkdf-parallel-threads=<replaceable>THREADS</replaceable></option></term>
+ <term><option>--luks-sector-size=<replaceable>BYTES</replaceable></option></term>
<listitem><para>Configures various cryptographic parameters for the LUKS2 storage mechanism. See
<citerefentry
</varlistentry>
<varlistentry>
- <term><option>--nosuid=</option><replaceable>BOOL</replaceable></term>
- <term><option>--nodev=</option><replaceable>BOOL</replaceable></term>
- <term><option>--noexec=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--nosuid=<replaceable>BOOL</replaceable></option></term>
+ <term><option>--nodev=<replaceable>BOOL</replaceable></option></term>
+ <term><option>--noexec=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Configures the <literal>nosuid</literal>, <literal>nodev</literal> and
<literal>noexec</literal> mount options for the home directories. By default <literal>nodev</literal>
</varlistentry>
<varlistentry>
- <term><option>--cifs-domain=</option><replaceable>DOMAIN</replaceable></term>
- <term><option>--cifs-user-name=</option><replaceable>USER</replaceable></term>
- <term><option>--cifs-service=</option><replaceable>SERVICE</replaceable></term>
- <term><option>--cifs-extra-mount-options=</option><replaceable>OPTIONS</replaceable></term>
+ <term><option>--cifs-domain=<replaceable>DOMAIN</replaceable></option></term>
+ <term><option>--cifs-user-name=<replaceable>USER</replaceable></option></term>
+ <term><option>--cifs-service=<replaceable>SERVICE</replaceable></option></term>
+ <term><option>--cifs-extra-mount-options=<replaceable>OPTIONS</replaceable></option></term>
<listitem><para>Configures the Windows File Sharing (CIFS) domain and user to associate with the home
directory/user account, as well as the file share ("service") to mount as directory. The latter is
</varlistentry>
<varlistentry>
- <term><option>--stop-delay=</option><replaceable>SECS</replaceable></term>
+ <term><option>--stop-delay=<replaceable>SECS</replaceable></option></term>
<listitem><para>Configures the time the per-user service manager shall continue to run after the all
sessions of the user ended. The default is configured in
</varlistentry>
<varlistentry>
- <term><option>--kill-processes=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--kill-processes=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Configures whether to kill all processes of the user on logout. The default is
configured in
</varlistentry>
<varlistentry>
- <term><option>--auto-login=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--auto-login=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Takes a boolean argument. Configures whether the graphical UI of the system should
automatically log this user in if possible. Defaults to off. If less or more than one user is marked
</varlistentry>
<varlistentry>
- <term><option>--session-launcher=</option><replaceable>LAUNCHER</replaceable></term>
+ <term><option>--session-launcher=<replaceable>LAUNCHER</replaceable></option></term>
<listitem><para>Takes a string argument. Configures the user's preferred session launcher
.desktop entry file (i.e. <literal>gnome</literal>, <literal>plasma</literal>, or other names that
</varlistentry>
<varlistentry>
- <term><option>--session-type=</option><replaceable>TYPE</replaceable></term>
+ <term><option>--session-type=<replaceable>TYPE</replaceable></option></term>
<listitem><para>Takes a string argument. Configures the user's preferred session type
(i.e. <literal>x11</literal>, <literal>wayland</literal>, and other values accepted by
<varlistentry>
<term><command>create</command> <replaceable>USER</replaceable></term>
- <term><command>create</command> <option>--identity=</option><replaceable>PATH</replaceable> <optional><replaceable>USER</replaceable></optional></term>
+ <term><command>create</command> <option>--identity=<replaceable>PATH</replaceable></option> <optional><replaceable>USER</replaceable></optional></term>
<listitem><para>Create a new home directory/user account of the specified name. Use the various
user record property options (as documented above) to control various aspects of the home directory
<varlistentry>
<term><command>update</command> <replaceable>USER</replaceable></term>
- <term><command>update</command> <option>--identity=</option><replaceable>PATH</replaceable> <optional><replaceable>USER</replaceable></optional></term>
+ <term><command>update</command> <option>--identity=<replaceable>PATH</replaceable></option> <optional><replaceable>USER</replaceable></optional></term>
<listitem><para>Update a home directory/user account. Use the various user record property options
(as documented above) to make changes to the account, or alternatively provide a full, updated JSON
</varlistentry>
<varlistentry>
- <term><option>--drop-in=</option><replaceable>NAME</replaceable></term>
+ <term><option>--drop-in=<replaceable>NAME</replaceable></option></term>
<listitem>
<para>When used with <command>edit</command>, edit the drop-in file <replaceable>NAME</replaceable>
<varlistentry>
<term><option>-p</option> <replaceable>PROFILE</replaceable></term>
- <term><option>--profile=</option><replaceable>PROFILE</replaceable></term>
+ <term><option>--profile=<replaceable>PROFILE</replaceable></option></term>
<listitem><para>When attaching an image, select the profile to use. By default the <literal>default</literal>
profile is used. For details about profiles, see below.</para>
</varlistentry>
<varlistentry>
- <term><option>--extension=</option><replaceable>PATH</replaceable></term>
+ <term><option>--extension=<replaceable>PATH</replaceable></option></term>
<listitem><para>Add an additional image <replaceable>PATH</replaceable> as an overlay on
top of <replaceable>IMAGE</replaceable> when attaching/detaching. This argument can be specified
<varlistentry>
<term><option>-i</option> <replaceable>INTERFACE</replaceable></term>
- <term><option>--interface=</option><replaceable>INTERFACE</replaceable></term>
+ <term><option>--interface=<replaceable>INTERFACE</replaceable></option></term>
<listitem><para>Specifies the network interface to execute the query on. This may either be specified as numeric
interface index or as network interface string (e.g. <literal>en0</literal>). Note that this option has no
<varlistentry>
<term><option>-p</option> <replaceable>PROTOCOL</replaceable></term>
- <term><option>--protocol=</option><replaceable>PROTOCOL</replaceable></term>
+ <term><option>--protocol=<replaceable>PROTOCOL</replaceable></option></term>
<listitem><para>Specifies the network protocol for the query. May be one of <literal>dns</literal>
(i.e. classic unicast DNS), <literal>llmnr</literal> (<ulink
<varlistentry>
<term><option>-t</option> <replaceable>TYPE</replaceable></term>
- <term><option>--type=</option><replaceable>TYPE</replaceable></term>
+ <term><option>--type=<replaceable>TYPE</replaceable></option></term>
<term><option>-c</option> <replaceable>CLASS</replaceable></term>
- <term><option>--class=</option><replaceable>CLASS</replaceable></term>
+ <term><option>--class=<replaceable>CLASS</replaceable></option></term>
<listitem><para>When used in conjunction with the <command>query</command> command, specifies the DNS
resource record type (e.g. <constant class='dns'>A</constant>, <constant class='dns'>AAAA</constant>,
</varlistentry>
<varlistentry>
- <term><option>--service-address=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--service-address=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Takes a boolean parameter. If true (the default), when doing a service lookup with
<option>--service</option> the hostnames contained in the <constant class='dns'>SRV</constant>
</varlistentry>
<varlistentry>
- <term><option>--service-txt=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--service-txt=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Takes a boolean parameter. If true (the default), when doing a DNS-SD service lookup
with <option>--service</option> the <constant class='dns'>TXT</constant> service metadata record is
</varlistentry>
<varlistentry>
- <term><option>--cname=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--cname=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Takes a boolean parameter. If true (the default), DNS <constant
class='dns'>CNAME</constant> or <constant class='dns'>DNAME</constant> redirections are
</varlistentry>
<varlistentry>
- <term><option>--validate=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--validate=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
(the default), DNSSEC validation is applied as usual — under the condition that it is enabled for the
</varlistentry>
<varlistentry>
- <term><option>--synthesize=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--synthesize=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
(the default), select domains are resolved on the local system, among them
</varlistentry>
<varlistentry>
- <term><option>--cache=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--cache=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
(the default), lookups use the local DNS resource record cache. If false, lookups are routed to the
</varlistentry>
<varlistentry>
- <term><option>--zone=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--zone=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
(the default), lookups are answered from locally registered LLMNR or mDNS resource records, if
</varlistentry>
<varlistentry>
- <term><option>--trust-anchor=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--trust-anchor=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
(the default), lookups for DS and DNSKEY are answered from the local DNSSEC trust anchors if
</varlistentry>
<varlistentry>
- <term><option>--network=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--network=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
(the default), lookups are answered via DNS, LLMNR or mDNS network requests if they cannot be
</varlistentry>
<varlistentry>
- <term><option>--search=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--search=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Takes a boolean parameter. If true (the default), any specified single-label
hostnames will be searched in the domains configured in the search domain list, if it is
</varlistentry>
<varlistentry>
- <term><option>--legend=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--legend=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Takes a boolean parameter. If true (the default), column headers and meta information about the
query response are shown. Otherwise, this output is suppressed.</para>
</varlistentry>
<varlistentry>
- <term><option>--stale-data=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--stale-data=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If true
(the default), lookups are answered with stale data (expired resource records) if
</varlistentry>
<varlistentry>
- <term><option>--relax-single-label=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--relax-single-label=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Takes a boolean parameter; used in conjunction with <command>query</command>. If
true, rules regarding routing of single-label names are relaxed. Defaults to false. By default,
</varlistentry>
<varlistentry id='legend'>
- <term><option>--legend=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--legend=<replaceable>BOOL</replaceable></option></term>
<listitem>
<para>Enable or disable printing of the legend, i.e. column headers and the footer with hints. The
</varlistentry>
<varlistentry id='json'>
- <term><option>--json=</option><replaceable>MODE</replaceable></term>
+ <term><option>--json=<replaceable>MODE</replaceable></option></term>
<listitem><para>Shows output formatted as JSON. Expects one of <literal>short</literal> (for the
shortest possible output without any redundant whitespace or line breaks), <literal>pretty</literal>
</varlistentry>
<varlistentry>
- <term><option>--kill-value=</option><replaceable>INT</replaceable></term>
+ <term><option>--kill-value=<replaceable>INT</replaceable></option></term>
<listitem><para>If used with the <command>kill</command> command, enqueues a signal along with the
specified integer value parameter to the specified process(es). This operation is only available for
</varlistentry>
<varlistentry>
- <term><option>--drop-in=</option><replaceable>NAME</replaceable></term>
+ <term><option>--drop-in=<replaceable>NAME</replaceable></option></term>
<listitem><para>When used with <command>edit</command>, use <replaceable>NAME</replaceable> as the
drop-in file name instead of <filename>override.conf</filename>.</para>
</varlistentry>
<varlistentry>
- <term><option>--fuzz=</option><replaceable>timespan</replaceable></term>
+ <term><option>--fuzz=<replaceable>timespan</replaceable></option></term>
<listitem><para>When used in conjunction with the
<command>critical-chain</command> command (see above), also
</varlistentry>
<varlistentry>
- <term><option>--tty=</option><replaceable></replaceable></term>
+ <term><option>--tty=<replaceable></replaceable></option></term>
<listitem><para>Specify the TTY to output to. By default <command>systemd-bsod</command> will
automatically find a free VT to display the message on. If this option is specified a TTY may be
</varlistentry>
<varlistentry>
- <term><option>--name=</option><replaceable>name</replaceable></term>
+ <term><option>--name=<replaceable>name</replaceable></option></term>
<listitem><para>When specified with the <command>encrypt</command> command controls the credential
name to embed in the encrypted credential data. If not specified the name is chosen automatically
</varlistentry>
<varlistentry>
- <term><option>--timestamp=</option><replaceable>timestamp</replaceable></term>
+ <term><option>--timestamp=<replaceable>timestamp</replaceable></option></term>
<listitem><para>When specified with the <command>encrypt</command> command controls the timestamp to
embed into the encrypted credential. Defaults to the current time. Takes a timestamp specification in
</varlistentry>
<varlistentry>
- <term><option>--not-after=</option><replaceable>timestamp</replaceable></term>
+ <term><option>--not-after=<replaceable>timestamp</replaceable></option></term>
<listitem><para>When specified with the <command>encrypt</command> command controls the time when the
credential shall not be used anymore. This embeds the specified timestamp in the encrypted
</varlistentry>
<varlistentry>
- <term><option>--tpm2-device=</option><replaceable>PATH</replaceable></term>
+ <term><option>--tpm2-device=<replaceable>PATH</replaceable></option></term>
<listitem><para>Controls the TPM2 device to use. Expects a device node path referring to the TPM2
chip (e.g. <filename>/dev/tpmrm0</filename>). Alternatively the special value <literal>auto</literal>
</varlistentry>
<varlistentry>
- <term><option>--tpm2-pcrs=</option><replaceable>PCR<optional>+PCR...</optional></replaceable></term>
+ <term><option>--tpm2-pcrs=<replaceable>PCR<optional>+PCR...</optional></replaceable></option></term>
<listitem><para>Configures the TPM2 PCRs (Platform Configuration Registers) to bind the encryption
key to. Takes a <literal>+</literal> separated list of numeric PCR indexes in the range 0…23. If not
</varlistentry>
<varlistentry>
- <term><option>--tpm2-public-key=</option><replaceable>PATH</replaceable></term>
- <term><option>--tpm2-public-key-pcrs=</option><replaceable>PCR<optional>+PCR...</optional></replaceable></term>
+ <term><option>--tpm2-public-key=<replaceable>PATH</replaceable></option></term>
+ <term><option>--tpm2-public-key-pcrs=<replaceable>PCR<optional>+PCR...</optional></replaceable></option></term>
<listitem><para>Configures a TPM2 signed PCR policy to bind encryption to, for use with the
<command>encrypt</command> command. The <option>--tpm2-public-key=</option> option accepts a path to
</varlistentry>
<varlistentry>
- <term><option>--tpm2-signature=</option><replaceable>PATH</replaceable></term>
+ <term><option>--tpm2-signature=<replaceable>PATH</replaceable></option></term>
<listitem><para>Takes a path to a TPM2 PCR signature file as generated by the
<citerefentry><refentrytitle>systemd-measure</refentrytitle><manvolnum>1</manvolnum></citerefentry>
</varlistentry>
<varlistentry>
- <term><option>--unlock-key-file=</option><replaceable>PATH</replaceable></term>
+ <term><option>--unlock-key-file=<replaceable>PATH</replaceable></option></term>
<listitem><para>Use a file instead of a password/passphrase read from stdin to unlock the volume.
Expects the PATH to the file containing your key to unlock the volume. Currently there is nothing like
</varlistentry>
<varlistentry>
- <term><option>--unlock-fido2-device=</option><replaceable>PATH</replaceable></term>
+ <term><option>--unlock-fido2-device=<replaceable>PATH</replaceable></option></term>
<listitem><para>Use a FIDO2 device instead of a password/passphrase read from stdin to unlock the
volume. Expects a <filename>hidraw</filename> device referring to the FIDO2 device (e.g.
</varlistentry>
<varlistentry>
- <term><option>--unlock-tpm2-device=</option><replaceable>PATH</replaceable></term>
+ <term><option>--unlock-tpm2-device=<replaceable>PATH</replaceable></option></term>
<listitem><para>Use a TPM2 device instead of a password/passhprase read from stdin to unlock the
volume. Expects a device node path referring to the TPM2 chip (e.g. <filename>/dev/tpmrm0</filename>).
</varlistentry>
<varlistentry>
- <term><option>--pkcs11-token-uri=</option><replaceable>URI</replaceable></term>
+ <term><option>--pkcs11-token-uri=<replaceable>URI</replaceable></option></term>
<listitem><para>Enroll a PKCS#11 security token or smartcard (e.g. a YubiKey). Expects a PKCS#11 URI
that allows to find an X.509 certificate or a public key on the token. The URI must also be suitable
</varlistentry>
<varlistentry>
- <term><option>--fido2-credential-algorithm=</option><replaceable>STRING</replaceable></term>
+ <term><option>--fido2-credential-algorithm=<replaceable>STRING</replaceable></option></term>
<listitem><para>Specify COSE algorithm used in credential generation. The default value is
<literal>es256</literal>. Supported values are <literal>es256</literal>, <literal>rs256</literal>
and <literal>eddsa</literal>.</para>
</varlistentry>
<varlistentry>
- <term><option>--fido2-device=</option><replaceable>PATH</replaceable></term>
+ <term><option>--fido2-device=<replaceable>PATH</replaceable></option></term>
<listitem><para>Enroll a FIDO2 security token that implements the <literal>hmac-secret</literal>
extension (e.g. a YubiKey). Expects a <filename>hidraw</filename> device referring to the FIDO2
</varlistentry>
<varlistentry>
- <term><option>--fido2-with-client-pin=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--fido2-with-client-pin=<replaceable>BOOL</replaceable></option></term>
<listitem><para>When enrolling a FIDO2 security token, controls whether to require the user to enter
a PIN when unlocking the volume (the FIDO2 <literal>clientPin</literal> feature). Defaults to
</varlistentry>
<varlistentry>
- <term><option>--fido2-with-user-presence=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--fido2-with-user-presence=<replaceable>BOOL</replaceable></option></term>
<listitem><para>When enrolling a FIDO2 security token, controls whether to require the user to
verify presence (tap the token, the FIDO2 <literal>up</literal> feature) when unlocking the volume.
</varlistentry>
<varlistentry>
- <term><option>--fido2-with-user-verification=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--fido2-with-user-verification=<replaceable>BOOL</replaceable></option></term>
<listitem><para>When enrolling a FIDO2 security token, controls whether to require user verification
when unlocking the volume (the FIDO2 <literal>uv</literal> feature). Defaults to
</varlistentry>
<varlistentry>
- <term><option>--tpm2-device=</option><replaceable>PATH</replaceable></term>
+ <term><option>--tpm2-device=<replaceable>PATH</replaceable></option></term>
<listitem><para>Enroll a TPM2 security chip. Expects a device node path referring to the TPM2 chip
(e.g. <filename>/dev/tpmrm0</filename>). Alternatively the special value <literal>auto</literal> may
</varlistentry>
<varlistentry>
- <term><option>--tpm2-device-key=</option><replaceable>PATH</replaceable></term>
+ <term><option>--tpm2-device-key=<replaceable>PATH</replaceable></option></term>
<listitem><para>Enroll a TPM2 security chip using its public key. Expects a path referring to the
TPM2 public key in TPM2B_PUBLIC format. This cannot be used with <option>--tpm2-device=</option>, as
</varlistentry>
<varlistentry>
- <term><option>--tpm2-seal-key-handle=</option><replaceable>HANDLE</replaceable></term>
+ <term><option>--tpm2-seal-key-handle=<replaceable>HANDLE</replaceable></option></term>
<listitem><para>Configures which parent key to use for sealing, using the TPM handle (index) of the
key. This is used to "seal" (encrypt) a secret and must be used later to "unseal" (decrypt) the
</varlistentry>
<varlistentry>
- <term><option>--tpm2-pcrs=</option><replaceable>PCR<optional>+PCR...</optional></replaceable></term>
+ <term><option>--tpm2-pcrs=<replaceable>PCR<optional>+PCR...</optional></replaceable></option></term>
<listitem><para>Configures the TPM2 PCRs (Platform Configuration Registers) to bind to when
enrollment is requested via <option>--tpm2-device=</option>. Takes a list of PCR entries, where each
</varlistentry>
<varlistentry>
- <term><option>--tpm2-with-pin=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--tpm2-with-pin=<replaceable>BOOL</replaceable></option></term>
<listitem><para>When enrolling a TPM2 device, controls whether to require the user to enter a PIN
when unlocking the volume in addition to PCR binding, based on TPM2 policy authentication. Defaults
</varlistentry>
<varlistentry>
- <term><option>--tpm2-public-key=</option><replaceable>PATH</replaceable></term>
- <term><option>--tpm2-public-key-pcrs=</option><replaceable>PCR<optional>+PCR...</optional></replaceable></term>
- <term><option>--tpm2-signature=</option><replaceable>PATH</replaceable></term>
+ <term><option>--tpm2-public-key=<replaceable>PATH</replaceable></option></term>
+ <term><option>--tpm2-public-key-pcrs=<replaceable>PCR<optional>+PCR...</optional></replaceable></option></term>
+ <term><option>--tpm2-signature=<replaceable>PATH</replaceable></option></term>
<listitem><para>Configures a TPM2 signed PCR policy to bind encryption to. The
<option>--tpm2-public-key=</option> option accepts a path to a PEM encoded RSA public key, to bind
</varlistentry>
<varlistentry>
- <term><option>--tpm2-pcrlock=</option><replaceable>PATH</replaceable></term>
+ <term><option>--tpm2-pcrlock=<replaceable>PATH</replaceable></option></term>
<listitem><para>Configures a TPM2 pcrlock policy to bind encryption to. Expects a path to a pcrlock
policy file as generated by the
</varlistentry>
<varlistentry>
- <term><option>--wipe-slot=</option><replaceable>SLOT<optional>,SLOT...</optional></replaceable></term>
+ <term><option>--wipe-slot=<replaceable>SLOT<optional>,SLOT...</optional></replaceable></option></term>
<listitem><para>Wipes one or more LUKS2 key slots. Takes a comma separated list of numeric slot
indexes, or the special strings <literal>all</literal> (for wiping all key slots),
</varlistentry>
<varlistentry>
- <term><option>--tpm2-device=</option><replaceable>PATH</replaceable></term>
+ <term><option>--tpm2-device=<replaceable>PATH</replaceable></option></term>
<listitem><para>Controls which TPM2 device to use. Expects a device node path referring to the TPM2
chip (e.g. <filename>/dev/tpmrm0</filename>). Alternatively the special value <literal>auto</literal>
</varlistentry>
<varlistentry>
- <term><option>--phase=</option><replaceable>PHASE</replaceable></term>
+ <term><option>--phase=<replaceable>PHASE</replaceable></option></term>
<listitem><para>Controls which boot phases to calculate expected PCR 11 values for. This takes a
series of colon-separated strings that encode boot "paths" for entering a specific phase of the boot
</varlistentry>
<varlistentry>
- <term><option>--append=</option><replaceable>PATH</replaceable></term>
+ <term><option>--append=<replaceable>PATH</replaceable></option></term>
<listitem><para>When generating a PCR JSON signature (via the <command>sign</command> command),
combine it with a previously generated PCR JSON signature, and output it as one. The specified path
<variablelist>
<varlistentry>
<term><option>-i</option> <replaceable>INTERFACE</replaceable><optional>:<replaceable>MIN_OPERSTATE</replaceable><optional>:<replaceable>MAX_OPERSTATE</replaceable></optional></optional></term>
- <term><option>--interface=</option><replaceable>INTERFACE</replaceable><optional>:<replaceable>MIN_OPERSTATE</replaceable><optional>:<replaceable>MAX_OPERSTATE</replaceable></optional></optional></term>
+ <term><option>--interface=<replaceable>INTERFACE</replaceable><optional>:<replaceable>MIN_OPERSTATE</replaceable><optional>:<replaceable>MAX_OPERSTATE</replaceable></optional></optional></option></term>
<listitem><para>Network interface to wait for before deciding if the system is online. This
is useful when a system has several interfaces which will be configured, but a particular
</varlistentry>
<varlistentry>
- <term><option>--ignore=</option><replaceable>INTERFACE</replaceable></term>
+ <term><option>--ignore=<replaceable>INTERFACE</replaceable></option></term>
<listitem><para>Network interfaces to be ignored when deciding
if the system is online. By default, only the loopback
<varlistentry>
<term><option>-o</option> <replaceable>MIN_OPERSTATE</replaceable><optional>:<replaceable>MAX_OPERSTATE</replaceable></optional></term>
- <term><option>--operational-state=</option><replaceable>MIN_OPERSTATE</replaceable><optional>:<replaceable>MAX_OPERSTATE</replaceable></optional></term>
+ <term><option>--operational-state=<replaceable>MIN_OPERSTATE</replaceable><optional>:<replaceable>MAX_OPERSTATE</replaceable></optional></option></term>
<listitem><para>Takes a minimum operational state and an optional maximum operational state.
Please see <citerefentry><refentrytitle>networkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
</varlistentry>
<varlistentry>
- <term><option>--timeout=</option><replaceable>SECS</replaceable></term>
+ <term><option>--timeout=<replaceable>SECS</replaceable></option></term>
<listitem><para>Fail the service if the network is not online
by the time the timeout elapses. A timeout of 0 disables the
</varlistentry>
<varlistentry>
- <term><option>--uid=</option><replaceable>USER</replaceable></term>
+ <term><option>--uid=<replaceable>USER</replaceable></option></term>
<listitem><para>Set the user ID to send the notification from. Takes a UNIX user name or numeric UID. When
specified the notification message will be sent with the specified UID as sender, in place of the user the
</varlistentry>
<varlistentry>
- <term><option>--settings=</option><replaceable>MODE</replaceable></term>
+ <term><option>--settings=<replaceable>MODE</replaceable></option></term>
<listitem><para>Controls whether
<command>systemd-nspawn</command> shall search for and use
<varlistentry>
<term><option>--volatile</option></term>
- <term><option>--volatile=</option><replaceable>MODE</replaceable></term>
+ <term><option>--volatile=<replaceable>MODE</replaceable></option></term>
<listitem><para>Boots the container in volatile mode. When no mode parameter is passed or when mode is
specified as <option>yes</option>, full volatile mode is enabled. This means the root directory is mounted as a
<variablelist>
<varlistentry>
- <term><option>--console=</option><replaceable>MODE</replaceable></term>
+ <term><option>--console=<replaceable>MODE</replaceable></option></term>
<listitem><para>Configures how to set up standard input, output and error output for the container
payload, as well as the <filename>/dev/console</filename> device for the container. Takes one of
<variablelist>
<varlistentry>
- <term><option>--load-credential=</option><replaceable>ID</replaceable>:<replaceable>PATH</replaceable></term>
- <term><option>--set-credential=</option><replaceable>ID</replaceable>:<replaceable>VALUE</replaceable></term>
+ <term><option>--load-credential=<replaceable>ID</replaceable>:<replaceable>PATH</replaceable></option></term>
+ <term><option>--set-credential=<replaceable>ID</replaceable>:<replaceable>VALUE</replaceable></option></term>
<listitem><para>Pass a credential to the container. These two options correspond to the
<varname>LoadCredential=</varname> and <varname>SetCredential=</varname> settings in unit files. See
</varlistentry>
<varlistentry>
- <term><option>--tpm2-device=</option><replaceable>PATH</replaceable></term>
+ <term><option>--tpm2-device=<replaceable>PATH</replaceable></option></term>
<listitem><para>Controls which TPM2 device to use. Expects a device node path referring to the TPM2
chip (e.g. <filename>/dev/tpmrm0</filename>). Alternatively the special value <literal>auto</literal>
</varlistentry>
<varlistentry>
- <term><option>--tpm2-device-key=</option><replaceable>PATH</replaceable></term>
- <term><option>--tpm2-seal-key-handle=</option><replaceable>HANDLE</replaceable></term>
+ <term><option>--tpm2-device-key=<replaceable>PATH</replaceable></option></term>
+ <term><option>--tpm2-seal-key-handle=<replaceable>HANDLE</replaceable></option></term>
<listitem><para>Configures a TPM2 SRK key to bind encryption to. See
<citerefentry><refentrytitle>systemd-cryptenroll</refentrytitle><manvolnum>1</manvolnum></citerefentry>
</varlistentry>
<varlistentry>
- <term><option>--tpm2-public-key=</option><replaceable>PATH</replaceable></term>
- <term><option>--tpm2-public-key-pcrs=</option><replaceable>PCR<optional>+PCR...</optional></replaceable></term>
+ <term><option>--tpm2-public-key=<replaceable>PATH</replaceable></option></term>
+ <term><option>--tpm2-public-key-pcrs=<replaceable>PCR<optional>+PCR...</optional></replaceable></option></term>
<listitem><para>Configures a TPM2 signed PCR policy to bind encryption to. See
<citerefentry><refentrytitle>systemd-cryptenroll</refentrytitle><manvolnum>1</manvolnum></citerefentry>
</varlistentry>
<varlistentry>
- <term><option>--tpm2-pcrlock=</option><replaceable>PATH</replaceable></term>
+ <term><option>--tpm2-pcrlock=<replaceable>PATH</replaceable></option></term>
<listitem><para>Configures a TPM2 pcrlock policy to bind encryption to. See
<citerefentry><refentrytitle>systemd-cryptenroll</refentrytitle><manvolnum>1</manvolnum></citerefentry>
</varlistentry>
<varlistentry>
- <term><option>--split=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--split=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Enables generation of split artifacts from partitions configured with
<varname>SplitName=</varname>. If enabled, for each partition with <varname>SplitName=</varname> set,
</varlistentry>
<varlistentry>
- <term><option>--include-partitions=</option><replaceable>PARTITIONS</replaceable></term>
- <term><option>--exclude-partitions=</option><replaceable>PARTITIONS</replaceable></term>
+ <term><option>--include-partitions=<replaceable>PARTITIONS</replaceable></option></term>
+ <term><option>--exclude-partitions=<replaceable>PARTITIONS</replaceable></option></term>
<listitem><para>These options specify which partition types <command>systemd-repart</command> should
operate on. If <option>--include-partitions=</option> is used, all partitions that aren't specified
</varlistentry>
<varlistentry>
- <term><option>--defer-partitions=</option><replaceable>PARTITIONS</replaceable></term>
+ <term><option>--defer-partitions=<replaceable>PARTITIONS</replaceable></option></term>
<listitem><para>This option specifies for which partition types <command>systemd-repart</command>
should defer. All partitions that are deferred using this option are still taken into account when
</varlistentry>
<varlistentry>
- <term><option>--sector-size=</option><replaceable>BYTES</replaceable></term>
+ <term><option>--sector-size=<replaceable>BYTES</replaceable></option></term>
<listitem><para>This option allows configuring the sector size of the image produced by
<command>systemd-repart</command>. It takes a value that is a power of <literal>2</literal> between
</varlistentry>
<varlistentry>
- <term><option>--architecture=</option><replaceable>ARCH</replaceable></term>
+ <term><option>--architecture=<replaceable>ARCH</replaceable></option></term>
<listitem><para>This option allows overriding the architecture used for architecture specific
partition types. For example, if set to <literal>arm64</literal> a partition type of
</varlistentry>
<varlistentry>
- <term><option>--offline=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--offline=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Instructs <command>systemd-repart</command> to build the image offline. Takes a
boolean or <literal>auto</literal>. Defaults to <literal>auto</literal>. If enabled, the image is
</varlistentry>
<varlistentry>
- <term><option>--copy-from=</option><replaceable>IMAGE</replaceable></term>
+ <term><option>--copy-from=<replaceable>IMAGE</replaceable></option></term>
<listitem><para>Instructs <command>systemd-repart</command> to synthesize partition definitions from
the partition table in the given image. This option can be specified multiple times to synthesize
</varlistentry>
<varlistentry>
- <term><option>--copy-source=</option><replaceable>PATH</replaceable></term>
+ <term><option>--copy-source=<replaceable>PATH</replaceable></option></term>
<term><option>-s</option> <replaceable>PATH</replaceable></term>
<listitem><para>Specifies a source directory all <varname>CopyFiles=</varname> source paths shall be
</varlistentry>
<varlistentry>
- <term><option>--make-ddi=</option><replaceable>TYPE</replaceable></term>
+ <term><option>--make-ddi=<replaceable>TYPE</replaceable></option></term>
<listitem><para>Takes one of <literal>sysext</literal>, <literal>confext</literal> or
<literal>portable</literal>. Generates a Discoverable Disk Image (DDI) for a system extension
</varlistentry>
<varlistentry>
- <term><option>--generate-fstab=</option><replaceable>PATH</replaceable></term>
+ <term><option>--generate-fstab=<replaceable>PATH</replaceable></option></term>
<listitem><para>Specifies a path where to write fstab entries for the mountpoints configured with
<option>MountPoint=</option> in the root directory specified with <option>--copy-source=</option> or
</varlistentry>
<varlistentry>
- <term><option>--generate-crypttab=</option><replaceable>PATH</replaceable></term>
+ <term><option>--generate-crypttab=<replaceable>PATH</replaceable></option></term>
<listitem><para>Specifies a path where to write crypttab entries for the encrypted volumes configured
with <option>EncryptedVolume=</option> in the root directory specified with
</varlistentry>
<varlistentry>
- <term><option>--fdname=</option><replaceable>NAME</replaceable><optional>:<replaceable>NAME</replaceable>…</optional></term>
+ <term><option>--fdname=<replaceable>NAME</replaceable><optional>:<replaceable>NAME</replaceable>…</optional></option></term>
<listitem><para>Specify names for the file descriptors passed. This is equivalent to setting
<varname>FileDescriptorName=</varname> in socket unit files, and enables use of
</varlistentry>
<varlistentry>
- <term><option>--mutable=</option><replaceable>BOOL</replaceable>|<replaceable>auto</replaceable>|<replaceable>import</replaceable></term>
+ <term><option>--mutable=<replaceable>BOOL</replaceable>|<replaceable>auto</replaceable>|<replaceable>import</replaceable></option></term>
<listitem><para>Set mutable mode.</para>
<variablelist>
</varlistentry>
<varlistentry>
- <term><option>--noexec=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--noexec=<replaceable>BOOL</replaceable></option></term>
<listitem><para>When merging configuration extensions into <filename>/etc/</filename> the
<literal>MS_NOEXEC</literal> mount flag is used by default. This option can be used to disable
<variablelist>
<varlistentry>
- <term><option>--cpus=</option><replaceable>CPUS</replaceable></term>
+ <term><option>--cpus=<replaceable>CPUS</replaceable></option></term>
<listitem><para>Configures the number of CPUs to start the virtual machine with.
Defaults to 1.</para>
</varlistentry>
<varlistentry>
- <term><option>--ram=</option><replaceable>BYTES</replaceable></term>
+ <term><option>--ram=<replaceable>BYTES</replaceable></option></term>
<listitem><para>Configures the amount of memory to start the virtual machine with.
Defaults to 2G.</para>
</varlistentry>
<varlistentry>
- <term><option>--kvm=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--kvm=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Configures whether to use KVM. If the option is not specified KVM support will be
detected automatically. If true, KVM is always used, and if false, KVM is never used.</para>
</varlistentry>
<varlistentry>
- <term><option>--vsock=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--vsock=<replaceable>BOOL</replaceable></option></term>
<listitem>
<para>Configure whether to use VSOCK networking.</para>
</varlistentry>
<varlistentry>
- <term><option>--vsock-cid=</option><replaceable>CID</replaceable></term>
+ <term><option>--vsock-cid=<replaceable>CID</replaceable></option></term>
<listitem>
<para>Configure vmspawn to use a specific CID for the guest.</para>
</varlistentry>
<varlistentry>
- <term><option>--tpm=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--tpm=<replaceable>BOOL</replaceable></option></term>
<listitem>
<para>Configure whether to use VM with a virtual TPM or not.</para>
</varlistentry>
<varlistentry>
- <term><option>--linux=</option><replaceable>PATH</replaceable></term>
+ <term><option>--linux=<replaceable>PATH</replaceable></option></term>
<listitem>
<para>Set the linux kernel image to use for direct kernel boot.</para>
</varlistentry>
<varlistentry>
- <term><option>--initrd=</option><replaceable>PATH</replaceable></term>
+ <term><option>--initrd=<replaceable>PATH</replaceable></option></term>
<listitem>
<para>Set the initrd to use for direct kernel boot.</para>
</varlistentry>
<varlistentry>
- <term><option>--firmware=</option><replaceable>PATH</replaceable></term>
+ <term><option>--firmware=<replaceable>PATH</replaceable></option></term>
<listitem><para>Takes an absolute path, or a relative path beginning with
<filename>./</filename>. Specifies a JSON firmware definition file, which allows selecting the
</varlistentry>
<varlistentry>
- <term><option>--secure-boot=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--secure-boot=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Configure whether to search for firmware which supports Secure Boot.</para>
<variablelist>
<varlistentry>
- <term><option>--private-users=</option><replaceable>UID_SHIFT[:UID_RANGE]</replaceable></term>
+ <term><option>--private-users=<replaceable>UID_SHIFT[:UID_RANGE]</replaceable></option></term>
<listitem><para>Controls user namespacing under <option>--directory=</option>.
If enabled, <command>virtiofsd</command> is instructed to map user and group ids (UIDs and GIDs).
<variablelist>
<varlistentry>
- <term><option>--bind=</option><replaceable>PATH</replaceable></term>
- <term><option>--bind-ro=</option><replaceable>PATH</replaceable></term>
+ <term><option>--bind=<replaceable>PATH</replaceable></option></term>
+ <term><option>--bind-ro=<replaceable>PATH</replaceable></option></term>
<listitem><para>Mount a directory from the host into the virtual machine. Takes one of: a path
argument — in which case the specified path will be mounted from the host to the same path in the virtual machine, or
</varlistentry>
<varlistentry>
- <term><option>--extra-drive=</option><replaceable>PATH</replaceable></term>
+ <term><option>--extra-drive=<replaceable>PATH</replaceable></option></term>
<listitem><para>Takes a disk image or block device on the host and supplies it to the virtual machine as another drive.</para>
<variablelist>
<varlistentry>
- <term><option>--forward-journal=</option><replaceable>FILE|DIR</replaceable></term>
+ <term><option>--forward-journal=<replaceable>FILE|DIR</replaceable></option></term>
<listitem><para>Forward the virtual machine's journal to the host.
<citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>
</varlistentry>
<varlistentry>
- <term><option>--pass-ssh-key=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--pass-ssh-key=<replaceable>BOOL</replaceable></option></term>
<listitem><para>By default an SSH key is generated to allow <command>systemd-vmspawn</command> to open
a D-Bus connection to the VM's systemd bus. Setting this to "no" will disable SSH key generation.</para>
</varlistentry>
<varlistentry>
- <term><option>--ssh-key-type=</option><replaceable>TYPE</replaceable></term>
+ <term><option>--ssh-key-type=<replaceable>TYPE</replaceable></option></term>
<listitem><para>Configures the type of SSH key to generate, see
<citerefentry project="man-pages"><refentrytitle>ssh-keygen</refentrytitle><manvolnum>1</manvolnum></citerefentry>
<variablelist>
<varlistentry>
- <term><option>--console=</option><replaceable>MODE</replaceable></term>
+ <term><option>--console=<replaceable>MODE</replaceable></option></term>
<listitem><para>Configures how to set up the console of the VM. Takes one of
<literal>interactive</literal>, <literal>read-only</literal>, <literal>native</literal>,
<variablelist>
<varlistentry>
- <term><option>--load-credential=</option><replaceable>ID</replaceable>:<replaceable>PATH</replaceable></term>
- <term><option>--set-credential=</option><replaceable>ID</replaceable>:<replaceable>VALUE</replaceable></term>
+ <term><option>--load-credential=<replaceable>ID</replaceable>:<replaceable>PATH</replaceable></option></term>
+ <term><option>--set-credential=<replaceable>ID</replaceable>:<replaceable>VALUE</replaceable></option></term>
<listitem><para>Pass a credential to the virtual machine. These two options correspond to the
<varname>LoadCredential=</varname> and <varname>SetCredential=</varname> settings in unit files. See
</varlistentry>
<varlistentry>
- <term><option>--crash-vt=</option><replaceable>VT</replaceable></term>
+ <term><option>--crash-vt=<replaceable>VT</replaceable></option></term>
<listitem><para>Switch to a specific virtual console (VT) on crash. This switch has no effect when
running as user instance. Same as <varname>systemd.crash_chvt=</varname> above (but not the
</varlistentry>
<varlistentry>
<term><option>-m</option></term>
- <term><option>--children-max=</option><replaceable>value</replaceable></term>
+ <term><option>--children-max=<replaceable>value</replaceable></option></term>
<listitem>
<para>Set the maximum number of events, systemd-udevd will handle at the same time. When 0 is
specified, then the maximum is determined based on the system resources.</para>
</varlistentry>
<varlistentry>
<term><option>-t</option></term>
- <term><option>--timeout=</option><replaceable>seconds</replaceable></term>
+ <term><option>--timeout=<replaceable>seconds</replaceable></option></term>
<listitem>
<para>The maximum number of seconds to wait for a reply from systemd-udevd.</para>
</listitem>
<variablelist>
<varlistentry>
- <term><option>--output=</option><replaceable>MODE</replaceable></term>
+ <term><option>--output=<replaceable>MODE</replaceable></option></term>
<listitem><para>Choose the output mode, takes one of <literal>classic</literal>,
<literal>friendly</literal>, <literal>table</literal>, <literal>json</literal>. If
</varlistentry>
<varlistentry>
- <term><option>--json=</option><replaceable>FORMAT</replaceable></term>
+ <term><option>--json=<replaceable>FORMAT</replaceable></option></term>
<listitem><para>Selects JSON output mode (like <option>--output=json</option>) and selects the
precise display mode. Takes one of <literal>pretty</literal> or <literal>short</literal>. If
</varlistentry>
<varlistentry>
- <term><option>--service=</option><replaceable>SERVICE</replaceable><optional>:<replaceable>SERVICE…</replaceable></optional></term>
+ <term><option>--service=<replaceable>SERVICE</replaceable><optional>:<replaceable>SERVICE…</replaceable></optional></option></term>
<term><option>-s</option> <replaceable>SERVICE</replaceable>:<replaceable>SERVICE…</replaceable></term>
<listitem><para>Controls which services to query for users/groups. Takes a list of one or more
</varlistentry>
<varlistentry>
- <term><option>--with-nss=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--with-nss=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Controls whether to include classic glibc/NSS user/group lookups in the output. If
<option>--with-nss=no</option> is used any attempts to resolve or enumerate users/groups provided
</varlistentry>
<varlistentry>
- <term><option>--with-varlink=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--with-varlink=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Controls whether to include Varlink user/group lookups in the output, i.e. those done
via the <ulink url="https://systemd.io/USER_GROUP_API">User/Group Record Lookup API via
</varlistentry>
<varlistentry>
- <term><option>--with-dropin=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--with-dropin=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Controls whether to include user/group lookups in the output that are defined using
drop-in files in <filename>/etc/userdb/</filename>, <filename>/run/userdb/</filename>,
</varlistentry>
<varlistentry>
- <term><option>--synthesize=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--synthesize=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Controls whether to synthesize records for the root and nobody users/groups if they
aren't defined otherwise. By default (or <literal>yes</literal>) such records are implicitly
</varlistentry>
<varlistentry>
- <term><option>--multiplexer=</option><replaceable>BOOL</replaceable></term>
+ <term><option>--multiplexer=<replaceable>BOOL</replaceable></option></term>
<listitem><para>Controls whether to do lookups via the multiplexer service (if specified as true, the
default) or do lookups in the client (if specified as false). Using the multiplexer service is
</varlistentry>
<varlistentry>
- <term><option>--json=</option><replaceable>MODE</replaceable></term>
+ <term><option>--json=<replaceable>MODE</replaceable></option></term>
<listitem>
<para>Selects the JSON output formatting, one of <literal>pretty</literal> (for nicely indented,
projects / thirdparty / systemd.git / commitdiff
