another unit listed in its Also= setting might be.
* Similar to the various existing ConditionXYZ= settings for
- units there are now matching AssertXYZ= settings. While
+ units, there are now matching AssertXYZ= settings. While
failing conditions cause a unit to be skipped, but its job
to succeed, failing assertions declared like this will cause
a unit start operation and its job to fail.
* hostnamed now knows a new chassis type "embedded".
* systemctl gained a new "edit" command. When used on a unit
- file this allows extending unit files with .d/ drop-in
+ file, this allows extending unit files with .d/ drop-in
configuration snippets or editing the full file (after
copying it from /usr/lib to /etc). This will invoke the
user's editor (as configured with $EDITOR), and reload the
inhibitors.
* Scope and service units gained a new "Delegate" boolean
- property, which when set allows processes running inside the
+ property, which, when set, allows processes running inside the
unit to further partition resources. This is primarily
useful for systemd user instances as well as container
managers.
audit fields are split up and fully indexed. This means that
journalctl in many ways is now a (nicer!) alternative to
ausearch, the traditional audit client. Note that this
- implements only a minimal audit client, if you want the
+ implements only a minimal audit client. If you want the
special audit modes like reboot-on-log-overflow, please use
the traditional auditd instead, which can be used in
parallel to journald.
will spew out warnings if the compilation fails. This
requires libxkbcommon to be installed.
- * When a coredump is collected a larger number of metadata
+ * When a coredump is collected, a larger number of metadata
fields is now collected and included in the journal records
- created for it. More specifically control group membership,
+ created for it. More specifically, control group membership,
environment variables, memory maps, working directory,
chroot directory, /proc/$PID/status, and a list of open file
descriptors is now stored in the log entry.
open_by_handle_at() is now prohibited for containers,
closing a hole similar to a recently discussed vulnerability
in docker regarding access to files on file hierarchies the
- container should normally not have access to. Note that for
- nspawn we generally make no security claims anyway (and
+ container should normally not have access to. Note that, for
+ nspawn, we generally make no security claims anyway (and
this is explicitly documented in the man page), so this is
just a fix for one of the most obvious problems.
devices as seat masters, i.e. as devices that are required
to be existing before a seat is considered preset. Instead,
it will now look for all devices that are tagged as
- "seat-master" in udev. By default framebuffer devices will
- be marked as such, but depending on local systems other
+ "seat-master" in udev. By default, framebuffer devices will
+ be marked as such, but depending on local systems, other
devices might be marked as well. This may be used to
integrate graphics cards using closed source drivers (such
as NVidia ones) more nicely into logind. Note however, that
* Reorder configuration file lookup order. /etc now always
overrides /run in order to allow the administrator to always
- and unconditionally override vendor supplied or
+ and unconditionally override vendor-supplied or
automatically generated data.
* The various user visible bits of the journal now have man
<term><varname>Frequency=25</varname></term>
<listitem><para>Configure the sample log frequency. This can
be a fractional number, but must be larger than 0.0. Most
- systems can cope with values under 25-50 without impacting
+ systems can cope with values under 25–50 without impacting
boot time severely.</para></listitem>
</varlistentry>
versions of systemd-boot, if the current version is newer than the
version installed in the EFI system partition. This also includes
the EFI default/fallback loader at /EFI/Boot/boot*.efi. A
- systemd-boot entry in the EFI boot variables is created, if there
+ systemd-boot entry in the EFI boot variables is created if there
is no current entry. The created entry will be added to the end of
the boot order list.</para>
versions of systemd-boot from the EFI system partition, and removes
systemd-boot from the EFI boot variables.</para>
- <para>If no command is passed <command>status</command> is
+ <para>If no command is passed, <command>status</command> is
implied.</para>
</refsect1>
<refsect1>
<title>Exit status</title>
- <para>On success 0 is returned, a non-zero failure
+ <para>On success, 0 is returned, a non-zero failure
code otherwise.</para>
</refsect1>
<term><option>--size=</option></term>
<listitem>
- <para>When used with the <command>capture</command> command
+ <para>When used with the <command>capture</command> command,
specifies the maximum bus message size to capture
("snaplen"). Defaults to 4096 bytes.</para>
</listitem>
<term><option>--list</option></term>
<listitem>
- <para>When used with the <command>tree</command> command shows a
+ <para>When used with the <command>tree</command> command, shows a
flat list of object paths instead of a tree.</para>
</listitem>
</varlistentry>
<term><option>--quiet</option></term>
<listitem>
- <para>When used with the <command>call</command> command
+ <para>When used with the <command>call</command> command,
suppresses display of the response message payload. Note that even
- if this option is specified errors returned will still be
+ if this option is specified, errors returned will still be
printed and the tool will indicate success or failure with
the process exit code.</para>
</listitem>
<listitem>
<para>When used with the <command>call</command> or
- <command>get-property</command> command shows output in a
+ <command>get-property</command> command, shows output in a
more verbose format.</para>
</listitem>
</varlistentry>
<term><option>--expect-reply=</option><replaceable>BOOL</replaceable></term>
<listitem>
- <para>When used with the <command>call</command> command
+ <para>When used with the <command>call</command> command,
specifies whether <command>busctl</command> shall wait for
completion of the method call, output the returned method
response data, and return success or failure via the process
- exit code. If this is set to <literal>no</literal> the
+ exit code. If this is set to <literal>no</literal>, the
method call will be issued but no response is expected, the
tool terminates immediately, and thus no response can be
shown, and no success or failure is returned via the exit
- code. To only suppress output of the reply message payload
+ code. To only suppress output of the reply message payload,
use <option>--quiet</option> above. Defaults to
<literal>yes</literal>.</para>
</listitem>
<term><option>--auto-start=</option><replaceable>BOOL</replaceable></term>
<listitem>
- <para>When used with the <command>call</command> command specifies
+ <para>When used with the <command>call</command> command, specifies
whether the method call should implicitly activate the
- called service should it not be running yet but is
+ called service, should it not be running yet but is
configured to be auto-started. Defaults to
<literal>yes</literal>.</para>
</listitem>
<term><option>--allow-interactive-authorization=</option><replaceable>BOOL</replaceable></term>
<listitem>
- <para>When used with the <command>call</command> command
+ <para>When used with the <command>call</command> command,
specifies whether the services may enforce interactive
authorization while executing the operation, if the security
policy is configured for this. Defaults to
<term><option>--timeout=</option><replaceable>SECS</replaceable></term>
<listitem>
- <para>When used with the <command>call</command> command
+ <para>When used with the <command>call</command> command,
specifies the maximum time to wait for method call
- completion. If no time unit is specified assumes
+ completion. If no time unit is specified, assumes
seconds. The usual other units are understood, too (ms, us,
s, min, h, d, w, month, y). Note that this timeout does not
- apply if <option>--expect-reply=no</option> is used as the
+ apply if <option>--expect-reply=no</option> is used, as the
tool does not wait for any reply message then. When not
- specified or when set to 0 the default of
+ specified or when set to 0, the default of
<literal>25s</literal> is assumed.</para>
</listitem>
</varlistentry>
<para>Controls whether credential data reported by
<command>list</command> or <command>status</command> shall
be augmented with data from
- <filename>/proc</filename>. When this is turned on the data
+ <filename>/proc</filename>. When this is turned on, the data
shown is possibly inconsistent, as the data read from
<filename>/proc</filename> might be more recent than rest of
the credential information. Defaults to <literal>yes</literal>.</para>
<term><command>list</command></term>
<listitem><para>Show all peers on the bus, by their service
- names. By default shows both unique and well-known names, but
+ names. By default, shows both unique and well-known names, but
this may be changed with the <option>--unique</option> and
<option>--acquired</option> switches. This is the default
operation if no command is specified.</para></listitem>
<term><command>capture</command> <arg choice="opt" rep="repeat"><replaceable>SERVICE</replaceable></arg></term>
<listitem><para>Similar to <command>monitor</command> but
- writes the output in pcap format (for details see the <ulink
+ writes the output in pcap format (for details
, see the <ulink
url="http://wiki.wireshark.org/Development/LibpcapFileFormat">Libpcap
File Format</ulink> description. Make sure to redirect the
output to STDOUT to a file. Tools like
<listitem><para>Show interfaces, methods, properties and
signals of the specified object (identified by its path) on
- the specified service. If the interface argument is passed the
+ the specified service. If the interface argument is passed, the
output is limited to members of the specified
interface.</para></listitem>
</varlistentry>
<listitem><para>Invoke a method and show the response. Takes a
service name, object path, interface name and method name. If
- parameters shall be passed to the method call a signature
+ parameters shall be passed to the method call, a signature
string is required, followed by the arguments, individually
formatted as strings. For details on the formatting used, see
- below. To suppress output of the returned data use the
+ below. To suppress output of the returned data, use the
<option>--quiet</option> option.</para></listitem>
</varlistentry>
<listitem><para>Retrieve the current value of one or more
object properties. Takes a service name, object path,
interface name and property name. Multiple properties may be
- specified at once in which case their values will be shown one
- after the other, separated by newlines. The output is by
- default in terse format. Use <option>--verbose</option> for a
+ specified at once, in which case their values will be shown one
+ after the other, separated by newlines. The output is, by
+ default, in terse format. Use <option>--verbose</option> for a
more elaborate output format.</para></listitem>
</varlistentry>
<para>The <command>call</command> and
<command>set-property</command> commands take a signature string
followed by a list of parameters formatted as string (for details
- on D-Bus signature strings see the <ulink
+ on D-Bus signature strings
, see the <ulink
url="http://dbus.freedesktop.org/doc/dbus-specification.html#type-system">Type
system chapter of the D-Bus specification</ulink>). For simple
- types each parameter following the signature should simply be the
+ types, each parameter following the signature should simply be the
parameter's value formatted as string. Positive boolean values may
be formatted as <literal>true</literal>, <literal>yes</literal>,
<literal>on</literal>, <literal>1</literal>; negative boolean
<literal>no</literal>, <literal>off</literal>,
<literal>0</literal>. For arrays, a numeric argument for the
number of entries followed by the entries shall be specified. For
- variants the signature of the contents shall be specified,
- followed by the contents. For dictionaries and structs the
+ variants, the signature of the contents shall be specified,
+ followed by the contents. For dictionaries and structs, the
contents of them shall be directly specified.</para>
<para>For example,
array that maps strings to variants, consisting of three
entries. The string <literal>One</literal> is assigned the
string <literal>Eins</literal>. The string
- <literal>Two</literal> is assigned the 32bit unsigned
+ <literal>Two</literal> is assigned the 32-bit unsigned
integer 2. The string <literal>Yes</literal> is assigned a
positive boolean.</para>
service, and passes it two strings
<literal>cups.service</literal> and
<literal>replace</literal>. As result of the method
- call a single object path parameter is received and
+ call, a single object path parameter is received and
shown:</para>
<programlisting># busctl call org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager StartUnit ss "cups.service" "replace"
coredumps are processed. Note that old coredumps are also
removed based on time via
<citerefentry><refentrytitle>systemd-tmpfiles</refentrytitle><manvolnum>8</manvolnum></citerefentry>. Set
- either value to 0 to turn off size based
+ either value to 0 to turn off size-based
clean-up.</para></listitem>
</varlistentry>
</variablelist>
<!--
- If stable URLs with fragment markers (references to the ID) turn out not to be important:
- generatedID could simply take the value of generate-id(), and various other helper templates may be dropped entirely.
- - Alternatively if xsltproc is patched to generate reproducible generate-id() output the same simplifications can be
+ - Alternatively, if xsltproc is patched to generate reproducible generate-id() output, the same simplifications can be
- applied at the cost of breaking compatibility with URLs generated from output of previous versions of this stylesheet.
-->
<xsl:variable name="generatedID">
configured address redundant. Another often suggested trigger
for service activation is low system load. However, here too, a
more convincing approach might be to make proper use of features
- of the operating system, in particular, the CPU or IO scheduler
+ of the operating system, in particular, the CPU or I/O scheduler
of Linux. Instead of scheduling jobs from userspace based on
monitoring the OS scheduler, it is advisable to leave the
scheduling of processes to the OS scheduler itself. systemd
- provides fine-grained access to the CPU and IO schedulers. If a
+ provides fine-grained access to the CPU and I/O schedulers. If a
process executed by the init system shall not negatively impact
- the amount of CPU or IO bandwidth available to other processes,
+ the amount of CPU or I/O bandwidth available to other processes,
it should be configured with
<varname>CPUSchedulingPolicy=idle</varname> and/or
<varname>IOSchedulingClass=idle</varname>. Optionally, this may
<varlistentry>
<term><filename>/boot</filename></term>
<listitem><para>The boot partition used for bringing up the
- system. On EFI systems this is possibly the EFI System
+ system. On EFI systems, this is possibly the EFI System
Partition, also see
<citerefentry><refentrytitle>systemd-gpt-auto-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
This directory is usually strictly local to the host, and
directory is usually mounted as a <literal>tmpfs</literal>
instance, and should hence not be used for larger files. (Use
<filename>/var/tmp</filename> for larger files.) Since the
- directory is accessible to other users of the system it is
+ directory is accessible to other users of the system, it is
essential that this directory is only written to with the
<citerefentry project='man-pages'><refentrytitle>mkstemp</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
<citerefentry project='man-pages'><refentrytitle>mkdtemp</refentrytitle><manvolnum>3</manvolnum></citerefentry>
and related calls. This directory is usually flushed at
boot-up. Also, files that are not accessed within a certain
time are usually automatically deleted. If applications find
- the environment variable <varname>$TMPDIR</varname> set they
+ the environment variable <varname>$TMPDIR</varname> set, they
should prefer using the directory specified in it over
directly referencing <filename>/tmp</filename> (see
<citerefentry project='man-pages'><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>
<varlistentry>
<term><filename>/usr/bin</filename></term>
- <listitem><para>Binaries and executables for user commands,
+ <listitem><para>Binaries and executables for user commands
that shall appear in the <varname>$PATH</varname> search path.
It is recommended not to place binaries in this directory that
are not useful for invocation from a shell (such as daemon
<term><filename>/usr/share/factory/var</filename></term>
<listitem><para>Similar to
- <filename>/usr/share/factory/etc</filename> but for vendor
+ <filename>/usr/share/factory/etc</filename>, but for vendor
versions of files in the variable, persistent data directory
<filename>/var</filename>.</para></listitem>
<varlistentry>
<term><filename>/var/tmp</filename></term>
<listitem><para>The place for larger and persistent temporary
- files. In contrast to <filename>/tmp</filename> this directory
+ files. In contrast to <filename>/tmp</filename>, this directory
is usually mounted from a persistent physical file system and
can thus accept larger files. (Use <filename>/tmp</filename>
for smaller files.) This directory is generally not flushed at
<citerefentry project='man-pages'><refentrytitle>mkdtemp</refentrytitle><manvolnum>3</manvolnum></citerefentry>
or similar calls should be used to make use of this directory.
If applications find the environment variable
- <varname>$TMPDIR</varname> set they should prefer using the
+ <varname>$TMPDIR</varname> set, they should prefer using the
directory specified in it over directly referencing
<filename>/var/tmp</filename> (see
<citerefentry project='man-pages'><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>
<variablelist>
<varlistentry>
<term><filename>/dev</filename></term>
- <listitem><para>The root directory for device nodes. Usually
+ <listitem><para>The root directory for device nodes. Usually,
this directory is mounted as a <literal>devtmpfs</literal>
instance, but might be of a different type in
sandboxed/containerized setups. This directory is managed
write access to this directory, special care should be taken
to avoid name clashes and vulnerabilities. For normal users,
shared memory segments in this directory are usually deleted
- when the user logs out. Usually it is a better idea to use
+ when the user logs out. Usually, it is a better idea to use
memory mapped files in <filename>/run</filename> (for system
programs) or <varname>$XDG_RUNTIME_DIR</varname> (for user
programs) instead of POSIX shared memory segments, since those
that exposes a number of kernel tunables. The primary way to
configure the settings in this API file tree is via
<citerefentry><refentrytitle>sysctl.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>
- files. In sandboxed/containerized setups this directory is
+ files. In sandboxed/containerized setups, this directory is
generally mounted read-only.</para></listitem>
</varlistentry>
discovered devices and other functionality. This file system
is mostly an API to interface with the kernel and not a place
where normal files may be stored. In sandboxed/containerized
- setups this directory is generally mounted read-only. A number
+ setups, this directory is generally mounted read-only. A number
of special purpose virtual file systems might be mounted below
this directory.</para></listitem>
</varlistentry>
<varlistentry>
<term><filename>/lib64</filename></term>
- <listitem><para>On some architecture ABIs this compatibility
+ <listitem><para>On some architecture ABIs, this compatibility
symlink points to <varname>$libdir</varname>, ensuring that
binaries referencing this legacy path correctly find their
dynamic loader. This symlink only exists on architectures
directory should have no effect on operation of programs,
except for increased runtimes necessary to rebuild these
caches. If an application finds
- <varname>$XDG_CACHE_HOME</varname> set is should use the
+ <varname>$XDG_CACHE_HOME</varname> set, is should use the
directory specified in it instead of this
directory.</para></listitem>
</varlistentry>
<term><filename>~/.config</filename></term>
<listitem><para>Application configuration and state. When a
- new user is created this directory will be empty or not exist
+ new user is created, this directory will be empty or not exist
at all. Applications should fall back to defaults should their
configuration or state in this directory be missing. If an
- application finds <varname>$XDG_CONFIG_HOME</varname> set is
+ application finds <varname>$XDG_CONFIG_HOME</varname> set, is
should use the directory specified in it instead of this
directory.</para></listitem>
</varlistentry>
invocation from a shell; these should be placed in a
subdirectory of <filename>~/.local/lib</filename> instead.
Care should be taken when placing architecture-dependent
- binaries in this place which might be problematic if the home
+ binaries in this place, which might be problematic if the home
directory is shared between multiple hosts with different
architectures.</para></listitem>
</varlistentry>
<term><filename>~/.local/lib/<replaceable>arch-id</replaceable></filename></term>
<listitem><para>Location for placing public dynamic libraries.
- The architecture identifier to use
, is defined on <ulink
+ The architecture identifier to use is defined on <ulink
url="https://wiki.debian.org/Multiarch/Tuples">Multiarch
Architecture Specifiers (Tuples)</ulink>
list.</para></listitem>
such as fonts or artwork. Usually, the precise location and
format of files stored below this directory is subject to
specifications that ensure interoperability. If an application
- finds <varname>$XDG_DATA_HOME</varname> set is should use the
+ finds <varname>$XDG_DATA_HOME</varname> set, is should use the
directory specified in it instead of this
directory.</para></listitem>
</varlistentry>
<filename>/run/user</filename>) of the user, which are all
writable.</para>
- <para>For unprivileged system processes only
+ <para>For unprivileged system processes, only
<filename>/tmp</filename>,
<filename>/var/tmp</filename> and
<filename>/dev/shm</filename> are writable. If an
- unprivileged system process needs a private, writable directory in
+ unprivileged system process needs a private writable directory in
<filename>/var</filename> or <filename>/run</filename>, it is
recommended to either create it before dropping privileges in the
daemon code, to create it via
<tbody>
<row>
<entry><filename>/usr/bin</filename></entry>
- <entry>Package executables that shall appear in the <varname>$PATH</varname> executable search path, compiled for any of the supported architectures compatible with the operating system. It is not recommended to place internal binaries or binaries that are not commonly invoked from the shell in this directory, such as daemon binaries. As this directory is shared with most other packages of the system special care should be taken to pick unique names for files placed here, that are unlikely to clash with other package's files.</entry>
+ <entry>Package executables that shall appear in the <varname>$PATH</varname> executable search path, compiled for any of the supported architectures compatible with the operating system. It is not recommended to place internal binaries or binaries that are not commonly invoked from the shell in this directory, such as daemon binaries. As this directory is shared with most other packages of the system, special care should be taken to pick unique names for files placed here, that are unlikely to clash with other package's files.</entry>
</row>
<row>
<entry><filename>/usr/lib/<replaceable>arch-id</replaceable></filename></entry>
</row>
<row>
<entry><filename>/usr/lib/<replaceable>package</replaceable></filename></entry>
- <entry>Private, static vendor resources of the package, including private binaries and libraries, or any other kind of read-only vendor data.</entry>
+ <entry>Private static vendor resources of the package, including private binaries and libraries, or any other kind of read-only vendor data.</entry>
</row>
<row>
<entry><filename>/usr/lib/<replaceable>arch-id</replaceable>/<replaceable>package</replaceable></filename></entry>
</table>
<para>Additional static vendor files may be installed in the
- <filename>/usr/share</filename> hierarchy, to the locations
+ <filename>/usr/share</filename> hierarchy to the locations
defined by the various relevant specifications.</para>
- <para>During runtime and for local configuration and state
+ <para>During runtime, and for local configuration and state,
additional directories are defined:</para>
<table>
</row>
<row>
<entry><filename>/var/cache/<replaceable>package</replaceable></filename></entry>
- <entry>Persistent cache data of the package. If this directory is flushed the application should work correctly on next invocation, though possibly slowed down due to the need to rebuild any local cache files. The application must be capable of recreating this directory should it be missing and necessary.</entry>
+ <entry>Persistent cache data of the package. If this directory is flushed, the application should work correctly on next invocation, though possibly slowed down due to the need to rebuild any local cache files. The application must be capable of recreating this directory should it be missing and necessary.</entry>
</row>
<row>
<entry><filename>/var/lib/<replaceable>package</replaceable></filename></entry>
when placing their own files in the user's home directory. The
following table lists recommended locations in the home directory
for specific types of files supplied by the vendor if the
- application is installed in the home directory. (Note however,
+ application is installed in the home directory. (Note, however,
that user applications installed system-wide should follow the
rules outlined above regarding placing vendor files.)</para>
<tbody>
<row>
<entry><filename>~/.local/bin</filename></entry>
- <entry>Package executables that shall appear in the <varname>$PATH</varname> executable search path. It is not recommended to place internal executables or executables that are not commonly invoked from the shell in this directory, such as daemon executables. As this directory is shared with most other packages of the user special care should be taken to pick unique names for files placed here, that are unlikely to clash with other package's files.</entry>
+ <entry>Package executables that shall appear in the <varname>$PATH</varname> executable search path. It is not recommended to place internal executables or executables that are not commonly invoked from the shell in this directory, such as daemon executables. As this directory is shared with most other packages of the user, special care should be taken to pick unique names for files placed here, that are unlikely to clash with other package's files.</entry>
</row>
<row>
<entry><filename>~/.local/lib/<replaceable>arch-id</replaceable></filename></entry>
</table>
<para>Additional static vendor files may be installed in the
- <filename>~/.local/share</filename> hierarchy, to the locations
+ <filename>~/.local/share</filename> hierarchy to the locations
defined by the various relevant specifications.</para>
- <para>During runtime and for local configuration and state
+ <para>During runtime, and for local configuration and state,
additional directories are defined:</para>
<table>
</row>
<row>
<entry><filename>~/.cache/<replaceable>package</replaceable></filename></entry>
- <entry>Persistent cache data of the package. If this directory is flushed the application should work correctly on next invocation, though possibly slowed down due to the need to rebuild any local cache files. The application must be capable of recreating this directory should it be missing and necessary.</entry>
+ <entry>Persistent cache data of the package. If this directory is flushed, the application should work correctly on next invocation, though possibly slowed down due to the need to rebuild any local cache files. The application must be capable of recreating this directory should it be missing and necessary.</entry>
</row>
</tbody>
</tgroup>
<para>The hwdb file contains data records consisting of matches and
associated key-value pairs. Every record in the hwdb starts with one or
- more match string, specifying a shell glob to compare the database
+ more match strings, specifying a shell glob to compare the database
lookup string against. Multiple match lines are specified in additional
consecutive lines. Every match line is compared individually, they are
combined by OR. Every match line must start at the first character of
and compiled to a binary database located at <filename>/etc/udev/hwdb.bin</filename>,
or alternatively <filename>/usr/lib/udev/hwdb.bin</filename> if you want ship the compiled
database in an immutable image.
- During runtime only the binary database is used.</para>
+ During runtime, only the binary database is used.</para>
</refsect1>
<refsect1>
<literal>_KERNEL_DEVICE=</literal> match for the device.</para>
<para>Additional constraints may be added using options
- <option>--boot</option>, <option>--unit=</option>, etc, to
+ <option>--boot</option>, <option>--unit=</option>, etc., to
further limit what entries will be shown (logical AND).</para>
<para>Output is interleaved from all accessible journal files,
<option>-n1000</option> to guarantee that the pager will not
buffer logs of unbounded size. This may be overridden with
an explicit <option>-n</option> with some other numeric
- value while <option>-nall</option> will disable this cap.
+ value, while <option>-nall</option> will disable this cap.
Note that this option is only supported for the
<citerefentry project='man-pages'><refentrytitle>less</refentrytitle><manvolnum>1</manvolnum></citerefentry>
pager.</para></listitem>
or no more than the specified number of separate journal files
remain. Note that running <option>--vacuum-size=</option> has
only indirect effect on the output shown by
- <option>--disk-usage</option> as the latter includes active
+ <option>--disk-usage</option>, as the latter includes active
journal files, while the vacuuming operation only operates
on archived journal files. Similar,
<option>--vacuum-files=</option> might not actually reduce the
rotated journal files are kept as history.</para>
<para>Specify values in bytes or use K, M, G, T, P, E as
- units for the specified sizes (equal to 1024, 1024²,... bytes).
+ units for the specified sizes (equal to 1024, 1024², ... bytes).
Note that size limits are enforced synchronously when journal
files are extended, and no explicit rotation step triggered by
time is needed.</para>
individual journal files to keep at maximum. Note that only
archived files are deleted to reduce the number of files until
this limit is reached; active files will stay around. This
- means that in effect there might still be more journal files
+ means that, in effect, there might still be more journal files
around in total than this limit after a vacuuming operation is
complete. This setting defaults to 100.</para></listitem>
</varlistentry>
<literal>notice</literal>,
<literal>info</literal>,
<literal>debug</literal>,
- or integer values in the range of 0..7 (corresponding to the
+ or integer values in the range of 0–7 (corresponding to the
same levels). Messages equal or below the log level specified
are stored/forwarded, messages above are dropped. Defaults to
<literal>debug</literal> for <varname>MaxLevelStore=</varname>
<para>Furthermore, libudev also exports legacy APIs that should
not be used by new software (and as such are not documented as
- part of this manual). This includes the hardware-database known
+ part of this manual). This includes the hardware database known
as <constant>udev_hwdb</constant> (please use the new
<citerefentry><refentrytitle>sd-hwdb</refentrytitle><manvolnum>3</manvolnum></citerefentry>
API instead) and the <constant>udev_queue</constant> object to
- query the udev-daemon (which should not be used by new software
+ query the udev daemon (which should not be used by new software
at all).</para>
</refsect1>
<title>Description</title>
<para>The <filename>/etc/locale.conf</filename> file configures
- system-wide locale settings. It is read at early-boot by
+ system-wide locale settings. It is read at early boot by
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>.</para>
<para>The basic file format of <filename>locale.conf</filename> is
<listitem><para>Show terse runtime status information about
one or more sessions, followed by the most recent log data
from the journal. Takes one or more session identifiers as
- parameters. If no session identifiers are passed the status of
+ parameters. If no session identifiers are passed, the status of
the caller's session is shown. This function is intended to
generate human-readable output. If you are looking for
computer-parsable output, use <command>show-session</command>
<term><command>activate</command> <optional><replaceable>ID</replaceable></optional></term>
<listitem><para>Activate a session. This brings a session into
- the foreground, if another session is currently in the
+ the foreground if another session is currently in the
foreground on the respective seat. Takes a session identifier
- as argument. If no argument is specified the session of the
+ as argument. If no argument is specified, the session of the
caller is put into foreground.</para></listitem>
</varlistentry>
<listitem><para>Activates/deactivates the screen lock on one
or more sessions, if the session supports it. Takes one or
more session identifiers as arguments. If no argument is
- specified the session of the caller is locked/unlocked.
+ specified, the session of the caller is locked/unlocked.
</para></listitem>
</varlistentry>
<listitem><para>Show terse runtime status information about
one or more logged in users, followed by the most recent log
data from the journal. Takes one or more user names or numeric
- user IDs as parameters. If no parameters are passed the status
+ user IDs as parameters. If no parameters are passed, the status
of the caller's user is shown. This function is intended to
generate human-readable output. If you are looking for
computer-parsable output, use <command>show-user</command>
spawned for the user at boot and kept around after logouts.
This allows users who are not logged in to run long-running
services. Takes one or more user names or numeric UIDs as
- argument. If no argument is specified enables/disables
+ argument. If no argument is specified, enables/disables
lingering for the user of the session of the caller.
</para></listitem>
</varlistentry>
seat. The devices should be specified via device paths in the
<filename>/sys</filename> file system. To create a new seat,
attach at least one graphics card to a previously unused seat
- name. Seat names may consist only of a-z, A-Z, 0-9,
+ name. Seat names may consist only of a–z, A–Z, 0–9,
<literal>-</literal> and <literal>_</literal> and must be
prefixed with <literal>seat</literal>. To drop assignment of a
device to a specific seat, just reassign it to a different
<literal>tablet</literal>,
<literal>handset</literal>,
<literal>watch</literal>, and
- <literal>embedded</literal>
+ <literal>embedded</literal>,
as well as the special chassis types
<literal>vm</literal> and
<literal>container</literal> for
</itemizedlist>
<para>Machines are identified by names that follow the same rules
- as UNIX and DNS host names, for details see below. Machines are
- instantiated from disk or file system images, that frequently but not
- necessarily carry the same name as machines running from
+ as UNIX and DNS host names, for details, see below. Machines are
+ instantiated from disk or file system images that frequently — but not
+ necessarily — carry the same name as machines running from
them. Images in this sense are considered:</para>
<itemizedlist>
<varlistentry>
<term><option>--mkdir</option></term>
- <listitem><para>When used with <command>bind</command> creates
+ <listitem><para>When used with <command>bind</command>, creates
the destination directory before applying the bind
mount.</para></listitem>
</varlistentry>
<varlistentry>
<term><option>--read-only</option></term>
- <listitem><para>When used with <command>bind</command> applies
+ <listitem><para>When used with <command>bind</command>, applies
a read-only bind mount.</para></listitem>
</varlistentry>
specify whether the image shall be verified before it is made
available. Takes one of <literal>no</literal>,
<literal>checksum</literal> and <literal>signature</literal>.
- If <literal>no</literal> no verification is done. If
- <literal>checksum</literal> is specified the download is
+ If <literal>no</literal>, no verification is done. If
+ <literal>checksum</literal> is specified, the download is
checked for integrity after transfer is complete, but no
signatures are verified. If <literal>signature</literal> is
specified, the checksum is verified and the images's signature
<term><option>--format=</option></term>
<listitem><para>When used with the <option>export-tar</option>
- or <option>export-raw</option> commands specifies the
+ or <option>export-raw</option> commands, specifies the
compression format to use for the resulting file. Takes one of
<literal>uncompressed</literal>, <literal>xz</literal>,
- <literal>gzip</literal>, <literal>bzip2</literal>. By default
+ <literal>gzip</literal>, <literal>bzip2</literal>. By default,
the format is determined automatically from the image file
name passed.</para></listitem>
</varlistentry>
image by the specified name in
<filename>/var/lib/machines/</filename> (and other search
paths, see below) and runs it. Use
- <command>list-images</command> (see below), for listing
+ <command>list-images</command> (see below) for listing
available container images to start.</para>
<para>Note that
<term><command>login</command> [<replaceable>NAME</replaceable>]</term>
<listitem><para>Open an interactive terminal login session in
- a container or on the local host. If an argument is supplied
+ a container or on the local host. If an argument is supplied,
it refers to the container machine to connect to. If none is
specified, or the container name is specified as the empty
string, or the special machine name <literal>.host</literal>
instead. This works similar to <command>login</command> but
immediately invokes a user process. This command runs the
specified executable with the specified arguments, or
- <filename>/bin/sh</filename> if none is specified. By default
+ <filename>/bin/sh</filename> if none is specified. By default,
opens a <literal>root</literal> shell, but by using
<option>--uid=</option>, or by prefixing the machine name with
a username and an <literal>@</literal> character, a different
environment variables for the executed process.</para>
<para>When using the <command>shell</command> command without
- arguments (thus invoking the executed shell or command on the
- local host) it is similar in many ways to a <citerefentry
+ arguments, (thus invoking the executed shell or command on the
+ local host), it is similar in many ways to a <citerefentry
project='die-net'><refentrytitle>su</refentrytitle><manvolnum>1</manvolnum></citerefentry>
- session, but unlike <command>su</command> completely isolates
+ session, but, unlike <command>su</command>, completely isolates
the new session from the originating session, so that it
shares no process or session properties, and is in a clean and
well-defined state. It will be tracked in a new utmp, login,
specified container. The first directory argument is the
source directory on the host, the second directory argument
is the destination directory in the container. When the
- latter is omitted the destination path in the container is
+ latter is omitted, the destination path in the container is
the same as the source path on the host. When combined with
- the <option>--read-only</option> switch a ready-only bind
+ the <option>--read-only</option> switch, a ready-only bind
mount is created. When combined with the
- <option>--mkdir</option> switch the destination path is first
+ <option>--mkdir</option> switch, the destination path is first
created before the mount is applied. Note that this option is
currently only supported for
<citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
<listitem><para>Copies files or directories from the host
system into a running container. Takes a container name,
followed by the source path on the host and the destination
- path in the container. If the destination path is omitted the
+ path in the container. If the destination path is omitted, the
same as the source path is used.</para></listitem>
</varlistentry>
<listitem><para>Copies files or directories from a container
into the host system. Takes a container name, followed by the
source path in the container the destination path on the host.
- If the destination path is omitted the same as the source path
+ If the destination path is omitted, the same as the source path
is used.</para></listitem>
</varlistentry>
</variablelist></refsect2>
directories and subvolumes in
<filename>/var/lib/machines/</filename> (and other search
paths, see below). Use <command>start</command> (see above) to
- run a container off one of the listed images. Note that by
- default containers whose name begins with a dot
+ run a container off one of the listed images. Note that, by
+ default, containers whose name begins with a dot
(<literal>.</literal>) are not shown. To show these too,
specify <option>--all</option>. Note that a special image
<literal>.host</literal> always implicitly exists and refers
<listitem><para>Removes one or more container or VM images.
The special image <literal>.host</literal>, which refers to
- the host's own directory tree may not be
+ the host's own directory tree, may not be
removed.</para></listitem>
</varlistentry>
<term><command>set-limit</command> [<replaceable>NAME</replaceable>] <replaceable>BYTES</replaceable></term>
<listitem><para>Sets the maximum size in bytes a specific
- container or VM image, or all images may grow up to on disk
+ container or VM image, or all images, may grow up to on disk
(disk quota). Takes either one or two parameters. The first,
optional parameter refers to a container or VM image name. If
- specified the size limit of the specified image is changed. If
- omitted the overall size limit of the sum of all images stored
+ specified, the size limit of the specified image is changed. If
+ omitted, the overall size limit of the sum of all images stored
locally is changed. The final argument specifies the size
limit in bytes, possibly suffixed by the usual K, M, G, T
units. If the size limit shall be disabled, specify
<literal>-</literal> as size.</para>
<para>Note that per-container size limits are only supported
- on btrfs file systems. Also note that if
+ on btrfs file systems. Also note that, if
<command>set-limit</command> is invoked without image
parameter, and <filename>/var/lib/machines</filename> is
empty, and the directory is not located on btrfs, a btrfs
loopback may later be readjusted with
<command>set-limit</command>, as well. If such a
loopback-mounted <filename>/var/lib/machines</filename>
- directory is used <command>set-limit</command> without image
+ directory is used, <command>set-limit</command> without image
name alters both the quota setting within the file system as
well as the loopback file and file system size
itself.</para></listitem>
<literal>https://</literal>, and must refer to a
<filename>.tar</filename>, <filename>.tar.gz</filename>,
<filename>.tar.xz</filename> or <filename>.tar.bz2</filename>
- archive file. If the local machine name is omitted it
+ archive file. If the local machine name is omitted, it
is automatically derived from the last component of the URL,
with its suffix removed.</para>
<para>The image is verified before it is made available,
unless <option>--verify=no</option> is specified. Verification
- is done via SHA256SUMS and SHA256SUMS.gpg files, that need to
+ is done via SHA256SUMS and SHA256SUMS.gpg files that need to
be made available on the same web server, under the same URL
as the <filename>.tar</filename> file, but with the last
component (the filename) of the URL replaced. With
- <option>--verify=checksum</option> only the SHA256 checksum
+ <option>--verify=checksum</option>, only the SHA256 checksum
for the file is verified, based on the
<filename>SHA256SUMS</filename> file. With
- <option>--verify=signature</option> the SHA256SUMS file is
+ <option>--verify=signature</option>, the SHA256SUMS file is
first verified with detached GPG signature file
<filename>SHA256SUMS.gpg</filename>. The public key for this
verification step needs to be available in
<para>The container image will be downloaded and stored in a
read-only subvolume in
- <filename>/var/lib/machines/</filename>, that is named after
+ <filename>/var/lib/machines/</filename> that is named after
the specified URL and its HTTP etag. A writable snapshot is
then taken from this subvolume, and named after the specified
local name. This behavior ensures that creating multiple
be a <filename>.qcow2</filename> or raw disk image, optionally
compressed as <filename>.gz</filename>,
<filename>.xz</filename>, or <filename>.bz2</filename>. If the
- local machine name is omitted it is automatically
+ local machine name is omitted, it is automatically
derived from the last component of the URL, with its suffix
removed.</para>
<listitem><para>Imports a TAR or RAW container or VM image,
and places it under the specified name in
<filename>/var/lib/machines/</filename>. When
- <command>import-tar</command> is used the file specified as
+ <command>import-tar</command> is used, the file specified as
first argument should be a tar archive, possibly compressed
with xz, gzip or bzip2. It will then be unpacked into its own
subvolume in <filename>/var/lib/machines</filename>. When
- <command>import-raw</command> is used the file should be a
+ <command>import-raw</command> is used, the file should be a
qcow2 or raw disk image, possibly compressed with xz, gzip or
bzip2. If the second argument (the resulting image name) is
- not specified it is automatically derived from the file
- name. If the file name is passed as <literal>-</literal> the
+ not specified, it is automatically derived from the file
+ name. If the file name is passed as <literal>-</literal>, the
image is read from standard input, in which case the second
argument is mandatory.</para>
<para>Similar as with <command>pull-tar</command>,
<command>pull-raw</command> the file system
<filename>/var/lib/machines.raw</filename> is increased in
- size of necessary and appropriate. Optionally the
+ size of necessary and appropriate. Optionally, the
<option>--read-only</option> switch may be used to create a
read-only container or VM image. No cryptographic validation
is done when importing the images.</para>
stores it in the specified file. The first parameter should be
a VM or container image name. The second parameter should be a
file path the TAR or RAW image is written to. If the path ends
- in <literal>.gz</literal> the file is compressed with gzip, if
- it ends in <literal>.xz</literal> with xz, and if it ends in
- <literal>.bz2</literal> with bzip2. If the path ends in
- neither the file is left uncompressed. If the second argument
- is missing the image is written to standard output. The
+ in <literal>.gz</literal>, the file is compressed with gzip, if
+ it ends in <literal>.xz</literal>, with xz, and if it ends in
+ <literal>.bz2</literal>, with bzip2. If the path ends in
+ neither, the file is left uncompressed. If the second argument
+ is missing, the image is written to standard output. The
compression may also be explicitly selected with the
<option>--format=</option> switch. This is in particular
useful if the second parameter is left unspecified.</para>
aborted with
<command>cancel-transfer</command>.</para>
- <para>Note that currently only directory and subvolume images
+ <para>Note that, currently, only directory and subvolume images
may be exported as TAR images, and only raw disk images as RAW
images.</para></listitem>
</varlistentry>
<title>Machine and Image Names</title>
<para>The <command>machinectl</command> tool operates on machines
- and images, whose names must be chosen following strict
+ and images whose names must be chosen following strict
rules. Machine names must be suitable for use as host names
following a conservative subset of DNS and UNIX/Linux
semantics. Specifically, they must consist of one or more
valid UTF-8, must be suitable as file names (hence not be the
single or double dot, and not include a slash), and may not
contain control characters. Since many operations search for an
- image by the name of a requested machine it is recommended to name
+ image by the name of a requested machine, it is recommended to name
images in the same strict fashion as machines.</para>
<para>A special image with the name <literal>.host</literal>
<para>Machine images are preferably stored in
<filename>/var/lib/machines/</filename>, but are also searched for
in <filename>/usr/local/lib/machines/</filename> and
- <filename>/usr/lib/machines/</filename>. For compatibility reasons
+ <filename>/usr/lib/machines/</filename>. For compatibility reasons,
the directory <filename>/var/lib/container/</filename> is
searched, too. Note that images stored below
<filename>/usr</filename> are always considered read-only. It is
# machinectl login Fedora-Cloud-Base-20141203-21</programlisting>
<para>This downloads the specified <filename>.raw</filename>
- image with verification disabled. Then a shell is opened in it
+ image with verification disabled. Then, a shell is opened in it
and a root password is set. Afterwards the shell is left, and
the machine started as system service. With the last command a
login prompt into the container is requested.</para>
<programlisting># machinectl shell --uid=lennart</programlisting>
- <para>This creates a new shell session on the local host, for
+ <para>This creates a new shell session on the local host for
the user ID <literal>lennart</literal>, in a <citerefentry
project='die-net'><refentrytitle>su</refentrytitle><manvolnum>1</manvolnum></citerefentry>-like
fashion.</para>
<para><command>nss-myhostname</command> is a plugin for the GNU
Name Service Switch (NSS) functionality of the GNU C Library
- (<command>glibc</command>) primarily providing hostname resolution
+ (<command>glibc</command>), primarily providing hostname resolution
for the locally configured system hostname as returned by
<citerefentry><refentrytitle>gethostname</refentrytitle><manvolnum>2</manvolnum></citerefentry>.
The precise hostnames resolved by this module are:</para>
time as changing the hostname. This is problematic since it
requires a writable <filename>/etc</filename> file system and is
fragile because the file might be edited by the administrator at
- the same time. With <command>nss-myhostname</command> enabled
+ the same time. With <command>nss-myhostname</command> enabled,
changing <filename>/etc/hosts</filename> is unnecessary, and on
- many systems the file becomes entirely optional.</para>
+ many systems, the file becomes entirely optional.</para>
<para>To activate the NSS modules, <literal>myhostname</literal>
has to be added to the line starting with
<title>Example</title>
<para>Here's an example <filename>/etc/nsswitch.conf</filename>
- file, that enables <command>myhostname</command> correctly:</para>
+ file that enables <command>myhostname</command> correctly:</para>
<programlisting>passwd: compat mymachines
group: compat mymachines
127.0.0.2 DGRAM
127.0.0.2 RAW</programlisting>
- <para>In this case the local hostname is <varname>omega</varname>.</para>
+ <para>In this case, the local hostname is <varname>omega</varname>.</para>
</refsect1>
<para><command>nss-mymachines</command> is a plugin for the GNU
Name Service Switch (NSS) functionality of the GNU C Library
- (<command>glibc</command>) providing hostname resolution for
- container names of containers running locally, that are registered
+ (<command>glibc</command>), providing hostname resolution for
+ container names of containers running locally that are registered
with
<citerefentry><refentrytitle>systemd-machined.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
The container names are resolved to the IP addresses of the
near the end of the <filename>nsswitch.conf</filename> lines to
make sure that its mappings are only used as fallback, and any
other mappings, such as DNS or <filename>/etc/hosts</filename>
- based mappings take precedence.</para>
+ based mappings, take precedence.</para>
</refsect1>
<refsect1>
<title>Example</title>
<para>Here's an example <filename>/etc/nsswitch.conf</filename>
- file, that enables <command>mymachines</command> correctly:</para>
+ file that enables <command>mymachines</command> correctly:</para>
<programlisting>passwd: compat <command>mymachines</command>
group: compat <command>mymachines</command>
<title>Example</title>
<para>Here's an example <filename>/etc/nsswitch.conf</filename>
- file, that enables <command>resolve</command> correctly:</para>
+ file that enables <command>resolve</command> correctly:</para>
<programlisting>passwd: compat mymachines
group: compat mymachines
without implementing a shell compatible execution engine. Variable
assignment values must be enclosed in double or single quotes if
they include spaces, semicolons or other special characters
- outside of A-Z, a-z, 0-9. Shell special characters ("$", quotes,
+ outside of A–Z, a–z, 0–9. Shell special characters ("$", quotes,
backslash, backtick) must be escaped with backslashes, following
shell style. All strings should be in UTF-8 format, and
non-printable characters should not be used. It is not supported
<term><varname>ID=</varname></term>
<listitem><para>A lower-case string (no spaces or other
- characters outside of 0-9, a-z, ".", "_" and "-") identifying
+ characters outside of 0–9, a–z, ".", "_" and "-") identifying
the operating system, excluding any version information and
suitable for processing by scripts or usage in generated
filenames. If not set, defaults to
<term><varname>VERSION_ID=</varname></term>
<listitem><para>A lower-case string (mostly numeric, no spaces
- or other characters outside of 0-9, a-z, ".", "_" and "-")
+ or other characters outside of 0–9, a–z, ".", "_" and "-")
identifying the operating system version, excluding any OS
name information or release code name, and suitable for
processing by scripts or usage in generated filenames. This
<listitem><para>
A lower-case string (no spaces or other characters outside of
- 0-9, a-z, ".", "_" and "-"), identifying a specific variant or
+ 0–9, a–z, ".", "_" and "-"), identifying a specific variant or
edition of the operating system. This may be interpreted by
other packages in order to determine a divergent default
configuration. This field is optional and may not be
as <constant>AF_UNIX</constant> sockets, FIFOs, PID files and
similar. It is guaranteed that this directory is local and
offers the greatest possible file system feature set the
- operating system provides. For further details see the <ulink
+ operating system provides. For further details
, see the <ulink
url="http://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html">XDG
Base Directory Specification</ulink>.</para></listitem>
</varlistentry>
<varlistentry>
<term><varname>DNS=</varname></term>
- <listitem><para>A space separated list of IPv4 and IPv6
+ <listitem><para>A space-separated list of IPv4 and IPv6
addresses to be used as system DNS servers. DNS requests are
sent to one of the listed DNS servers in parallel to any
per-interface DNS servers acquired from
<citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
- For compatibility reasons, if set to the empty list the DNS
+ For compatibility reasons, if set to the empty list, the DNS
servers listed in <filename>/etc/resolv.conf</filename> are
used, if any are configured there. This setting defaults to
the empty list.</para></listitem>
<varlistentry>
<term><varname>FallbackDNS=</varname></term>
- <listitem><para>A space separated list of IPv4 and IPv6
+ <listitem><para>A space-separated list of IPv4 and IPv6
addresses to be used as the fallback DNS servers. Any
per-interface DNS servers obtained from
<citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
<literal>resolve</literal>. Controls Link-Local Multicast Name
Resolution support (<ulink
url="https://tools.ietf.org/html/rfc4795">RFC 4794</ulink>) on
- the local host. If true enables full LLMNR responder and
- resolver support. If false disable both. If set to
- <literal>resolve</literal> only resolving support is enabled,
+ the local host. If true, enables full LLMNR responder and
+ resolver support. If false, disable both. If set to
+ <literal>resolve</literal>, only resolving support is enabled,
but responding is disabled. Note that
<citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
also maintains per-interface LLMNR settings. LLMNR will be
<title>Description</title>
<para>In addition to the error names user programs define, D-Bus
- knows a number of generic, standardized error names, that are
+ knows a number of generic, standardized error names that are
listed below.</para>
- <para>In addition to this list, in sd-bus the special error
+ <para>In addition to this list, in sd-bus, the special error
namespace <literal>System.Error.</literal> is used to map
arbitrary Linux system errors (as defined by <citerefentry
project='man-pages'><refentrytitle>errno</refentrytitle><manvolnum>3</manvolnum></citerefentry>)
<varlistentry>
<term><varname>SD_BUS_ERROR_IO_ERROR</varname></term>
<listitem><para>Generic input/output error, for example when
- accessing a socket or other IO context.</para></listitem>
+ accessing a socket or other I/O context.</para></listitem>
</varlistentry>
<varlistentry>
<term><varname>SD_BUS_ERROR_BAD_ADDRESS</varname></term>
</varlistentry>
<varlistentry>
<term><varname>SD_BUS_ERROR_ACCESS_DENIED</varname></term>
- <listitem><para>Access to a resource has been denied, due to security restrictions.</para></listitem>
+ <listitem><para>Access to a resource has been denied due to security restrictions.</para></listitem>
</varlistentry>
<varlistentry>
<term><varname>SD_BUS_ERROR_AUTH_FAILED</varname></term>
<varlistentry>
<term><varname>SD_BUS_ERROR_INTERACTIVE_AUTHORIZATION_REQUIRED</varname></term>
<listitem><para>Access to the requested operation is not
- permitted, however, it might be available after interactive
+ permitted. However, it might be available after interactive
authentication. This is usually returned by method calls
supporting a framework for additional interactive
authorization, when interactive authorization was not enabled
the systemd unit name (in the system instance of systemd) that the
process is part of. See
<citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>. For
- processes that are not part of a unit returns -ENXIO.
+ processes that are not part of a unit, returns -ENXIO.
</para>
<para><function>sd_bus_creds_get_user_unit()</function> will
retrieve the systemd unit name (in the user instance of systemd)
that the process is part of. See
<citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>. For
- processes that are not part of a user unit returns -ENXIO.
+ processes that are not part of a user unit, returns -ENXIO.
</para>
<para><function>sd_bus_creds_get_slice()</function> will retrieve
retrieve the identifier of the login session that the process is
part of. See
<citerefentry><refentrytitle>systemd-logind.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>. For
- processes that are not part of a session returns -ENXIO.
+ processes that are not part of a session, returns -ENXIO.
</para>
<para><function>sd_bus_creds_get_owner_uid()</function> will
retrieve the numeric UID (user identifier) of the user who owns
the login session that the process is part of. See
<citerefentry><refentrytitle>systemd-logind.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
- For processes that are not part of a session returns -ENXIO.
+ For processes that are not part of a session, returns -ENXIO.
</para>
<para><function>sd_bus_creds_has_effective_cap()</function> will
subset of fields requested in <parameter>creds_mask</parameter>.
</para>
- <para>Similar to <function>sd_bus_creds_get_mask()</function> the
+ <para>Similar to <function>sd_bus_creds_get_mask()</function>, the
function <function>sd_bus_creds_get_augmented_mask()</function>
returns a bitmask of field constants. The mask indicates which
credential fields have been retrieved in a non-atomic fashion. For
credential objects created via
- <function>sd_bus_creds_new_from_pid()</function> this mask will be
+ <function>sd_bus_creds_new_from_pid()</function>, this mask will be
identical to the mask returned by
<function>sd_bus_creds_get_mask()</function>. However, for
credential objects retrieved via
- <function>sd_bus_get_name_creds()</function> this mask will be set
+ <function>sd_bus_get_name_creds()</function>, this mask will be set
for the credential fields that could not be determined atomically
at peer connection time, and which were later added by reading
augmenting credential data from
<filename>/proc</filename>. Similar, for credential objects
- retrieved via <function>sd_bus_get_owner_creds()</function> the
+ retrieved via <function>sd_bus_get_owner_creds()</function>, the
mask is set for the fields that could not be determined atomically
at bus creation time, but have been augmented. Similar, for
credential objects retrieved via
- <function>sd_bus_message_get_creds()</function> the mask is set
+ <function>sd_bus_message_get_creds()</function>, the mask is set
for the fields that could not be determined atomically at message
send time, but have been augmented. The mask returned by
<function>sd_bus_creds_get_augmented_mask()</function> is always a
object. The latter call hence returns all credential fields
available in the credential object, the former then marks the
subset of those that have been augmented. Note that augmented
- fields are unsuitable for authorization decisions as they may be
- retrieved at different times, thus being subject to races. Hence
+ fields are unsuitable for authorization decisions, as they may be
+ retrieved at different times, thus being subject to races. Hence,
augmented fields should be used exclusively for informational
purposes.
</para>
connection object to the user bus when invoked in user context, or
to the system bus otherwise. The connection object is associated
with the calling thread. Each time the function is invoked from
- the same thread the same object is returned, but its reference
+ the same thread, the same object is returned, but its reference
count is increased by one, as long as at least one reference is
kept. When the last reference to the connection is dropped (using
the
call), the connection is terminated. Note that the connection is
not automatically terminated when the associated thread ends. It
is important to drop the last reference to the bus connection
- explicitly before the thread ends or otherwise the connection will
+ explicitly before the thread ends, or otherwise, the connection will
be leaked. Also, queued but unread or unwritten messages keep the
bus referenced, see below.</para>
connects to the system bus. In contrast to
<function>sd_bus_default()</function>,
<function>sd_bus_default_user()</function>,
- <function>sd_bus_default_system()</function> these calls return
+ <function>sd_bus_default_system()</function>, these calls return
new, independent connection objects that are not associated with
the invoking thread and are not shared between multiple
invocations. It is recommended to share connections per thread to
<para>Queued but unwritten/unread messages also keep a reference
to their bus connection object. For this reason, even if an
- application dropped all references to a bus connection it might
- not get destroyed right-away. Until all incoming queued
+ application dropped all references to a bus connection, it might
+ not get destroyed right away. Until all incoming queued
messages are read, and until all outgoing unwritten messages are
written, the bus object will stay
alive. <function>sd_bus_flush()</function> may be used to write
all outgoing queued messages so they drop their references. To
- flush the unread incoming messages use
+ flush the unread incoming messages, use
<function>sd_bus_close()</function>, which will also close the bus
- connection. When using the default bus logic it is a good idea to
+ connection. When using the default bus logic, it is a good idea to
first invoke <function>sd_bus_flush()</function> followed by
<function>sd_bus_close()</function> when a thread or process
terminates, and thus its bus connection object should be
freed.</para>
- <para>The life-cycle of the default bus connection should be the
+ <para>The life cycle of the default bus connection should be the
responsibility of the code that creates/owns the thread the
default bus connection object is associated with. Library code
should neither call <function>sd_bus_flush()</function> nor
<function>sd_bus_close()</function> on default bus objects unless
it does so in its own private, self-allocated thread. Library code
should not use the default bus object in other threads unless it
- is clear that the program using it will life-cycle the bus
+ is clear that the program using it will life cycle the bus
connection object and flush and close it before exiting from the
thread. In libraries where it is not clear that the calling
- program will life-cycle the bus connection object it is hence
+ program will life cycle the bus connection object, it is hence
recommended to use <function>sd_bus_open_system()</function>
instead of <function>sd_bus_default_system()</function> and
related calls.</para>
<citerefentry><refentrytitle>sd-bus-errors</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
but additional domain-specific errors may be defined by
applications. The <structfield>message</structfield> field usually
- contains a human readable string describing the details, but might
+ contains a human-readable string describing the details, but might
be NULL. An unset <structname>sd_bus_error</structname> structure
should have both fields initialized to NULL. Set an error
structure to <constant>SD_BUS_ERROR_NULL</constant> in order to
for a list of well-known error names. Additional error mappings
may be defined with
<citerefentry><refentrytitle>sd_bus_error_add_map</refentrytitle><manvolnum>3</manvolnum></citerefentry>. If
- <parameter>e</parameter> is NULL no error structure is initialized
+ <parameter>e</parameter> is NULL, no error structure is initialized,
but the error is still converted into an
<varname>errno</varname>-style error. If
<parameter>name</parameter> is <constant>NULL</constant>, it is
assumed that no error occurred, and 0 is returned. This means that
this function may be conveniently used in a
<function>return</function> statement. If
- <parameter>message</parameter> is NULL no message is set. This
+ <parameter>message</parameter> is NULL, no message is set. This
call can fail if no memory may be allocated for the name and
message strings, in which case an
<constant>SD_BUS_ERROR_NO_MEMORY</constant> error might be set
instead and -ENOMEM returned. Do not use this call on error
structures that are already initialized. If you intend to reuse an
- error structure free the old data stored in it with
+ error structure, free the old data stored in it with
<function>sd_bus_error_free()</function> first.</para>
<para><function>sd_bus_error_setf()</function> is similar to
are not copied internally, and must hence remain constant and
valid for the lifetime of <parameter>e</parameter>. Use this call
to avoid memory allocations when setting error structures. Since
- this call does not allocate memory it will not fail with an
- out-of-memory condition, as
+ this call does not allocate memory, it will not fail with an
+ out-of-memory condition as
<function>sd_bus_error_set()</function> can, as described
above. Alternatively, the
<constant>SD_BUS_ERROR_MAKE_CONST()</constant> macro may be used
<parameter>format</parameter> and the arguments.</para>
<para><function>sd_bus_error_set_errnofv()</function> is similar to
- <function>sd_bus_error_set_errnof()</function> but takes the
+ <function>sd_bus_error_set_errnof()</function>, but takes the
format string parameters as <citerefentry
project='man-pages'><refentrytitle>va_arg</refentrytitle><manvolnum>3</manvolnum></citerefentry>
parameter list.</para>
<title>Reference ownership</title>
<para><structname>sd_bus_error</structname> is not reference
counted. Users should destroy resources held by it by calling
- <function>sd_bus_error_free()</function>. Usually error structures
+ <function>sd_bus_error_free()</function>. Usually, error structures
are allocated on the stack or passed in as function parameters,
but they may also be allocated dynamically, in which case it is
the duty of the caller to <citerefentry
<citerefentry><refentrytitle>sd_bus_error_set</refentrytitle><manvolnum>3</manvolnum></citerefentry>
or
<citerefentry><refentrytitle>sd_bus_error_get_errno</refentrytitle><manvolnum>3</manvolnum></citerefentry>. By
- default a number of generic, standardized mappings are known, as
+ default, a number of generic, standardized mappings are known, as
documented in
<citerefentry><refentrytitle>sd-bus-errors</refentrytitle><manvolnum>3</manvolnum></citerefentry>. Use
this call to add further, application-specific mappings.</para>
entire remaining runtime of the process.</para>
<para>The mapping array should be put together with a series of
- <constant>SD_BUS_ERROR_MAP()</constant> macro invocations, that
+ <constant>SD_BUS_ERROR_MAP()</constant> macro invocations that
take a literal name string and a (positive)
<varname>errno</varname>-style error number. The last entry of the
array should be an invocation of the
appends a sequence of fields to the D-Bus message object
<parameter>m</parameter>. The type string
<parameter>types</parameter> describes the types of the field
- arguments that follow. For each type specified in the type string
+ arguments that follow. For each type specified in the type string,
one or more arguments need to be specified, in the same order as
declared in the type string.</para>
process. Not all protocol transports support passing memory file
descriptors between participants, in which case this call will
automatically fall back to copying. Also, as memory file
- descriptor passing is inefficient for smaller amounts of data
+ descriptor passing is inefficient for smaller amounts of data,
copying might still be enforced even where memory file descriptor
passing is supported.</para>
function appends an array of a trivial type to the message
<parameter>m</parameter>, similar to
<function>sd_bus_message_append_array()</function>. Contents of
- the IO vector array <parameter>iov</parameter> are used as the
+ the I
/O vector array <parameter>iov</parameter> are used as the
contents of the array. The total size of
<parameter>iov</parameter> payload (the sum of
<structfield>iov_len</structfield> fields) must be a multiple of
the size of the type <parameter>type</parameter>. The
<parameter>iov</parameter> argument must point to
- <parameter>n</parameter> IO vector structures. Each structure may
+ <parameter>n</parameter> I/O vector structures. Each structure may
have the <structname>iov_base</structname> field set, in which
case the memory pointed to will be copied into the message, or
unset (set to zero), in which case a block of zeros of length
<parameter>p</parameter>. The caller should subsequently write the
array contents to this memory. Modifications of the memory
pointed to should only occur until the next operation on the bus
- message is invoked, most importantly the memory should not be
+ message is invoked. Most importantly, the memory should not be
altered anymore when another field has been added to the message
or the message has been sealed.</para>
</refsect1>
<citerefentry><refentrytitle>sd_bus_message_get_realtime_usec</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
<citerefentry><refentrytitle>sd_bus_message_get_seqnum</refentrytitle><manvolnum>3</manvolnum></citerefentry>
to query the timestamps of incoming messages. If negotiation is
- disabled or not supported these calls will fail with
+ disabled or not supported, these calls will fail with
<constant>-ENODATA</constant>. Note that not all transports
support timestamping of messages. Specifically, timestamping is
only available on the kdbus transport, but not on dbus1. The
<citerefentry><refentrytitle>sd_bus_start</refentrytitle><manvolnum>3</manvolnum></citerefentry>. Both
<function>sd_bus_negotiate_timestamp()</function> and
<function>sd_bus_negotiate_creds()</function> may also be called
- after a connection has been set up. Note that when operating on a
+ after a connection has been set up. Note that, when operating on a
connection that is shared between multiple components of the same
program (for example via
<citerefentry><refentrytitle>sd_bus_default</refentrytitle><manvolnum>3</manvolnum></citerefentry>)
or a related call, and then start the connection with
<citerefentry><refentrytitle>sd_bus_start</refentrytitle><manvolnum>3</manvolnum></citerefentry>.</para>
- <para>In most cases it's a better idea to invoke
+ <para>In most cases, it's a better idea to invoke
<citerefentry><refentrytitle>sd_bus_default_user</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
<citerefentry><refentrytitle>sd_bus_default_system</refentrytitle><manvolnum>3</manvolnum></citerefentry>
or related calls instead of the more low-level
<para><function>sd_bus_path_encode_many()</function> works like
its counterpart <function>sd_bus_path_encode()</function>, but
- takes a path-template as argument and encodes multiple labels
+ takes a path template as argument and encodes multiple labels
according to its embedded directives. For each
<literal>%</literal> character found in the template, the caller
- must provide a string via var-args, which will be encoded and
+ must provide a string via varargs, which will be encoded and
embedded at the position of the <literal>%</literal> character.
Any other character in the template is copied verbatim into the
encoded path.</para>
<para><function>sd_bus_path_decode_many()</function> does the
reverse of <function>sd_bus_path_encode_many()</function>. It
- decodes the passed object path, according to the given
- path-template. For each <literal>%</literal> character in the
+ decodes the passed object path according to the given
+ path template. For each <literal>%</literal> character in the
template, the caller must provide an output storage
- (<literal>char **</literal>) via var-args. The decoded label
+ (<literal>char **</literal>) via varargs. The decoded label
will be stored there. Each <literal>%</literal> character will
only match the current label. It will never match across labels.
Furthermore, only a single such directive is allowed per label.
<function>sd_event_default()</function>, then releasing it, and
then acquiring a new one with
<function>sd_event_default()</function> will result in two
- distinct objects. Note that in order to free an event loop object,
+ distinct objects. Note that, in order to free an event loop object,
all remaining event sources of the event loop also need to be
freed as each keeps a reference to it.</para>
</refsect1>
<para><function>sd_event_run()</function> can be used to run one
iteration of the event loop of libsystemd. This function waits
- until an event to process is available and dispatches a handler
+ until an event to process is available, and dispatches a handler
for it. Parameter <parameter>timeout</parameter> specifices the
maximum time (in microseconds) to wait. <constant>(uint64_t)
-1</constant> may be used to specify an infinite timeout.</para>
</variablelist>
- <para>Other errors are possible too.</para>
+ <para>Other errors are possible, too.</para>
</refsect1>
<refsect1>
<para>On success, these functions return 0 or a positive integer.
On failure, they return a negative errno-style error code. In case
of <function>sd_event_prepare</function> and
- <function>sd_event_wait</function> a positive value means that
+ <function>sd_event_wait</function>, a positive value means that
events are ready to be processed and 0 means that no events are
- ready. In case of <function>sd_event_dispatch</function> a
+ ready. In case of <function>sd_event_dispatch</function>, a
positive value means that the loop is again in the initial state
- and 0 means the loop is finished. For any of those functions, a
+ and 0 means the loop is finished. For any of these functions, a
negative return value means the loop must be aborted.</para>
</refsect1>
</variablelist>
- <para>Other errors are possible too.</para>
+ <para>Other errors are possible, too.</para>
</refsect1>
<refsect1>
and
<citerefentry><refentrytitle>sd_journal_get_data</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
Matches are of the form <literal>FIELD=value</literal>, where the
- field part is a short uppercase string consisting only of 0-9, A-Z
+ field part is a short uppercase string consisting only of 0–9, A–Z
and the underscore. It may not begin with two underscores or be
the empty string. The value part may be any value, including
binary. If a match is applied, only entries with this field set
<function>sd_journal_get_data()</function> or
<function>sd_journal_enumerate_data()</function>, or the read
pointer is altered. Note that the data returned will be prefixed
- with the field name and '='. Also note that by default data fields
+ with the field name and '='. Also note that, by default, data fields
larger than 64K might get truncated to 64K. This threshold may be
changed and turned off with
<function>sd_journal_set_data_threshold()</function> (see
<para><function>sd_journal_open()</function> opens the log journal
for reading. It will find all journal files automatically and
interleave them automatically when reading. As first argument it
- takes a pointer to a <varname>sd_journal</varname> pointer, which
- on success will contain a journal context object. The second
+ takes a pointer to a <varname>sd_journal</varname> pointer, which,
+ on success, will contain a journal context object. The second
argument is a flags field, which may consist of the following
flags ORed together: <constant>SD_JOURNAL_LOCAL_ONLY</constant>
makes sure only journal files generated on the local machine will
be ignored.) The value can be of any size and format. It is highly
recommended to submit text strings formatted in the UTF-8
character encoding only, and submit binary fields only when
- formatting in UTF-8 strings is not sensible. A number of well
- known fields are defined, see
+ formatting in UTF-8 strings is not sensible. A number of
+ well-known fields are defined, see
<citerefentry><refentrytitle>systemd.journal-fields</refentrytitle><manvolnum>7</manvolnum></citerefentry>
for details, but additional application defined fields may be
used. A variable may be assigned more than one value per
<para><function>sd_journal_perror()</function> is a similar to
<citerefentry project='die-net'><refentrytitle>perror</refentrytitle><manvolnum>3</manvolnum></citerefentry>
and writes a message to the journal that consists of the passed
- string, suffixed with ": " and a human readable representation of
+ string, suffixed with ": " and a human-readable representation of
the current error code stored in
<citerefentry project='man-pages'><refentrytitle>errno</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
If the message string is passed as <constant>NULL</constant> or
daemon to check for file descriptors passed by the service manager as
part of the socket-based activation logic. It returns the number
of received file descriptors. If no file descriptors have been
- received zero is returned. The first file descriptor may be found
+ received, zero is returned. The first file descriptor may be found
at file descriptor number 3
(i.e. <constant>SD_LISTEN_FDS_START</constant>), the remaining
descriptors follow at 4, 5, 6, ..., if any.</para>
passed file descriptors to avoid further inheritance to children
of the calling process.</para>
- <para>If multiple socket units activate the same service the order
+ <para>If multiple socket units activate the same service, the order
of the file descriptors passed to its main process is undefined.
If additional file descriptors have been passed to the service
manager using
variables are no longer inherited by child processes.</para>
<para><function>sd_listen_fds_with_names()</function> is like
- <function>sd_listen_fds()</function> but optionally also returns
+ <function>sd_listen_fds()</function>, but optionally also returns
an array of strings with identification names for the passed file
- descriptors, if that is available, and the
+ descriptors, if that is available and the
<parameter>names</parameter> parameter is non-NULL. This
information is read from the <varname>$LISTEN_FDNAMES</varname>
variable, which may contain a colon-separated list of names. For
files, see
<citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>
for details. For file descriptors pushed into the file descriptor
- store (see above) the name is set via the
+ store (see above), the name is set via the
<varname>FDNAME=</varname> field transmitted via
<function>sd_pid_notify_with_fds()</function>. The primary usecase
for these names are services which accept a variety of file
terminating the array. The caller needs to free the array itself
and each of its elements with libc's <function>free()</function>
call after use. If the <parameter>names</parameter> parameter is
- NULL the call is entirely equivalent to
+ NULL, the call is entirely equivalent to
<function>sd_listen_fds()</function>.</para>
- <para>Under specific conditions the following automatic file
+ <para>Under specific conditions, the following automatic file
descriptor names are returned:
<table>
<para><function>sd_notify()</function> may be called by a service
to notify the service manager about state changes. It can be used
to send arbitrary information, encoded in an
- environment-block-like string. Most importantly it can be used for
+ environment-block-like string. Most importantly, it can be used for
start-up completion notification.</para>
<para>If the <parameter>unset_environment</parameter> parameter is
to the service manager that describes the service state. This
is free-form and can be used for various purposes: general
state feedback, fsck-like programs could pass completion
- percentages and failing programs could pass a human readable
+ percentages and failing programs could pass a human-readable
error message. Example: <literal>STATUS=Completed 66% of file
system check...</literal></para></listitem>
</varlistentry>
<term>FDNAME=...</term>
<listitem><para>When used in combination with
- <varname>FDSTORE=1</varname> specifies a name for the
+ <varname>FDSTORE=1</varname>, specifies a name for the
submitted file descriptors. This name is passed to the service
during activation, and may be queried using
<citerefentry><refentrytitle>sd_listen_fds_with_names</refentrytitle><manvolnum>3</manvolnum></citerefentry>. File
descriptors submitted without this field set, will implicitly
- get the name <literal>stored</literal> assigned. Note that if
- multiple file descriptors are submitted at once the specified
+ get the name <literal>stored</literal> assigned. Note that, if
+ multiple file descriptors are submitted at once, the specified
name will be assigned to all of them. In order to assign
different names to submitted file descriptors, submit them in
seperate invocations of
consist of any ASCII characters, but must not contain control
characters or <literal>:</literal>. It may not be longer than
255 characters. If a submitted name does not follow these
- restrictions it is ignored.</para></listitem>
+ restrictions, it is ignored.</para></listitem>
</varlistentry>
</variablelist>
use as originating PID for the message as first argument. This is
useful to send notification messages on behalf of other processes,
provided the appropriate privileges are available. If the PID
- argument is specified as 0 the process ID of the calling process
+ argument is specified as 0, the process ID of the calling process
is used, in which case the calls are fully equivalent to
<function>sd_notify()</function> and
<function>sd_notifyf()</function>.</para>
<para>To store an open file descriptor in the service manager,
in order to continue operation after a service restart without
- losing state use <literal>FDSTORE=1</literal>:</para>
+ losing state, use <literal>FDSTORE=1</literal>:</para>
<programlisting>sd_pid_notify_with_fds(0, 0, "FDSTORE=1\nFDNAME=foobar", &fd, 1);</programlisting>
</example>
not all processes are part of a login session (e.g. system service
processes, user processes that are shared between multiple
sessions of the same user, or kernel threads). For processes not
- being part of a login session this function will fail with
+ being part of a login session, this function will fail with
-ENODATA. The returned string needs to be freed with the libc
<citerefentry
project='man-pages'><refentrytitle>free</refentrytitle><manvolnum>3</manvolnum></citerefentry>
unit name is a short string, suitable for usage in file system
paths. Note that not all processes are part of a system
unit/service (e.g. user processes, or kernel threads). For
- processes not being part of a systemd system unit this function
- will fail with -ENODATA (More specifically: this call will not
+ processes not being part of a systemd system unit, this function
+ will fail with -ENODATA. (More specifically, this call will not
work for kernel threads.) The returned string needs to be freed
with the libc <citerefentry
project='man-pages'><refentrytitle>free</refentrytitle><manvolnum>3</manvolnum></citerefentry>
<para><function>sd_pid_get_user_unit()</function> may be used to
determine the systemd user unit (i.e. user service or scope unit)
identifier of a process identified by the specified PID. This is
- similar to <function>sd_pid_get_unit()</function> but applies to
+ similar to <function>sd_pid_get_unit()</function>, but applies to
user units instead of system units.</para>
<para><function>sd_pid_get_owner_uid()</function> may be used to
multiple login sessions of the same user, where
<function>sd_pid_get_session()</function> will fail. For processes
not being part of a login session and not being a shared process
- of a user this function will fail with -ENODATA.</para>
+ of a user, this function will fail with -ENODATA.</para>
<para><function>sd_pid_get_machine_name()</function> may be used
to determine the name of the VM or container is a member of. The
paths. The returned string needs to be freed with the libc
<citerefentry
project='man-pages'><refentrytitle>free</refentrytitle><manvolnum>3</manvolnum></citerefentry>
- call after use. For processes not part of a VM or containers this
+ call after use. For processes not part of a VM or containers, this
function fails with -ENODATA.</para>
<para><function>sd_pid_get_slice()</function> may be used to
group path of the specified process, relative to the root of the
hierarchy. Returns the path without trailing slash, except for
processes located in the root control group, where "/" is
- returned. To find the actual control group path in the file system
+ returned. To find the actual control group path in the file system,
the returned path needs to be prefixed with
<filename>/sys/fs/cgroup/</filename> (if the unified control group
setup is used), or
systemd-41.</para>
<para><function>sd_watchdog_enabled()</function> function was
- added in systemd-209. Since that version the
+ added in systemd-209. Since that version, the
<varname>$WATCHDOG_PID</varname> variable is also set.</para>
</refsect1>
<para>Default configuration is defined during compilation, so a
configuration file is only needed when it is necessary to deviate
- from those defaults. By default the configuration file in
+ from those defaults. By default, the configuration file in
<filename>/etc/systemd/</filename> contains commented out entries
showing the defaults as a guide to the administrator. This file
can be edited to create local overrides.
</programlisting>
<para>This method applies settings when the module is
- loaded. Please note that unless the <filename>br_netfilter</filename>
+ loaded. Please note that, unless the <filename>br_netfilter</filename>
module is loaded, bridged packets will not be filtered by
netfilter (starting with kernel 3.18), so simply not loading the
module is suffient to avoid filtering.</para>
</programlisting>
<para>This method forces the module to be always loaded. Please
- note that unless the <filename>br_netfilter</filename> module is
+ note that, unless the <filename>br_netfilter</filename> module is
loaded, bridged packets will not be filtered with netfilter
(starting with kernel 3.18), so simply not loading the module is
suffient to avoid filtering.</para>
<para>Properties for units vary by unit type, so showing any
unit (even a non-existent one) is a way to list properties
- pertaining to this type. Similarly showing any job will list
+ pertaining to this type. Similarly, showing any job will list
properties pertaining to all jobs. Properties for units are
documented in
<citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
<!-- we do not document -failed here, as it has been made
redundant by -state=failed, which it predates. To keep
- things simple we only document the new switch, while
+ things simple, we only document the new switch, while
keeping the old one around for compatibility only. -->
<varlistentry>
<listitem>
<para>When used with <command>kill</command>, choose which
signal to send to selected processes. Must be one of the
- well known signal specifiers such as <constant>SIGTERM</constant>, <constant>SIGINT</constant> or
+ well-known signal specifiers such as <constant>SIGTERM</constant>, <constant>SIGINT</constant> or
<constant>SIGSTOP</constant>. If omitted, defaults to
<option>SIGTERM</option>.</para>
</listitem>
<para>This function is intended to generate human-readable
output. If you are looking for computer-parsable output,
- use <command>show</command> instead. By default this
+ use <command>show</command> instead. By default, this
function only shows 10 lines of output and ellipsizes
lines to fit in the terminal window. This can be changes
with <option>--lines</option> and <option>--full</option>,
starting any of the units being enabled. If this
is desired, either <option>--now</option> should be used
together with this command, or an additional <command>start</command>
- command must be invoked for the unit. Also note that in case of
+ command must be invoked for the unit. Also note that, in case of
instance enablement, symlinks named the same as instances
are created in the install location, however they all point to the
same template unit file.</para>
<para>Depending on whether <option>--system</option> (the default),
<option>--user</option>, or <option>--global</option> is specified,
this creates a drop-in file for each unit either for the system,
- for the calling user or for all futures logins of all users. Then,
+ for the calling user, or for all futures logins of all users. Then,
the editor (see the "Environment" section below) is invoked on
temporary files which will be written to the real location if the
editor exits successfully.</para>
be made temporarily in <filename>/run</filename> and they will be
lost on the next reboot.</para>
- <para>If the temporary file is empty upon exit the modification of
- the related unit is canceled</para>
+ <para>If the temporary file is empty upon exit, the modification of
+ the related unit is canceled.</para>
<para>After the units have been edited, systemd configuration is
reloaded (in a way that is equivalent to <command>daemon-reload</command>).
<para>Note that this command cannot be used to remotely edit units
and that you cannot temporarily edit units which are in
- <filename>/etc</filename> since they take precedence over
+ <filename>/etc</filename>, since they take precedence over
<filename>/run</filename>.</para>
</listitem>
</varlistentry>
<para>Switches to a different root directory and executes a
new system manager process below it. This is intended for
usage in initial RAM disks ("initrd"), and will transition
- from the initrd's system manager process (a.k.a "init"
+ from the initrd's system manager process (a.k.a. "init"
process) to the main system manager process. This call takes two
arguments: the directory that is to become the new root directory, and
the path to the new system manager binary below it to
<title>Description</title>
<para><command>systemd-activate</command> can be used to
- launch a socket activated daemon from the command line for
+ launch a socket-activated daemon from the command line for
testing purposes. It can also be used to launch single instances
of the daemon per connection (inetd-style).
</para>
</example>
<example>
- <title>Run a socket activated instance of <citerefentry><refentrytitle>systemd-journal-gatewayd</refentrytitle><manvolnum>8</manvolnum></citerefentry></title>
+ <title>Run a socket-activated instance of <citerefentry><refentrytitle>systemd-journal-gatewayd</refentrytitle><manvolnum>8</manvolnum></citerefentry></title>
<programlisting>$ /usr/lib/systemd/systemd-activate -l 19531 /usr/lib/systemd/systemd-journal-gatewayd</programlisting>
</example>
<replaceable>TARGET</replaceable></command> changes the current log
target of the <command>systemd</command> daemon to
<replaceable>TARGET</replaceable> (accepts the same values as
- <option>--log-target=</option> described in
+ <option>--log-target=</option>, described in
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>).</para>
<para><command>systemd-analyze verify</command> will load unit
cache for the password. If set, then the tool will try to push
any collected passwords into the kernel keyring of the root
user, as a key of the specified name. If combined with
- <option>--accept-cached</option> it will also try to retrieve
+ <option>--accept-cached</option>, it will also try to retrieve
the such cached passwords from the key in the kernel keyring
- instead of querying the user right-away. By using this option
+ instead of querying the user right away. By using this option,
the kernel keyring may be used as effective cache to avoid
repeatedly asking users for passwords, if there are multiple
objects that may be unlocked with the same password. The
<refsect1>
<title>Description</title>
- <para><filename>systemd-binfmt.service</filename> is an early-boot
+ <para><filename>systemd-binfmt.service</filename> is an early boot
service that registers additional binary formats for executables
in the kernel.</para>
and logging startup information in the background.
</para>
<para>
- After collecting a certain amount of data (usually 15-30
+ After collecting a certain amount of data (usually 15–30
seconds, default 20 s) the logging stops and a graph is
generated from the logged information. This graph contains vital
clues as to which resources are being used, in which order, and
<term><emphasis>Started as a standalone program</emphasis></term>
<listitem><para>One can execute
<command>systemd-bootchart</command> as normal application
- from the command line. In this mode it is highly recommended
+ from the command line. In this mode, it is highly recommended
to pass the <option>-r</option> flag in order to not graph the
time elapsed since boot and before systemd-bootchart was
started, as it may result in extremely large graphs. The time
<term><option>--freq <replaceable>f</replaceable></option></term>
<listitem><para>Specify the sample log frequency, a positive
real <replaceable>f</replaceable>, in Hz. Most systems can
- cope with values up to 25-50 without creating too much
+ cope with values up to 25–50 without creating too much
overhead.</para></listitem>
</varlistentry>
<citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
Defaults to <literal>info</literal>. Note that this simply
controls the default, individual lines may be logged with
- different levels if they are prefixed accordingly. For details
+ different levels if they are prefixed accordingly. For details,
see <option>--level-prefix=</option> below.</para></listitem>
</varlistentry>
<term><option>-r</option></term>
<term><option>--raw</option></term>
- <listitem><para>Format byte counts (as in memory usage and IO metrics)
+ <listitem><para>Format byte counts (as in memory usage and I/O metrics)
with raw numeric values rather than human-readable
numbers.</para></listitem>
</varlistentry>
<term><option>--cpu=time</option></term>
<listitem><para>Controls whether the CPU usage is shown as
- percentage or time. By default the CPU usage is shown as
+ percentage or time. By default, the CPU usage is shown as
percentage. This setting may also be toggled at runtime by
pressing the <keycap>%</keycap> key.</para></listitem>
</varlistentry>
<term><option>-P</option></term>
<listitem><para>Count only userspace processes instead of all
- tasks. By default all tasks are counted: each kernel thread
- and each userspace thread individually. With this setting
+ tasks. By default, all tasks are counted: each kernel thread
+ and each userspace thread individually. With this setting,
kernel threads are excluded from the counting and each
userspace process only counts as one, regardless how many
threads it consists of. This setting may also be toggled at
<term><option>-k</option></term>
<listitem><para>Count only userspace processes and kernel
- threads instead of all tasks. By default all tasks are
+ threads instead of all tasks. By default, all tasks are
counted: each kernel thread and each userspace thread
- individually. With this setting kernel threads are included in
+ individually. With this setting, kernel threads are included in
the counting and each userspace process only counts as on one,
regardless how many threads it consists of. This setting may
also be toggled at runtime by pressing the <keycap>k</keycap>
for a control group shall include all processes that are
contained in any of the child control groups as well. Takes a
boolean argument, defaults to <literal>yes</literal>. If
- enabled the processes in child control groups are included, if
- disabled only the processes in the control group itself are
+ enabled, the processes in child control groups are included, if
+ disabled, only the processes in the control group itself are
counted. This setting may also be toggled at runtime by
pressing the <keycap>r</keycap> key. Note that this setting
only applies to process counting, i.e. when the
<term><keycap>i</keycap></term>
<listitem><para>Sort the control groups by path, number of
- tasks, CPU load, memory usage, or IO load, respectively. This
+ tasks, CPU load, memory usage, or I/O load, respectively. This
setting may also be controlled using the
<option>--order=</option> command line
switch.</para></listitem>
in <citerefentry project='man-pages'><refentrytitle>core</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
In particular, the coredump will only be processed when the
related resource limits are high enough. For programs started by
- <command>systemd</command> those may be set using
+ <command>systemd</command>, those may be set using
<varname>LimitCore=</varname> (see
<citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>).
</para>
system and the initrd.</para>
<para>If /etc/crypttab contains entries with the same UUID,
then the name, keyfile and options specified there will be
- used. Otherwise the device will have the name
+ used. Otherwise, the device will have the name
<literal>luks-UUID</literal>.</para>
<para>If /etc/crypttab exists, only those UUIDs
specified on the kernel command line
directories which contain "drop-in" files with configuration
snippets which augment the main configuration file. "Drop-in"
files can be overridden in the same way by placing files with the
- same name in a directory of higher priority (except that in case
+ same name in a directory of higher priority (except that, in case
of "drop-in" files, both the "drop-in" file name and the name of
the containing directory, which corresponds to the name of the
main configuration file, must match). For a fuller explanation,
technology and can distinguish full VM virtualization from
container virtualization. <filename>systemd-detect-virt</filename>
exits with a return value of 0 (success) if a virtualization
- technology is detected, and non-zero (error) otherwise. By default
+ technology is detected, and non-zero (error) otherwise. By default,
any type of virtualization is detected, and the options
<option>--container</option> and <option>--vm</option> can be used
to limit what types of virtualization are detected.</para>
<listitem><para>Detect whether invoked in a
<citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry>
- environment. In this mode no output is written, but the return
+ environment. In this mode, no output is written, but the return
value indicates whether the process was invoked in a
<function>chroot()</function>
environment or not.</para></listitem>
and will process them individually, one after the other. It will
output them separated by spaces to stdout.</para>
- <para>By default this command will escape the strings passed,
+ <para>By default, this command will escape the strings passed,
unless <option>--unescape</option> is passed which results in the
inverse operation being applied. If <option>--mangle</option> a
special mode of escaping is applied instead, which assumes a
copied from a host system that is used to set up the system
image.</para>
- <para>If a setting is already initialized it will not be
+ <para>If a setting is already initialized, it will not be
overwritten and the user will not be prompted for the
setting.</para>
directly on the command line,
<option>--root-password-file=</option> reads it from a file.
Note that it is not recommended specifying passwords on the
- command line as other users might be able to see them simply
+ command line, as other users might be able to see them simply
by invoking
<citerefentry project='die-net'><refentrytitle>ps</refentrytitle><manvolnum>1</manvolnum></citerefentry>.</para></listitem>
</varlistentry>
<varname>mount.usr=</varname> will default to the value set in
<varname>root=</varname>.</para>
- <para>Otherwise this parameter defaults to the
+ <para>Otherwise, this parameter defaults to the
<filename>/usr</filename> entry found in
<filename>/etc/fstab</filename> on the root filesystem.</para>
<varname>mount.usrfstype=</varname> will default to the value
set in <varname>rootfstype=</varname>.</para>
- <para>Otherwise this value will be read from the
+ <para>Otherwise, this value will be read from the
<filename>/usr</filename> entry in
<filename>/etc/fstab</filename> on the root filesystem.</para>
<varname>mount.usrflags=</varname> will default to the value
set in <varname>rootflags=</varname>.</para>
- <para>Otherwise this value will be read from the
+ <para>Otherwise, this value will be read from the
<filename>/usr</filename> entry in
<filename>/etc/fstab</filename> on the root filesystem.</para>
</table>
<para>The <filename>/home</filename> and <filename>/srv</filename>
- partitions may be encrypted in LUKS format. In this case a device
+ partitions may be encrypted in LUKS format. In this case, a device
mapper device is set up under the names
<filename>/dev/mapper/home</filename> and
<filename>/dev/mapper/srv</filename>. Note that this might create
device name.</para>
<para>Mount and automount units for the EFI System Partition (ESP),
- mounting it to <filename>/boot</filename> are generated on EFI
- systems, where the boot loader communicates the used ESP to the operating
+ mounting it to <filename>/boot</filename>, are generated on EFI
+ systems where the boot loader communicates the used ESP to the operating
system. Since this generator creates an automount unit, the mount will
only be activated on-demand, when accessed. On systems where
<filename>/boot</filename> is an explicitly configured mount
<programlisting>openssl req -newkey rsa:2048 -days 3650 -x509 -nodes \
-out ca.pem -keyout ca.key -subj '/CN=Certificate authority/'
-cat >ca.conf <<EOF
+cat >ca.conf <<EOF
[ ca ]
default_ca = this
EOF
touch index
-echo 0001 > serial
+echo 0001 >serial
SERVER=server
CLIENT=client
<varname>ServerCertificateFile=</varname>,
<varname>ServerKeyFile=</varname>, in
<filename>/etc/systemd/journal-remote.conf</filename> and
- <filename>/etc/systemd/journal-upload.conf</filename>
+ <filename>/etc/systemd/journal-upload.conf</filename>,
respectively. The default locations can be queried by using
<command>systemd-journal-remote --help</command> and
<command>systemd-journal-upload --help</command>.</para>
<title>Description</title>
<para><filename>systemd-machine-id-commit.service</filename> is an
- early-boot service responsible for committing transient
+ early boot service responsible for committing transient
<filename>/etc/machine-id</filename> files to a writable disk file
system. See
<citerefentry><refentrytitle>machine-id</refentrytitle><manvolnum>5</manvolnum></citerefentry>
<para>The main use case of this service are systems where
<filename>/etc/machine-id</filename> is read-only and initially
- not initialized. In this case the system manager will generate a
+ not initialized. In this case, the system manager will generate a
transient machine ID file on a memory file system, and mount it
over <filename>/etc/machine-id</filename>, during the early boot
phase. This service is then invoked in a later boot phase, as soon
for more information about this file.</para>
<para>If the tool is invoked without the <option>--commit</option>
- switch <filename>/etc/machine-id</filename> is initialized with a
+ switch, <filename>/etc/machine-id</filename> is initialized with a
valid, new machined ID if it is missing or empty. The new machine
ID will be acquired in the following fashion:</para>
VM.</para></listitem>
<listitem><para>Similar, if run inside a Linux container
- environment and a UUID is configured for the container this is
- used to initialize the machine ID. For details see the
+ environment and a UUID is configured for the container, this is
+ used to initialize the machine ID. For details, see the
documentation of the <ulink
url="http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface">Container
Interface</ulink>.</para></listitem>
- <listitem><para>Otherwise a new ID is randomly
+ <listitem><para>Otherwise, a new ID is randomly
generated.</para></listitem>
</orderedlist>
<para>This command is primarily used by the
<citerefentry><refentrytitle>systemd-machine-id-commit.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
- early-boot service.</para></listitem>
+ early boot service.</para></listitem>
</varlistentry>
<xi:include href="standard-options.xml" xpointer="help" />
<title>Description</title>
<para><filename>systemd-modules-load.service</filename> is an
- early-boot service that loads kernel modules based on static
+ early boot service that loads kernel modules based on static
configuration.</para>
<para>See
<varlistentry>
<term><option>--ignore=</option></term>
<listitem><para>Network interfaces to be ignored when deciding
- if the system is online. By default only the loopback
+ if the system is online. By default, only the loopback
interface is ignored. This option may be used more than once
to ignore multiple network interfaces. </para></listitem>
</varlistentry>
<para><command>systemd-notify</command> may be called by daemon
scripts to notify the init system about status changes. It can be
used to send arbitrary information, encoded in an
- environment-block-like list of strings. Most importantly it can be
+ environment-block-like list of strings. Most importantly, it can be
used for start-up completion notification.</para>
<para>This is mostly just a wrapper around
<varlistentry>
<term><option>--private-users=</option></term>
- <listitem><para>Enables user namespacing. If enabled the
+ <listitem><para>Enables user namespacing. If enabled, the
container will run with its own private set of Unix user and
group ids (UIDs and GIDs). Takes none, one or two
colon-separated parameters: the first parameter specifies the
assigned. If the first parameter is also omitted (and hence
no parameter passed at all), the first UID assigned to the
container is read from the owner of the root directory of the
- container's directory tree. By default no user namespacing is
+ container's directory tree. By default, no user namespacing is
applied.</para>
<para>Note that user namespacing currently requires OS trees
<para>It is recommended to assign as least 65536 UIDs to each
container, so that the usable UID range in the container
- covers 16bit. For best security do not assign overlapping UID
+ covers 16 bit. For best security, do not assign overlapping UID
ranges to multiple containers. It is hence a good idea to use
- the upper 16bit of the host 32bit UIDs as container
- identifier, while the lower 16bit encode the container UID
+ the upper 16 bit of the host 32-bit UIDs as container
+ identifier, while the lower 16 bit encode the container UID
used.</para>
- <para>When user namespaces are used the GID range assigned to
+ <para>When user namespaces are used, the GID range assigned to
each container is always chosen identical to the UID
range.</para></listitem>
</varlistentry>
<term><option>--bind-ro=</option></term>
<listitem><para>Bind mount a file or directory from the host
- into the container. Takes one of: a path argument -- in which
+ into the container. Takes one of: a path argument — in which
case the specified path will be mounted from the host to the
- same path in the container --, or a colon-separated pair of
- paths -- in which case the first specified path is the source
+ same path in the container —, or a colon-separated pair of
+ paths — in which case the first specified path is the source
in the host, and the second path is the destination in the
- container --, or a colon-separated triple of source path,
- destination path and mount options. Mount options are comma
- separated and currently only "rbind" and "norbind"
- are allowed. Defaults to "rbind". Backslash escapes are interpreted so
+ container —, or a colon-separated triple of source path,
+ destination path and mount options. Mount options are
+ comma-separated and currently, only "rbind" and "norbind"
+ are allowed. Defaults to "rbind". Backslash escapes are interpreted, so
<literal>\:</literal> may be used to embed colons in either path.
This option may be specified multiple times for
creating multiple independent bind mount points. The
mount the tmpfs instance to (in which case the directory
access mode will be chosen as 0755, owned by root/root), or
optionally a colon-separated pair of path and mount option
- string, that is used for mounting (in which case the kernel
+ string that is used for mounting (in which case the kernel
default for access mode and owner will be chosen, unless
otherwise specified). This option is particularly useful for
mounting directories such as <filename>/var</filename> as
tmpfs, to allow state-less systems, in particular when
combined with <option>--read-only</option>.
- Backslash escapes are interpreted in the path so
+ Backslash escapes are interpreted in the path, so
<literal>\:</literal> may be used to embed colons in the path.
</para></listitem>
</varlistentry>
overlay file system. The left-most path is hence the lowest
directory tree, the second-to-last path the highest directory
tree in the stacking order. If <option>--overlay-ro=</option>
- is used instead of <option>--overlay=</option> a read-only
+ is used instead of <option>--overlay=</option>, a read-only
overlay file system is created. If a writable overlay file
- system is created all changes made to it are written to the
+ system is created, all changes made to it are written to the
highest directory tree in the stacking order, i.e. the
second-to-last specified.</para>
<listitem><para>Boots the container in volatile mode. When no
mode parameter is passed or when mode is specified as
- <option>yes</option> full volatile mode is enabled. This
+ <option>yes</option>, full volatile mode is enabled. This
means the root directory is mounted as mostly unpopulated
<literal>tmpfs</literal> instance, and
<filename>/usr</filename> from the OS tree is mounted into it,
read-only (the system thus starts up with read-only OS
resources, but pristine state and configuration, any changes
to the either are lost on shutdown). When the mode parameter
- is specified as <option>state</option> the OS tree is
+ is specified as <option>state</option>, the OS tree is
mounted read-only, but <filename>/var</filename> is mounted as
<literal>tmpfs</literal> instance into it (the system thus
starts up with read-only OS resources and configuration, but
pristine state, any changes to the latter are lost on
shutdown). When the mode parameter is specified as
- <option>no</option> (the default) the whole OS tree is made
+ <option>no</option> (the default), the whole OS tree is made
available writable.</para>
<para>Note that setting this to <option>yes</option> or
special values <option>override</option> or
<option>trusted</option>.</para>
- <para>If enabled (the default) a settings file named after the
+ <para>If enabled (the default), a settings file named after the
machine (as specified with the <option>--machine=</option>
setting, or derived from the directory or image file name)
with the suffix <filename>.nspawn</filename> is searched in
<filename>/etc/systemd/nspawn/</filename> and
<filename>/run/systemd/nspawn/</filename>. If it is found
there, its settings are read and used. If it is not found
- there it is subsequently searched in the same directory as the
+ there, it is subsequently searched in the same directory as the
image file or in the immediate parent of the root directory of
- the container. In this case, if the file is found its settings
+ the container. In this case, if the file is found, its settings
will be also read and used, but potentially unsafe settings
- are ignored. Note that in both these cases settings on the
+ are ignored. Note that in both these cases, settings on the
command line take precedence over the corresponding settings
from loaded <filename>.nspawn</filename> files, if both are
specified. Unsafe settings are considered all settings that
elevate the container's privileges or grant access to
additional resources such as files or directories of the
host. For details about the format and contents of
- <filename>.nspawn</filename> files consult
+ <filename>.nspawn</filename> files, consult
<citerefentry><refentrytitle>systemd.nspawn</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
- <para>If this option is set to <option>override</option> the
- file is searched, read and used the same way, however the order of
+ <para>If this option is set to <option>override</option>, the
+ file is searched, read and used the same way, however, the order of
precedence is reversed: settings read from the
<filename>.nspawn</filename> file will take precedence over
the corresponding command line options, if both are
specified.</para>
- <para>If this option is set to <option>trusted</option> the
+ <para>If this option is set to <option>trusted</option>, the
file is searched, read and used the same way, but regardless
if found in <filename>/etc/systemd/nspawn/</filename>,
<filename>/run/systemd/nspawn/</filename> or next to the image
file or container root directory, all settings will take
- effect, however command line arguments still take precedence
+ effect, however, command line arguments still take precedence
over corresponding settings.</para>
- <para>If disabled no <filename>.nspawn</filename> file is read
+ <para>If disabled, no <filename>.nspawn</filename> file is read
and no settings except the ones on the command line are in
effect.</para></listitem>
</varlistentry>
<citerefentry><refentrytitle>file-hierarchy</refentrytitle><manvolnum>7</manvolnum></citerefentry>
queriable.</para>
- <para>When invoked without arguments a list of known paths and
+ <para>When invoked without arguments, a list of known paths and
their current values is shown. When at least one argument is
- passed the path with this name is queried and its value shown.
+ passed, the path with this name is queried and its value shown.
The variables whose name begins with <literal>search-</literal>
don't refer to individual paths, but instead to a list of
colon-separated search paths, in their order of precedence.</para>
<title>Description</title>
<para><filename>systemd-random-seed.service</filename> is a
- service that restores the random seed of the system at early-boot
+ service that restores the random seed of the system at early boot
and saves it at shutdown. See
<citerefentry><refentrytitle>random</refentrytitle><manvolnum>4</manvolnum></citerefentry>
for details. Saving/restoring the random seed across boots
<title>Description</title>
<para><filename>systemd-remount-fs.service</filename> is an
- early-boot service that applies mount options listed in
+ early boot service that applies mount options listed in
<citerefentry project='man-pages'><refentrytitle>fstab</refentrytitle><manvolnum>5</manvolnum></citerefentry>
to the root file system, the <filename>/usr</filename> file system,
and the kernel API file systems. This is required so that the
<citerefentry><refentrytitle>resolved.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
and
<citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>
- for details. To improve compatibility
+ for details. To improve compatibility,
<filename>/etc/resolv.conf</filename> is read in order to discover
configured system DNS servers, however only if it is not a symlink
to <filename>/run/systemd/resolve/resolv.conf</filename> (see above).</para>
<para>If lookups are routed to multiple interfaces, the first
successful response is returned (thus effectively merging the
lookup zones on all matching interfaces). If the lookup failed on
- all interfaces the last failing response is returned.</para>
+ all interfaces, the last failing response is returned.</para>
<para>Routing of lookups may be influenced by configuring
- per-interface domain names, see
+ per-interface domain names. See
<citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>
for details. Lookups for a hostname ending in one of the
per-interface domains are exclusively routed to the matching
and thus shows up in the output of <command>systemctl
list-units</command> like any other unit. It will run in a clean
and detached execution environment, with the service manager as
- its parent process. In this mode <command>systemd-run</command>
+ its parent process. In this mode, <command>systemd-run</command>
will start the service asynchronously in the background and return
after the command has begun execution.</para>
<para>The following command invokes the
<citerefentry project='man-pages'><refentrytitle>updatedb</refentrytitle><manvolnum>8</manvolnum></citerefentry>
- tool, but lowers the block IO weight for it to 10. See
+ tool, but lowers the block I/O weight for it to 10. See
<citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
for more information on the <varname>BlockIOWeight=</varname>
property.</para>
<refsect1>
<title>Description</title>
- <para><filename>systemd-sysctl.service</filename> is an early-boot
+ <para><filename>systemd-sysctl.service</filename> is an early boot
service that configures
<citerefentry project='man-pages'><refentrytitle>sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>
kernel parameters.</para>
specified in
<citerefentry><refentrytitle>sysusers.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>
are searched for a matching file. If the string
- <filename>-</filename> is specified as filenames entries from the
+ <filename>-</filename> is specified as filenames, entries from the
standard input of the process are read.</para>
</refsect1>
<term><option>--event-timeout=</option></term>
<listitem>
<para>Set the number of seconds to wait for events to finish. After
- this time the event will be terminated. The default is 180 seconds.</para>
+ this time, the event will be terminated. The default is 180 seconds.</para>
</listitem>
</varlistentry>
<para><filename>systemd-user-sessions.service</filename> is a
service that controls user logins through
<citerefentry project='man-pages'><refentrytitle>pam_nologin</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
- After basic system initialization is complete it removes
+ After basic system initialization is complete, it removes
<filename>/run/nologin</filename>, thus permitting logins. Before
- system shutdown it creates <filename>/run/nologin</filename>, thus
+ system shutdown, it creates <filename>/run/nologin</filename>, thus
prohibiting further logins.</para>
</refsect1>
<title>Description</title>
<para><filename>systemd-vconsole-setup.service</filename> is an
- early-boot service that configures the virtual console font and
+ early boot service that configures the virtual console font and
console keymap. Internally it calls
<citerefentry project='mankier'><refentrytitle>loadkeys</refentrytitle><manvolnum>1</manvolnum></citerefentry>
and
<listitem><para>Takes an absolute directory path, or the
special value <literal>~</literal>. Sets the working directory
- for executed processes. If set to <literal>~</literal> the
+ for executed processes. If set to <literal>~</literal>, the
home directory of the user specified in
<varname>User=</varname> is used. If not set, defaults to the
root directory when systemd is running as a system instance
<listitem><para>Sets the supplementary Unix groups the
processes are executed as. This takes a space-separated list
of group names or IDs. This option may be specified more than
- once in which case all listed groups are set as supplementary
- groups. When the empty string is assigned the list of
+ once, in which case all listed groups are set as supplementary
+ groups. When the empty string is assigned, the list of
supplementary groups is reset, and all assignments prior to
this one will have no effect. In any way, this option does not
override, but extends the list of supplementary groups
<varlistentry>
<term><varname>IOSchedulingClass=</varname></term>
- <listitem><para>Sets the IO scheduling class for executed
+ <listitem><para>Sets the I/O scheduling class for executed
processes. Takes an integer between 0 and 3 or one of the
strings <option>none</option>, <option>realtime</option>,
<option>best-effort</option> or <option>idle</option>. See
<varlistentry>
<term><varname>IOSchedulingPriority=</varname></term>
- <listitem><para>Sets the IO scheduling priority for executed
+ <listitem><para>Sets the I/O scheduling priority for executed
processes. Takes an integer between 0 (highest priority) and 7
(lowest priority). The available priorities depend on the
- selected IO scheduling class (see above). See
+ selected I/O scheduling class (see above). See
<citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
for details.</para></listitem>
</varlistentry>
processes. Takes a list of CPU indices or ranges separated by
either whitespace or commas. CPU ranges are specified by the
lower and upper CPU indices separated by a dash.
- This option may be specified more than once in which case the
+ This option may be specified more than once, in which case the
specified CPU affinity masks are merged. If the empty string
is assigned, the mask is reset, all assignments prior to this
will have no effect. See
<listitem><para>Sets environment variables for executed
processes. Takes a space-separated list of variable
- assignments. This option may be specified more than once in
+ assignments. This option may be specified more than once, in
which case all listed variables will be set. If the same
variable is set twice, the later setting will override the
earlier setting. If the empty string is assigned to this
different log level which can be used to override the default
log level specified here. The interpretation of these prefixes
may be disabled with <varname>SyslogLevelPrefix=</varname>,
- see below. For details see
+ see below. For details, see
<citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
Defaults to
of what <varname>Capabilities=</varname> does. If this option
is not used, the capability bounding set is not modified on
process execution, hence no limits on the capabilities of the
- process are enforced. This option may appear more than once in
+ process are enforced. This option may appear more than once, in
which case the bounding sets are merged. If the empty string
is assigned to this option, the bounding set is reset to the
empty capability set, and all prior settings have no effect.
<option>no-setuid-fixup-locked</option>,
<option>noroot</option>, and
<option>noroot-locked</option>.
- This option may appear more than once in which case the secure
+ This option may appear more than once, in which case the secure
bits are ORed. If the empty string is assigned to this option,
the bits are reset to 0. See
<citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
inaccessible for processes inside the namespace. Note that
restricting access with these options does not extend to
submounts of a directory that are created later on. These
- options may be specified more than once in which case all
+ options may be specified more than once, in which case all
directories listed will have limited access from within the
namespace. If the empty string is assigned to this option, the
specific list is reset, and all prior assignments have no
directories read-only for processes invoked by this unit. If
set to <literal>full</literal>, the <filename>/etc</filename>
directory is mounted read-only, too. This setting ensures that
- any modification of the vendor supplied operating system (and
+ any modification of the vendor-supplied operating system (and
optionally its configuration) is prohibited for the service.
It is recommended to enable this setting for all long-running
services, unless they are involved with system updates or need
<literal>login</literal> is set, first an
<constant>INIT_PROCESS</constant> entry, followed by an
<constant>LOGIN_PROCESS</constant> entry is generated. In
- this case the invoked process must implement a <citerefentry
+ this case, the invoked process must implement a <citerefentry
project='die-net'><refentrytitle>login</refentrytitle><manvolnum>1</manvolnum></citerefentry>-compatible
utmp/wtmp logic. If <literal>user</literal> is set, first an
<constant>INIT_PROCESS</constant> entry, then a
<constant>LOGIN_PROCESS</constant> entry and finally an
<constant>USER_PROCESS</constant> entry is generated. In this
- case the invoked process may be any process that is suitable
+ case, the invoked process may be any process that is suitable
to be run as session leader. Defaults to
<literal>init</literal>.</para></listitem>
</varlistentry>
<listitem><para>Takes a <option>SMACK64</option> security
label as argument. The process executed by the unit will be
started under this label and SMACK will decide whether the
- process is allowed to run or not based on it. The process
+ process is allowed to run or not, based on it. The process
will continue to run under the label specified here unless the
executable has its own <option>SMACK64EXEC</option> label, in
which case the process will transition to run under that
<function>sigreturn</function>,
<function>exit_group</function>, <function>exit</function>
system calls are implicitly whitelisted and do not need to be
- listed explicitly. This option may be specified more than once
+ listed explicitly. This option may be specified more than once,
in which case the filter masks are merged. If the empty string
is assigned, the filter is reset, all prior assignments will
have no effect.</para>
<varlistentry>
<term><varname>SystemCallArchitectures=</varname></term>
- <listitem><para>Takes a space separated list of architecture
+ <listitem><para>Takes a space-separated list of architecture
identifiers to include in the system call filter. The known
architecture identifiers are <constant>x86</constant>,
<constant>x86-64</constant>, <constant>x32</constant>,
<filename>/dev/null</filename> or an empty file can be used to
mask a generator, thereby preventing it from running. Please note
that the order of the two directories with the highest priority is
- reversed with respect to the unit load path and generators in
+ reversed with respect to the unit load path, and generators in
<filename>/run</filename> overwrite those in
<filename>/etc</filename>.</para>
<para>
Generators should only be used to generate unit files, not
any other kind of configuration. Due to the lifecycle
- logic mentioned above generators are not a good fit to
+ logic mentioned above, generators are not a good fit to
generate dynamic configuration for other services. If you
- need to generate dynamic configuration for other services
+ need to generate dynamic configuration for other services,
do so in normal services you order before the service in
question.
</para>
<para>
Since
<citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
- is not available (see above) log messages have to be
+ is not available (see above), log messages have to be
written to <filename>/dev/kmsg</filename> instead.
</para>
</listitem>
Generators may write out dynamic unit files or just hook
unit files into other units with the usual
<filename>.wants/</filename> or
- <filename>.requires/</filename> symlinks. Often it is
+ <filename>.requires/</filename> symlinks. Often, it is
nicer to simply instantiate a template unit file from
<filename>/usr</filename> with a generator instead of
- writing out entirely dynamic unit files. Of course this
+ writing out entirely dynamic unit files. Of course, this
works only if a single parameter is to be used.
</para>
</listitem>
<listitem>
<para>
- If you are careful you can implement generators in shell
+ If you are careful, you can implement generators in shell
scripts. We do recommend C code however, since generators
delay are executed synchronously and hence delay the
entire boot if they are slow.
temporarily redirects <filename>default.target</filename> to
<filename>system-update.target</filename> if a system update is
scheduled. Since this needs to override the default user
- configuration for <filename>default.target</filename> it uses
+ configuration for <filename>default.target</filename>, it uses
argv[2]. For details about this logic, see
<ulink url="http://www.freedesktop.org/wiki/Software/systemd/SystemUpdates">Implementing
Offline System Updates</ulink>.</para>
<citerefentry project='man-pages'><refentrytitle>signal</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
Defaults to <constant>SIGTERM</constant>. </para>
- <para>Note that right after sending the signal specified in
- this setting systemd will always send
+ <para>Note that, right after sending the signal specified in
+ this setting, systemd will always send
<constant>SIGCONT</constant>, to ensure that even suspended
tasks can be terminated cleanly.</para>
</listitem>
name in <filename>/usr/lib</filename>. This can be used to
override a system-supplied link file with a local file if needed.
As a special case, an empty file (file size 0) or symlink with the
- same name pointing to <filename>/dev/null</filename>, disable the
+ same name pointing to <filename>/dev/null</filename> disable the
configuration file entirely (it is "masked").</para>
<para>The link file contains a <literal>[Match]</literal> section,
generated which is guaranteed to be the same on every
boot for the given machine and the given device, but
which is otherwise random. This feature depends on ID_NET_NAME_*
- properties existing for the link, on hardware where these
- properties are not set the generation of a persistent MAC address
+ properties existing for the link. On hardware where these
+ properties are not set, the generation of a persistent MAC address
will fail.</para>
</listitem>
</varlistentry>
<para>If the kernel is using a random MAC address,
nothing is done. Otherwise, a new address is randomly
generated each time the device appears, typically at
- boot. Either way the random address will have the
+ boot. Either way, the random address will have the
<literal>unicast</literal> and
<literal>locally administered</literal> bits set.</para>
</listitem>
<varlistentry>
<term><option>nofail</option></term>
- <listitem><para>With <option>nofail</option> this mount will
+ <listitem><para>With <option>nofail</option>, this mount will
be only wanted, not required, by
<filename>local-fs.target</filename> or
<filename>remote-fs.target</filename>. This means that the
name in <filename>/usr/lib</filename>. This can be used to
override a system-supplied configuration file with a local file if
needed. As a special case, an empty file (file size 0) or symlink
- with the same name pointing to <filename>/dev/null</filename>,
+ with the same name pointing to <filename>/dev/null</filename>
disable the configuration file entirely (it is "masked").</para>
</refsect1>
<term><varname>TTL=</varname></term>
<listitem>
<para>A fixed Time To Live N on Virtual eXtensible Local
- Area Network packets. N is a number in the range 1-255. 0
+ Area Network packets. N is a number in the range 1–255. 0
is a special value meaning that packets inherit the TTL
value.</para>
</listitem>
<term><varname>FDBAgeingSec=</varname></term>
<listitem>
<para>The lifetime of Forwarding Database entry learnt by
- the kernel in seconds.</para>
+ the kernel, in seconds.</para>
</listitem>
</varlistentry>
<varlistentry>
<varlistentry>
<term><varname>RouteShortCircuit=</varname></term>
<listitem>
- <para>A boolean. When true route short circuit is turned
+ <para>A boolean. When true, route short circuit is turned
on.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>UDPCheckSum=</varname></term>
<listitem>
- <para>A boolean. When true transmitting UDP checksums when doing VXLAN/IPv4 is turned on.</para>
+ <para>A boolean. When true, transmitting UDP checksums when doing VXLAN/IPv4 is turned on.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>UDP6ZeroChecksumTx=</varname></term>
<listitem>
- <para>A boolean. When true sending zero checksums in VXLAN/IPv6 is turned on.</para>
+ <para>A boolean. When true, sending zero checksums in VXLAN/IPv6 is turned on.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>UDP6ZeroCheckSumRx=</varname></term>
<listitem>
- <para>A boolean. When true receiving zero checksums in VXLAN/IPv6 is turned on.</para>
+ <para>A boolean. When true, receiving zero checksums in VXLAN/IPv6 is turned on.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>GroupPolicyExtension=</varname></term>
<listitem>
- <para>A boolean. When true it enables Group Policy VXLAN extension security label mechanism
- across network peers based on VXLAN. For details about the Group Policy VXLAN see the
+ <para>A boolean. When true, it enables Group Policy VXLAN extension security label mechanism
+ across network peers based on VXLAN. For details about the Group Policy VXLAN, see the
<ulink url="https://tools.ietf.org/html/draft-smith-vxlan-group-policy">
VXLAN Group Policy </ulink> document. Defaults to false.</para>
</listitem>
<term><varname>TOS=</varname></term>
<listitem>
<para>The Type Of Service byte value for a tunnel interface.
- For details about the TOS see the
+ For details about the TOS, see the
<ulink url="http://tools.ietf.org/html/rfc1349"> Type of
Service in the Internet Protocol Suite </ulink> document.
</para>
<term><varname>TTL=</varname></term>
<listitem>
<para>A fixed Time To Live N on tunneled packets. N is a
- number in the range 1-255. 0 is a special value meaning that
+ number in the range 1–255. 0 is a special value meaning that
packets inherit the TTL value. The default value for IPv4
- tunnels is: inherit. The default value for IPv6 tunnels is:
+ tunnels is: inherit. The default value for IPv6 tunnels is
64.</para>
</listitem>
</varlistentry>
value of zero means that a packet carrying that option may not enter
another tunnel before exiting the current tunnel.
(see <ulink url="https://tools.ietf.org/html/rfc2473#section-4.1.1"> RFC 2473</ulink>).
- The valid range is 0-255 and <literal>none</literal>. Defaults to 4.
+ The valid range is 0–255 and <literal>none</literal>. Defaults to 4.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>MACAddress=</varname></term>
<listitem>
- <para>The peer MACAddress, if not set it is generated in
+ <para>The peer MACAddress, if not set, it is generated in
the same way as the MAC address of the main
interface.</para>
</listitem>
<term><varname>PacketInfo=</varname></term>
<listitem><para>Takes a boolean argument. Configures whether
packets should be prepended with four extra bytes (two flag
- bytes and two protocol bytes). If disabled it indicates that
+ bytes and two protocol bytes). If disabled, it indicates that
the packets will be pure IP packets. Defaults to
<literal>no</literal>.</para>
</listitem>
<listitem>
<para>Specifies the number of seconds between instances where the bonding
driver sends learning packets to each slaves peer switch.
- The valid range is 1 - 0x7fffffff; the default value is 1. This Option
+ The valid range is 1–0x7fffffff; the default value is 1. This Option
has effect only in balance-tlb and balance-alb modes.</para>
</listitem>
</varlistentry>
<para>Specifies the number of IGMP membership reports to be issued after
a failover event. One membership report is issued immediately after
the failover, subsequent packets are sent in each 200ms interval.
- The valid range is (0 - 255). Defaults to 1. A value of 0
+ The valid range is 0–255. Defaults to 1. A value of 0
prevents the IGMP membership report from being issued in response
to the failover event.
</para>
<varlistentry>
<term><varname>PacketsPerSlave=</varname></term>
<listitem>
- <para> Specify the number of packets to transmit through a slave before
- moving to the next one. When set to 0 then a slave is chosen at
- random. The valid range is (0 - 65535). Defaults to 1. This option
+ <para>Specify the number of packets to transmit through a slave before
+ moving to the next one. When set to 0, then a slave is chosen at
+ random. The valid range is 0–65535. Defaults to 1. This option
has effect only in balance-rr mode.
</para>
</listitem>
<listitem>
<para>Specify the number of peer notifications (gratuitous ARPs and
unsolicited IPv6 Neighbor Advertisements) to be issued after a
- failover event. As soon as the link is up on the new slave
+ failover event. As soon as the link is up on the new slave,
a peer notification is sent on the bonding device and each
VLAN sub-device. This is repeated at each link monitor interval
(ARPIntervalSec or MIIMonitorSec, whichever is active) if the number is
- greater than 1. The valid range is (0 - 255). Default value is 1.
+ greater than 1. The valid range is 0–255. Default value is 1.
These options affect only the active-backup mode.
</para>
</listitem>
name in <filename>/usr/lib</filename>. This can be used to
override a system-supplied configuration file with a local file if
needed. As a special case, an empty file (file size 0) or symlink
- with the same name pointing to <filename>/dev/null</filename>,
+ with the same name pointing to <filename>/dev/null</filename>
disable the configuration file entirely (it is "masked").</para>
</refsect1>
<literal>yes</literal>, <literal>no</literal>,
<literal>ipv4</literal>, or <literal>ipv6</literal>.</para>
- <para>Please note that by default the domain name
+ <para>Please note that, by default, the domain name
specified through DHCP is not used for name resolution.
See option <option>UseDomains=</option> below.</para>
</listitem>
<term><varname>IPv6Token=</varname></term>
<listitem>
<para>An IPv6 address with the top 64 bits unset. When set, indicates the
- 64 bits interface part of SLAAC IPv6 addresses for this link. By default
+ 64 bits interface part of SLAAC IPv6 addresses for this link. By default,
it is autogenerated.</para>
</listitem>
</varlistentry>
<term><varname>LLMNR=</varname></term>
<listitem>
<para>A boolean or <literal>resolve</literal>. When true, enables
- Link-Local Multicast Name Resolution on the link, when set to
- <literal>resolve</literal> only resolution is enabled, but not
+ Link-Local Multicast Name Resolution on the link. When set to
+ <literal>resolve</literal>, only resolution is enabled, but not
announcement. Defaults to true.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>IPForward=</varname></term>
<listitem><para>Configures IP forwarding for the network
- interface. If enabled incoming packets on the network
+ interface. If enabled, incoming packets on the network
interface will be forwarded to other interfaces according to
the routing table. Takes either a boolean argument, or the
values <literal>ipv4</literal> or <literal>ipv6</literal>,
<varlistentry>
<term><varname>IPMasquerade=</varname></term>
<listitem><para>Configures IP masquerading for the network
- interface. If enabled packets forwarded from the network
+ interface. If enabled, packets forwarded from the network
interface will be appear as coming from the local host.
Takes a boolean argument. Implies
<varname>IPForward=ipv4</varname>. Defaults to
Privacy Extensions for Stateless Address Autoconfiguration
in IPv6). Takes a boolean or the special values
<literal>prefer-public</literal> and
- <literal>kernel</literal>. When true enables the privacy
+ <literal>kernel</literal>. When true, enables the privacy
extensions and prefers temporary addresses over public
- addresses. When <literal>prefer-public</literal> enables the
+ addresses. When <literal>prefer-public</literal>, enables the
privacy extensions, but prefers public addresses over
temporary addresses. When false, the privacy extensions
- remain disabled. When <literal>kernel</literal> the kernel's
+ remain disabled. When <literal>kernel</literal>, the kernel's
default setting will be left in place. Defaults to
<literal>no</literal>.</para></listitem>
</varlistentry>
<term><varname>Destination=</varname></term>
<listitem>
<para>The destination prefix of the route. Possibly
- followed by a slash and the prefixlength. If omitted, a
+ followed by a slash and the prefix length. If omitted, a
full-length host route is assumed.</para>
</listitem>
</varlistentry>
<term><varname>Source=</varname></term>
<listitem>
<para>The source prefix of the route. Possibly followed by
- a slash and the prefixlength. If omitted, a full-length
+ a slash and the prefix length. If omitted, a full-length
host route is assumed.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>Metric=</varname></term>
<listitem>
- <para>The metric of the route. An unsigned integer</para>
+ <para>The metric of the route (an unsigned integer).</para>
</listitem>
</varlistentry>
<varlistentry>
address. <varname>PoolOffset=</varname> takes the offset of the pool
from the start of subnet, or zero to use the default value.
<varname>PoolSize=</varname> takes the number of IP addresses in the
- pool or zero to use the default value. By default the pool starts at
+ pool or zero to use the default value. By default, the pool starts at
the first address after the subnet address and takes up the rest of
the subnet, excluding the broadcast address. If the pool includes
the server address (the default), this is reserved and not handed
another common time unit, depending on the suffix. The default
lease time is used for clients that did not ask for a specific
lease time. If a client asks for a lease time longer than the
- maximum lease time it is automatically shortened to the
+ maximum lease time, it is automatically shortened to the
specified time. The default lease time defaults to 1h, the
maximum lease time to 12h. Shorter lease times are beneficial
if the configuration data in DHCP leases changes frequently
pass to clients may be configured with the
<varname>DNS=</varname> option, which takes a list of IPv4
addresses. If the <varname>EmitDNS=</varname> option is
- enabled but no servers configured the servers are
+ enabled but no servers configured, the servers are
automatically propagated from an "uplink" interface that has
appropriate servers set. The "uplink" interface is determined
by the default route of the system with the highest
<filename>/etc/resolv.conf</filename> into account. Also, note
that the leases are not refreshed if uplink network
configuration changes. To ensure clients regularly acquire the
- most current uplink DNS server information it is thus
+ most current uplink DNS server information, it is thus
advisable to shorten the DHCP lease time via
<varname>MaxLeaseTimeSec=</varname> described
above.</para></listitem>
<term><varname>NTP=</varname></term>
<listitem><para>Similar to the <varname>EmitDNS=</varname> and
- <varname>DNS=</varname> settings described above these
+ <varname>DNS=</varname> settings described above, these
settings configure whether and what NTP server information
shall be emitted as part of the DHCP lease. The same syntax,
propagation semantics and defaults apply as for
<varname>Timezone=</varname> setting takes a timezone string
(such as <literal>Europe/Berlin</literal> or
<literal>UTC</literal>) to pass to clients. If no explicit
- timezone is set the system timezone of the local host is
+ timezone is set, the system timezone of the local host is
propagated, as determined by the
<filename>/etc/localtime</filename> symlink.</para></listitem>
</varlistentry>
Microsoft Windows <filename>.ini</filename> files.</para>
<para>Boolean arguments used in these settings files can be
- written in various formats. For positive settings the strings
+ written in various formats. For positive settings, the strings
<option>1</option>, <option>yes</option>, <option>true</option>
and <option>on</option> are equivalent. For negative settings, the
strings <option>0</option>, <option>no</option>,
directory or image file name. This file is first searched in
<filename>/etc/systemd/nspawn/</filename> and
<filename>/run/systemd/nspawn/</filename>. If found in these
- directories its settings are read and all of them take full effect
+ directories, its settings are read and all of them take full effect
(but are possibly overridden by corresponding command line
- arguments). If not found the file will then be searched next to
+ arguments). If not found, the file will then be searched next to
the image file or in the immediate parent of the root directory of
- the container. If the file is found there only a subset of the
+ the container. If the file is found there, only a subset of the
settings will take effect however. All settings that possibly
elevate privileges or grant additional access to resources of the
host (such as files or directories) are ignored. To which options
placed in <filename>/var/lib/machines/</filename> instead (next to
the container images), where their security impact is limited. In
order to add privileged settings to <filename>.nspawn</filename>
- files acquired from the image vendor it is recommended to copy the
+ files acquired from the image vendor, it is recommended to copy the
settings files into <filename>/etc/systemd/nspawn/</filename> and
edit them there, so that the privileged options become
available. The precise algorithm how the files are searched and
<term><varname>Boot=</varname></term>
<listitem><para>Takes a boolean argument, defaults to off. If
- enabled <command>systemd-nspawn</command> will automatically
+ enabled, <command>systemd-nspawn</command> will automatically
search for an <filename>init</filename> executable and invoke
- it. In this case the specified parameters using
+ it. In this case, the specified parameters using
<varname>Parameters=</varname> are passed as additional
arguments to the <filename>init</filename> process. This
setting corresponds to the <option>--boot</option> switch on
<varlistentry>
<term><varname>Parameters=</varname></term>
- <listitem><para>Takes a space separated list of
+ <listitem><para>Takes a space-separated list of
arguments. This is either a command line, beginning with the
binary name to execute, or – if <varname>Boot=</varname> is
enabled – the list of arguments to pass to the init
<term><varname>Capability=</varname></term>
<term><varname>DropCapability=</varname></term>
- <listitem><para>Takes a space separated list of Linux process
+ <listitem><para>Takes a space-separated list of Linux process
capabilities (see
<citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
for details). The <varname>Capability=</varname> setting
<filename>.nspawn</filename> files in
<filename>/etc/systemd/nspawn/</filename> and
<filename>/run/system/nspawn/</filename> (see above). On the
- other hand <varname>DropCapability=</varname> takes effect in
+ other hand, <varname>DropCapability=</varname> takes effect in
all cases.</para></listitem>
</varlistentry>
<varlistentry>
<term><varname>MachineID=</varname></term>
- <listitem><para>Configures the 128bit machine ID (UUID) to pass to
+ <listitem><para>Configures the 128-bit machine ID (UUID) to pass to
the container. This is equivalent to the
<option>--uuid=</option> command line switch. This option is
privileged (see above). </para></listitem>
<term><varname>ReadOnly=</varname></term>
<listitem><para>Takes a boolean argument, defaults to off. If
- specified the container will be run with a read-only file
+ specified, the container will be run with a read-only file
system. This setting corresponds to the
<option>--read-only</option> command line
switch.</para></listitem>
<term><varname>Private=</varname></term>
<listitem><para>Takes a boolean argument, defaults to off. If
- enabled the container will run in its own network namespace
+ enabled, the container will run in its own network namespace
and not share network interfaces and configuration with the
host. This setting corresponds to the
<option>--private-network</option> command line
<varlistentry>
<term><varname>Interface=</varname></term>
- <listitem><para>Takes a space separated list of interfaces to
+ <listitem><para>Takes a space-separated list of interfaces to
add to the container. This option corresponds to the
<option>--network-interface=</option> command line switch and
implies <varname>Private=yes</varname>. This option is
<term><varname>MACVLAN=</varname></term>
<term><varname>IPVLAN=</varname></term>
- <listitem><para>Takes a space separated list of interfaces to
+ <listitem><para>Takes a space-separated list of interfaces to
add MACLVAN or IPVLAN interfaces to, which are then added to
the container. These options correspond to the
<option>--network-macvlan=</option> and
or T, the specified memory size is parsed as Kilobytes,
Megabytes, Gigabytes, or Terabytes (with the base 1024),
respectively. If assigned the special value
- <literal>infinity</literal> no memory limit is applied. This
+ <literal>infinity</literal>, no memory limit is applied. This
controls the <literal>memory.limit_in_bytes</literal>
control group attribute. For details about this control
group attribute, see <ulink
created in the unit. This ensures that the number of tasks
accounted for the unit (see above) stays below a specific
limit. If assigned the special value
- <literal>infinity</literal> no tasks limit is applied. This
+ <literal>infinity</literal>, no tasks limit is applied. This
controls the <literal>pids.max</literal> control group
attribute. For details about this control group attribute,
see <ulink
<term><varname>BlockIOAccounting=</varname></term>
<listitem>
- <para>Turn on Block IO accounting for this unit. Takes a
- boolean argument. Note that turning on block IO accounting
+ <para>Turn on Block I/O accounting for this unit. Takes a
+ boolean argument. Note that turning on block I/O accounting
for one unit will also implicitly turn it on for all units
contained in the same slice and all for its parent slices
and the units contained therein. The system default for this
<term><varname>BlockIOWeight=<replaceable>weight</replaceable></varname></term>
<term><varname>StartupBlockIOWeight=<replaceable>weight</replaceable></varname></term>
- <listitem><para>Set the default overall block IO weight for
+ <listitem><para>Set the default overall block I/O weight for
the executed processes. Takes a single weight value (between
- 10 and 1000) to set the default block IO weight. This controls
+ 10 and 1000) to set the default block I/O weight. This controls
the <literal>blkio.weight</literal> control group attribute,
which defaults to 500. For details about this control group
attribute, see <ulink
url="https://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt">blkio-controller.txt</ulink>.
- The available IO bandwidth is split up among all units within
- one slice relative to their block IO weight.</para>
+ The available I/O bandwidth is split up among all units within
+ one slice relative to their block I/O weight.</para>
<para>While <varname>StartupBlockIOWeight=</varname> only
applies to the startup phase of the system,
<term><varname>BlockIODeviceWeight=<replaceable>device</replaceable> <replaceable>weight</replaceable></varname></term>
<listitem>
- <para>Set the per-device overall block IO weight for the
+ <para>Set the per-device overall block I/O weight for the
executed processes. Takes a space-separated pair of a file
path and a weight value to specify the device specific
weight value, between 10 and 1000. (Example: "/dev/sda
<term><varname>BlockIOWriteBandwidth=<replaceable>device</replaceable> <replaceable>bytes</replaceable></varname></term>
<listitem>
- <para>Set the per-device overall block IO bandwidth limit
+ <para>Set the per-device overall block I/O bandwidth limit
for the executed processes. Takes a space-separated pair of
a file path and a bandwidth value (in bytes per second) to
specify the device specific bandwidth. The file path may be
<para>Turns on delegation of further resource control
partitioning to processes of the unit. For unprivileged
services (i.e. those using the <varname>User=</varname>
- setting) this allows processes to create a subhierarchy
+ setting), this allows processes to create a subhierarchy
beneath its control group path. For privileged services and
- scopes this ensures the processes will have all control
+ scopes, this ensures the processes will have all control
group controllers enabled.</para>
</listitem>
</varlistentry>
for, and its node will be bind-mounted over the default bus
node location, so the service can only access the bus through
its own endpoint. Note that custom bus endpoints default to a
- 'deny all' policy. Hence, if at least one
+ "deny all" policy. Hence, if at least one
<varname>BusPolicy=</varname> directive is given, you have to
make sure to add explicit rules for everything the service
should be able to do.</para>
<para>Note that it is usually not sufficient to specify a
command for this setting that only asks the service to
- terminate (for example by queuing some form of termination
+ terminate (for example, by queuing some form of termination
signal for it), but does not wait for it to do so. Since the
remaining processes of the services are killed using
<constant>SIGKILL</constant> immediately after the command
- exited this would not result in a clean stop. The specified
+ exited, this would not result in a clean stop. The specified
command should hence be a synchronous operation, not an
asynchronous one.</para></listitem>
</varlistentry>
</tgroup>
</table>
- <para>As exceptions to the setting above the service will not
+ <para>As exceptions to the setting above, the service will not
be restarted if the exit code or signal is specified in
<varname>RestartPreventExitStatus=</varname> (see below).
Also, the services will always be restarted if the exit code
<varlistentry>
<term><varname>SuccessExitStatus=</varname></term>
- <listitem><para>Takes a list of exit status definitions that
- when returned by the main service process will be considered
+ <listitem><para>Takes a list of exit status definitions that,
+ when returned by the main service process, will be considered
successful termination, in addition to the normal successful
exit code 0 and the signals <constant>SIGHUP</constant>,
<constant>SIGINT</constant>, <constant>SIGTERM</constant>, and
<varlistentry>
<term><varname>RestartPreventExitStatus=</varname></term>
- <listitem><para>Takes a list of exit status definitions that
- when returned by the main service process will prevent
+ <listitem><para>Takes a list of exit status definitions that,
+ when returned by the main service process, will prevent
automatic service restarts, regardless of the restart setting
configured with <varname>Restart=</varname>. Exit status
definitions can either be numeric exit codes or termination
<varlistentry>
<term><varname>RestartForceExitStatus=</varname></term>
- <listitem><para>Takes a list of exit status definitions that
- when returned by the main service process will force automatic
+ <listitem><para>Takes a list of exit status definitions that,
+ when returned by the main service process, will force automatic
service restarts, regardless of the restart setting configured
with <varname>Restart=</varname>. The argument format is
similar to
<term><varname>Sockets=</varname></term>
<listitem><para>Specifies the name of the socket units this
service shall inherit socket file descriptors from when the
- service is started. Normally it should not be necessary to use
- this setting as all socket file descriptors whose unit shares
+ service is started. Normally, it should not be necessary to use
+ this setting, as all socket file descriptors whose unit shares
the same name as the service (subject to the different unit
name suffix of course) are passed to the spawned
process.</para>
to multiple processes simultaneously. Also note that a
different service may be activated on incoming socket traffic
than the one which is ultimately configured to inherit the
- socket file descriptors. Or in other words: the
+ socket file descriptors. Or, in other words: the
<varname>Service=</varname> setting of
<filename>.socket</filename> units does not have to match the
inverse of the <varname>Sockets=</varname> setting of the
contains, resulting in a single argument. Use
<literal>$FOO</literal> as a separate word on the command line, in
which case it will be replaced by the value of the environment
- variable split at whitespace resulting in zero or more arguments.
+ variable split at whitespace, resulting in zero or more arguments.
For this type of expansion, quotes are respected when splitting
into words, and afterwards removed.</para>
<example>
<title>Oneshot service</title>
- <para>Sometimes units should just execute an action without
+ <para>Sometimes, units should just execute an action without
keeping active processes, such as a filesystem check or a
cleanup action on boot. For this,
<varname>Type=</varname><option>oneshot</option> exists. Units
WantedBy=multi-user.target</programlisting>
<para>Note that systemd will consider the unit to be in the
- state 'starting' until the program has terminated, so ordered
+ state "starting" until the program has terminated, so ordered
dependencies will wait for the program to finish before starting
- themselves. The unit will revert to the 'inactive' state after
- the execution is done, never reaching the 'active' state. That
+ themselves. The unit will revert to the "inactive" state after
+ the execution is done, never reaching the "active" state. That
means another request to start the unit will perform the action
again.</para>
<para>Similarly to the oneshot services, there are sometimes
units that need to execute a program to set up something and
then execute another to shut it down, but no process remains
- active while they are considered 'started'. Network
+ active while they are considered "started". Network
configuration can sometimes fall into this category. Another use
case is if a oneshot service shall not be executed a each time
when they are pulled in as a dependency, but only the first
types, but is most useful with
<varname>Type=</varname><option>oneshot</option> and
<varname>Type=</varname><option>simple</option>. With
- <varname>Type=</varname><option>oneshot</option> systemd waits
+ <varname>Type=</varname><option>oneshot</option>, systemd waits
until the start action has completed before it considers the
unit to be active, so dependencies start only after the start
action has succeeded. With
- <varname>Type=</varname><option>simple</option> dependencies
+ <varname>Type=</varname><option>simple</option>, dependencies
will start immediately after the start action has been
dispatched. The following unit provides an example for a simple
static firewall.</para>
<varname>RemainAfterExit=</varname><option>no</option>), the
service is considered started.</para>
- <para>Often a traditional daemon only consists of one process.
+ <para>Often, a traditional daemon only consists of one process.
Therefore, if only one process is left after the original
process terminates, systemd will consider that process the main
process of the service. In that case, the
traditional PID file, systemd will be able to read the main PID
from there. Please set <varname>PIDFile=</varname> accordingly.
Note that the daemon should write that file before finishing
- with its initialization, otherwise systemd might try to read the
+ with its initialization. Otherwise, systemd might try to read the
file before it exists.</para>
<para>The following example shows a simple daemon that forks and
refers to TCP sockets, <constant>SOCK_DGRAM</constant> (i.e.
<varname>ListenDatagram=</varname>) to UDP.</para>
- <para>These options may be specified more than once in which
+ <para>These options may be specified more than once, in which
case incoming traffic on any of the sockets will trigger
service activation, and all listed sockets will be passed to
the service, regardless of whether there is incoming traffic
to work unmodified with systemd socket
activation.</para>
- <para>For IPv4 and IPv6 connections the <varname>REMOTE_ADDR</varname>
+ <para>For IPv4 and IPv6 connections, the <varname>REMOTE_ADDR</varname>
environment variable will contain the remote IP, and <varname>REMOTE_PORT</varname>
will contain the remote port. This is the same as the format used by CGI.
- For SOCK_RAW the port is the IP protocol.</para></listitem>
+ For SOCK_RAW, the port is the IP protocol.</para></listitem>
</varlistentry>
<varlistentry>
<listitem><para>Takes a boolean argument. May only be used in
conjunction with <varname>ListenSpecial=</varname>. If true,
the specified special file is opened in read-write mode, if
- false in read-only mode. Defaults to false.</para></listitem>
+ false, in read-only mode. Defaults to false.</para></listitem>
</varlistentry>
<varlistentry>
<varlistentry>
<term><varname>KeepAliveTimeSec=</varname></term>
- <listitem><para>Takes time (in seconds) as argument . The connection needs to remain
+ <listitem><para>Takes time (in seconds) as argument. The connection needs to remain
idle before TCP starts sending keepalive probes. This controls the TCP_KEEPIDLE
socket option (see
<citerefentry project='man-pages'><refentrytitle>socket</refentrytitle><manvolnum>7</manvolnum></citerefentry>
descriptors. Names may contain any ASCII character, but must
exclude control characters or <literal>:</literal>, and must
be at most 255 characters in length. If this setting is not
- used the file descriptor name defaults to the name of the
+ used, the file descriptor name defaults to the name of the
socket unit, including its <filename>.socket</filename>
suffix.</para></listitem>
</varlistentry>
for this target unit to all services (except for those with
<varname>DefaultDependencies=no</varname>).</para>
- <para>Usually this should pull-in all local mount points plus
+ <para>Usually, this should pull-in all local mount points plus
<filename>/var</filename>, <filename>/tmp</filename> and
<filename>/var/tmp</filename>, swap devices, sockets, timers,
path units and other basic initialization necessary for general
<term><filename>ctrl-alt-del.target</filename></term>
<listitem>
<para>systemd starts this target whenever Control+Alt+Del is
- pressed on the console. Usually this should be aliased
+ pressed on the console. Usually, this should be aliased
(symlinked) to <filename>reboot.target</filename>.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><filename>default.target</filename></term>
<listitem>
- <para>The default unit systemd starts at bootup. Usually
+ <para>The default unit systemd starts at bootup. Usually,
this should be aliased (symlinked) to
<filename>multi-user.target</filename> or
<filename>graphical.target</filename>.</para>
<varlistentry>
<term><filename>display-manager.service</filename></term>
<listitem>
- <para>The display manager service. Usually this should be
+ <para>The display manager service. Usually, this should be
aliased (symlinked) to <filename>gdm.service</filename> or a
similar display manager service.</para>
</listitem>
signal when running as user service daemon.</para>
<para>Normally, this (indirectly) pulls in
- <filename>shutdown.target</filename> which in turn should be
+ <filename>shutdown.target</filename>, which in turn should be
conflicted by all units that want to be scheduled for
shutdown when the service manager starts to exit.</para>
</listitem>
<filename>/etc/fstab</filename> and a unit file, the configuration
in the latter takes precedence.</para>
- <para>When reading <filename>/etc/fstab</filename> a few special
+ <para>When reading <filename>/etc/fstab</filename>, a few special
options are understood by systemd which influence how dependencies
are created for swap units.</para>
<term><option>noauto</option></term>
<term><option>auto</option></term>
- <listitem><para>With <option>noauto</option> the swap unit
+ <listitem><para>With <option>noauto</option>, the swap unit
will not be added as a dependency for
<filename>swap.target</filename>. This means that it will not
be activated automatically during boot, unless it is pulled in
<varlistentry>
<term><option>nofail</option></term>
- <listitem><para>With <option>nofail</option> the swap unit
+ <listitem><para>With <option>nofail</option>, the swap unit
will be only wanted, not required by
<filename>swap.target</filename>. This means that the boot
will continue even if this swap device is not activated
<refsect1>
<title>Parsing Timestamps</title>
- <para>When parsing systemd will accept a similar syntax, but
+ <para>When parsing, systemd will accept a similar syntax, but
expects no timezone specification, unless it is given as the
- literal string "UTC". In this case the time is considered in UTC,
+ literal string "UTC". In this case, the time is considered in UTC,
otherwise in the local timezone. The weekday specification is
- optional, but when the weekday is specified it must either be in
+ optional, but when the weekday is specified, it must either be in
the abbreviated (<literal>Wed</literal>) or non-abbreviated
(<literal>Wednesday</literal>) English language form (case does
not matter), and is not subject to the locale choice of the user.
used to refer to the current time (or of the invocation of the
command that is currently executed). <literal>today</literal>,
<literal>yesterday</literal>, <literal>tomorrow</literal> refer to
- 00:00:00 of the current day, the day before or the next day,
+ 00:00:00 of the current day, the day before, or the next day,
respectively.</para>
<para>When parsing, systemd will also accept relative time
<para>Note that timestamps printed by systemd will not be parsed
correctly by systemd, as the timezone specification is not
accepted, and printing timestamps is subject to locale settings
- for the weekday while parsing only accepts English weekday
+ for the weekday, while parsing only accepts English weekday
names.</para>
<para>In some cases, systemd will display a relative timestamp
<literal>Mon *-*-* 00:00:00</literal>,
<literal>*-01-01 00:00:00</literal>,
<literal>*-01,04,07,10-01 00:00:00</literal> and
- <literal>*-01,07-01 00:00:00</literal> respectively.
+ <literal>*-01,07-01 00:00:00</literal>, respectively.
</para>
<para>Examples for valid timestamps and their
be parsed after the file itself is parsed. This is useful to alter
or add configuration settings to a unit, without having to modify
their unit files. Make sure that the file that is included has the
- appropriate section headers before any directive. Note that for
- instanced units this logic will first look for the instance
+ appropriate section headers before any directive. Note that, for
+ instanced units, this logic will first look for the instance
<literal>.d/</literal> subdirectory and read its
<literal>.conf</literal> files, followed by the template
<literal>.d/</literal> subdirectory and reads its
device node <filename noindex='true'>/dev/sda</filename> in the
file system namespace. If this applies, a special way to escape
the path name is used, so that the result is usable as part of a
- filename. Basically, given a path, "/" is replaced by "-" and all
+ filename. Basically, given a path, "/" is replaced by "-", and all
other characters which are not ASCII alphanumerics are replaced by
C-style "\x2d" escapes (except that "_" is never replaced and "."
is only replaced when it would be the first character in the
with <varname>After=</varname> or <varname>Before=</varname>,
then both units will be started simultaneously and without any
delay between them if <filename>foo.service</filename> is
- activated. Often it is a better choice to use
+ activated. Often, it is a better choice to use
<varname>Wants=</varname> instead of
<varname>Requires=</varname> in order to achieve a system that
is more robust when dealing with failing services.</para>
<para>Note that dependencies of this type may also be
configured outside of the unit configuration file by adding a
symlink to a <filename>.requires/</filename> directory
- accompanying the unit file. For details see
+ accompanying the unit file. For details, see
above.</para></listitem>
</varlistentry>
<listitem><para>Takes a boolean argument. If
<option>true</option>, this unit will be stopped when it is no
- longer used. Note that in order to minimize the work to be
+ longer used. Note that, in order to minimize the work to be
executed, systemd will not stop units by default unless they
are conflicting with other units, or the user explicitly
requested their shut down. If this option is set, a unit will
<term><varname>JobTimeoutAction=</varname></term>
<term><varname>JobTimeoutRebootArgument=</varname></term>
- <listitem><para>When a job for this unit is queued a time-out
+ <listitem><para>When a job for this unit is queued, a time-out
may be configured. If this time limit is reached, the job will
be cancelled, the unit however will not change state or even
enter the <literal>failed</literal> mode. This value defaults
<term><varname>ConditionFileIsExecutable=</varname></term>
<!-- We don't document ConditionNull=
- here as it is not particularly
+ here, as it is not particularly
useful and probably just
confusing. -->
<para><varname>ConditionSecurity=</varname> may be used to
check whether the given security module is enabled on the
- system. Currently the recognized values values are
+ system. Currently, the recognized values values are
<varname>selinux</varname>,
<varname>apparmor</varname>,
<varname>ima</varname>,
<listitem><para>Similar to the
<varname>ConditionArchitecture=</varname>,
<varname>ConditionVirtualization=</varname>, ... condition
- settings described above these settings add assertion checks
+ settings described above, these settings add assertion checks
to the start-up of the unit. However, unlike the conditions
- settings any assertion setting that is not met results in
+ settings, any assertion setting that is not met results in
failure of the start job it was triggered
by.</para></listitem>
</varlistentry>
run a system instance, even if the process ID is not 1, i.e.
systemd is not run as init process. <option>--user</option>
does the opposite, running a user instance even if the process
- ID is 1. Normally it should not be necessary to pass these
+ ID is 1. Normally, it should not be necessary to pass these
options, as systemd automatically detects the mode it is
started in. These options are hence of little use except for
debugging. Note that it is not supported booting and
<term><option>--crash-vt=</option><replaceable>VT</replaceable></term>
<listitem><para>Switch to a specific virtual console (VT) on
- crash. Takes a positive integer in the range 1..63, or a
+ crash. Takes a positive integer in the range 1–63, or a
boolean argument. If an integer is passed, selects which VT to
switch to. If <constant>yes</constant>, the VT kernel messages
are written to is selected. If <constant>no</constant>, no VT
<orderedlist>
<listitem><para>Service units, which start and control daemons
- and the processes they consist of. For details see
+ and the processes they consist of. For details, see
<citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para></listitem>
<listitem><para>Socket units, which encapsulate local IPC or
network sockets in the system, useful for socket-based
- activation. For details about socket units see
+ activation. For details about socket units, see
<citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
for details on socket-based activation and other forms of
activation, see
<listitem><para>Device units expose kernel devices in systemd
and may be used to implement device-based activation. For
- details see
+ details, see
<citerefentry><refentrytitle>systemd.device</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para></listitem>
<listitem><para>Mount units control mount points in the file
<listitem><para>Snapshot units can be used to temporarily save
the state of the set of systemd units, which later may be
restored by activating the saved snapshot unit. For more
- information see
+ information, see
<citerefentry><refentrytitle>systemd.snapshot</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para></listitem>
<listitem><para>Timer units are useful for triggering activation
<para>On boot systemd activates the target unit
<filename>default.target</filename> whose job is to activate
on-boot services and other on-boot units by pulling them in via
- dependencies. Usually the unit name is just an alias (symlink) for
+ dependencies. Usually, the unit name is just an alias (symlink) for
either <filename>graphical.target</filename> (for fully-featured
boots into the UI) or <filename>multi-user.target</filename> (for
limited console-only boots for use in embedded or server
<para>Units may be generated dynamically at boot and system
manager reload time, for example based on other configuration
- files or parameters passed on the kernel command line. For details see
+ files or parameters passed on the kernel command line. For details, see
<citerefentry><refentrytitle>systemd.generator</refentrytitle><manvolnum>7</manvolnum></citerefentry>.</para>
<para>Systems which invoke systemd in a container or initrd
<filename>ctrl-alt-del.target</filename> unit. This is mostly
equivalent to <command>systemctl start
ctl-alt-del.target</command>. If this signal is received more
- often than 7 times per 2s an immediate reboot is triggered.
+ often than 7 times per 2s, an immediate reboot is triggered.
Note that pressing Ctrl-Alt-Del on the console will trigger
- this signal. Hence, if a reboot is hanging pressing
+ this signal. Hence, if a reboot is hanging, pressing
Ctrl-Alt-Del more than 7 times in 2s is a relatively safe way
to trigger an immediate reboot.</para>
<term><constant>SIGUSR2</constant></term>
<listitem><para>When this signal is received the systemd
- manager will log its complete state in human readable form.
+ manager will log its complete state in human-readable form.
The data logged is the same as printed by
<command>systemd-analyze dump</command>.</para></listitem>
</varlistentry>
<term><varname>systemd.crash_chvt=</varname></term>
<listitem><para>Takes a positive integer, or a boolean
- argument. If a positive integer (in the range 1..63) is
- specified the system manager (PID 1) will activate the specified
+ argument. If a positive integer (in the range 1–63) is
+ specified, the system manager (PID 1) will activate the specified
virtual terminal (VT) when it crashes. Defaults to
<constant>no</constant>, meaning that no such switch is
- attempted. If set to <constant>yes</constant> the VT the
+ attempted. If set to <constant>yes</constant>, the VT the
kernel messages are written to is selected.</para></listitem>
</varlistentry>
like <option>false</option> until a service fails or there is
a significant delay in boot. Defaults to
<option>yes</option>, unless <option>quiet</option> is passed
- as kernel command line option in which case it defaults to
+ as kernel command line option, in which case it defaults to
<constant>auto</constant>.</para></listitem>
</varlistentry>
<listitem><para>Set the system locale to use. This overrides
the settings in <filename>/etc/locale.conf</filename>. For
- more information see
+ more information, see
<citerefentry project='man-pages'><refentrytitle>locale.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
and
<citerefentry project='man-pages'><refentrytitle>locale</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
<term><varname>r</varname></term>
<listitem><para>Add a range of numeric UIDs/GIDs to the pool
to allocate new UIDs and GIDs from. If no line of this type
- is specified the range of UIDs/GIDs is set to some
+ is specified, the range of UIDs/GIDs is set to some
compiled-in default. Note that both UIDs and GIDs are
allocated from the same pool, in order to ensure that users
and groups of the same name are likely to carry the same
all system and group names with the underscore, and avoiding too
generic names.</para>
- <para>For <varname>m</varname> lines this field should contain
+ <para>For <varname>m</varname> lines, this field should contain
the user name to add to a group.</para>
- <para>For lines of type <varname>r</varname> this field should
+ <para>For lines of type <varname>r</varname>, this field should
be set to <literal>-</literal>.</para>
</refsect2>
<refsect2>
<title>ID</title>
- <para>For <varname>u</varname> and <varname>g</varname> the
- numeric 32bit UID or GID of the user/group. Do not use IDs 65535
+ <para>For <varname>u</varname> and <varname>g</varname>, the
+ numeric 32-bit UID or GID of the user/group. Do not use IDs 65535
or 4294967295, as they have special placeholder meanings.
Specify <literal>-</literal> for automatic UID/GID allocation
for the user or group. Alternatively, specify an absolute path
- in the file system. In this case the UID/GID is read from the
+ in the file system. In this case, the UID/GID is read from the
path's owner/group. This is useful to create users whose UID/GID
match the owners of pre-existing files (such as SUID or SGID
binaries).</para>
- <para>For <varname>m</varname> lines this field should contain
+ <para>For <varname>m</varname> lines, this field should contain
the group name to add to a user to.</para>
- <para>For lines of type <varname>r</varname> this field should
+ <para>For lines of type <varname>r</varname>, this field should
be set to a UID/GID range in the format
- <literal>FROM-TO</literal> where both values are formatted as
+ <literal>FROM-TO</literal>, where both values are formatted as
decimal ASCII numbers. Alternatively, a single UID/GID may be
specified formatted as decimal ASCII numbers.</para>
</refsect2>
<refsect2>
<title>Home Directory</title>
- <para>The home directory for a new system user. If omitted
+ <para>The home directory for a new system user. If omitted,
defaults to the root directory. It is recommended to not
unnecessarily specify home directories for system users, unless
software strictly requires one to be set.</para>
<para>Note that <command>systemd-sysusers</command> will do
nothing if the specified users or groups already exist, so
- normally there no reason to override
+ normally, there no reason to override
<filename>sysusers.d</filename> vendor configuration, except to
block certain users or groups from being created.</para>
</refsect1>
on. Note that whether network time synchronization is on
simply reflects whether the
<filename>systemd-timesyncd.service</filename> unit is
- enabled. Even if this command shows the status as off a
+ enabled. Even if this command shows the status as off, a
different service might still synchronize the clock with the
network.</para></listitem>
</varlistentry>
<para>Note that even if time synchronization is turned off
with this command, another unrelated system service might
- still synchronize the clock with the network. Also note that
- strictly speaking
+ still synchronize the clock with the network. Also note that,
+ strictly speaking,
<filename>systemd-timesyncd.service</filename> does more than
- just network time synchronization as it ensures a monotonic
+ just network time synchronization, as it ensures a monotonic
clock on systems without RTC even if no network is
available. See
<citerefentry><refentrytitle>systemd-timesyncd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
<varlistentry>
<term><varname>NTP=</varname></term>
- <listitem><para>A space separated list of NTP server host
+ <listitem><para>A space-separated list of NTP server host
names or IP addresses. During runtime this list is combined
with any per-interface NTP servers acquired from
<citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
<varlistentry>
<term><varname>FallbackNTP=</varname></term>
- <listitem><para>A space separated list of NTP server host
+ <listitem><para>A space-separated list of NTP server host
names or IP addresses to be used as the fallback NTP servers.
Any per-interface NTP servers obtained from
<citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
prefix and suffix of each other, then the prefix is always
processed first, the suffix later. Lines that take globs are
applied after those accepting no globs. If multiple operations
- shall be applied on the same file (such as ACL, xattr, file
- attribute adjustments) these are always done in the same fixed
+ shall be applied on the same file, (such as ACL, xattr, file
+ attribute adjustments), these are always done in the same fixed
order. Otherwise, the files/directories are processed in the order
they are listed.</para>
<term><varname>v</varname></term>
<listitem><para>Create a subvolume if the path does not
exist yet and the file system supports this
- (btrfs). Otherwise create a normal directory, in the same
+ (btrfs). Otherwise, create a normal directory, in the same
way as <varname>d</varname>. A subvolume created with this
line type is not assigned to any higher-level quota
- group. For that use <varname>q</varname> or
- <varname>Q</varname> which allow creating simple quota group
+ group. For that, use <varname>q</varname> or
+ <varname>Q</varname>, which allow creating simple quota group
hierarchies, see below.</para></listitem>
</varlistentry>
<varlistentry>
<term><varname>q</varname></term>
- <listitem><para>Similar to <varname>v</varname>, however
+ <listitem><para>Similar to <varname>v</varname>. However,
makes sure that the subvolume will be assigned to the same
higher-level quota groups as the subvolume it has been
created in. This ensures that higher-level limits and
specified subvolume. On non-btrfs file systems, this line
type is identical to <varname>d</varname>. If the subvolume
already exists and is already assigned to one or more higher
- level quota groups no change to the quota hierarchy is
+ level quota groups, no change to the quota hierarchy is
made. Also see <varname>Q</varname> below. See <citerefentry
project='die-net'><refentrytitle>btrfs-qgroup</refentrytitle><manvolnum>8</manvolnum></citerefentry>
for details about the btrfs quota group
<varlistentry>
<term><varname>Q</varname></term>
- <listitem><para>Similar to <varname>q</varname>, however
+ <listitem><para>Similar to <varname>q</varname>. However,
instead of copying the higher-level quota group assignments
from the parent as-is, the lowest quota group of the parent
subvolume is determined that is not the leaf quota
enforce limits and accounting to the specified subvolume and
children subvolume created within it. Thus, by creating
subvolumes only via <varname>q</varname> and
- <varname>Q</varname> a concept of "subtree quotas" is
+ <varname>Q</varname>, a concept of "subtree quotas" is
implemented. Each subvolume for which <varname>Q</varname>
is set will get a "subtree" quota group created, and all
child subvolumes created within it will be assigned to
</para>
<para>Passing only <varname>=</varname> as argument resets
all the file attributes listed above. It has to be pointed
- out that the <varname>=</varname> prefix, limits itself to
+ out that the <varname>=</varname> prefix limits itself to
the attributes corresponding to the letters listed here. All
other attributes will be left untouched. Does not follow
symlinks.</para>
<varname>w</varname> may be used to specify a short string that
is written to the file, suffixed by a newline. For
<varname>C</varname>, specifies the source file or
- directory. For <varname>t</varname>, <varname>T</varname>
+ directory. For <varname>t</varname>, <varname>T</varname>,
determines extended attributes to be set. For
- <varname>a</varname>, <varname>A</varname> determines ACL
+ <varname>a</varname>, <varname>A</varname>, determines ACL
attributes to be set. For <varname>h</varname>,
- <varname>H</varname> determines the file attributes to
+ <varname>H</varname>, determines the file attributes to
set. Ignored for all other lines.</para>
</refsect2>
<term><literal>program</literal></term>
<listitem>
<para>Execute an external program specified as the assigned
- value and if it returns successfully
+ value and, if it returns successfully,
import its output, which must be in environment key
format. Path specification, command/argument separation,
and quoting work like in <varname>RUN</varname>.</para>
<varlistentry>
<term><option>string_escape=<replaceable>none|replace</replaceable></option></term>
<listitem>
- <para>Usually control and other possibly unsafe characters are replaced
+ <para>Usually, control and other possibly unsafe characters are replaced
in strings used for device naming. The mode of replacement can be specified
with this option.</para>
</listitem>
<function>udev_device_new_from_subsystem_sysname</function>, and
<function>udev_device_new_from_device_id</function>
create the device object based on information found in
- <filename>/sys</filename> annotated with properties from the udev-internal
+ <filename>/sys</filename>, annotated with properties from the udev-internal
device database. A syspath is any subdirectory of <filename>/sys</filename>,
with the restriction that a subdirectory of <filename>/sys/devices</filename>
(or a symlink to one) represents a real device and as such must contain
and
<citerefentry><refentrytitle>udev_device_get_sysname</refentrytitle><manvolnum>3</manvolnum></citerefentry>)
and <function>udev_device_new_from_device_id</function> looks up devices based on the provided
- device id which is a special string in one of the following four forms:
+ device id, which is a special string in one of the following four forms:
<table>
<title>Device ID strings</title>
<function>udev_list_entry_get_name()</function> and
<function>udev_list_entry_get_value()</function> return a
pointer to a constant string representing the requested value.
- The string is bound to the lifetime of the list-entry itself.
+ The string is bound to the lifetime of the list entry itself.
On failure, <constant>NULL</constant> is returned.</para>
</refsect1>
</varlistentry>
</variablelist>
- <para>In addition an optional positional argument can be used
+ <para>In addition, an optional positional argument can be used
to specify a device name or a sys path. It must start with
<filename>/dev</filename> or <filename>/sys</filename>
respectively.</para>
</varlistentry>
</variablelist>
- <para>In addition optional positional arguments can be used
+ <para>In addition, optional positional arguments can be used
to specify device names or sys paths. They must start with
<filename>/dev</filename> or <filename>/sys</filename>
respectively.</para>
assert_se(sigaction(SIGHUP, &sa_old, NULL) == 0);
- /* Sometimes it makes sense to ignore TIOCSCTTY
+ /* Sometimes, it makes sense to ignore TIOCSCTTY
* returning EPERM, i.e. when very likely we already
* are have this controlling terminal. */
if (r < 0 && r == -EPERM && ignore_tiocstty_eperm)
* /blah/blah is converted to blah-blah.mount, anything else is left alone,
* except that @suffix is appended if a valid unit suffix is not present.
*
- * If @allow_globs, globs characters are preserved. Otherwise they are escaped.
+ * If @allow_globs, globs characters are preserved. Otherwise, they are escaped.
*/
int unit_name_mangle_with_suffix(const char *name, UnitNameMangle allow_globs, const char *suffix, char **ret) {
char *s, *t;
if (other->from_fragment)
return UNIT(other);
- /* Otherwise make everybody follow the unit that's named after
+ /* Otherwise, make everybody follow the unit that's named after
* the swap device in the kernel */
if (streq_ptr(s->what, s->devnode))
const char *bus_error_message(const sd_bus_error *e, int error) {
if (e) {
- /* Sometimes the D-Bus server is a little bit too verbose with
+ /* Sometimes, the D-Bus server is a little bit too verbose with
* its error messages, so let's override them here */
if (sd_bus_error_has_name(e, SD_BUS_ERROR_ACCESS_DENIED))
return "Access denied";
return 0;
}
- /* Otherwise make PID 1 do it for us, for the entire cgroup */
+ /* Otherwise, make PID 1 do it for us, for the entire cgroup */
return manager_kill_unit(m->manager, m->unit, signo, NULL);
}
p = j;
j = NULL;
- /* By default we trust configuration from /etc and /run */
+ /* By default, we trust configuration from /etc and /run */
if (arg_settings_trusted < 0)
arg_settings_trusted = true;
if (!f && errno != ENOENT)
return log_error_errno(errno, "Failed to open %s: %m", p);
- /* By default we do not trust configuration from /var/lib/machines */
+ /* By default, we do not trust configuration from /var/lib/machines */
if (arg_settings_trusted < 0)
arg_settings_trusted = false;
}
/* Empty assignment means clear the list */
manager_flush_dns_servers(m, ltype);
else {
- /* Otherwise add to the list */
+ /* Otherwise, add to the list */
r = manager_parse_dns_server(m, ltype, rvalue);
if (r < 0) {
log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse DNS server string '%s'. Ignoring.", rvalue);
}
}
- /* Otherwise try to reuse the group ID */
+ /* Otherwise, try to reuse the group ID */
if (!i->uid_set && i->gid_set) {
r = uid_is_ok((uid_t) i->gid, i->name);
if (r < 0)
projects / thirdparty / systemd.git / commitdiff
