]> git.ipfire.org Git - thirdparty/systemd.git/commitdiff
Merge pull request #14145 from poettering/process-bypass
authorZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Wed, 27 Nov 2019 13:53:39 +0000 (14:53 +0100)
committerGitHub <noreply@github.com>
Wed, 27 Nov 2019 13:53:39 +0000 (14:53 +0100)
/proc bypass in various process-util.c calls

20 files changed:
docs/TRANSIENT-SETTINGS.md
man/less-variables.xml
man/systemctl.xml
man/systemd.link.xml
man/systemd.network.xml
man/systemd.nspawn.xml
man/systemd.syntax.xml
man/systemd.xml
src/basic/terminal-util.c
src/core/load-fragment-gperf.gperf.m4
src/core/load-fragment.c
src/core/load-fragment.h
src/core/service.c
src/core/timer.c
src/network/networkd-route.c
src/shared/ethtool-util.c
src/test/test-fileio.c
src/udev/net/link-config.c
src/udev/udevd.c
test/fuzz/fuzz-unit-file/directives.service

index 05d6d4c0682d2359ba789921cb2584315c9fa336..838b90936ecfd223afa58a9d1bac2e1dcc0eb397 100644 (file)
@@ -348,7 +348,7 @@ Most timer unit settings are available to transient units.
 ✓ OnCalendar=
 ✓ OnClockChange=
 ✓ OnStartupSec=
-✓ OnTimezoneChange
+✓ OnTimezoneChange=
 ✓ OnUnitActiveSec=
 ✓ OnUnitInactiveSec=
 ✓ Persistent=
index 03e4b353883c9d22e6b65d57b66b800fe0bc8f6b..08e513c99f8e9d52f5db5dfc0ec988bc0337f856 100644 (file)
       </listitem>
     </varlistentry>
 
+    <!-- This is not documented on purpose, because it is not clear if $NO_COLOR will become supported
+         widely enough. So let's provide support, but without advertising this.
+    <varlistentry id='no-color'>
+      <term><varname>$NO_COLOR</varname></term>
+
+      <listitem><para>If set (to any value), and <varname>$SYSTEMD_COLORS</varname> is not set, equivalent to
+      <option>SYSTEMD_COLORS=0</option>. See <ulink url="https://no-color.org/">no-color.org</ulink>.</para>
+      </listitem>
+    </varlistentry>
+    -->
+
     <varlistentry id='urlify'>
       <term><varname>$SYSTEMD_URLIFY</varname></term>
 
index fb0ca466202c8048d204e7d3471edade1f7c815d..3d86f7dffa8cbcdf3997028c8f53b5a7ec260ec6 100644 (file)
@@ -2161,6 +2161,8 @@ Jan 12 10:46:45 example.com bluetoothd[8900]: gatt-time-server: Input/output err
     <xi:include href="less-variables.xml" xpointer="pager"/>
     <xi:include href="less-variables.xml" xpointer="less"/>
     <xi:include href="less-variables.xml" xpointer="lesscharset"/>
+    <xi:include href="less-variables.xml" xpointer="colors"/>
+    <xi:include href="less-variables.xml" xpointer="urlify"/>
   </refsect1>
 
   <refsect1>
index 59d14346948823353d62a4a3f6452eb5806f3400..63bb31d6e81a4a75971a5db250727d272ba207d3 100644 (file)
@@ -668,7 +668,7 @@ MACAddress=00:a0:de:63:7a:e6
 Name=dmz0</programlisting>
 
       <para><varname>NamePolicy=</varname> is not set, so <varname>Name=</varname> takes effect. We use the
-      <literal>10-</literal> prefix to order this file early in the list. Note that it needs to before
+      <literal>10-</literal> prefix to order this file early in the list. Note that it needs to be before
       <literal>99-link</literal>, i.e. it needs a numerical prefix, to have any effect at all.</para>
     </example>
 
index 8b401eeaf9454a5cf078d37fbdcbbf551444ef91..f06ce2eb7924259bce29b2fd05a3ccb155d99a82 100644 (file)
         <varlistentry>
           <term><varname>Scope=</varname></term>
           <listitem>
-            <para>The scope of the route, which can be <literal>global</literal>,
-            <literal>link</literal> or <literal>host</literal>. Defaults to
-            <literal>global</literal>.</para>
+            <para>The scope of the route, which can be <literal>global</literal>, <literal>site</literal>,
+            <literal>link</literal>, <literal>host</literal>, or <literal>nowhere</literal>. For IPv4 route,
+            defaults to <literal>host</literal> if <varname>Type=</varname> is <literal>local</literal>
+            or <literal>nat</literal>, and <literal>link</literal> if <varname>Type=</varname> is
+            <literal>broadcast</literal>, <literal>multicast</literal>, or <literal>anycast</literal>.
+            In other cases, defaults to <literal>global</literal>.</para>
           </listitem>
         </varlistentry>
         <varlistentry>
           </listitem>
         </varlistentry>
         <varlistentry>
-          <term><varname>Table=<replaceable>num</replaceable></varname></term>
+          <term><varname>Table=</varname></term>
           <listitem>
-          <para>The table identifier for the route (a number between 1 and 4294967295, or 0 to unset).
-          The table can be retrieved using <command>ip route show table <replaceable>num</replaceable></command>.
+            <para>The table identifier for the route. Takes <literal>default</literal>,
+            <literal>main</literal>, <literal>local</literal> or a number between 1 and 4294967295.
+            The table can be retrieved using <command>ip route show table <replaceable>num</replaceable></command>.
+            If unset and <varname>Type=</varname> is <literal>local</literal>, <literal>broadcast</literal>,
+            <literal>anycast</literal>, or <literal>nat</literal>, then <literal>local</literal> is used.
+            In other cases, defaults to <literal>main</literal>.
           </para>
           </listitem>
         </varlistentry>
index 787d5fd699d8731ba26a1829ac552bef98fac172..8f5590c73ad0384df4f606288cc08c4efba0a125 100644 (file)
   <refsect1>
     <title>Description</title>
 
-    <para>An nspawn container settings file (suffix
-    <filename>.nspawn</filename>) encodes additional runtime
-    information about a local container, and is searched, read and
-    used by
-    <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>
-    when starting a container. Files of this type are named after the
-    containers they define settings for. They are optional, and only
-    required for containers whose execution environment shall differ
-    from the defaults. Files of this type mostly contain settings that
-    may also be set on the <command>systemd-nspawn</command> command
-    line, and make it easier to persistently attach specific settings
-    to specific containers. The syntax of these files is inspired by
-    <filename>.desktop</filename> files following the <ulink
-    url="http://standards.freedesktop.org/desktop-entry-spec/latest/">XDG
-    Desktop Entry Specification</ulink>, which in turn are inspired by
-    Microsoft Windows <filename>.ini</filename> files.</para>
-
-    <para>Boolean arguments used in these settings files can be
-    written in various formats. For positive settings, the strings
-    <option>1</option>, <option>yes</option>, <option>true</option>
-    and <option>on</option> are equivalent. For negative settings, the
-    strings <option>0</option>, <option>no</option>,
-    <option>false</option> and <option>off</option> are
-    equivalent.</para>
-
-    <para>Empty lines and lines starting with # or ; are
-    ignored. This may be used for commenting. Lines ending
-    in a backslash are concatenated with the following
-    line while reading and the backslash is replaced by a
-    space character. This may be used to wrap long lines.</para>
-
+    <para>An nspawn container settings file (suffix <filename>.nspawn</filename>) contains runtime
+    configuration for a local container, and is used used by
+    <citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
+    Files of this type are named after the containers they define settings for. They are optional, and only
+    required for containers whose execution environment shall differ from the defaults. Files of this type
+    mostly contain settings that may also be set on the <command>systemd-nspawn</command> command line, and
+    make it easier to persistently attach specific settings to specific containers. The syntax of these files
+    is inspired by <filename>.desktop</filename> files, similarly to other configuration files supported by
+    the systemd project. See
+    <citerefentry><refentrytitle>systemd.syntax</refentrytitle><manvolnum>7</manvolnum></citerefentry> for an
+    overview.</para>
   </refsect1>
 
   <refsect1>
     <title><filename>.nspawn</filename> File Discovery</title>
 
-    <para>Files are searched by appending the
-    <filename>.nspawn</filename> suffix to the machine name of the
-    container, as specified with the <option>--machine=</option>
-    switch of <command>systemd-nspawn</command>, or derived from the
-    directory or image file name. This file is first searched in
-    <filename>/etc/systemd/nspawn/</filename> and
-    <filename>/run/systemd/nspawn/</filename>. If found in these
-    directories, its settings are read and all of them take full effect
-    (but are possibly overridden by corresponding command line
-    arguments). If not found, the file will then be searched next to
-    the image file or in the immediate parent of the root directory of
-    the container. If the file is found there, only a subset of the
-    settings will take effect however. All settings that possibly
-    elevate privileges or grant additional access to resources of the
-    host (such as files or directories) are ignored. To which options
-    this applies is documented below.</para>
+    <para>Files are searched for by appending the <filename>.nspawn</filename> suffix to the machine name of
+    the container, as specified with the <option>--machine=</option> switch of
+    <command>systemd-nspawn</command>, or derived from the directory or image file name. This file is first
+    searched for in <filename>/etc/systemd/nspawn/</filename> and
+    <filename>/run/systemd/nspawn/</filename>. If found there, the settings are read and all of them take
+    full effect (but may still be overridden by corresponding command line arguments). Otherwise, the file
+    will then be searched for next to the image file or in the immediate parent of the root directory of the
+    container. If the file is found there, only a subset of the settings will take effect however. All
+    settings that possibly elevate privileges or grant additional access to resources of the host (such as
+    files or directories) are ignored. To which options this applies is documented below.</para>
 
     <para>Persistent settings files created and maintained by the
     administrator (and thus trusted) should be placed in
index 3b58e4528036fcdabd8a8598f4e2d1174b4033eb..05786cc534a1edadffef8ef8d69baa2960f1176d 100644 (file)
@@ -42,7 +42,9 @@
       <citerefentry><refentrytitle>systemd.path</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
       <citerefentry><refentrytitle>systemd.timer</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
       <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
-      <citerefentry><refentrytitle>systemd.scope</refentrytitle><manvolnum>5</manvolnum></citerefentry></para></listitem>
+      <citerefentry><refentrytitle>systemd.scope</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>systemd.nspawn</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      </para></listitem>
 
       <listitem><para>daemon config files, see
       <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
index 9b2d5ac2805c768ea623aa9d3d69b3c22926444f..bde79d56fd899533aba24e23a65ac4ae3c77ba8e 100644 (file)
         script runlevel link farms.</para></listitem>
       </varlistentry>
 
-      <xi:include href="less-variables.xml" xpointer="colors" />
-      <xi:include href="less-variables.xml" xpointer="urlify" />
+      <xi:include href="less-variables.xml" xpointer="pager"/>
+      <xi:include href="less-variables.xml" xpointer="less"/>
+      <xi:include href="less-variables.xml" xpointer="lesscharset"/>
+      <xi:include href="less-variables.xml" xpointer="colors"/>
+      <xi:include href="less-variables.xml" xpointer="urlify"/>
 
       <varlistentry>
         <term><varname>$LISTEN_PID</varname></term>
index 98c3ff04ef2bacc9d4e0c72e325918302942e4b5..511734cbbb8fd085c208b7b040be858d1c692edf 100644 (file)
@@ -1206,6 +1206,11 @@ bool colors_enabled(void) {
                 val = getenv_bool("SYSTEMD_COLORS");
                 if (val >= 0)
                         cached_colors_enabled = val;
+
+                else if (getenv("NO_COLOR"))
+                        /* We only check for the presence of the variable; value is ignored. */
+                        cached_colors_enabled = false;
+
                 else if (getpid_cached() == 1)
                         /* PID1 outputs to the console without holding it open all the time */
                         cached_colors_enabled = !getenv_terminal_is_dumb();
@@ -1231,6 +1236,9 @@ bool dev_console_colors_enabled(void) {
         if (b >= 0)
                 return b;
 
+        if (getenv("NO_COLOR"))
+                return false;
+
         if (getenv_for_pid(1, "TERM", &s) <= 0)
                 (void) proc_cmdline_get_key("TERM", 0, &s);
 
index 42fc4eaac9d4b65521b3074f19dac98356dee5b8..de08f7d0676b7a04d672e0947460b1e94354cf41 100644 (file)
@@ -166,6 +166,8 @@ $1.WatchdogSignal,               config_parse_signal,                0,
 )m4_dnl
 m4_define(`CGROUP_CONTEXT_CONFIG_ITEMS',
 `$1.Slice,                       config_parse_unit_slice,            0,                             0
+$1.AllowedCPUs,                  config_parse_allowed_cpus,          0,                             offsetof($1, cgroup_context)
+$1.AllowedMemoryNodes,           config_parse_allowed_mems,          0,                             offsetof($1, cgroup_context)
 $1.CPUAccounting,                config_parse_bool,                  0,                             offsetof($1, cgroup_context.cpu_accounting)
 $1.CPUWeight,                    config_parse_cg_weight,             0,                             offsetof($1, cgroup_context.cpu_weight)
 $1.StartupCPUWeight,             config_parse_cg_weight,             0,                             offsetof($1, cgroup_context.startup_cpu_weight)
@@ -173,8 +175,6 @@ $1.CPUShares,                    config_parse_cpu_shares,            0,
 $1.StartupCPUShares,             config_parse_cpu_shares,            0,                             offsetof($1, cgroup_context.startup_cpu_shares)
 $1.CPUQuota,                     config_parse_cpu_quota,             0,                             offsetof($1, cgroup_context)
 $1.CPUQuotaPeriodSec,            config_parse_sec_def_infinity,      0,                             offsetof($1, cgroup_context.cpu_quota_period_usec)
-$1.CPUSetCpus,                   config_parse_cpuset_cpus,           0,                             offsetof($1, cgroup_context)
-$1.CPUSetMems,                   config_parse_cpuset_mems,           0,                             offsetof($1, cgroup_context)
 $1.MemoryAccounting,             config_parse_bool,                  0,                             offsetof($1, cgroup_context.memory_accounting)
 $1.MemoryMin,                    config_parse_memory_limit,          0,                             offsetof($1, cgroup_context)
 $1.DefaultMemoryMin,             config_parse_memory_limit,          0,                             offsetof($1, cgroup_context)
index 0631ea5ce203d639b15126e0d34b2484004654a1..54c71d3579d893a11b09498a62cf96f401c65c73 100644 (file)
@@ -3146,7 +3146,7 @@ int config_parse_cpu_quota(
         return 0;
 }
 
-int config_parse_cpuset_cpus(
+int config_parse_allowed_cpus(
                 const char *unit,
                 const char *filename,
                 unsigned line,
@@ -3165,7 +3165,7 @@ int config_parse_cpuset_cpus(
         return 0;
 }
 
-int config_parse_cpuset_mems(
+int config_parse_allowed_mems(
                 const char *unit,
                 const char *filename,
                 unsigned line,
index f369c4dc4f6eb095d24414a808bea34ac35bb82d..b81887d510408c368a1e3d4c21404421ffa5839b 100644 (file)
@@ -90,8 +90,8 @@ CONFIG_PARSER_PROTOTYPE(config_parse_set_status);
 CONFIG_PARSER_PROTOTYPE(config_parse_namespace_path_strv);
 CONFIG_PARSER_PROTOTYPE(config_parse_temporary_filesystems);
 CONFIG_PARSER_PROTOTYPE(config_parse_cpu_quota);
-CONFIG_PARSER_PROTOTYPE(config_parse_cpuset_cpus);
-CONFIG_PARSER_PROTOTYPE(config_parse_cpuset_mems);
+CONFIG_PARSER_PROTOTYPE(config_parse_allowed_cpus);
+CONFIG_PARSER_PROTOTYPE(config_parse_allowed_mems);
 CONFIG_PARSER_PROTOTYPE(config_parse_protect_home);
 CONFIG_PARSER_PROTOTYPE(config_parse_protect_system);
 CONFIG_PARSER_PROTOTYPE(config_parse_bus_name);
index 4b17889eb4861178ce54ce549456fe1f6f9b4cd8..49ad166c26045643c9fc4b24505a929f40a0bd4d 100644 (file)
@@ -3758,12 +3758,12 @@ static int service_dispatch_timer(sd_event_source *source, usec_t usec, void *us
         case SERVICE_AUTO_RESTART:
                 if (s->restart_usec > 0) {
                         char buf_restart[FORMAT_TIMESPAN_MAX];
-                        log_unit_info(UNIT(s),
-                                      "Service RestartSec=%s expired, scheduling restart.",
-                                      format_timespan(buf_restart, sizeof buf_restart, s->restart_usec, USEC_PER_SEC));
+                        log_unit_debug(UNIT(s),
+                                       "Service RestartSec=%s expired, scheduling restart.",
+                                       format_timespan(buf_restart, sizeof buf_restart, s->restart_usec, USEC_PER_SEC));
                 } else
-                        log_unit_info(UNIT(s),
-                                      "Service has no hold-off time (RestartSec=0), scheduling restart.");
+                        log_unit_debug(UNIT(s),
+                                       "Service has no hold-off time (RestartSec=0), scheduling restart.");
 
                 service_enter_restart(s);
                 break;
index 47c59ab7e9627afd254da474e5437b0604e7b249..051ca76273223a97e0539b5596b57230b2f10fe0 100644 (file)
@@ -216,7 +216,7 @@ static void timer_dump(Unit *u, FILE *f, const char *prefix) {
                 "%sAccuracy: %s\n"
                 "%sRemainAfterElapse: %s\n"
                 "%sOnClockChange: %s\n"
-                "%sOnTimeZoneChange %s\n",
+                "%sOnTimeZoneChange: %s\n",
                 prefix, timer_state_to_string(t->state),
                 prefix, timer_result_to_string(t->result),
                 prefix, trigger ? trigger->id : "n/a",
index 85df5d9395f4e2d56fa8400fe944f237a48c5ed7..592de4e430ac03b17149a542827480f075f71988 100644 (file)
@@ -1494,16 +1494,14 @@ int route_section_verify(Route *route, Network *network) {
                                          route->section->filename, route->section->line);
         }
 
-        if (route->family != AF_INET6) {
-                if (!route->table_set && IN_SET(route->type, RTN_LOCAL, RTN_BROADCAST, RTN_ANYCAST, RTN_NAT))
-                        route->table = RT_TABLE_LOCAL;
-
-                if (!route->scope_set) {
-                        if (IN_SET(route->type, RTN_LOCAL, RTN_NAT))
-                                route->scope = RT_SCOPE_HOST;
-                        else if (IN_SET(route->type, RTN_BROADCAST, RTN_ANYCAST))
-                                route->scope = RT_SCOPE_LINK;
-                }
+        if (!route->table_set && IN_SET(route->type, RTN_LOCAL, RTN_BROADCAST, RTN_ANYCAST, RTN_NAT))
+                route->table = RT_TABLE_LOCAL;
+
+        if (!route->scope_set && route->family != AF_INET6) {
+                if (IN_SET(route->type, RTN_LOCAL, RTN_NAT))
+                        route->scope = RT_SCOPE_HOST;
+                else if (IN_SET(route->type, RTN_BROADCAST, RTN_ANYCAST, RTN_MULTICAST))
+                        route->scope = RT_SCOPE_LINK;
         }
 
         if (network->n_static_addresses == 0 &&
index 8fec1a83f072a376e9e586b9a1e0b0a1e50a599a..3119b2b92e3b86dc629fb1119dee5e8725ac57ec 100644 (file)
@@ -744,7 +744,7 @@ int ethtool_set_glinksettings(
         else
                 r = set_sset(*fd, &ifr, u);
         if (r < 0)
-                return log_warning_errno(r, "ethtool: Cannot set device settings for %s : %m", ifname);
+                return log_warning_errno(r, "ethtool: Cannot set device settings for %s: %m", ifname);
 
         return r;
 }
index 56af5a8bc31ada80b205c62d0a5d3b04daffd19a..23c7d370d4eb1a86fae3e8e500482631ec412d47 100644 (file)
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1+ */
 
 #include <fcntl.h>
+#include <limits.h>
 #include <stdio.h>
 #include <unistd.h>
 
@@ -639,14 +640,18 @@ static void test_fgetc(void) {
         f = fmemopen_unlocked((void*) chars, sizeof(chars), "re");
         assert_se(f);
 
-        for (unsigned i = 0; i < sizeof(chars); i++) {
+        for (size_t i = 0; i < sizeof(chars); i++) {
                 assert_se(safe_fgetc(f, &c) == 1);
                 assert_se(c == chars[i]);
 
-                /* EOF is -1, and hence we can't push value 255 in this way if char is signed */
-                assert_se(ungetc(c, f) != EOF || c == EOF);
-                assert_se(c == EOF || safe_fgetc(f, &c) == 1);
-                assert_se(c == chars[i]);
+                if (ungetc(c, f) == EOF) {
+                        /* EOF is -1, and hence we can't push value 255 in this way – if char is signed */
+                        assert_se(c == (char) EOF);
+                        assert_se(CHAR_MIN == -128); /* verify that char is signed on this platform */
+                } else {
+                        assert_se(safe_fgetc(f, &c) == 1);
+                        assert_se(c == chars[i]);
+                }
 
                 /* But it works when we push it properly cast */
                 assert_se(ungetc((unsigned char) c, f) != EOF);
index 129a5a27b1da7bf8920c8400f1910c8a95dd2abe..7b07e2f38fa819ddefbf90cabaa804c1be276d5a 100644 (file)
@@ -362,8 +362,8 @@ int link_config_apply(link_config_ctx *ctx, link_config *config,
                         }
                 }
 
-                if (config->duplex !=_DUP_INVALID)
-                        log_warning_errno(r, "Could not set duplex of %s to (%s): %m", old_name, duplex_to_string(config->duplex));
+                if (config->duplex != _DUP_INVALID)
+                        log_warning_errno(r, "Could not set duplex of %s to %s: %m", old_name, duplex_to_string(config->duplex));
         }
 
         r = ethtool_set_wol(&ctx->ethtool_fd, old_name, config->wol);
index 2bb322796b26015855709be602171ef74688d17c..7678331897f5e988a66ef2dba903433fae518091 100644 (file)
@@ -293,8 +293,6 @@ static void manager_free(Manager *manager) {
         if (!manager)
                 return;
 
-        manager->monitor = sd_device_monitor_unref(manager->monitor);
-
         udev_builtin_exit();
 
         if (manager->pid == getpid_cached())
@@ -791,6 +789,8 @@ static void manager_exit(Manager *manager) {
         manager->inotify_event = sd_event_source_unref(manager->inotify_event);
         manager->fd_inotify = safe_close(manager->fd_inotify);
 
+        manager->monitor = sd_device_monitor_unref(manager->monitor);
+
         /* discard queued events and kill workers */
         event_queue_cleanup(manager, EVENT_QUEUED);
         manager_kill_workers(manager);
@@ -1311,10 +1311,12 @@ static int on_sigchld(sd_event_source *s, const struct signalfd_siginfo *si, voi
                         device_delete_db(worker->event->dev);
                         device_tag_index(worker->event->dev, NULL, false);
 
-                        /* forward kernel event without amending it */
-                        r = device_monitor_send_device(manager->monitor, NULL, worker->event->dev_kernel);
-                        if (r < 0)
-                                log_device_error_errno(worker->event->dev_kernel, r, "Failed to send back device to kernel: %m");
+                        if (manager->monitor) {
+                                /* forward kernel event without amending it */
+                                r = device_monitor_send_device(manager->monitor, NULL, worker->event->dev_kernel);
+                                if (r < 0)
+                                        log_device_error_errno(worker->event->dev_kernel, r, "Failed to send back device to kernel: %m");
+                        }
                 }
 
                 worker_free(worker);
index 068f4398b9bd6733336c32a7df1267cc564103e3..31a45043daca31d1be54b84a9f1bb43a1f876610 100644 (file)
@@ -3,6 +3,8 @@ Accept=
 AccuracySec=
 After=
 Alias=
+AllowedCPUs=
+AllowedMemoryNodes=
 AllowIsolate=
 Also=
 AmbientCapabilities=