1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <?xml-stylesheet type="text/xsl" href="http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl"?>
3 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
4 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
7 This file is part of systemd.
9 Copyright 2010 Lennart Poettering
11 systemd is free software; you can redistribute it and/or modify it
12 under the terms of the GNU Lesser General Public License as published by
13 the Free Software Foundation; either version 2.1 of the License, or
14 (at your option) any later version.
16 systemd is distributed in the hope that it will be useful, but
17 WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
19 Lesser General Public License for more details.
21 You should have received a copy of the GNU Lesser General Public License
22 along with systemd; If not, see <http://www.gnu.org/licenses/>.
25 <refentry id="systemd.exec">
27 <title>systemd.exec</title>
28 <productname>systemd</productname>
32 <contrib>Developer</contrib>
33 <firstname>Lennart</firstname>
34 <surname>Poettering</surname>
35 <email>lennart@poettering.net</email>
41 <refentrytitle>systemd.exec</refentrytitle>
42 <manvolnum>5</manvolnum>
46 <refname>systemd.exec</refname>
47 <refpurpose>Execution environment configuration</refpurpose>
51 <para><filename>systemd.service</filename>,
52 <filename>systemd.socket</filename>,
53 <filename>systemd.mount</filename>,
54 <filename>systemd.swap</filename></para>
58 <title>Description</title>
60 <para>Unit configuration files for services, sockets,
61 mount points and swap devices share a subset of
62 configuration options which define the execution
63 environment of spawned processes.</para>
65 <para>This man page lists the configuration options
66 shared by these four unit types. See
67 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
68 for the common options of all unit configuration
70 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
71 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
72 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>
74 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>
75 for more information on the specific unit
76 configuration files. The execution specific
77 configuration options are configured in the [Service],
78 [Socket], [Mount], or [Swap] sections, depending on the unit
83 <title>Options</title>
88 <term><varname>WorkingDirectory=</varname></term>
90 <listitem><para>Takes an absolute
91 directory path. Sets the working
92 directory for executed processes. If
93 not set defaults to the root directory
94 when systemd is running as a system
95 instance and the respective user's
96 home directory if run as
97 user.</para></listitem>
101 <term><varname>RootDirectory=</varname></term>
103 <listitem><para>Takes an absolute
104 directory path. Sets the root
105 directory for executed processes, with
107 <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry>
108 system call. If this is used it must
109 be ensured that the process and all
110 its auxiliary files are available in
111 the <function>chroot()</function>
112 jail.</para></listitem>
116 <term><varname>User=</varname></term>
117 <term><varname>Group=</varname></term>
119 <listitem><para>Sets the Unix user
120 or group that the processes are executed
121 as, respectively. Takes a single user or group
122 name or ID as argument. If no group is
123 set, the default group of the user is
124 chosen.</para></listitem>
128 <term><varname>SupplementaryGroups=</varname></term>
130 <listitem><para>Sets the supplementary
131 Unix groups the processes are executed
132 as. This takes a space separated list
133 of group names or IDs. This option may
134 be specified more than once in which
135 case all listed groups are set as
136 supplementary groups. When the empty
137 string is assigned the list of
138 supplementary groups is reset, and all
139 assignments prior to this one will
140 have no effect. In any way, this
141 option does not override, but extends
142 the list of supplementary groups
143 configured in the system group
145 user.</para></listitem>
149 <term><varname>Nice=</varname></term>
151 <listitem><para>Sets the default nice
152 level (scheduling priority) for
153 executed processes. Takes an integer
154 between -20 (highest priority) and 19
155 (lowest priority). See
156 <citerefentry><refentrytitle>setpriority</refentrytitle><manvolnum>2</manvolnum></citerefentry>
157 for details.</para></listitem>
161 <term><varname>OOMScoreAdjust=</varname></term>
163 <listitem><para>Sets the adjustment
164 level for the Out-Of-Memory killer for
165 executed processes. Takes an integer
166 between -1000 (to disable OOM killing
167 for this process) and 1000 (to make
168 killing of this process under memory
169 pressure very likely). See <ulink
170 url="http://www.kernel.org/doc/Documentation/filesystems/proc.txt">proc.txt</ulink>
171 for details.</para></listitem>
175 <term><varname>IOSchedulingClass=</varname></term>
177 <listitem><para>Sets the IO scheduling
178 class for executed processes. Takes an
179 integer between 0 and 3 or one of the
180 strings <option>none</option>,
181 <option>realtime</option>,
182 <option>best-effort</option> or
183 <option>idle</option>. See
184 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
185 for details.</para></listitem>
189 <term><varname>IOSchedulingPriority=</varname></term>
191 <listitem><para>Sets the IO scheduling
192 priority for executed processes. Takes
193 an integer between 0 (highest
194 priority) and 7 (lowest priority). The
195 available priorities depend on the
196 selected IO scheduling class (see
198 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
199 for details.</para></listitem>
203 <term><varname>CPUSchedulingPolicy=</varname></term>
205 <listitem><para>Sets the CPU
206 scheduling policy for executed
207 processes. Takes one of
208 <option>other</option>,
209 <option>batch</option>,
210 <option>idle</option>,
211 <option>fifo</option> or
212 <option>rr</option>. See
213 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
214 for details.</para></listitem>
218 <term><varname>CPUSchedulingPriority=</varname></term>
220 <listitem><para>Sets the CPU
221 scheduling priority for executed
222 processes. The available priority
223 range depends on the selected CPU
224 scheduling policy (see above). For
225 real-time scheduling policies an
226 integer between 1 (lowest priority)
227 and 99 (highest priority) can be used.
228 See <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
234 <term><varname>CPUSchedulingResetOnFork=</varname></term>
236 <listitem><para>Takes a boolean
237 argument. If true elevated CPU
238 scheduling priorities and policies
239 will be reset when the executed
240 processes fork, and can hence not leak
241 into child processes. See
242 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
243 for details. Defaults to false.</para></listitem>
247 <term><varname>CPUAffinity=</varname></term>
249 <listitem><para>Controls the CPU
250 affinity of the executed
251 processes. Takes a space-separated
252 list of CPU indexes. This option may
253 be specified more than once in which
254 case the specificed CPU affinity masks
255 are merged. If the empty string is
256 assigned the mask is reset, all
257 assignments prior to this will have no
259 <citerefentry><refentrytitle>sched_setaffinity</refentrytitle><manvolnum>2</manvolnum></citerefentry>
260 for details.</para></listitem>
264 <term><varname>UMask=</varname></term>
266 <listitem><para>Controls the file mode
267 creation mask. Takes an access mode in
269 <citerefentry><refentrytitle>umask</refentrytitle><manvolnum>2</manvolnum></citerefentry>
270 for details. Defaults to
271 0022.</para></listitem>
275 <term><varname>Environment=</varname></term>
277 <listitem><para>Sets environment
278 variables for executed
279 processes. Takes a space-separated
280 list of variable assignments. This
281 option may be specified more than once
282 in which case all listed variables
283 will be set. If the same variable is
284 set twice the later setting will
285 override the earlier setting. If the
286 empty string is assigned to this
287 option the list of environment
288 variables is reset, all prior
289 assignments have no effect. See
290 <citerefentry><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>
291 for details.</para></listitem>
294 <term><varname>EnvironmentFile=</varname></term>
295 <listitem><para>Similar to
296 <varname>Environment=</varname> but
297 reads the environment variables from a
298 text file. The text file should
299 contain new-line separated variable
300 assignments. Empty lines and lines
301 starting with ; or # will be ignored,
302 which may be used for commenting. A line
303 ending with a backslash will be concatenated
304 with the following one, allowing multiline variable
305 definitions. The parser strips leading
306 and trailing whitespace from the values
307 of assignments, unless you use
308 double quotes (").</para>
310 <para>The argument passed should be an
311 absolute file name or wildcard
312 expression, optionally prefixed with
313 "-", which indicates that if the file
314 does not exist it won't be read and no
315 error or warning message is logged.
316 This option may be specified more than
317 once in which case all specified files
318 are read. If the empty string is
319 assigned to this option the list of
320 file to read is reset, all prior
321 assignments have no effect.</para>
323 <para>The files listed with this
324 directive will be read shortly before
325 the process is executed. Settings from
326 these files override settings made
328 <varname>Environment=</varname>. If
329 the same variable is set twice from
330 these files the files will be read in
331 the order they are specified and the
332 later setting will override the
333 earlier setting.</para></listitem>
337 <term><varname>StandardInput=</varname></term>
338 <listitem><para>Controls where file
339 descriptor 0 (STDIN) of the executed
340 processes is connected to. Takes one
341 of <option>null</option>,
342 <option>tty</option>,
343 <option>tty-force</option>,
344 <option>tty-fail</option> or
345 <option>socket</option>. If
346 <option>null</option> is selected
347 standard input will be connected to
348 <filename>/dev/null</filename>,
349 i.e. all read attempts by the process
350 will result in immediate EOF. If
351 <option>tty</option> is selected
352 standard input is connected to a TTY
354 <varname>TTYPath=</varname>, see
355 below) and the executed process
356 becomes the controlling process of the
357 terminal. If the terminal is already
358 being controlled by another process the
359 executed process waits until the current
360 controlling process releases the
362 <option>tty-force</option>
363 is similar to <option>tty</option>,
364 but the executed process is forcefully
365 and immediately made the controlling
366 process of the terminal, potentially
367 removing previous controlling
369 terminal. <option>tty-fail</option> is
370 similar to <option>tty</option> but if
371 the terminal already has a controlling
372 process start-up of the executed
374 <option>socket</option> option is only
375 valid in socket-activated services,
376 and only when the socket configuration
378 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>
379 for details) specifies a single socket
380 only. If this option is set standard
381 input will be connected to the socket
382 the service was activated from, which
383 is primarily useful for compatibility
384 with daemons designed for use with the
386 <citerefentry><refentrytitle>inetd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
387 daemon. This setting defaults to
388 <option>null</option>.</para></listitem>
391 <term><varname>StandardOutput=</varname></term>
392 <listitem><para>Controls where file
393 descriptor 1 (STDOUT) of the executed
394 processes is connected to. Takes one
395 of <option>inherit</option>,
396 <option>null</option>,
397 <option>tty</option>,
398 <option>syslog</option>,
399 <option>kmsg</option>,
400 <option>journal</option>,
401 <option>syslog+console</option>,
402 <option>kmsg+console</option>,
403 <option>journal+console</option> or
404 <option>socket</option>. If set to
405 <option>inherit</option> the file
406 descriptor of standard input is
407 duplicated for standard output. If set
408 to <option>null</option> standard
409 output will be connected to
410 <filename>/dev/null</filename>,
411 i.e. everything written to it will be
412 lost. If set to <option>tty</option>
413 standard output will be connected to a
414 tty (as configured via
415 <varname>TTYPath=</varname>, see
416 below). If the TTY is used for output
417 only the executed process will not
418 become the controlling process of the
419 terminal, and will not fail or wait
420 for other processes to release the
421 terminal. <option>syslog</option>
422 connects standard output to the
423 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
425 service. <option>kmsg</option>
426 connects it with the kernel log buffer
427 which is accessible via
428 <citerefentry><refentrytitle>dmesg</refentrytitle><manvolnum>1</manvolnum></citerefentry>. <option>journal</option>
429 connects it with the journal which is
431 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
432 (Note that everything that is written
433 to syslog or kmsg is implicitly stored
434 in the journal as well, those options
435 are hence supersets of this
436 one). <option>syslog+console</option>,
437 <option>journal+console</option> and
438 <option>kmsg+console</option> work
439 similarly but copy the output to the
441 well. <option>socket</option> connects
442 standard output to a socket from
443 socket activation, semantics are
444 similar to the respective option of
445 <varname>StandardInput=</varname>.
446 This setting defaults to the value set
448 <option>DefaultStandardOutput=</option>
450 <citerefentry><refentrytitle>systemd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
452 <option>journal</option>.</para></listitem>
455 <term><varname>StandardError=</varname></term>
456 <listitem><para>Controls where file
457 descriptor 2 (STDERR) of the executed
458 processes is connected to. The
459 available options are identical to
461 <varname>StandardOutput=</varname>,
462 with one exception: if set to
463 <option>inherit</option> the file
464 descriptor used for standard output is
465 duplicated for standard error. This
466 setting defaults to the value set with
467 <option>DefaultStandardError=</option>
469 <citerefentry><refentrytitle>systemd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
471 <option>inherit</option>.</para></listitem>
474 <term><varname>TTYPath=</varname></term>
475 <listitem><para>Sets the terminal
476 device node to use if standard input,
477 output or stderr are connected to a
478 TTY (see above). Defaults to
479 <filename>/dev/console</filename>.</para></listitem>
482 <term><varname>TTYReset=</varname></term>
483 <listitem><para>Reset the terminal
484 device specified with
485 <varname>TTYPath=</varname> before and
486 after execution. Defaults to
487 <literal>no</literal>.</para></listitem>
490 <term><varname>TTYVHangup=</varname></term>
491 <listitem><para>Disconnect all clients
492 which have opened the terminal device
494 <varname>TTYPath=</varname>
495 before and after execution. Defaults
497 <literal>no</literal>.</para></listitem>
500 <term><varname>TTYVTDisallocate=</varname></term>
501 <listitem><para>If the terminal
502 device specified with
503 <varname>TTYPath=</varname> is a
504 virtual console terminal try to
505 deallocate the TTY before and after
506 execution. This ensures that the
507 screen and scrollback buffer is
509 <literal>no</literal>.</para></listitem>
512 <term><varname>SyslogIdentifier=</varname></term>
513 <listitem><para>Sets the process name
514 to prefix log lines sent to syslog or
515 the kernel log buffer with. If not set
516 defaults to the process name of the
517 executed process. This option is only
519 <varname>StandardOutput=</varname> or
520 <varname>StandardError=</varname> are
521 set to <option>syslog</option> or
522 <option>kmsg</option>.</para></listitem>
525 <term><varname>SyslogFacility=</varname></term>
526 <listitem><para>Sets the syslog
527 facility to use when logging to
528 syslog. One of <option>kern</option>,
529 <option>user</option>,
530 <option>mail</option>,
531 <option>daemon</option>,
532 <option>auth</option>,
533 <option>syslog</option>,
534 <option>lpr</option>,
535 <option>news</option>,
536 <option>uucp</option>,
537 <option>cron</option>,
538 <option>authpriv</option>,
539 <option>ftp</option>,
540 <option>local0</option>,
541 <option>local1</option>,
542 <option>local2</option>,
543 <option>local3</option>,
544 <option>local4</option>,
545 <option>local5</option>,
546 <option>local6</option> or
547 <option>local7</option>. See
548 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
549 for details. This option is only
551 <varname>StandardOutput=</varname> or
552 <varname>StandardError=</varname> are
553 set to <option>syslog</option>.
555 <option>daemon</option>.</para></listitem>
558 <term><varname>SyslogLevel=</varname></term>
559 <listitem><para>Default syslog level
560 to use when logging to syslog or the
561 kernel log buffer. One of
562 <option>emerg</option>,
563 <option>alert</option>,
564 <option>crit</option>,
565 <option>err</option>,
566 <option>warning</option>,
567 <option>notice</option>,
568 <option>info</option>,
569 <option>debug</option>. See
570 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
571 for details. This option is only
573 <varname>StandardOutput=</varname> or
574 <varname>StandardError=</varname> are
575 set to <option>syslog</option> or
576 <option>kmsg</option>. Note that
577 individual lines output by the daemon
578 might be prefixed with a different log
579 level which can be used to override
580 the default log level specified
581 here. The interpretation of these
582 prefixes may be disabled with
583 <varname>SyslogLevelPrefix=</varname>,
584 see below. For details see
585 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
588 <option>info</option>.</para></listitem>
592 <term><varname>SyslogLevelPrefix=</varname></term>
593 <listitem><para>Takes a boolean
594 argument. If true and
595 <varname>StandardOutput=</varname> or
596 <varname>StandardError=</varname> are
597 set to <option>syslog</option>,
598 <option>kmsg</option> or
599 <option>journal</option>, log lines
600 written by the executed process that
601 are prefixed with a log level will be
602 passed on to syslog with this log
603 level set but the prefix removed. If
604 set to false, the interpretation of
605 these prefixes is disabled and the
606 logged lines are passed on as-is. For
607 details about this prefixing see
608 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
609 Defaults to true.</para></listitem>
613 <term><varname>TimerSlackNSec=</varname></term>
614 <listitem><para>Sets the timer slack
615 in nanoseconds for the executed
616 processes. The timer slack controls
617 the accuracy of wake-ups triggered by
619 <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
620 for more information. Note that in
621 contrast to most other time span
622 definitions this parameter takes an
623 integer value in nano-seconds if no
624 unit is specified. The usual time
626 too.</para></listitem>
630 <term><varname>LimitCPU=</varname></term>
631 <term><varname>LimitFSIZE=</varname></term>
632 <term><varname>LimitDATA=</varname></term>
633 <term><varname>LimitSTACK=</varname></term>
634 <term><varname>LimitCORE=</varname></term>
635 <term><varname>LimitRSS=</varname></term>
636 <term><varname>LimitNOFILE=</varname></term>
637 <term><varname>LimitAS=</varname></term>
638 <term><varname>LimitNPROC=</varname></term>
639 <term><varname>LimitMEMLOCK=</varname></term>
640 <term><varname>LimitLOCKS=</varname></term>
641 <term><varname>LimitSIGPENDING=</varname></term>
642 <term><varname>LimitMSGQUEUE=</varname></term>
643 <term><varname>LimitNICE=</varname></term>
644 <term><varname>LimitRTPRIO=</varname></term>
645 <term><varname>LimitRTTIME=</varname></term>
646 <listitem><para>These settings control
647 various resource limits for executed
649 <citerefentry><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry>
650 for details. Use the string
651 <varname>infinity</varname> to
652 configure no limit on a specific
653 resource.</para></listitem>
657 <term><varname>PAMName=</varname></term>
658 <listitem><para>Sets the PAM service
659 name to set up a session as. If set
660 the executed process will be
661 registered as a PAM session under the
662 specified service name. This is only
663 useful in conjunction with the
664 <varname>User=</varname> setting. If
665 not set no PAM session will be opened
666 for the executed processes. See
667 <citerefentry><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>
668 for details.</para></listitem>
672 <term><varname>TCPWrapName=</varname></term>
673 <listitem><para>If this is a
674 socket-activated service this sets the
675 tcpwrap service name to check the
676 permission for the current connection
677 with. This is only useful in
678 conjunction with socket-activated
679 services, and stream sockets (TCP) in
680 particular. It has no effect on other
681 socket types (e.g. datagram/UDP) and
682 on processes unrelated to socket-based
683 activation. If the tcpwrap
684 verification fails daemon start-up
685 will fail and the connection is
687 <citerefentry><refentrytitle>tcpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
688 for details. Note that this option may
689 be used to do access control checks
690 only. Shell commands and commands
692 <citerefentry><refentrytitle>hosts_options</refentrytitle><manvolnum>5</manvolnum></citerefentry>
693 are not supported.</para></listitem>
697 <term><varname>CapabilityBoundingSet=</varname></term>
699 <listitem><para>Controls which
700 capabilities to include in the
701 capability bounding set for the
702 executed process. See
703 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
704 for details. Takes a whitespace
705 separated list of capability names as
707 <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
708 Capabilities listed will be included
709 in the bounding set, all others are
710 removed. If the list of capabilities
711 is prefixed with ~ all but the listed
712 capabilities will be included, the
713 effect of the assignment
714 inverted. Note that this option also
715 effects the respective capabilities in
716 the effective, permitted and
717 inheritable capability sets, on top of
718 what <varname>Capabilities=</varname>
719 does. If this option is not used the
720 capability bounding set is not
721 modified on process execution, hence
722 no limits on the capabilities of the
723 process are enforced. This option may
724 appear more than once in which case
725 the bounding sets are merged. If the empty
726 string is assigned to this option the
727 bounding set is reset, and all prior
729 effect.</para></listitem>
733 <term><varname>SecureBits=</varname></term>
734 <listitem><para>Controls the secure
735 bits set for the executed process. See
736 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
737 for details. Takes a list of strings:
738 <option>keep-caps</option>,
739 <option>keep-caps-locked</option>,
740 <option>no-setuid-fixup</option>,
741 <option>no-setuid-fixup-locked</option>,
742 <option>noroot</option> and/or
743 <option>noroot-locked</option>. This
744 option may appear more than once in
745 which case the secure bits are
746 ORed. If the empty string is assigned
747 to this option the bits are reset to
752 <term><varname>Capabilities=</varname></term>
753 <listitem><para>Controls the
754 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
755 set for the executed process. Take a
756 capability string describing the
757 effective, permitted and inherited
758 capability sets as documented in
759 <citerefentry><refentrytitle>cap_from_text</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
760 Note that these capability sets are
761 usually influenced by the capabilities
762 attached to the executed file. Due to
764 <varname>CapabilityBoundingSet=</varname>
765 is probably the much more useful
766 setting.</para></listitem>
770 <term><varname>ControlGroup=</varname></term>
772 <listitem><para>Controls the control
773 groups the executed processes shall be
774 made members of. Takes a
775 space-separated list of cgroup
776 identifiers. A cgroup identifier is
778 <filename>cpu:/foo/bar</filename>,
779 where "cpu" indicates the kernel
780 control group controller used, and
781 <filename>/foo/bar</filename> is the
782 control group path. The controller
783 name and ":" may be omitted in which
784 case the named systemd control group
785 hierarchy is implied. Alternatively,
786 the path and ":" may be omitted, in
787 which case the default control group
788 path for this unit is implied.</para>
790 <para>This option may be used to place
791 executed processes in arbitrary groups
792 in arbitrary hierarchies -- which may
793 then be externally configured with
794 additional execution limits. By
795 default systemd will place all
796 executed processes in separate
797 per-unit control groups (named after
798 the unit) in the systemd named
799 hierarchy. This option is primarily
800 intended to place executed processes
801 in specific paths in specific kernel
802 controller hierarchies. It is not
803 recommended to manipulate the service
804 control group path in the systemd
805 named hierarchy. For details about
806 control groups see <ulink
807 url="http://www.kernel.org/doc/Documentation/cgroups/cgroups.txt">cgroups.txt</ulink>.</para>
809 <para>This option may appear more than
810 once, in which case the list of
811 control group assignments is
812 merged. If the same hierarchy gets two
813 different paths assigned only the
814 later setting will take effect. If the
815 empty string is assigned to this
816 option the list of control group
817 assignments is reset, all previous
818 assignments will have no
821 <para>Note that the list of control
822 group assignments of a unit is
823 extended implicitly based on the
825 <varname>DefaultControllers=</varname>
827 <citerefentry><refentrytitle>systemd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
829 <varname>ControlGroup=</varname>
830 setting for a specific controller
831 takes precedence.</para></listitem>
835 <term><varname>ControlGroupModify=</varname></term>
836 <listitem><para>Takes a boolean
837 argument. If true, the control groups
838 created for this unit will be owned by
839 the user specified with
840 <varname>User=</varname> (and the
841 appropriate group), and he/she can create
842 subgroups as well as add processes to
843 the group.</para></listitem>
847 <term><varname>ControlGroupPersistent=</varname></term>
848 <listitem><para>Takes a boolean
849 argument. If true, the control groups
850 created for this unit will be marked
851 to be persistent, i.e. systemd will
852 not remove them when stopping the
853 unit. The default is false, meaning
854 that the control groups will be
855 removed when the unit is stopped. For
856 details about the semantics of this
858 url="http://www.freedesktop.org/wiki/Software/systemd/PaxControlGroups">PaxControlGroups</ulink>.</para></listitem>
862 <term><varname>ControlGroupAttribute=</varname></term>
864 <listitem><para>Set a specific control
865 group attribute for executed
866 processes, and (if needed) add the
867 executed processes to a cgroup in the
868 hierarchy of the controller the
869 attribute belongs to. Takes two
870 space-separated arguments: the
871 attribute name (syntax is
872 <literal>cpu.shares</literal> where
873 <literal>cpu</literal> refers to a
874 specific controller and
875 <literal>shares</literal> to the
876 attribute name), and the attribute
878 <literal>ControlGroupAttribute=cpu.shares
879 512</literal>. If this option is used
880 for an attribute that belongs to a
881 kernel controller hierarchy the unit
882 is not already configured to be added
883 to (for example via the
884 <literal>ControlGroup=</literal>
885 option) then the unit will be added to
886 the controller and the default unit
887 cgroup path is implied. Thus, using
888 <varname>ControlGroupAttribute=</varname>
889 is in most cases sufficient to make
890 use of control group enforcements,
892 <varname>ControlGroup=</varname> are
893 only necessary in case the implied
894 default control group path for a
895 service is not desirable. For details
896 about control group attributes see
898 url="http://www.kernel.org/doc/Documentation/cgroups/cgroups.txt">cgroups.txt</ulink>. This
899 option may appear more than once, in
900 order to set multiple control group
901 attributes. If this option is used
902 multiple times for the same cgroup
903 attribute only the later setting takes
904 effect. If the empty string is
905 assigned to this option the list of
906 attributes is reset, all previous
907 cgroup attribute settings have no
908 effect, including those done with
909 <varname>CPUShares=</varname>,
910 <varname>MemoryLimit=</varname>,
911 <varname>MemorySoftLimit</varname>,
912 <varname>DeviceAllow=</varname>,
913 <varname>DeviceDeny=</varname>,
914 <varname>BlockIOWeight=</varname>,
915 <varname>BlockIOReadBandwidth=</varname>,
916 <varname>BlockIOWriteBandwidth=</varname>.
921 <term><varname>CPUShares=</varname></term>
923 <listitem><para>Assign the specified
924 overall CPU time shares to the
925 processes executed. Takes an integer
926 value. This controls the
927 <literal>cpu.shares</literal> control
928 group attribute, which defaults to
929 1024. For details about this control
930 group attribute see <ulink
931 url="http://www.kernel.org/doc/Documentation/scheduler/sched-design-CFS.txt">sched-design-CFS.txt</ulink>.</para></listitem>
935 <term><varname>MemoryLimit=</varname></term>
936 <term><varname>MemorySoftLimit=</varname></term>
938 <listitem><para>Limit the overall memory usage
939 of the executed processes to a certain
940 size. Takes a memory size in bytes. If
941 the value is suffixed with K, M, G or
942 T the specified memory size is parsed
943 as Kilobytes, Megabytes, Gigabytes,
944 or Terabytes (to the base
945 1024), respectively. This controls the
946 <literal>memory.limit_in_bytes</literal>
948 <literal>memory.soft_limit_in_bytes</literal>
949 control group attributes. For details
950 about these control group attributes
952 url="http://www.kernel.org/doc/Documentation/cgroups/memory.txt">memory.txt</ulink>.</para></listitem>
956 <term><varname>DeviceAllow=</varname></term>
957 <term><varname>DeviceDeny=</varname></term>
959 <listitem><para>Control access to
960 specific device nodes by the executed processes. Takes two
961 space separated strings: a device node
963 <filename>/dev/null</filename>)
964 followed by a combination of r, w, m
965 to control reading, writing, or
966 creating of the specific device node
967 by the unit, respectively. This controls the
968 <literal>devices.allow</literal>
970 <literal>devices.deny</literal>
971 control group attributes. For details
972 about these control group attributes
974 url="http://www.kernel.org/doc/Documentation/cgroups/devices.txt">devices.txt</ulink>.</para></listitem>
978 <term><varname>BlockIOWeight=</varname></term>
980 <listitem><para>Set the default or
981 per-device overall block IO weight
982 value for the executed
983 processes. Takes either a single
984 weight value (between 10 and 1000) to
985 set the default block IO weight, or a
986 space separated pair of a file path
987 and a weight value to specify the
988 device specific weight value (Example:
989 "/dev/sda 500"). The file path may be
990 specified as path to a block device
991 node or as any other file in which
992 case the backing block device of the
993 file system of the file is
994 determined. This controls the
995 <literal>blkio.weight</literal> and
996 <literal>blkio.weight_device</literal>
997 control group attributes, which
998 default to 1000. Use this option
999 multiple times to set weights for
1000 multiple devices. For details about
1001 these control group attributes see
1003 url="http://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt">blkio-controller.txt</ulink>.</para></listitem>
1007 <term><varname>BlockIOReadBandwidth=</varname></term>
1008 <term><varname>BlockIOWriteBandwidth=</varname></term>
1010 <listitem><para>Set the per-device
1011 overall block IO bandwidth limit for
1012 the executed processes. Takes a space
1013 separated pair of a file path and a
1014 bandwidth value (in bytes per second)
1015 to specify the device specific
1016 bandwidth. The file path may be
1017 specified as path to a block device
1018 node or as any other file in which
1019 case the backing block device of the
1020 file system of the file is determined.
1021 If the bandwidth is suffixed with K, M,
1022 G, or T the specified bandwidth is
1023 parsed as Kilobytes, Megabytes,
1024 Gigabytes, or Terabytes, respectively (Example:
1025 "/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0
1026 5M"). This controls the
1027 <literal>blkio.read_bps_device</literal>
1029 <literal>blkio.write_bps_device</literal>
1030 control group attributes. Use this
1031 option multiple times to set bandwidth
1032 limits for multiple devices. For
1033 details about these control group
1034 attributes see <ulink
1035 url="http://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt">blkio-controller.txt</ulink>.</para></listitem>
1039 <term><varname>ReadWriteDirectories=</varname></term>
1040 <term><varname>ReadOnlyDirectories=</varname></term>
1041 <term><varname>InaccessibleDirectories=</varname></term>
1043 <listitem><para>Sets up a new
1044 file-system name space for executed
1045 processes. These options may be used
1046 to limit access a process might have
1047 to the main file-system
1048 hierarchy. Each setting takes a
1049 space-separated list of absolute
1050 directory paths. Directories listed in
1051 <varname>ReadWriteDirectories=</varname>
1052 are accessible from within the
1053 namespace with the same access rights
1054 as from outside. Directories listed in
1055 <varname>ReadOnlyDirectories=</varname>
1056 are accessible for reading only,
1057 writing will be refused even if the
1058 usual file access controls would
1059 permit this. Directories listed in
1060 <varname>InaccessibleDirectories=</varname>
1061 will be made inaccessible for
1062 processes inside the namespace. Note
1063 that restricting access with these
1064 options does not extend to submounts
1065 of a directory. You must list
1066 submounts separately in these settings
1067 to ensure the same limited
1068 access. These options may be specified
1069 more than once in which case all
1070 directories listed will have limited
1071 access from within the namespace. If
1072 the empty string is assigned to this
1073 option the specific list is reset, and
1074 all prior assignments have no
1075 effect.</para></listitem>
1079 <term><varname>PrivateTmp=</varname></term>
1081 <listitem><para>Takes a boolean
1082 argument. If true sets up a new file
1083 system namespace for the executed
1084 processes and mounts a private
1085 <filename>/tmp</filename> directory
1086 inside it, that is not shared by
1087 processes outside of the
1088 namespace. This is useful to secure
1089 access to temporary files of the
1090 process, but makes sharing between
1092 <filename>/tmp</filename>
1093 impossible. Defaults to
1094 false.</para></listitem>
1098 <term><varname>PrivateNetwork=</varname></term>
1100 <listitem><para>Takes a boolean
1101 argument. If true sets up a new
1102 network namespace for the executed
1103 processes and configures only the
1104 loopback network device
1105 <literal>lo</literal> inside it. No
1106 other network devices will be
1107 available to the executed process.
1108 This is useful to securely turn off
1109 network access by the executed
1110 process. Defaults to
1111 false.</para></listitem>
1115 <term><varname>MountFlags=</varname></term>
1117 <listitem><para>Takes a mount
1119 <option>shared</option>,
1120 <option>slave</option> or
1121 <option>private</option>, which
1122 control whether the file system
1123 namespace set up for this unit's
1124 processes will receive or propagate
1126 <citerefentry><refentrytitle>mount</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1127 for details. Default to
1128 <option>shared</option>.</para></listitem>
1132 <term><varname>UtmpIdentifier=</varname></term>
1134 <listitem><para>Takes a four
1135 character identifier string for an
1136 utmp/wtmp entry for this service. This
1137 should only be set for services such
1138 as <command>getty</command>
1139 implementations where utmp/wtmp
1140 entries must be created and cleared
1141 before and after execution. If the
1142 configured string is longer than four
1143 characters it is truncated and the
1144 terminal four characters are
1145 used. This setting interprets %I style
1146 string replacements. This setting is
1147 unset by default, i.e. no utmp/wtmp
1148 entries are created or cleaned up for
1149 this service.</para></listitem>
1153 <term><varname>IgnoreSIGPIPE=</varname></term>
1155 <listitem><para>Takes a boolean
1156 argument. If true causes SIGPIPE to be
1157 ignored in the executed
1158 process. Defaults to true, since
1159 SIGPIPE generally is useful only in
1160 shell pipelines.</para></listitem>
1164 <term><varname>NoNewPrivileges=</varname></term>
1166 <listitem><para>Takes a boolean
1167 argument. If true ensures that the
1168 service process and all its children
1169 can never gain new privileges. This
1170 option is more powerful than the respective
1171 secure bits flags (see above), as it
1172 also prohibits UID changes of any
1173 kind. This is the simplest, most
1174 effective way to ensure that a process
1175 and its children can never elevate
1176 privileges again.</para></listitem>
1180 <term><varname>SystemCallFilter=</varname></term>
1182 <listitem><para>Takes a space
1183 separated list of system call
1184 names. If this setting is used all
1185 system calls executed by the unit
1186 process except for the listed ones
1187 will result in immediate process
1188 termination with the SIGSYS signal
1189 (whitelisting). If the first character
1190 of the list is <literal>~</literal>
1191 the effect is inverted: only the
1192 listed system calls will result in
1193 immediate process termination
1194 (blacklisting). If this option is used
1195 <varname>NoNewPrivileges=yes</varname>
1196 is implied. This feature makes use of
1197 the Secure Computing Mode 2 interfaces
1198 of the kernel ('seccomp filtering')
1199 and is useful for enforcing a minimal
1200 sandboxing environment. Note that the
1201 <function>execve</function>,
1202 <function>rt_sigreturn</function>,
1203 <function>sigreturn</function>,
1204 <function>exit_group</function>,
1205 <function>exit</function> system calls
1206 are implicitly whitelisted and don't
1207 need to be listed explicitly. This
1208 option may be specified more than once
1209 in which case the filter masks are
1210 merged. If the empty string is
1211 assigned the filter is reset, all
1212 prior assignments will have no
1213 effect.</para></listitem>
1220 <title>See Also</title>
1222 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1223 <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1224 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1225 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1226 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1227 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1228 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1229 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1230 <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1231 <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>