1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <?xml-stylesheet type="text/xsl" href="http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl"?>
3 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
4 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
7 This file is part of systemd.
9 Copyright 2010 Lennart Poettering
11 systemd is free software; you can redistribute it and/or modify it
12 under the terms of the GNU Lesser General Public License as published by
13 the Free Software Foundation; either version 2.1 of the License, or
14 (at your option) any later version.
16 systemd is distributed in the hope that it will be useful, but
17 WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
19 Lesser General Public License for more details.
21 You should have received a copy of the GNU Lesser General Public License
22 along with systemd; If not, see <http://www.gnu.org/licenses/>.
25 <refentry id="systemd.exec">
27 <title>systemd.exec</title>
28 <productname>systemd</productname>
32 <contrib>Developer</contrib>
33 <firstname>Lennart</firstname>
34 <surname>Poettering</surname>
35 <email>lennart@poettering.net</email>
41 <refentrytitle>systemd.exec</refentrytitle>
42 <manvolnum>5</manvolnum>
46 <refname>systemd.exec</refname>
47 <refpurpose>Execution environment configuration</refpurpose>
51 <para><filename><replaceable>service</replaceable>.service</filename>,
52 <filename><replaceable>socket</replaceable>.socket</filename>,
53 <filename><replaceable>mount</replaceable>.mount</filename>,
54 <filename><replaceable>swap</replaceable>.swap</filename></para>
58 <title>Description</title>
60 <para>Unit configuration files for services, sockets,
61 mount points and swap devices share a subset of
62 configuration options which define the execution
63 environment of spawned processes.</para>
65 <para>This man page lists the configuration options
66 shared by these four unit types. See
67 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
68 for the common options of all unit configuration
70 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
71 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
72 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
74 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>
75 for more information on the specific unit
76 configuration files. The execution specific
77 configuration options are configured in the [Service],
78 [Socket], [Mount], or [Swap] sections, depending on the unit
83 <title>Options</title>
85 <variablelist class='unit-directives'>
88 <term><varname>WorkingDirectory=</varname></term>
90 <listitem><para>Takes an absolute
91 directory path. Sets the working
92 directory for executed processes. If
93 not set defaults to the root directory
94 when systemd is running as a system
95 instance and the respective user's
96 home directory if run as
97 user.</para></listitem>
101 <term><varname>RootDirectory=</varname></term>
103 <listitem><para>Takes an absolute
104 directory path. Sets the root
105 directory for executed processes, with
107 <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry>
108 system call. If this is used it must
109 be ensured that the process and all
110 its auxiliary files are available in
111 the <function>chroot()</function>
112 jail.</para></listitem>
116 <term><varname>User=</varname></term>
117 <term><varname>Group=</varname></term>
119 <listitem><para>Sets the Unix user
120 or group that the processes are executed
121 as, respectively. Takes a single user or group
122 name or ID as argument. If no group is
123 set, the default group of the user is
124 chosen.</para></listitem>
128 <term><varname>SupplementaryGroups=</varname></term>
130 <listitem><para>Sets the supplementary
131 Unix groups the processes are executed
132 as. This takes a space-separated list
133 of group names or IDs. This option may
134 be specified more than once in which
135 case all listed groups are set as
136 supplementary groups. When the empty
137 string is assigned the list of
138 supplementary groups is reset, and all
139 assignments prior to this one will
140 have no effect. In any way, this
141 option does not override, but extends
142 the list of supplementary groups
143 configured in the system group
145 user.</para></listitem>
149 <term><varname>Nice=</varname></term>
151 <listitem><para>Sets the default nice
152 level (scheduling priority) for
153 executed processes. Takes an integer
154 between -20 (highest priority) and 19
155 (lowest priority). See
156 <citerefentry><refentrytitle>setpriority</refentrytitle><manvolnum>2</manvolnum></citerefentry>
157 for details.</para></listitem>
161 <term><varname>OOMScoreAdjust=</varname></term>
163 <listitem><para>Sets the adjustment
164 level for the Out-Of-Memory killer for
165 executed processes. Takes an integer
166 between -1000 (to disable OOM killing
167 for this process) and 1000 (to make
168 killing of this process under memory
169 pressure very likely). See <ulink
170 url="https://www.kernel.org/doc/Documentation/filesystems/proc.txt">proc.txt</ulink>
171 for details.</para></listitem>
175 <term><varname>IOSchedulingClass=</varname></term>
177 <listitem><para>Sets the IO scheduling
178 class for executed processes. Takes an
179 integer between 0 and 3 or one of the
180 strings <option>none</option>,
181 <option>realtime</option>,
182 <option>best-effort</option> or
183 <option>idle</option>. See
184 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
185 for details.</para></listitem>
189 <term><varname>IOSchedulingPriority=</varname></term>
191 <listitem><para>Sets the IO scheduling
192 priority for executed processes. Takes
193 an integer between 0 (highest
194 priority) and 7 (lowest priority). The
195 available priorities depend on the
196 selected IO scheduling class (see
198 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
199 for details.</para></listitem>
203 <term><varname>CPUSchedulingPolicy=</varname></term>
205 <listitem><para>Sets the CPU
206 scheduling policy for executed
207 processes. Takes one of
208 <option>other</option>,
209 <option>batch</option>,
210 <option>idle</option>,
211 <option>fifo</option> or
212 <option>rr</option>. See
213 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
214 for details.</para></listitem>
218 <term><varname>CPUSchedulingPriority=</varname></term>
220 <listitem><para>Sets the CPU
221 scheduling priority for executed
222 processes. The available priority
223 range depends on the selected CPU
224 scheduling policy (see above). For
225 real-time scheduling policies an
226 integer between 1 (lowest priority)
227 and 99 (highest priority) can be used.
228 See <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
234 <term><varname>CPUSchedulingResetOnFork=</varname></term>
236 <listitem><para>Takes a boolean
237 argument. If true elevated CPU
238 scheduling priorities and policies
239 will be reset when the executed
240 processes fork, and can hence not leak
241 into child processes. See
242 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
243 for details. Defaults to false.</para></listitem>
247 <term><varname>CPUAffinity=</varname></term>
249 <listitem><para>Controls the CPU
250 affinity of the executed
251 processes. Takes a space-separated
252 list of CPU indexes. This option may
253 be specified more than once in which
254 case the specificed CPU affinity masks
255 are merged. If the empty string is
256 assigned the mask is reset, all
257 assignments prior to this will have no
259 <citerefentry><refentrytitle>sched_setaffinity</refentrytitle><manvolnum>2</manvolnum></citerefentry>
260 for details.</para></listitem>
264 <term><varname>UMask=</varname></term>
266 <listitem><para>Controls the file mode
267 creation mask. Takes an access mode in
269 <citerefentry><refentrytitle>umask</refentrytitle><manvolnum>2</manvolnum></citerefentry>
270 for details. Defaults to
271 0022.</para></listitem>
275 <term><varname>Environment=</varname></term>
277 <listitem><para>Sets environment
278 variables for executed
279 processes. Takes a space-separated
280 list of variable assignments. This
281 option may be specified more than once
282 in which case all listed variables
283 will be set. If the same variable is
284 set twice the later setting will
285 override the earlier setting. If the
286 empty string is assigned to this
287 option the list of environment
288 variables is reset, all prior
289 assignments have no effect.
290 Variable expansion is not performed
291 inside the strings, however, specifier
292 expansion is possible. $ character has
294 If you need to assign a value containing spaces
295 to a variable, use double quotes (")
296 for the assignment.</para>
299 <programlisting>Environment="VAR1=word1 word2" VAR2=word3 "VAR3=word 5 6"</programlisting>
300 gives three variables <literal>VAR1</literal>,
301 <literal>VAR2</literal>, <literal>VAR3</literal>.
306 <citerefentry><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>
307 for details about environment variables.</para></listitem>
310 <term><varname>EnvironmentFile=</varname></term>
311 <listitem><para>Similar to
312 <varname>Environment=</varname> but
313 reads the environment variables from a
314 text file. The text file should
315 contain new-line-separated variable
316 assignments. Empty lines and lines
317 starting with ; or # will be ignored,
318 which may be used for commenting. A line
319 ending with a backslash will be concatenated
320 with the following one, allowing multiline variable
321 definitions. The parser strips leading
322 and trailing whitespace from the values
323 of assignments, unless you use
324 double quotes (").</para>
326 <para>The argument passed should be an
327 absolute filename or wildcard
328 expression, optionally prefixed with
329 <literal>-</literal>, which indicates
330 that if the file does not exist it
331 won't be read and no error or warning
332 message is logged. This option may be
333 specified more than once in which case
334 all specified files are read. If the
335 empty string is assigned to this
336 option the list of file to read is
337 reset, all prior assignments have no
340 <para>The files listed with this
341 directive will be read shortly before
342 the process is executed. Settings from
343 these files override settings made
345 <varname>Environment=</varname>. If
346 the same variable is set twice from
347 these files the files will be read in
348 the order they are specified and the
349 later setting will override the
350 earlier setting.</para></listitem>
354 <term><varname>StandardInput=</varname></term>
355 <listitem><para>Controls where file
356 descriptor 0 (STDIN) of the executed
357 processes is connected to. Takes one
358 of <option>null</option>,
359 <option>tty</option>,
360 <option>tty-force</option>,
361 <option>tty-fail</option> or
362 <option>socket</option>. If
363 <option>null</option> is selected
364 standard input will be connected to
365 <filename>/dev/null</filename>,
366 i.e. all read attempts by the process
367 will result in immediate EOF. If
368 <option>tty</option> is selected
369 standard input is connected to a TTY
371 <varname>TTYPath=</varname>, see
372 below) and the executed process
373 becomes the controlling process of the
374 terminal. If the terminal is already
375 being controlled by another process the
376 executed process waits until the current
377 controlling process releases the
379 <option>tty-force</option>
380 is similar to <option>tty</option>,
381 but the executed process is forcefully
382 and immediately made the controlling
383 process of the terminal, potentially
384 removing previous controlling
386 terminal. <option>tty-fail</option> is
387 similar to <option>tty</option> but if
388 the terminal already has a controlling
389 process start-up of the executed
391 <option>socket</option> option is only
392 valid in socket-activated services,
393 and only when the socket configuration
395 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>
396 for details) specifies a single socket
397 only. If this option is set standard
398 input will be connected to the socket
399 the service was activated from, which
400 is primarily useful for compatibility
401 with daemons designed for use with the
403 <citerefentry><refentrytitle>inetd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
404 daemon. This setting defaults to
405 <option>null</option>.</para></listitem>
408 <term><varname>StandardOutput=</varname></term>
409 <listitem><para>Controls where file
410 descriptor 1 (STDOUT) of the executed
411 processes is connected to. Takes one
412 of <option>inherit</option>,
413 <option>null</option>,
414 <option>tty</option>,
415 <option>syslog</option>,
416 <option>kmsg</option>,
417 <option>journal</option>,
418 <option>syslog+console</option>,
419 <option>kmsg+console</option>,
420 <option>journal+console</option> or
421 <option>socket</option>. If set to
422 <option>inherit</option> the file
423 descriptor of standard input is
424 duplicated for standard output. If set
425 to <option>null</option> standard
426 output will be connected to
427 <filename>/dev/null</filename>,
428 i.e. everything written to it will be
429 lost. If set to <option>tty</option>
430 standard output will be connected to a
431 tty (as configured via
432 <varname>TTYPath=</varname>, see
433 below). If the TTY is used for output
434 only the executed process will not
435 become the controlling process of the
436 terminal, and will not fail or wait
437 for other processes to release the
438 terminal. <option>syslog</option>
439 connects standard output to the
440 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
442 service. <option>kmsg</option>
443 connects it with the kernel log buffer
444 which is accessible via
445 <citerefentry><refentrytitle>dmesg</refentrytitle><manvolnum>1</manvolnum></citerefentry>. <option>journal</option>
446 connects it with the journal which is
448 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
449 (Note that everything that is written
450 to syslog or kmsg is implicitly stored
451 in the journal as well, those options
452 are hence supersets of this
453 one). <option>syslog+console</option>,
454 <option>journal+console</option> and
455 <option>kmsg+console</option> work
456 similarly but copy the output to the
458 well. <option>socket</option> connects
459 standard output to a socket from
460 socket activation, semantics are
461 similar to the respective option of
462 <varname>StandardInput=</varname>.
463 This setting defaults to the value set
465 <option>DefaultStandardOutput=</option>
467 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
469 <option>journal</option>.</para></listitem>
472 <term><varname>StandardError=</varname></term>
473 <listitem><para>Controls where file
474 descriptor 2 (STDERR) of the executed
475 processes is connected to. The
476 available options are identical to
478 <varname>StandardOutput=</varname>,
479 with one exception: if set to
480 <option>inherit</option> the file
481 descriptor used for standard output is
482 duplicated for standard error. This
483 setting defaults to the value set with
484 <option>DefaultStandardError=</option>
486 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
488 <option>inherit</option>.</para></listitem>
491 <term><varname>TTYPath=</varname></term>
492 <listitem><para>Sets the terminal
493 device node to use if standard input,
494 output or stderr are connected to a
495 TTY (see above). Defaults to
496 <filename>/dev/console</filename>.</para></listitem>
499 <term><varname>TTYReset=</varname></term>
500 <listitem><para>Reset the terminal
501 device specified with
502 <varname>TTYPath=</varname> before and
503 after execution. Defaults to
504 <literal>no</literal>.</para></listitem>
507 <term><varname>TTYVHangup=</varname></term>
508 <listitem><para>Disconnect all clients
509 which have opened the terminal device
511 <varname>TTYPath=</varname>
512 before and after execution. Defaults
514 <literal>no</literal>.</para></listitem>
517 <term><varname>TTYVTDisallocate=</varname></term>
518 <listitem><para>If the terminal
519 device specified with
520 <varname>TTYPath=</varname> is a
521 virtual console terminal try to
522 deallocate the TTY before and after
523 execution. This ensures that the
524 screen and scrollback buffer is
526 <literal>no</literal>.</para></listitem>
529 <term><varname>SyslogIdentifier=</varname></term>
530 <listitem><para>Sets the process name
531 to prefix log lines sent to syslog or
532 the kernel log buffer with. If not set
533 defaults to the process name of the
534 executed process. This option is only
536 <varname>StandardOutput=</varname> or
537 <varname>StandardError=</varname> are
538 set to <option>syslog</option> or
539 <option>kmsg</option>.</para></listitem>
542 <term><varname>SyslogFacility=</varname></term>
543 <listitem><para>Sets the syslog
544 facility to use when logging to
545 syslog. One of <option>kern</option>,
546 <option>user</option>,
547 <option>mail</option>,
548 <option>daemon</option>,
549 <option>auth</option>,
550 <option>syslog</option>,
551 <option>lpr</option>,
552 <option>news</option>,
553 <option>uucp</option>,
554 <option>cron</option>,
555 <option>authpriv</option>,
556 <option>ftp</option>,
557 <option>local0</option>,
558 <option>local1</option>,
559 <option>local2</option>,
560 <option>local3</option>,
561 <option>local4</option>,
562 <option>local5</option>,
563 <option>local6</option> or
564 <option>local7</option>. See
565 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
566 for details. This option is only
568 <varname>StandardOutput=</varname> or
569 <varname>StandardError=</varname> are
570 set to <option>syslog</option>.
572 <option>daemon</option>.</para></listitem>
575 <term><varname>SyslogLevel=</varname></term>
576 <listitem><para>Default syslog level
577 to use when logging to syslog or the
578 kernel log buffer. One of
579 <option>emerg</option>,
580 <option>alert</option>,
581 <option>crit</option>,
582 <option>err</option>,
583 <option>warning</option>,
584 <option>notice</option>,
585 <option>info</option>,
586 <option>debug</option>. See
587 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
588 for details. This option is only
590 <varname>StandardOutput=</varname> or
591 <varname>StandardError=</varname> are
592 set to <option>syslog</option> or
593 <option>kmsg</option>. Note that
594 individual lines output by the daemon
595 might be prefixed with a different log
596 level which can be used to override
597 the default log level specified
598 here. The interpretation of these
599 prefixes may be disabled with
600 <varname>SyslogLevelPrefix=</varname>,
601 see below. For details see
602 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
605 <option>info</option>.</para></listitem>
609 <term><varname>SyslogLevelPrefix=</varname></term>
610 <listitem><para>Takes a boolean
611 argument. If true and
612 <varname>StandardOutput=</varname> or
613 <varname>StandardError=</varname> are
614 set to <option>syslog</option>,
615 <option>kmsg</option> or
616 <option>journal</option>, log lines
617 written by the executed process that
618 are prefixed with a log level will be
619 passed on to syslog with this log
620 level set but the prefix removed. If
621 set to false, the interpretation of
622 these prefixes is disabled and the
623 logged lines are passed on as-is. For
624 details about this prefixing see
625 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
626 Defaults to true.</para></listitem>
630 <term><varname>TimerSlackNSec=</varname></term>
631 <listitem><para>Sets the timer slack
632 in nanoseconds for the executed
633 processes. The timer slack controls
634 the accuracy of wake-ups triggered by
636 <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
637 for more information. Note that in
638 contrast to most other time span
639 definitions this parameter takes an
640 integer value in nano-seconds if no
641 unit is specified. The usual time
643 too.</para></listitem>
647 <term><varname>LimitCPU=</varname></term>
648 <term><varname>LimitFSIZE=</varname></term>
649 <term><varname>LimitDATA=</varname></term>
650 <term><varname>LimitSTACK=</varname></term>
651 <term><varname>LimitCORE=</varname></term>
652 <term><varname>LimitRSS=</varname></term>
653 <term><varname>LimitNOFILE=</varname></term>
654 <term><varname>LimitAS=</varname></term>
655 <term><varname>LimitNPROC=</varname></term>
656 <term><varname>LimitMEMLOCK=</varname></term>
657 <term><varname>LimitLOCKS=</varname></term>
658 <term><varname>LimitSIGPENDING=</varname></term>
659 <term><varname>LimitMSGQUEUE=</varname></term>
660 <term><varname>LimitNICE=</varname></term>
661 <term><varname>LimitRTPRIO=</varname></term>
662 <term><varname>LimitRTTIME=</varname></term>
663 <listitem><para>These settings control
664 various resource limits for executed
666 <citerefentry><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry>
667 for details. Use the string
668 <varname>infinity</varname> to
669 configure no limit on a specific
670 resource.</para></listitem>
674 <term><varname>PAMName=</varname></term>
675 <listitem><para>Sets the PAM service
676 name to set up a session as. If set
677 the executed process will be
678 registered as a PAM session under the
679 specified service name. This is only
680 useful in conjunction with the
681 <varname>User=</varname> setting. If
682 not set no PAM session will be opened
683 for the executed processes. See
684 <citerefentry><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>
685 for details.</para></listitem>
689 <term><varname>TCPWrapName=</varname></term>
690 <listitem><para>If this is a
691 socket-activated service this sets the
692 tcpwrap service name to check the
693 permission for the current connection
694 with. This is only useful in
695 conjunction with socket-activated
696 services, and stream sockets (TCP) in
697 particular. It has no effect on other
698 socket types (e.g. datagram/UDP) and
699 on processes unrelated to socket-based
700 activation. If the tcpwrap
701 verification fails daemon start-up
702 will fail and the connection is
704 <citerefentry><refentrytitle>tcpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
705 for details. Note that this option may
706 be used to do access control checks
707 only. Shell commands and commands
709 <citerefentry><refentrytitle>hosts_options</refentrytitle><manvolnum>5</manvolnum></citerefentry>
710 are not supported.</para></listitem>
714 <term><varname>CapabilityBoundingSet=</varname></term>
716 <listitem><para>Controls which
717 capabilities to include in the
718 capability bounding set for the
719 executed process. See
720 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
721 for details. Takes a whitespace-separated
722 list of capability names as read by
723 <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
724 e.g. <constant>CAP_SYS_ADMIN</constant>,
725 <constant>CAP_DAC_OVERRIDE</constant>,
726 <constant>CAP_SYS_PTRACE</constant>.
727 Capabilities listed will be included
728 in the bounding set, all others are
729 removed. If the list of capabilities
730 is prefixed with <literal>~</literal>
731 all but the listed capabilities will
732 be included, the effect of the
733 assignment inverted. Note that this
734 option also affects the respective
735 capabilities in the effective,
736 permitted and inheritable capability
738 <varname>Capabilities=</varname>
739 does. If this option is not used the
740 capability bounding set is not
741 modified on process execution, hence
742 no limits on the capabilities of the
743 process are enforced. This option may
744 appear more than once in which case
745 the bounding sets are merged. If the
746 empty string is assigned to this
747 option the bounding set is reset to
748 the empty capability set, and all
749 prior settings have no effect. If set
750 to <literal>~</literal> (without any
751 further argument) the bounding set is
752 reset to the full set of available
753 capabilities, also undoing any
754 previous settings.</para></listitem>
758 <term><varname>SecureBits=</varname></term>
759 <listitem><para>Controls the secure
760 bits set for the executed process. See
761 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
762 for details. Takes a list of strings:
763 <option>keep-caps</option>,
764 <option>keep-caps-locked</option>,
765 <option>no-setuid-fixup</option>,
766 <option>no-setuid-fixup-locked</option>,
767 <option>noroot</option> and/or
768 <option>noroot-locked</option>. This
769 option may appear more than once in
770 which case the secure bits are
771 ORed. If the empty string is assigned
772 to this option the bits are reset to
777 <term><varname>Capabilities=</varname></term>
778 <listitem><para>Controls the
779 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
780 set for the executed process. Take a
781 capability string describing the
782 effective, permitted and inherited
783 capability sets as documented in
784 <citerefentry><refentrytitle>cap_from_text</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
785 Note that these capability sets are
786 usually influenced by the capabilities
787 attached to the executed file. Due to
789 <varname>CapabilityBoundingSet=</varname>
790 is probably the much more useful
791 setting.</para></listitem>
795 <term><varname>ReadWriteDirectories=</varname></term>
796 <term><varname>ReadOnlyDirectories=</varname></term>
797 <term><varname>InaccessibleDirectories=</varname></term>
799 <listitem><para>Sets up a new
800 file system namespace for executed
801 processes. These options may be used
802 to limit access a process might have
803 to the main file system
804 hierarchy. Each setting takes a
805 space-separated list of absolute
806 directory paths. Directories listed in
807 <varname>ReadWriteDirectories=</varname>
808 are accessible from within the
809 namespace with the same access rights
810 as from outside. Directories listed in
811 <varname>ReadOnlyDirectories=</varname>
812 are accessible for reading only,
813 writing will be refused even if the
814 usual file access controls would
815 permit this. Directories listed in
816 <varname>InaccessibleDirectories=</varname>
817 will be made inaccessible for
818 processes inside the namespace. Note
819 that restricting access with these
820 options does not extend to submounts
821 of a directory. You must list
822 submounts separately in these settings
823 to ensure the same limited
824 access. These options may be specified
825 more than once in which case all
826 directories listed will have limited
827 access from within the namespace. If
828 the empty string is assigned to this
829 option the specific list is reset, and
830 all prior assignments have no
831 effect.</para></listitem>
835 <term><varname>PrivateTmp=</varname></term>
837 <listitem><para>Takes a boolean
838 argument. If true sets up a new file
839 system namespace for the executed
840 processes and mounts private
841 <filename>/tmp</filename> and
842 <filename>/var/tmp</filename> directories
843 inside it, that are not shared by
844 processes outside of the
845 namespace. This is useful to secure
846 access to temporary files of the
847 process, but makes sharing between
849 <filename>/tmp</filename> or
850 <filename>/var/tmp</filename>
851 impossible. All temporary data created
852 by service will be removed after service
853 is stopped. Defaults to
854 false.</para></listitem>
858 <term><varname>PrivateNetwork=</varname></term>
860 <listitem><para>Takes a boolean
861 argument. If true sets up a new
862 network namespace for the executed
863 processes and configures only the
864 loopback network device
865 <literal>lo</literal> inside it. No
866 other network devices will be
867 available to the executed process.
868 This is useful to securely turn off
869 network access by the executed
871 false.</para></listitem>
875 <term><varname>MountFlags=</varname></term>
877 <listitem><para>Takes a mount
879 <option>shared</option>,
880 <option>slave</option> or
881 <option>private</option>, which
882 control whether the file system
883 namespace set up for this unit's
884 processes will receive or propagate
886 <citerefentry><refentrytitle>mount</refentrytitle><manvolnum>2</manvolnum></citerefentry>
887 for details. Default to
888 <option>shared</option>.</para></listitem>
892 <term><varname>UtmpIdentifier=</varname></term>
894 <listitem><para>Takes a four
895 character identifier string for an
896 utmp/wtmp entry for this service. This
897 should only be set for services such
898 as <command>getty</command>
899 implementations where utmp/wtmp
900 entries must be created and cleared
901 before and after execution. If the
902 configured string is longer than four
903 characters it is truncated and the
904 terminal four characters are
905 used. This setting interprets %I style
906 string replacements. This setting is
907 unset by default, i.e. no utmp/wtmp
908 entries are created or cleaned up for
909 this service.</para></listitem>
913 <term><varname>IgnoreSIGPIPE=</varname></term>
915 <listitem><para>Takes a boolean
916 argument. If true, causes <constant>SIGPIPE</constant> to be
917 ignored in the executed
918 process. Defaults to true because
919 <constant>SIGPIPE</constant> generally is useful only in
920 shell pipelines.</para></listitem>
924 <term><varname>NoNewPrivileges=</varname></term>
926 <listitem><para>Takes a boolean
927 argument. If true, ensures that the
928 service process and all its children
929 can never gain new privileges. This
930 option is more powerful than the respective
931 secure bits flags (see above), as it
932 also prohibits UID changes of any
933 kind. This is the simplest, most
934 effective way to ensure that a process
935 and its children can never elevate
936 privileges again.</para></listitem>
940 <term><varname>SystemCallFilter=</varname></term>
942 <listitem><para>Takes a space-separated
944 names. If this setting is used, all
945 system calls executed by the unit
946 process except for the listed ones
947 will result in immediate process
949 <constant>SIGSYS</constant> signal
950 (whitelisting). If the first character
951 of the list is <literal>~</literal>
952 the effect is inverted: only the
953 listed system calls will result in
954 immediate process termination
955 (blacklisting). If this option is used
956 <varname>NoNewPrivileges=yes</varname>
957 is implied. This feature makes use of
958 the Secure Computing Mode 2 interfaces
959 of the kernel ('seccomp filtering')
960 and is useful for enforcing a minimal
961 sandboxing environment. Note that the
962 <function>execve</function>,
963 <function>rt_sigreturn</function>,
964 <function>sigreturn</function>,
965 <function>exit_group</function>,
966 <function>exit</function> system calls
967 are implicitly whitelisted and don't
968 need to be listed explicitly. This
969 option may be specified more than once
970 in which case the filter masks are
971 merged. If the empty string is
972 assigned the filter is reset, all
973 prior assignments will have no
974 effect.</para></listitem>
981 <title>See Also</title>
983 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
984 <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
985 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
986 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
987 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
988 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
989 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
990 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
991 <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
992 <citerefentry><refentrytitle>systemd.cgroup</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
993 <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>