1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <?xml-stylesheet type="text/xsl" href="http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl"?>
3 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
4 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
7 This file is part of systemd.
9 Copyright 2010 Lennart Poettering
11 systemd is free software; you can redistribute it and/or modify it
12 under the terms of the GNU Lesser General Public License as published by
13 the Free Software Foundation; either version 2.1 of the License, or
14 (at your option) any later version.
16 systemd is distributed in the hope that it will be useful, but
17 WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
19 Lesser General Public License for more details.
21 You should have received a copy of the GNU Lesser General Public License
22 along with systemd; If not, see <http://www.gnu.org/licenses/>.
25 <refentry id="systemd.exec">
27 <title>systemd.exec</title>
28 <productname>systemd</productname>
32 <contrib>Developer</contrib>
33 <firstname>Lennart</firstname>
34 <surname>Poettering</surname>
35 <email>lennart@poettering.net</email>
41 <refentrytitle>systemd.exec</refentrytitle>
42 <manvolnum>5</manvolnum>
46 <refname>systemd.exec</refname>
47 <refpurpose>Execution environment configuration</refpurpose>
51 <para><filename><replaceable>service</replaceable>.service</filename>,
52 <filename><replaceable>socket</replaceable>.socket</filename>,
53 <filename><replaceable>mount</replaceable>.mount</filename>,
54 <filename><replaceable>swap</replaceable>.swap</filename></para>
58 <title>Description</title>
60 <para>Unit configuration files for services, sockets,
61 mount points and swap devices share a subset of
62 configuration options which define the execution
63 environment of spawned processes.</para>
65 <para>This man page lists the configuration options
66 shared by these four unit types. See
67 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
68 for the common options of all unit configuration
70 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
71 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
72 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
74 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>
75 for more information on the specific unit
76 configuration files. The execution specific
77 configuration options are configured in the [Service],
78 [Socket], [Mount], or [Swap] sections, depending on the unit
83 <title>Options</title>
85 <variablelist class='unit-directives'>
88 <term><varname>WorkingDirectory=</varname></term>
90 <listitem><para>Takes an absolute
91 directory path. Sets the working
92 directory for executed processes. If
93 not set defaults to the root directory
94 when systemd is running as a system
95 instance and the respective user's
96 home directory if run as
97 user.</para></listitem>
101 <term><varname>RootDirectory=</varname></term>
103 <listitem><para>Takes an absolute
104 directory path. Sets the root
105 directory for executed processes, with
107 <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry>
108 system call. If this is used it must
109 be ensured that the process and all
110 its auxiliary files are available in
111 the <function>chroot()</function>
112 jail.</para></listitem>
116 <term><varname>User=</varname></term>
117 <term><varname>Group=</varname></term>
119 <listitem><para>Sets the Unix user
120 or group that the processes are executed
121 as, respectively. Takes a single user or group
122 name or ID as argument. If no group is
123 set, the default group of the user is
124 chosen.</para></listitem>
128 <term><varname>SupplementaryGroups=</varname></term>
130 <listitem><para>Sets the supplementary
131 Unix groups the processes are executed
132 as. This takes a space-separated list
133 of group names or IDs. This option may
134 be specified more than once in which
135 case all listed groups are set as
136 supplementary groups. When the empty
137 string is assigned the list of
138 supplementary groups is reset, and all
139 assignments prior to this one will
140 have no effect. In any way, this
141 option does not override, but extends
142 the list of supplementary groups
143 configured in the system group
145 user.</para></listitem>
149 <term><varname>Nice=</varname></term>
151 <listitem><para>Sets the default nice
152 level (scheduling priority) for
153 executed processes. Takes an integer
154 between -20 (highest priority) and 19
155 (lowest priority). See
156 <citerefentry><refentrytitle>setpriority</refentrytitle><manvolnum>2</manvolnum></citerefentry>
157 for details.</para></listitem>
161 <term><varname>OOMScoreAdjust=</varname></term>
163 <listitem><para>Sets the adjustment
164 level for the Out-Of-Memory killer for
165 executed processes. Takes an integer
166 between -1000 (to disable OOM killing
167 for this process) and 1000 (to make
168 killing of this process under memory
169 pressure very likely). See <ulink
170 url="http://www.kernel.org/doc/Documentation/filesystems/proc.txt">proc.txt</ulink>
171 for details.</para></listitem>
175 <term><varname>IOSchedulingClass=</varname></term>
177 <listitem><para>Sets the IO scheduling
178 class for executed processes. Takes an
179 integer between 0 and 3 or one of the
180 strings <option>none</option>,
181 <option>realtime</option>,
182 <option>best-effort</option> or
183 <option>idle</option>. See
184 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
185 for details.</para></listitem>
189 <term><varname>IOSchedulingPriority=</varname></term>
191 <listitem><para>Sets the IO scheduling
192 priority for executed processes. Takes
193 an integer between 0 (highest
194 priority) and 7 (lowest priority). The
195 available priorities depend on the
196 selected IO scheduling class (see
198 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
199 for details.</para></listitem>
203 <term><varname>CPUSchedulingPolicy=</varname></term>
205 <listitem><para>Sets the CPU
206 scheduling policy for executed
207 processes. Takes one of
208 <option>other</option>,
209 <option>batch</option>,
210 <option>idle</option>,
211 <option>fifo</option> or
212 <option>rr</option>. See
213 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
214 for details.</para></listitem>
218 <term><varname>CPUSchedulingPriority=</varname></term>
220 <listitem><para>Sets the CPU
221 scheduling priority for executed
222 processes. The available priority
223 range depends on the selected CPU
224 scheduling policy (see above). For
225 real-time scheduling policies an
226 integer between 1 (lowest priority)
227 and 99 (highest priority) can be used.
228 See <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
234 <term><varname>CPUSchedulingResetOnFork=</varname></term>
236 <listitem><para>Takes a boolean
237 argument. If true elevated CPU
238 scheduling priorities and policies
239 will be reset when the executed
240 processes fork, and can hence not leak
241 into child processes. See
242 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
243 for details. Defaults to false.</para></listitem>
247 <term><varname>CPUAffinity=</varname></term>
249 <listitem><para>Controls the CPU
250 affinity of the executed
251 processes. Takes a space-separated
252 list of CPU indexes. This option may
253 be specified more than once in which
254 case the specificed CPU affinity masks
255 are merged. If the empty string is
256 assigned the mask is reset, all
257 assignments prior to this will have no
259 <citerefentry><refentrytitle>sched_setaffinity</refentrytitle><manvolnum>2</manvolnum></citerefentry>
260 for details.</para></listitem>
264 <term><varname>UMask=</varname></term>
266 <listitem><para>Controls the file mode
267 creation mask. Takes an access mode in
269 <citerefentry><refentrytitle>umask</refentrytitle><manvolnum>2</manvolnum></citerefentry>
270 for details. Defaults to
271 0022.</para></listitem>
275 <term><varname>Environment=</varname></term>
277 <listitem><para>Sets environment
278 variables for executed
279 processes. Takes a space-separated
280 list of variable assignments. This
281 option may be specified more than once
282 in which case all listed variables
283 will be set. If the same variable is
284 set twice the later setting will
285 override the earlier setting. If the
286 empty string is assigned to this
287 option the list of environment
288 variables is reset, all prior
289 assignments have no effect.
290 Variable expansion is not performed
291 inside the strings, however, specifier
292 expansion is possible. $ character has
294 If you need to assign a value containing spaces
295 to a variable, use double quotes (")
296 for the assignment.</para>
299 <programlisting>Environment="VAR1=word1 word2" VAR2=word3 "VAR3=word 5 6"</programlisting>
300 gives three variables <literal>VAR1</literal>,
301 <literal>VAR2</literal>, <literal>VAR3</literal>.
306 <citerefentry><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>
307 for details about environment variables.</para></listitem>
310 <term><varname>EnvironmentFile=</varname></term>
311 <listitem><para>Similar to
312 <varname>Environment=</varname> but
313 reads the environment variables from a
314 text file. The text file should
315 contain new-line-separated variable
316 assignments. Empty lines and lines
317 starting with ; or # will be ignored,
318 which may be used for commenting. A line
319 ending with a backslash will be concatenated
320 with the following one, allowing multiline variable
321 definitions. The parser strips leading
322 and trailing whitespace from the values
323 of assignments, unless you use
324 double quotes (").</para>
326 <para>The argument passed should be an
327 absolute filename or wildcard
328 expression, optionally prefixed with
329 <literal>-</literal>, which indicates
330 that if the file does not exist it
331 won't be read and no error or warning
332 message is logged. This option may be
333 specified more than once in which case
334 all specified files are read. If the
335 empty string is assigned to this
336 option the list of file to read is
337 reset, all prior assignments have no
340 <para>The files listed with this
341 directive will be read shortly before
342 the process is executed. Settings from
343 these files override settings made
345 <varname>Environment=</varname>. If
346 the same variable is set twice from
347 these files the files will be read in
348 the order they are specified and the
349 later setting will override the
350 earlier setting.</para></listitem>
354 <term><varname>StandardInput=</varname></term>
355 <listitem><para>Controls where file
356 descriptor 0 (STDIN) of the executed
357 processes is connected to. Takes one
358 of <option>null</option>,
359 <option>tty</option>,
360 <option>tty-force</option>,
361 <option>tty-fail</option> or
362 <option>socket</option>. If
363 <option>null</option> is selected
364 standard input will be connected to
365 <filename>/dev/null</filename>,
366 i.e. all read attempts by the process
367 will result in immediate EOF. If
368 <option>tty</option> is selected
369 standard input is connected to a TTY
371 <varname>TTYPath=</varname>, see
372 below) and the executed process
373 becomes the controlling process of the
374 terminal. If the terminal is already
375 being controlled by another process the
376 executed process waits until the current
377 controlling process releases the
379 <option>tty-force</option>
380 is similar to <option>tty</option>,
381 but the executed process is forcefully
382 and immediately made the controlling
383 process of the terminal, potentially
384 removing previous controlling
386 terminal. <option>tty-fail</option> is
387 similar to <option>tty</option> but if
388 the terminal already has a controlling
389 process start-up of the executed
391 <option>socket</option> option is only
392 valid in socket-activated services,
393 and only when the socket configuration
395 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>
396 for details) specifies a single socket
397 only. If this option is set standard
398 input will be connected to the socket
399 the service was activated from, which
400 is primarily useful for compatibility
401 with daemons designed for use with the
403 <citerefentry><refentrytitle>inetd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
404 daemon. This setting defaults to
405 <option>null</option>.</para></listitem>
408 <term><varname>StandardOutput=</varname></term>
409 <listitem><para>Controls where file
410 descriptor 1 (STDOUT) of the executed
411 processes is connected to. Takes one
412 of <option>inherit</option>,
413 <option>null</option>,
414 <option>tty</option>,
415 <option>syslog</option>,
416 <option>kmsg</option>,
417 <option>journal</option>,
418 <option>syslog+console</option>,
419 <option>kmsg+console</option>,
420 <option>journal+console</option> or
421 <option>socket</option>. If set to
422 <option>inherit</option> the file
423 descriptor of standard input is
424 duplicated for standard output. If set
425 to <option>null</option> standard
426 output will be connected to
427 <filename>/dev/null</filename>,
428 i.e. everything written to it will be
429 lost. If set to <option>tty</option>
430 standard output will be connected to a
431 tty (as configured via
432 <varname>TTYPath=</varname>, see
433 below). If the TTY is used for output
434 only the executed process will not
435 become the controlling process of the
436 terminal, and will not fail or wait
437 for other processes to release the
438 terminal. <option>syslog</option>
439 connects standard output to the
440 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
442 service. <option>kmsg</option>
443 connects it with the kernel log buffer
444 which is accessible via
445 <citerefentry><refentrytitle>dmesg</refentrytitle><manvolnum>1</manvolnum></citerefentry>. <option>journal</option>
446 connects it with the journal which is
448 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
449 (Note that everything that is written
450 to syslog or kmsg is implicitly stored
451 in the journal as well, those options
452 are hence supersets of this
453 one). <option>syslog+console</option>,
454 <option>journal+console</option> and
455 <option>kmsg+console</option> work
456 similarly but copy the output to the
458 well. <option>socket</option> connects
459 standard output to a socket from
460 socket activation, semantics are
461 similar to the respective option of
462 <varname>StandardInput=</varname>.
463 This setting defaults to the value set
465 <option>DefaultStandardOutput=</option>
467 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
469 <option>journal</option>.</para></listitem>
472 <term><varname>StandardError=</varname></term>
473 <listitem><para>Controls where file
474 descriptor 2 (STDERR) of the executed
475 processes is connected to. The
476 available options are identical to
478 <varname>StandardOutput=</varname>,
479 with one exception: if set to
480 <option>inherit</option> the file
481 descriptor used for standard output is
482 duplicated for standard error. This
483 setting defaults to the value set with
484 <option>DefaultStandardError=</option>
486 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
488 <option>inherit</option>.</para></listitem>
491 <term><varname>TTYPath=</varname></term>
492 <listitem><para>Sets the terminal
493 device node to use if standard input,
494 output or stderr are connected to a
495 TTY (see above). Defaults to
496 <filename>/dev/console</filename>.</para></listitem>
499 <term><varname>TTYReset=</varname></term>
500 <listitem><para>Reset the terminal
501 device specified with
502 <varname>TTYPath=</varname> before and
503 after execution. Defaults to
504 <literal>no</literal>.</para></listitem>
507 <term><varname>TTYVHangup=</varname></term>
508 <listitem><para>Disconnect all clients
509 which have opened the terminal device
511 <varname>TTYPath=</varname>
512 before and after execution. Defaults
514 <literal>no</literal>.</para></listitem>
517 <term><varname>TTYVTDisallocate=</varname></term>
518 <listitem><para>If the terminal
519 device specified with
520 <varname>TTYPath=</varname> is a
521 virtual console terminal try to
522 deallocate the TTY before and after
523 execution. This ensures that the
524 screen and scrollback buffer is
526 <literal>no</literal>.</para></listitem>
529 <term><varname>SyslogIdentifier=</varname></term>
530 <listitem><para>Sets the process name
531 to prefix log lines sent to syslog or
532 the kernel log buffer with. If not set
533 defaults to the process name of the
534 executed process. This option is only
536 <varname>StandardOutput=</varname> or
537 <varname>StandardError=</varname> are
538 set to <option>syslog</option> or
539 <option>kmsg</option>.</para></listitem>
542 <term><varname>SyslogFacility=</varname></term>
543 <listitem><para>Sets the syslog
544 facility to use when logging to
545 syslog. One of <option>kern</option>,
546 <option>user</option>,
547 <option>mail</option>,
548 <option>daemon</option>,
549 <option>auth</option>,
550 <option>syslog</option>,
551 <option>lpr</option>,
552 <option>news</option>,
553 <option>uucp</option>,
554 <option>cron</option>,
555 <option>authpriv</option>,
556 <option>ftp</option>,
557 <option>local0</option>,
558 <option>local1</option>,
559 <option>local2</option>,
560 <option>local3</option>,
561 <option>local4</option>,
562 <option>local5</option>,
563 <option>local6</option> or
564 <option>local7</option>. See
565 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
566 for details. This option is only
568 <varname>StandardOutput=</varname> or
569 <varname>StandardError=</varname> are
570 set to <option>syslog</option>.
572 <option>daemon</option>.</para></listitem>
575 <term><varname>SyslogLevel=</varname></term>
576 <listitem><para>Default syslog level
577 to use when logging to syslog or the
578 kernel log buffer. One of
579 <option>emerg</option>,
580 <option>alert</option>,
581 <option>crit</option>,
582 <option>err</option>,
583 <option>warning</option>,
584 <option>notice</option>,
585 <option>info</option>,
586 <option>debug</option>. See
587 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
588 for details. This option is only
590 <varname>StandardOutput=</varname> or
591 <varname>StandardError=</varname> are
592 set to <option>syslog</option> or
593 <option>kmsg</option>. Note that
594 individual lines output by the daemon
595 might be prefixed with a different log
596 level which can be used to override
597 the default log level specified
598 here. The interpretation of these
599 prefixes may be disabled with
600 <varname>SyslogLevelPrefix=</varname>,
601 see below. For details see
602 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
605 <option>info</option>.</para></listitem>
609 <term><varname>SyslogLevelPrefix=</varname></term>
610 <listitem><para>Takes a boolean
611 argument. If true and
612 <varname>StandardOutput=</varname> or
613 <varname>StandardError=</varname> are
614 set to <option>syslog</option>,
615 <option>kmsg</option> or
616 <option>journal</option>, log lines
617 written by the executed process that
618 are prefixed with a log level will be
619 passed on to syslog with this log
620 level set but the prefix removed. If
621 set to false, the interpretation of
622 these prefixes is disabled and the
623 logged lines are passed on as-is. For
624 details about this prefixing see
625 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
626 Defaults to true.</para></listitem>
630 <term><varname>TimerSlackNSec=</varname></term>
631 <listitem><para>Sets the timer slack
632 in nanoseconds for the executed
633 processes. The timer slack controls
634 the accuracy of wake-ups triggered by
636 <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
637 for more information. Note that in
638 contrast to most other time span
639 definitions this parameter takes an
640 integer value in nano-seconds if no
641 unit is specified. The usual time
643 too.</para></listitem>
647 <term><varname>LimitCPU=</varname></term>
648 <term><varname>LimitFSIZE=</varname></term>
649 <term><varname>LimitDATA=</varname></term>
650 <term><varname>LimitSTACK=</varname></term>
651 <term><varname>LimitCORE=</varname></term>
652 <term><varname>LimitRSS=</varname></term>
653 <term><varname>LimitNOFILE=</varname></term>
654 <term><varname>LimitAS=</varname></term>
655 <term><varname>LimitNPROC=</varname></term>
656 <term><varname>LimitMEMLOCK=</varname></term>
657 <term><varname>LimitLOCKS=</varname></term>
658 <term><varname>LimitSIGPENDING=</varname></term>
659 <term><varname>LimitMSGQUEUE=</varname></term>
660 <term><varname>LimitNICE=</varname></term>
661 <term><varname>LimitRTPRIO=</varname></term>
662 <term><varname>LimitRTTIME=</varname></term>
663 <listitem><para>These settings control
664 various resource limits for executed
666 <citerefentry><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry>
667 for details. Use the string
668 <varname>infinity</varname> to
669 configure no limit on a specific
670 resource.</para></listitem>
674 <term><varname>PAMName=</varname></term>
675 <listitem><para>Sets the PAM service
676 name to set up a session as. If set
677 the executed process will be
678 registered as a PAM session under the
679 specified service name. This is only
680 useful in conjunction with the
681 <varname>User=</varname> setting. If
682 not set no PAM session will be opened
683 for the executed processes. See
684 <citerefentry><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>
685 for details.</para></listitem>
689 <term><varname>TCPWrapName=</varname></term>
690 <listitem><para>If this is a
691 socket-activated service this sets the
692 tcpwrap service name to check the
693 permission for the current connection
694 with. This is only useful in
695 conjunction with socket-activated
696 services, and stream sockets (TCP) in
697 particular. It has no effect on other
698 socket types (e.g. datagram/UDP) and
699 on processes unrelated to socket-based
700 activation. If the tcpwrap
701 verification fails daemon start-up
702 will fail and the connection is
704 <citerefentry><refentrytitle>tcpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
705 for details. Note that this option may
706 be used to do access control checks
707 only. Shell commands and commands
709 <citerefentry><refentrytitle>hosts_options</refentrytitle><manvolnum>5</manvolnum></citerefentry>
710 are not supported.</para></listitem>
714 <term><varname>CapabilityBoundingSet=</varname></term>
716 <listitem><para>Controls which
717 capabilities to include in the
718 capability bounding set for the
719 executed process. See
720 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
721 for details. Takes a whitespace-separated
722 list of capability names as read by
723 <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
724 e.g. <constant>CAP_SYS_ADMIN</constant>,
725 <constant>CAP_DAC_OVERRIDE</constant>,
726 <constant>CAP_SYS_PTRACE</constant>.
727 Capabilities listed will be included
728 in the bounding set, all others are
729 removed. If the list of capabilities
730 is prefixed with <literal>~</literal>
731 all but the listed capabilities will
732 be included, the effect of the
733 assignment inverted. Note that this
734 option also affects the respective
735 capabilities in the effective,
736 permitted and inheritable capability
738 <varname>Capabilities=</varname>
739 does. If this option is not used the
740 capability bounding set is not
741 modified on process execution, hence
742 no limits on the capabilities of the
743 process are enforced. This option may
744 appear more than once in which case
745 the bounding sets are merged. If the
746 empty string is assigned to this
747 option the bounding set is reset to
748 the empty capability set, and all
749 prior settings have no effect. If set
750 to <literal>~</literal> (without any
751 further argument) the bounding set is
752 reset to the full set of available
753 capabilities, also undoing any
754 previous settings.</para></listitem>
758 <term><varname>SecureBits=</varname></term>
759 <listitem><para>Controls the secure
760 bits set for the executed process. See
761 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
762 for details. Takes a list of strings:
763 <option>keep-caps</option>,
764 <option>keep-caps-locked</option>,
765 <option>no-setuid-fixup</option>,
766 <option>no-setuid-fixup-locked</option>,
767 <option>noroot</option> and/or
768 <option>noroot-locked</option>. This
769 option may appear more than once in
770 which case the secure bits are
771 ORed. If the empty string is assigned
772 to this option the bits are reset to
777 <term><varname>Capabilities=</varname></term>
778 <listitem><para>Controls the
779 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
780 set for the executed process. Take a
781 capability string describing the
782 effective, permitted and inherited
783 capability sets as documented in
784 <citerefentry><refentrytitle>cap_from_text</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
785 Note that these capability sets are
786 usually influenced by the capabilities
787 attached to the executed file. Due to
789 <varname>CapabilityBoundingSet=</varname>
790 is probably the much more useful
791 setting.</para></listitem>
795 <term><varname>ControlGroup=</varname></term>
797 <listitem><para>Controls the control
798 groups the executed processes shall be
799 made members of. Takes a
800 space-separated list of cgroup
801 identifiers. A cgroup identifier is
803 <filename noindex='true'>cpu:/foo/bar</filename>,
804 where "cpu" indicates the kernel
805 control group controller used, and
806 <filename noindex='true'>/foo/bar</filename> is the
807 control group path. The controller
808 name and ":" may be omitted in which
809 case the named systemd control group
810 hierarchy is implied. Alternatively,
811 the path and ":" may be omitted, in
812 which case the default control group
813 path for this unit is implied.</para>
815 <para>This option may be used to place
816 executed processes in arbitrary groups
817 in arbitrary hierarchies -- which may
818 then be externally configured with
819 additional execution limits. By
820 default systemd will place all
821 executed processes in separate
822 per-unit control groups (named after
823 the unit) in the systemd named
824 hierarchy. This option is primarily
825 intended to place executed processes
826 in specific paths in specific kernel
827 controller hierarchies. It is not
828 recommended to manipulate the service
829 control group path in the private
830 systemd named hierarchy
831 (i.e. <literal>name=systemd</literal>),
832 and doing this might result in
833 undefined behaviour. For details about
834 control groups see <ulink
835 url="http://www.kernel.org/doc/Documentation/cgroups/cgroups.txt">cgroups.txt</ulink>.</para>
837 <para>This option may appear more than
838 once, in which case the list of
839 control group assignments is
840 merged. If the same hierarchy gets two
841 different paths assigned only the
842 later setting will take effect. If the
843 empty string is assigned to this
844 option the list of control group
845 assignments is reset, all previous
846 assignments will have no
849 <para>Note that the list of control
850 group assignments of a unit is
851 extended implicitly based on the
853 <varname>DefaultControllers=</varname>
855 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
857 <varname>ControlGroup=</varname>
858 setting for a specific controller
859 takes precedence.</para></listitem>
863 <term><varname>ControlGroupModify=</varname></term>
864 <listitem><para>Takes a boolean
865 argument. If true, the control groups
866 created for this unit will be owned by
867 the user specified with
868 <varname>User=</varname> (and the
869 appropriate group), and he/she can create
870 subgroups as well as add processes to
871 the group.</para></listitem>
875 <term><varname>ControlGroupPersistent=</varname></term>
876 <listitem><para>Takes a boolean
877 argument. If true, the control groups
878 created for this unit will be marked
879 to be persistent, i.e. systemd will
880 not remove them when stopping the
881 unit. The default is false, meaning
882 that the control groups will be
883 removed when the unit is stopped. For
884 details about the semantics of this
886 url="http://www.freedesktop.org/wiki/Software/systemd/PaxControlGroups">PaxControlGroups</ulink>.</para></listitem>
890 <term><varname>ControlGroupAttribute=</varname></term>
892 <listitem><para>Set a specific control
893 group attribute for executed
894 processes, and (if needed) add the
895 executed processes to a cgroup in the
896 hierarchy of the controller the
897 attribute belongs to. Takes two
898 space-separated arguments: the
899 attribute name (syntax is
900 <literal>cpu.shares</literal> where
901 <literal>cpu</literal> refers to a
902 specific controller and
903 <literal>shares</literal> to the
904 attribute name), and the attribute
906 <literal>ControlGroupAttribute=cpu.shares
907 512</literal>. If this option is used
908 for an attribute that belongs to a
909 kernel controller hierarchy the unit
910 is not already configured to be added
911 to (for example via the
912 <literal>ControlGroup=</literal>
913 option) then the unit will be added to
914 the controller and the default unit
915 cgroup path is implied. Thus, using
916 <varname>ControlGroupAttribute=</varname>
917 is in most cases sufficient to make
918 use of control group enforcements,
920 <varname>ControlGroup=</varname> are
921 only necessary in case the implied
922 default control group path for a
923 service is not desirable. For details
924 about control group attributes see
926 url="http://www.kernel.org/doc/Documentation/cgroups/cgroups.txt">cgroups.txt</ulink>. This
927 option may appear more than once, in
928 order to set multiple control group
929 attributes. If this option is used
930 multiple times for the same cgroup
931 attribute only the later setting takes
932 effect. If the empty string is
933 assigned to this option the list of
934 attributes is reset, all previous
935 cgroup attribute settings have no
936 effect, including those done with
937 <varname>CPUShares=</varname>,
938 <varname>MemoryLimit=</varname>,
939 <varname>MemorySoftLimit</varname>,
940 <varname>DeviceAllow=</varname>,
941 <varname>DeviceDeny=</varname>,
942 <varname>BlockIOWeight=</varname>,
943 <varname>BlockIOReadBandwidth=</varname>,
944 <varname>BlockIOWriteBandwidth=</varname>.
949 <term><varname>ReadWriteDirectories=</varname></term>
950 <term><varname>ReadOnlyDirectories=</varname></term>
951 <term><varname>InaccessibleDirectories=</varname></term>
953 <listitem><para>Sets up a new
954 file system namespace for executed
955 processes. These options may be used
956 to limit access a process might have
957 to the main file system
958 hierarchy. Each setting takes a
959 space-separated list of absolute
960 directory paths. Directories listed in
961 <varname>ReadWriteDirectories=</varname>
962 are accessible from within the
963 namespace with the same access rights
964 as from outside. Directories listed in
965 <varname>ReadOnlyDirectories=</varname>
966 are accessible for reading only,
967 writing will be refused even if the
968 usual file access controls would
969 permit this. Directories listed in
970 <varname>InaccessibleDirectories=</varname>
971 will be made inaccessible for
972 processes inside the namespace. Note
973 that restricting access with these
974 options does not extend to submounts
975 of a directory. You must list
976 submounts separately in these settings
977 to ensure the same limited
978 access. These options may be specified
979 more than once in which case all
980 directories listed will have limited
981 access from within the namespace. If
982 the empty string is assigned to this
983 option the specific list is reset, and
984 all prior assignments have no
985 effect.</para></listitem>
989 <term><varname>PrivateTmp=</varname></term>
991 <listitem><para>Takes a boolean
992 argument. If true sets up a new file
993 system namespace for the executed
994 processes and mounts private
995 <filename>/tmp</filename> and
996 <filename>/var/tmp</filename> directories
997 inside it, that are not shared by
998 processes outside of the
999 namespace. This is useful to secure
1000 access to temporary files of the
1001 process, but makes sharing between
1003 <filename>/tmp</filename> or
1004 <filename>/var/tmp</filename>
1005 impossible. All temporary data created
1006 by service will be removed after service
1007 is stopped. Defaults to
1008 false.</para></listitem>
1012 <term><varname>PrivateNetwork=</varname></term>
1014 <listitem><para>Takes a boolean
1015 argument. If true sets up a new
1016 network namespace for the executed
1017 processes and configures only the
1018 loopback network device
1019 <literal>lo</literal> inside it. No
1020 other network devices will be
1021 available to the executed process.
1022 This is useful to securely turn off
1023 network access by the executed
1024 process. Defaults to
1025 false.</para></listitem>
1029 <term><varname>MountFlags=</varname></term>
1031 <listitem><para>Takes a mount
1033 <option>shared</option>,
1034 <option>slave</option> or
1035 <option>private</option>, which
1036 control whether the file system
1037 namespace set up for this unit's
1038 processes will receive or propagate
1040 <citerefentry><refentrytitle>mount</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1041 for details. Default to
1042 <option>shared</option>.</para></listitem>
1046 <term><varname>UtmpIdentifier=</varname></term>
1048 <listitem><para>Takes a four
1049 character identifier string for an
1050 utmp/wtmp entry for this service. This
1051 should only be set for services such
1052 as <command>getty</command>
1053 implementations where utmp/wtmp
1054 entries must be created and cleared
1055 before and after execution. If the
1056 configured string is longer than four
1057 characters it is truncated and the
1058 terminal four characters are
1059 used. This setting interprets %I style
1060 string replacements. This setting is
1061 unset by default, i.e. no utmp/wtmp
1062 entries are created or cleaned up for
1063 this service.</para></listitem>
1067 <term><varname>IgnoreSIGPIPE=</varname></term>
1069 <listitem><para>Takes a boolean
1070 argument. If true, causes <constant>SIGPIPE</constant> to be
1071 ignored in the executed
1072 process. Defaults to true because
1073 <constant>SIGPIPE</constant> generally is useful only in
1074 shell pipelines.</para></listitem>
1078 <term><varname>NoNewPrivileges=</varname></term>
1080 <listitem><para>Takes a boolean
1081 argument. If true, ensures that the
1082 service process and all its children
1083 can never gain new privileges. This
1084 option is more powerful than the respective
1085 secure bits flags (see above), as it
1086 also prohibits UID changes of any
1087 kind. This is the simplest, most
1088 effective way to ensure that a process
1089 and its children can never elevate
1090 privileges again.</para></listitem>
1094 <term><varname>SystemCallFilter=</varname></term>
1096 <listitem><para>Takes a space-separated
1098 names. If this setting is used, all
1099 system calls executed by the unit
1100 process except for the listed ones
1101 will result in immediate process
1102 termination with the
1103 <constant>SIGSYS</constant> signal
1104 (whitelisting). If the first character
1105 of the list is <literal>~</literal>
1106 the effect is inverted: only the
1107 listed system calls will result in
1108 immediate process termination
1109 (blacklisting). If this option is used
1110 <varname>NoNewPrivileges=yes</varname>
1111 is implied. This feature makes use of
1112 the Secure Computing Mode 2 interfaces
1113 of the kernel ('seccomp filtering')
1114 and is useful for enforcing a minimal
1115 sandboxing environment. Note that the
1116 <function>execve</function>,
1117 <function>rt_sigreturn</function>,
1118 <function>sigreturn</function>,
1119 <function>exit_group</function>,
1120 <function>exit</function> system calls
1121 are implicitly whitelisted and don't
1122 need to be listed explicitly. This
1123 option may be specified more than once
1124 in which case the filter masks are
1125 merged. If the empty string is
1126 assigned the filter is reset, all
1127 prior assignments will have no
1128 effect.</para></listitem>
1135 <title>See Also</title>
1137 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1138 <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1139 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1140 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1141 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1142 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1143 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1144 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1145 <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1146 <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>