1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <?xml-stylesheet type="text/xsl" href="http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl"?>
3 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
4 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
7 This file is part of systemd.
9 Copyright 2010 Lennart Poettering
11 systemd is free software; you can redistribute it and/or modify it
12 under the terms of the GNU Lesser General Public License as published by
13 the Free Software Foundation; either version 2.1 of the License, or
14 (at your option) any later version.
16 systemd is distributed in the hope that it will be useful, but
17 WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
19 Lesser General Public License for more details.
21 You should have received a copy of the GNU Lesser General Public License
22 along with systemd; If not, see <http://www.gnu.org/licenses/>.
25 <refentry id="systemd.exec">
27 <title>systemd.exec</title>
28 <productname>systemd</productname>
32 <contrib>Developer</contrib>
33 <firstname>Lennart</firstname>
34 <surname>Poettering</surname>
35 <email>lennart@poettering.net</email>
41 <refentrytitle>systemd.exec</refentrytitle>
42 <manvolnum>5</manvolnum>
46 <refname>systemd.exec</refname>
47 <refpurpose>Execution environment configuration</refpurpose>
51 <para><filename><replaceable>service</replaceable>.service</filename>,
52 <filename><replaceable>socket</replaceable>.socket</filename>,
53 <filename><replaceable>mount</replaceable>.mount</filename>,
54 <filename><replaceable>swap</replaceable>.swap</filename></para>
58 <title>Description</title>
60 <para>Unit configuration files for services, sockets,
61 mount points and swap devices share a subset of
62 configuration options which define the execution
63 environment of spawned processes.</para>
65 <para>This man page lists the configuration options
66 shared by these four unit types. See
67 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
68 for the common options of all unit configuration
70 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
71 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
72 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>
74 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>
75 for more information on the specific unit
76 configuration files. The execution specific
77 configuration options are configured in the [Service],
78 [Socket], [Mount], or [Swap] sections, depending on the unit
83 <title>Options</title>
85 <variablelist class='unit-directives'>
88 <term><varname>WorkingDirectory=</varname></term>
90 <listitem><para>Takes an absolute
91 directory path. Sets the working
92 directory for executed processes. If
93 not set defaults to the root directory
94 when systemd is running as a system
95 instance and the respective user's
96 home directory if run as
97 user.</para></listitem>
101 <term><varname>RootDirectory=</varname></term>
103 <listitem><para>Takes an absolute
104 directory path. Sets the root
105 directory for executed processes, with
107 <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry>
108 system call. If this is used it must
109 be ensured that the process and all
110 its auxiliary files are available in
111 the <function>chroot()</function>
112 jail.</para></listitem>
116 <term><varname>User=</varname></term>
117 <term><varname>Group=</varname></term>
119 <listitem><para>Sets the Unix user
120 or group that the processes are executed
121 as, respectively. Takes a single user or group
122 name or ID as argument. If no group is
123 set, the default group of the user is
124 chosen.</para></listitem>
128 <term><varname>SupplementaryGroups=</varname></term>
130 <listitem><para>Sets the supplementary
131 Unix groups the processes are executed
132 as. This takes a space-separated list
133 of group names or IDs. This option may
134 be specified more than once in which
135 case all listed groups are set as
136 supplementary groups. When the empty
137 string is assigned the list of
138 supplementary groups is reset, and all
139 assignments prior to this one will
140 have no effect. In any way, this
141 option does not override, but extends
142 the list of supplementary groups
143 configured in the system group
145 user.</para></listitem>
149 <term><varname>Nice=</varname></term>
151 <listitem><para>Sets the default nice
152 level (scheduling priority) for
153 executed processes. Takes an integer
154 between -20 (highest priority) and 19
155 (lowest priority). See
156 <citerefentry><refentrytitle>setpriority</refentrytitle><manvolnum>2</manvolnum></citerefentry>
157 for details.</para></listitem>
161 <term><varname>OOMScoreAdjust=</varname></term>
163 <listitem><para>Sets the adjustment
164 level for the Out-Of-Memory killer for
165 executed processes. Takes an integer
166 between -1000 (to disable OOM killing
167 for this process) and 1000 (to make
168 killing of this process under memory
169 pressure very likely). See <ulink
170 url="http://www.kernel.org/doc/Documentation/filesystems/proc.txt">proc.txt</ulink>
171 for details.</para></listitem>
175 <term><varname>IOSchedulingClass=</varname></term>
177 <listitem><para>Sets the IO scheduling
178 class for executed processes. Takes an
179 integer between 0 and 3 or one of the
180 strings <option>none</option>,
181 <option>realtime</option>,
182 <option>best-effort</option> or
183 <option>idle</option>. See
184 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
185 for details.</para></listitem>
189 <term><varname>IOSchedulingPriority=</varname></term>
191 <listitem><para>Sets the IO scheduling
192 priority for executed processes. Takes
193 an integer between 0 (highest
194 priority) and 7 (lowest priority). The
195 available priorities depend on the
196 selected IO scheduling class (see
198 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
199 for details.</para></listitem>
203 <term><varname>CPUSchedulingPolicy=</varname></term>
205 <listitem><para>Sets the CPU
206 scheduling policy for executed
207 processes. Takes one of
208 <option>other</option>,
209 <option>batch</option>,
210 <option>idle</option>,
211 <option>fifo</option> or
212 <option>rr</option>. See
213 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
214 for details.</para></listitem>
218 <term><varname>CPUSchedulingPriority=</varname></term>
220 <listitem><para>Sets the CPU
221 scheduling priority for executed
222 processes. The available priority
223 range depends on the selected CPU
224 scheduling policy (see above). For
225 real-time scheduling policies an
226 integer between 1 (lowest priority)
227 and 99 (highest priority) can be used.
228 See <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
234 <term><varname>CPUSchedulingResetOnFork=</varname></term>
236 <listitem><para>Takes a boolean
237 argument. If true elevated CPU
238 scheduling priorities and policies
239 will be reset when the executed
240 processes fork, and can hence not leak
241 into child processes. See
242 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
243 for details. Defaults to false.</para></listitem>
247 <term><varname>CPUAffinity=</varname></term>
249 <listitem><para>Controls the CPU
250 affinity of the executed
251 processes. Takes a space-separated
252 list of CPU indexes. This option may
253 be specified more than once in which
254 case the specificed CPU affinity masks
255 are merged. If the empty string is
256 assigned the mask is reset, all
257 assignments prior to this will have no
259 <citerefentry><refentrytitle>sched_setaffinity</refentrytitle><manvolnum>2</manvolnum></citerefentry>
260 for details.</para></listitem>
264 <term><varname>UMask=</varname></term>
266 <listitem><para>Controls the file mode
267 creation mask. Takes an access mode in
269 <citerefentry><refentrytitle>umask</refentrytitle><manvolnum>2</manvolnum></citerefentry>
270 for details. Defaults to
271 0022.</para></listitem>
275 <term><varname>Environment=</varname></term>
277 <listitem><para>Sets environment
278 variables for executed
279 processes. Takes a space-separated
280 list of variable assignments. This
281 option may be specified more than once
282 in which case all listed variables
283 will be set. If the same variable is
284 set twice the later setting will
285 override the earlier setting. If the
286 empty string is assigned to this
287 option the list of environment
288 variables is reset, all prior
289 assignments have no effect.
290 Variable expansion is not performed
291 inside the strings, however, specifier
292 expansion is possible. $ character has
294 If you need to assign a value containing spaces
295 to a variable, use double quotes (")
296 for the assignment.</para>
299 <programlisting>Environment="VAR1=word1 word2" VAR2=word3 "VAR3=word 5 6"</programlisting>
300 gives three variables <literal>VAR1</literal>,
301 <literal>VAR2</literal>, <literal>VAR3</literal>.
306 <citerefentry><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>
307 for details about environment variables.</para></listitem>
310 <term><varname>EnvironmentFile=</varname></term>
311 <listitem><para>Similar to
312 <varname>Environment=</varname> but
313 reads the environment variables from a
314 text file. The text file should
315 contain new-line-separated variable
316 assignments. Empty lines and lines
317 starting with ; or # will be ignored,
318 which may be used for commenting. A line
319 ending with a backslash will be concatenated
320 with the following one, allowing multiline variable
321 definitions. The parser strips leading
322 and trailing whitespace from the values
323 of assignments, unless you use
324 double quotes (").</para>
326 <para>The argument passed should be an
327 absolute filename or wildcard
328 expression, optionally prefixed with
329 "-", which indicates that if the file
330 does not exist it won't be read and no
331 error or warning message is logged.
332 This option may be specified more than
333 once in which case all specified files
334 are read. If the empty string is
335 assigned to this option the list of
336 file to read is reset, all prior
337 assignments have no effect.</para>
339 <para>The files listed with this
340 directive will be read shortly before
341 the process is executed. Settings from
342 these files override settings made
344 <varname>Environment=</varname>. If
345 the same variable is set twice from
346 these files the files will be read in
347 the order they are specified and the
348 later setting will override the
349 earlier setting.</para></listitem>
353 <term><varname>StandardInput=</varname></term>
354 <listitem><para>Controls where file
355 descriptor 0 (STDIN) of the executed
356 processes is connected to. Takes one
357 of <option>null</option>,
358 <option>tty</option>,
359 <option>tty-force</option>,
360 <option>tty-fail</option> or
361 <option>socket</option>. If
362 <option>null</option> is selected
363 standard input will be connected to
364 <filename>/dev/null</filename>,
365 i.e. all read attempts by the process
366 will result in immediate EOF. If
367 <option>tty</option> is selected
368 standard input is connected to a TTY
370 <varname>TTYPath=</varname>, see
371 below) and the executed process
372 becomes the controlling process of the
373 terminal. If the terminal is already
374 being controlled by another process the
375 executed process waits until the current
376 controlling process releases the
378 <option>tty-force</option>
379 is similar to <option>tty</option>,
380 but the executed process is forcefully
381 and immediately made the controlling
382 process of the terminal, potentially
383 removing previous controlling
385 terminal. <option>tty-fail</option> is
386 similar to <option>tty</option> but if
387 the terminal already has a controlling
388 process start-up of the executed
390 <option>socket</option> option is only
391 valid in socket-activated services,
392 and only when the socket configuration
394 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>
395 for details) specifies a single socket
396 only. If this option is set standard
397 input will be connected to the socket
398 the service was activated from, which
399 is primarily useful for compatibility
400 with daemons designed for use with the
402 <citerefentry><refentrytitle>inetd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
403 daemon. This setting defaults to
404 <option>null</option>.</para></listitem>
407 <term><varname>StandardOutput=</varname></term>
408 <listitem><para>Controls where file
409 descriptor 1 (STDOUT) of the executed
410 processes is connected to. Takes one
411 of <option>inherit</option>,
412 <option>null</option>,
413 <option>tty</option>,
414 <option>syslog</option>,
415 <option>kmsg</option>,
416 <option>journal</option>,
417 <option>syslog+console</option>,
418 <option>kmsg+console</option>,
419 <option>journal+console</option> or
420 <option>socket</option>. If set to
421 <option>inherit</option> the file
422 descriptor of standard input is
423 duplicated for standard output. If set
424 to <option>null</option> standard
425 output will be connected to
426 <filename>/dev/null</filename>,
427 i.e. everything written to it will be
428 lost. If set to <option>tty</option>
429 standard output will be connected to a
430 tty (as configured via
431 <varname>TTYPath=</varname>, see
432 below). If the TTY is used for output
433 only the executed process will not
434 become the controlling process of the
435 terminal, and will not fail or wait
436 for other processes to release the
437 terminal. <option>syslog</option>
438 connects standard output to the
439 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
441 service. <option>kmsg</option>
442 connects it with the kernel log buffer
443 which is accessible via
444 <citerefentry><refentrytitle>dmesg</refentrytitle><manvolnum>1</manvolnum></citerefentry>. <option>journal</option>
445 connects it with the journal which is
447 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
448 (Note that everything that is written
449 to syslog or kmsg is implicitly stored
450 in the journal as well, those options
451 are hence supersets of this
452 one). <option>syslog+console</option>,
453 <option>journal+console</option> and
454 <option>kmsg+console</option> work
455 similarly but copy the output to the
457 well. <option>socket</option> connects
458 standard output to a socket from
459 socket activation, semantics are
460 similar to the respective option of
461 <varname>StandardInput=</varname>.
462 This setting defaults to the value set
464 <option>DefaultStandardOutput=</option>
466 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
468 <option>journal</option>.</para></listitem>
471 <term><varname>StandardError=</varname></term>
472 <listitem><para>Controls where file
473 descriptor 2 (STDERR) of the executed
474 processes is connected to. The
475 available options are identical to
477 <varname>StandardOutput=</varname>,
478 with one exception: if set to
479 <option>inherit</option> the file
480 descriptor used for standard output is
481 duplicated for standard error. This
482 setting defaults to the value set with
483 <option>DefaultStandardError=</option>
485 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
487 <option>inherit</option>.</para></listitem>
490 <term><varname>TTYPath=</varname></term>
491 <listitem><para>Sets the terminal
492 device node to use if standard input,
493 output or stderr are connected to a
494 TTY (see above). Defaults to
495 <filename>/dev/console</filename>.</para></listitem>
498 <term><varname>TTYReset=</varname></term>
499 <listitem><para>Reset the terminal
500 device specified with
501 <varname>TTYPath=</varname> before and
502 after execution. Defaults to
503 <literal>no</literal>.</para></listitem>
506 <term><varname>TTYVHangup=</varname></term>
507 <listitem><para>Disconnect all clients
508 which have opened the terminal device
510 <varname>TTYPath=</varname>
511 before and after execution. Defaults
513 <literal>no</literal>.</para></listitem>
516 <term><varname>TTYVTDisallocate=</varname></term>
517 <listitem><para>If the terminal
518 device specified with
519 <varname>TTYPath=</varname> is a
520 virtual console terminal try to
521 deallocate the TTY before and after
522 execution. This ensures that the
523 screen and scrollback buffer is
525 <literal>no</literal>.</para></listitem>
528 <term><varname>SyslogIdentifier=</varname></term>
529 <listitem><para>Sets the process name
530 to prefix log lines sent to syslog or
531 the kernel log buffer with. If not set
532 defaults to the process name of the
533 executed process. This option is only
535 <varname>StandardOutput=</varname> or
536 <varname>StandardError=</varname> are
537 set to <option>syslog</option> or
538 <option>kmsg</option>.</para></listitem>
541 <term><varname>SyslogFacility=</varname></term>
542 <listitem><para>Sets the syslog
543 facility to use when logging to
544 syslog. One of <option>kern</option>,
545 <option>user</option>,
546 <option>mail</option>,
547 <option>daemon</option>,
548 <option>auth</option>,
549 <option>syslog</option>,
550 <option>lpr</option>,
551 <option>news</option>,
552 <option>uucp</option>,
553 <option>cron</option>,
554 <option>authpriv</option>,
555 <option>ftp</option>,
556 <option>local0</option>,
557 <option>local1</option>,
558 <option>local2</option>,
559 <option>local3</option>,
560 <option>local4</option>,
561 <option>local5</option>,
562 <option>local6</option> or
563 <option>local7</option>. See
564 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
565 for details. This option is only
567 <varname>StandardOutput=</varname> or
568 <varname>StandardError=</varname> are
569 set to <option>syslog</option>.
571 <option>daemon</option>.</para></listitem>
574 <term><varname>SyslogLevel=</varname></term>
575 <listitem><para>Default syslog level
576 to use when logging to syslog or the
577 kernel log buffer. One of
578 <option>emerg</option>,
579 <option>alert</option>,
580 <option>crit</option>,
581 <option>err</option>,
582 <option>warning</option>,
583 <option>notice</option>,
584 <option>info</option>,
585 <option>debug</option>. See
586 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
587 for details. This option is only
589 <varname>StandardOutput=</varname> or
590 <varname>StandardError=</varname> are
591 set to <option>syslog</option> or
592 <option>kmsg</option>. Note that
593 individual lines output by the daemon
594 might be prefixed with a different log
595 level which can be used to override
596 the default log level specified
597 here. The interpretation of these
598 prefixes may be disabled with
599 <varname>SyslogLevelPrefix=</varname>,
600 see below. For details see
601 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
604 <option>info</option>.</para></listitem>
608 <term><varname>SyslogLevelPrefix=</varname></term>
609 <listitem><para>Takes a boolean
610 argument. If true and
611 <varname>StandardOutput=</varname> or
612 <varname>StandardError=</varname> are
613 set to <option>syslog</option>,
614 <option>kmsg</option> or
615 <option>journal</option>, log lines
616 written by the executed process that
617 are prefixed with a log level will be
618 passed on to syslog with this log
619 level set but the prefix removed. If
620 set to false, the interpretation of
621 these prefixes is disabled and the
622 logged lines are passed on as-is. For
623 details about this prefixing see
624 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
625 Defaults to true.</para></listitem>
629 <term><varname>TimerSlackNSec=</varname></term>
630 <listitem><para>Sets the timer slack
631 in nanoseconds for the executed
632 processes. The timer slack controls
633 the accuracy of wake-ups triggered by
635 <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
636 for more information. Note that in
637 contrast to most other time span
638 definitions this parameter takes an
639 integer value in nano-seconds if no
640 unit is specified. The usual time
642 too.</para></listitem>
646 <term><varname>LimitCPU=</varname></term>
647 <term><varname>LimitFSIZE=</varname></term>
648 <term><varname>LimitDATA=</varname></term>
649 <term><varname>LimitSTACK=</varname></term>
650 <term><varname>LimitCORE=</varname></term>
651 <term><varname>LimitRSS=</varname></term>
652 <term><varname>LimitNOFILE=</varname></term>
653 <term><varname>LimitAS=</varname></term>
654 <term><varname>LimitNPROC=</varname></term>
655 <term><varname>LimitMEMLOCK=</varname></term>
656 <term><varname>LimitLOCKS=</varname></term>
657 <term><varname>LimitSIGPENDING=</varname></term>
658 <term><varname>LimitMSGQUEUE=</varname></term>
659 <term><varname>LimitNICE=</varname></term>
660 <term><varname>LimitRTPRIO=</varname></term>
661 <term><varname>LimitRTTIME=</varname></term>
662 <listitem><para>These settings control
663 various resource limits for executed
665 <citerefentry><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry>
666 for details. Use the string
667 <varname>infinity</varname> to
668 configure no limit on a specific
669 resource.</para></listitem>
673 <term><varname>PAMName=</varname></term>
674 <listitem><para>Sets the PAM service
675 name to set up a session as. If set
676 the executed process will be
677 registered as a PAM session under the
678 specified service name. This is only
679 useful in conjunction with the
680 <varname>User=</varname> setting. If
681 not set no PAM session will be opened
682 for the executed processes. See
683 <citerefentry><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>
684 for details.</para></listitem>
688 <term><varname>TCPWrapName=</varname></term>
689 <listitem><para>If this is a
690 socket-activated service this sets the
691 tcpwrap service name to check the
692 permission for the current connection
693 with. This is only useful in
694 conjunction with socket-activated
695 services, and stream sockets (TCP) in
696 particular. It has no effect on other
697 socket types (e.g. datagram/UDP) and
698 on processes unrelated to socket-based
699 activation. If the tcpwrap
700 verification fails daemon start-up
701 will fail and the connection is
703 <citerefentry><refentrytitle>tcpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
704 for details. Note that this option may
705 be used to do access control checks
706 only. Shell commands and commands
708 <citerefentry><refentrytitle>hosts_options</refentrytitle><manvolnum>5</manvolnum></citerefentry>
709 are not supported.</para></listitem>
713 <term><varname>CapabilityBoundingSet=</varname></term>
715 <listitem><para>Controls which
716 capabilities to include in the
717 capability bounding set for the
718 executed process. See
719 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
720 for details. Takes a whitespace-separated
721 list of capability names as read by
722 <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
723 e.g. <constant>CAP_SYS_ADMIN</constant>,
724 <constant>CAP_DAC_OVERRIDE</constant>,
725 <constant>CAP_SYS_PTRACE</constant>.
726 Capabilities listed will be included
727 in the bounding set, all others are
728 removed. If the list of capabilities
729 is prefixed with <literal>~</literal>
730 all but the listed capabilities will
731 be included, the effect of the
732 assignment inverted. Note that this
733 option also affects the respective
734 capabilities in the effective,
735 permitted and inheritable capability
737 <varname>Capabilities=</varname>
738 does. If this option is not used the
739 capability bounding set is not
740 modified on process execution, hence
741 no limits on the capabilities of the
742 process are enforced. This option may
743 appear more than once in which case
744 the bounding sets are merged. If the
745 empty string is assigned to this
746 option the bounding set is reset to
747 the empty capability set, and all
748 prior settings have no effect. If set
749 to <literal>~</literal> (without any
750 further argument) the bounding set is
751 reset to the full set of available
752 capabilities, also undoing any
753 previous settings.</para></listitem>
757 <term><varname>SecureBits=</varname></term>
758 <listitem><para>Controls the secure
759 bits set for the executed process. See
760 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
761 for details. Takes a list of strings:
762 <option>keep-caps</option>,
763 <option>keep-caps-locked</option>,
764 <option>no-setuid-fixup</option>,
765 <option>no-setuid-fixup-locked</option>,
766 <option>noroot</option> and/or
767 <option>noroot-locked</option>. This
768 option may appear more than once in
769 which case the secure bits are
770 ORed. If the empty string is assigned
771 to this option the bits are reset to
776 <term><varname>Capabilities=</varname></term>
777 <listitem><para>Controls the
778 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
779 set for the executed process. Take a
780 capability string describing the
781 effective, permitted and inherited
782 capability sets as documented in
783 <citerefentry><refentrytitle>cap_from_text</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
784 Note that these capability sets are
785 usually influenced by the capabilities
786 attached to the executed file. Due to
788 <varname>CapabilityBoundingSet=</varname>
789 is probably the much more useful
790 setting.</para></listitem>
794 <term><varname>ControlGroup=</varname></term>
796 <listitem><para>Controls the control
797 groups the executed processes shall be
798 made members of. Takes a
799 space-separated list of cgroup
800 identifiers. A cgroup identifier is
802 <filename noindex='true'>cpu:/foo/bar</filename>,
803 where "cpu" indicates the kernel
804 control group controller used, and
805 <filename noindex='true'>/foo/bar</filename> is the
806 control group path. The controller
807 name and ":" may be omitted in which
808 case the named systemd control group
809 hierarchy is implied. Alternatively,
810 the path and ":" may be omitted, in
811 which case the default control group
812 path for this unit is implied.</para>
814 <para>This option may be used to place
815 executed processes in arbitrary groups
816 in arbitrary hierarchies -- which may
817 then be externally configured with
818 additional execution limits. By
819 default systemd will place all
820 executed processes in separate
821 per-unit control groups (named after
822 the unit) in the systemd named
823 hierarchy. This option is primarily
824 intended to place executed processes
825 in specific paths in specific kernel
826 controller hierarchies. It is not
827 recommended to manipulate the service
828 control group path in the private
829 systemd named hierarchy
830 (i.e. <literal>name=systemd</literal>),
831 and doing this might result in
832 undefined behaviour. For details about
833 control groups see <ulink
834 url="http://www.kernel.org/doc/Documentation/cgroups/cgroups.txt">cgroups.txt</ulink>.</para>
836 <para>This option may appear more than
837 once, in which case the list of
838 control group assignments is
839 merged. If the same hierarchy gets two
840 different paths assigned only the
841 later setting will take effect. If the
842 empty string is assigned to this
843 option the list of control group
844 assignments is reset, all previous
845 assignments will have no
848 <para>Note that the list of control
849 group assignments of a unit is
850 extended implicitly based on the
852 <varname>DefaultControllers=</varname>
854 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
856 <varname>ControlGroup=</varname>
857 setting for a specific controller
858 takes precedence.</para></listitem>
862 <term><varname>ControlGroupModify=</varname></term>
863 <listitem><para>Takes a boolean
864 argument. If true, the control groups
865 created for this unit will be owned by
866 the user specified with
867 <varname>User=</varname> (and the
868 appropriate group), and he/she can create
869 subgroups as well as add processes to
870 the group.</para></listitem>
874 <term><varname>ControlGroupPersistent=</varname></term>
875 <listitem><para>Takes a boolean
876 argument. If true, the control groups
877 created for this unit will be marked
878 to be persistent, i.e. systemd will
879 not remove them when stopping the
880 unit. The default is false, meaning
881 that the control groups will be
882 removed when the unit is stopped. For
883 details about the semantics of this
885 url="http://www.freedesktop.org/wiki/Software/systemd/PaxControlGroups">PaxControlGroups</ulink>.</para></listitem>
889 <term><varname>ControlGroupAttribute=</varname></term>
891 <listitem><para>Set a specific control
892 group attribute for executed
893 processes, and (if needed) add the
894 executed processes to a cgroup in the
895 hierarchy of the controller the
896 attribute belongs to. Takes two
897 space-separated arguments: the
898 attribute name (syntax is
899 <literal>cpu.shares</literal> where
900 <literal>cpu</literal> refers to a
901 specific controller and
902 <literal>shares</literal> to the
903 attribute name), and the attribute
905 <literal>ControlGroupAttribute=cpu.shares
906 512</literal>. If this option is used
907 for an attribute that belongs to a
908 kernel controller hierarchy the unit
909 is not already configured to be added
910 to (for example via the
911 <literal>ControlGroup=</literal>
912 option) then the unit will be added to
913 the controller and the default unit
914 cgroup path is implied. Thus, using
915 <varname>ControlGroupAttribute=</varname>
916 is in most cases sufficient to make
917 use of control group enforcements,
919 <varname>ControlGroup=</varname> are
920 only necessary in case the implied
921 default control group path for a
922 service is not desirable. For details
923 about control group attributes see
925 url="http://www.kernel.org/doc/Documentation/cgroups/cgroups.txt">cgroups.txt</ulink>. This
926 option may appear more than once, in
927 order to set multiple control group
928 attributes. If this option is used
929 multiple times for the same cgroup
930 attribute only the later setting takes
931 effect. If the empty string is
932 assigned to this option the list of
933 attributes is reset, all previous
934 cgroup attribute settings have no
935 effect, including those done with
936 <varname>CPUShares=</varname>,
937 <varname>MemoryLimit=</varname>,
938 <varname>MemorySoftLimit</varname>,
939 <varname>DeviceAllow=</varname>,
940 <varname>DeviceDeny=</varname>,
941 <varname>BlockIOWeight=</varname>,
942 <varname>BlockIOReadBandwidth=</varname>,
943 <varname>BlockIOWriteBandwidth=</varname>.
948 <term><varname>CPUShares=</varname></term>
950 <listitem><para>Assign the specified
951 overall CPU time shares to the
952 processes executed. Takes an integer
953 value. This controls the
954 <literal>cpu.shares</literal> control
955 group attribute, which defaults to
956 1024. For details about this control
957 group attribute see <ulink
958 url="http://www.kernel.org/doc/Documentation/scheduler/sched-design-CFS.txt">sched-design-CFS.txt</ulink>.</para></listitem>
962 <term><varname>MemoryLimit=</varname></term>
963 <term><varname>MemorySoftLimit=</varname></term>
965 <listitem><para>Limit the overall memory usage
966 of the executed processes to a certain
967 size. Takes a memory size in bytes. If
968 the value is suffixed with K, M, G or
969 T the specified memory size is parsed
970 as Kilobytes, Megabytes, Gigabytes,
971 or Terabytes (to the base
972 1024), respectively. This controls the
973 <literal>memory.limit_in_bytes</literal>
975 <literal>memory.soft_limit_in_bytes</literal>
976 control group attributes. For details
977 about these control group attributes
979 url="http://www.kernel.org/doc/Documentation/cgroups/memory.txt">memory.txt</ulink>.</para></listitem>
983 <term><varname>DeviceAllow=</varname></term>
984 <term><varname>DeviceDeny=</varname></term>
986 <listitem><para>Control access to
987 specific device nodes by the executed processes. Takes two
988 space-separated strings: a device node
990 <filename>/dev/null</filename>)
991 followed by a combination of r, w, m
992 to control reading, writing, or
993 creating of the specific device node
994 by the unit, respectively. This controls the
995 <literal>devices.allow</literal>
997 <literal>devices.deny</literal>
998 control group attributes. For details
999 about these control group attributes
1001 url="http://www.kernel.org/doc/Documentation/cgroups/devices.txt">devices.txt</ulink>.</para></listitem>
1005 <term><varname>BlockIOWeight=</varname></term>
1007 <listitem><para>Set the default or
1008 per-device overall block IO weight
1009 value for the executed
1010 processes. Takes either a single
1011 weight value (between 10 and 1000) to
1012 set the default block IO weight, or a
1013 space-separated pair of a file path
1014 and a weight value to specify the
1015 device specific weight value (Example:
1016 "/dev/sda 500"). The file path may be
1017 specified as path to a block device
1018 node or as any other file in which
1019 case the backing block device of the
1020 file system of the file is
1021 determined. This controls the
1022 <literal>blkio.weight</literal> and
1023 <literal>blkio.weight_device</literal>
1024 control group attributes, which
1025 default to 1000. Use this option
1026 multiple times to set weights for
1027 multiple devices. For details about
1028 these control group attributes see
1030 url="http://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt">blkio-controller.txt</ulink>.</para></listitem>
1034 <term><varname>BlockIOReadBandwidth=</varname></term>
1035 <term><varname>BlockIOWriteBandwidth=</varname></term>
1037 <listitem><para>Set the per-device
1038 overall block IO bandwidth limit for
1039 the executed processes. Takes a
1040 space-separated pair of a file path and a
1041 bandwidth value (in bytes per second)
1042 to specify the device specific
1043 bandwidth. The file path may be
1044 specified as path to a block device
1045 node or as any other file in which
1046 case the backing block device of the
1047 file system of the file is determined.
1048 If the bandwidth is suffixed with K, M,
1049 G, or T the specified bandwidth is
1050 parsed as Kilobytes, Megabytes,
1051 Gigabytes, or Terabytes, respectively (Example:
1052 "/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0
1053 5M"). This controls the
1054 <literal>blkio.read_bps_device</literal>
1056 <literal>blkio.write_bps_device</literal>
1057 control group attributes. Use this
1058 option multiple times to set bandwidth
1059 limits for multiple devices. For
1060 details about these control group
1061 attributes see <ulink
1062 url="http://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt">blkio-controller.txt</ulink>.</para></listitem>
1066 <term><varname>ReadWriteDirectories=</varname></term>
1067 <term><varname>ReadOnlyDirectories=</varname></term>
1068 <term><varname>InaccessibleDirectories=</varname></term>
1070 <listitem><para>Sets up a new
1071 file system namespace for executed
1072 processes. These options may be used
1073 to limit access a process might have
1074 to the main file system
1075 hierarchy. Each setting takes a
1076 space-separated list of absolute
1077 directory paths. Directories listed in
1078 <varname>ReadWriteDirectories=</varname>
1079 are accessible from within the
1080 namespace with the same access rights
1081 as from outside. Directories listed in
1082 <varname>ReadOnlyDirectories=</varname>
1083 are accessible for reading only,
1084 writing will be refused even if the
1085 usual file access controls would
1086 permit this. Directories listed in
1087 <varname>InaccessibleDirectories=</varname>
1088 will be made inaccessible for
1089 processes inside the namespace. Note
1090 that restricting access with these
1091 options does not extend to submounts
1092 of a directory. You must list
1093 submounts separately in these settings
1094 to ensure the same limited
1095 access. These options may be specified
1096 more than once in which case all
1097 directories listed will have limited
1098 access from within the namespace. If
1099 the empty string is assigned to this
1100 option the specific list is reset, and
1101 all prior assignments have no
1102 effect.</para></listitem>
1106 <term><varname>PrivateTmp=</varname></term>
1108 <listitem><para>Takes a boolean
1109 argument. If true sets up a new file
1110 system namespace for the executed
1111 processes and mounts private
1112 <filename>/tmp</filename> and
1113 <filename>/var/tmp</filename> directories
1114 inside it, that are not shared by
1115 processes outside of the
1116 namespace. This is useful to secure
1117 access to temporary files of the
1118 process, but makes sharing between
1120 <filename>/tmp</filename> or
1121 <filename>/var/tmp</filename>
1122 impossible. All temporary data created
1123 by service will be removed after service
1124 is stopped. Defaults to
1125 false.</para></listitem>
1129 <term><varname>PrivateNetwork=</varname></term>
1131 <listitem><para>Takes a boolean
1132 argument. If true sets up a new
1133 network namespace for the executed
1134 processes and configures only the
1135 loopback network device
1136 <literal>lo</literal> inside it. No
1137 other network devices will be
1138 available to the executed process.
1139 This is useful to securely turn off
1140 network access by the executed
1141 process. Defaults to
1142 false.</para></listitem>
1146 <term><varname>MountFlags=</varname></term>
1148 <listitem><para>Takes a mount
1150 <option>shared</option>,
1151 <option>slave</option> or
1152 <option>private</option>, which
1153 control whether the file system
1154 namespace set up for this unit's
1155 processes will receive or propagate
1157 <citerefentry><refentrytitle>mount</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1158 for details. Default to
1159 <option>shared</option>.</para></listitem>
1163 <term><varname>UtmpIdentifier=</varname></term>
1165 <listitem><para>Takes a four
1166 character identifier string for an
1167 utmp/wtmp entry for this service. This
1168 should only be set for services such
1169 as <command>getty</command>
1170 implementations where utmp/wtmp
1171 entries must be created and cleared
1172 before and after execution. If the
1173 configured string is longer than four
1174 characters it is truncated and the
1175 terminal four characters are
1176 used. This setting interprets %I style
1177 string replacements. This setting is
1178 unset by default, i.e. no utmp/wtmp
1179 entries are created or cleaned up for
1180 this service.</para></listitem>
1184 <term><varname>IgnoreSIGPIPE=</varname></term>
1186 <listitem><para>Takes a boolean
1187 argument. If true, causes SIGPIPE to be
1188 ignored in the executed
1189 process. Defaults to true because
1190 SIGPIPE generally is useful only in
1191 shell pipelines.</para></listitem>
1195 <term><varname>NoNewPrivileges=</varname></term>
1197 <listitem><para>Takes a boolean
1198 argument. If true, ensures that the
1199 service process and all its children
1200 can never gain new privileges. This
1201 option is more powerful than the respective
1202 secure bits flags (see above), as it
1203 also prohibits UID changes of any
1204 kind. This is the simplest, most
1205 effective way to ensure that a process
1206 and its children can never elevate
1207 privileges again.</para></listitem>
1211 <term><varname>SystemCallFilter=</varname></term>
1213 <listitem><para>Takes a space-separated
1215 names. If this setting is used, all
1216 system calls executed by the unit
1217 process except for the listed ones
1218 will result in immediate process
1219 termination with the
1220 <constant>SIGSYS</constant> signal
1221 (whitelisting). If the first character
1222 of the list is <literal>~</literal>
1223 the effect is inverted: only the
1224 listed system calls will result in
1225 immediate process termination
1226 (blacklisting). If this option is used
1227 <varname>NoNewPrivileges=yes</varname>
1228 is implied. This feature makes use of
1229 the Secure Computing Mode 2 interfaces
1230 of the kernel ('seccomp filtering')
1231 and is useful for enforcing a minimal
1232 sandboxing environment. Note that the
1233 <function>execve</function>,
1234 <function>rt_sigreturn</function>,
1235 <function>sigreturn</function>,
1236 <function>exit_group</function>,
1237 <function>exit</function> system calls
1238 are implicitly whitelisted and don't
1239 need to be listed explicitly. This
1240 option may be specified more than once
1241 in which case the filter masks are
1242 merged. If the empty string is
1243 assigned the filter is reset, all
1244 prior assignments will have no
1245 effect.</para></listitem>
1252 <title>See Also</title>
1254 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1255 <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1256 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1257 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1258 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1259 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1260 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1261 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1262 <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1263 <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>