1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
6 This file is part of systemd.
8 Copyright 2010 Lennart Poettering
10 systemd is free software; you can redistribute it and/or modify it
11 under the terms of the GNU Lesser General Public License as published by
12 the Free Software Foundation; either version 2.1 of the License, or
13 (at your option) any later version.
15 systemd is distributed in the hope that it will be useful, but
16 WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Lesser General Public License for more details.
20 You should have received a copy of the GNU Lesser General Public License
21 along with systemd; If not, see <http://www.gnu.org/licenses/>.
24 <refentry id="systemd.socket">
26 <title>systemd.socket</title>
27 <productname>systemd</productname>
31 <contrib>Developer</contrib>
32 <firstname>Lennart</firstname>
33 <surname>Poettering</surname>
34 <email>lennart@poettering.net</email>
40 <refentrytitle>systemd.socket</refentrytitle>
41 <manvolnum>5</manvolnum>
45 <refname>systemd.socket</refname>
46 <refpurpose>Socket unit configuration</refpurpose>
50 <para><filename><replaceable>socket</replaceable>.socket</filename></para>
54 <title>Description</title>
56 <para>A unit configuration file whose name ends in
57 <literal>.socket</literal> encodes information about an IPC or
58 network socket or a file system FIFO controlled and supervised by
59 systemd, for socket-based activation.</para>
61 <para>This man page lists the configuration options specific to
63 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
64 for the common options of all unit configuration files. The common
65 configuration items are configured in the generic [Unit] and
66 [Install] sections. The socket specific configuration options are
67 configured in the [Socket] section.</para>
69 <para>Additional options are listed in
70 <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
71 which define the execution environment the
72 <option>ExecStartPre=</option>, <option>ExecStartPost=</option>,
73 <option>ExecStopPre=</option> and <option>ExecStopPost=</option>
74 commands are executed in, and in
75 <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
76 which define the way the processes are terminated, and in
77 <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
78 which configure resource control settings for the processes of the
81 <para>For each socket file, a matching service file must exist,
82 describing the service to start on incoming traffic on the socket
84 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
85 for more information about .service files). The name of the
86 .service unit is by default the same as the name of the .socket
87 unit, but can be altered with the <option>Service=</option> option
88 described below. Depending on the setting of the
89 <option>Accept=</option> option described below, this .service
90 unit must either be named like the .socket unit, but with the
91 suffix replaced, unless overridden with <option>Service=</option>;
92 or it must be a template unit named the same way. Example: a
93 socket file <filename>foo.socket</filename> needs a matching
94 service <filename>foo.service</filename> if
95 <option>Accept=false</option> is set. If
96 <option>Accept=true</option> is set, a service template file
97 <filename>foo@.service</filename> must exist from which services
98 are instantiated for each incoming connection.</para>
100 <para>Unless <varname>DefaultDependencies=</varname> is set to
101 <option>false</option>, socket units will implicitly have
102 dependencies of type <varname>Requires=</varname> and
103 <varname>After=</varname> on <filename>sysinit.target</filename>
104 as well as dependencies of type <varname>Conflicts=</varname> and
105 <varname>Before=</varname> on
106 <filename>shutdown.target</filename>. These ensure that socket
107 units pull in basic system initialization, and are terminated
108 cleanly prior to system shutdown. Only sockets involved with early
109 boot or late system shutdown should disable this option.</para>
111 <para>Socket units will have a <varname>Before=</varname>
112 dependency on the service which they trigger added implicitly. No
113 implicit <varname>WantedBy=</varname> or
114 <varname>RequiredBy=</varname> dependency from the socket to the
115 service is added. This means that the service may be started
116 without the socket, in which case it must be able to open sockets
117 by itself. To prevent this, an explicit
118 <varname>Requires=</varname> dependency may be added.</para>
120 <para>Socket units may be used to implement on-demand starting of
121 services, as well as parallelized starting of services. See the
122 blog stories linked at the end for an introduction.</para>
124 <para>Note that the daemon software configured for socket
125 activation with socket units needs to be able to accept sockets
126 from systemd, either via systemd's native socket passing interface
128 <citerefentry><refentrytitle>sd_listen_fds</refentrytitle><manvolnum>3</manvolnum></citerefentry>
129 for details) or via the traditional
130 <citerefentry><refentrytitle>inetd</refentrytitle><manvolnum>8</manvolnum></citerefentry>-style
131 socket passing (i.e. sockets passed in via standard input and
132 output, using <varname>StandardInput=socket</varname> in the
133 service file).</para>
137 <title>Options</title>
139 <para>Socket files must include a [Socket] section, which carries
140 information about the socket or FIFO it supervises. A number of
141 options that may be used in this section are shared with other
142 unit types. These options are documented in
143 <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
145 <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
146 The options specific to the [Socket] section of socket units are
147 the following:</para>
149 <variablelist class='unit-directives'>
151 <term><varname>ListenStream=</varname></term>
152 <term><varname>ListenDatagram=</varname></term>
153 <term><varname>ListenSequentialPacket=</varname></term>
154 <listitem><para>Specifies an address to listen on for a stream
155 (<constant>SOCK_STREAM</constant>), datagram
156 (<constant>SOCK_DGRAM</constant>), or sequential packet
157 (<constant>SOCK_SEQPACKET</constant>) socket, respectively.
158 The address can be written in various formats:</para>
160 <para>If the address starts with a slash
161 (<literal>/</literal>), it is read as file system socket in
162 the <constant>AF_UNIX</constant> socket family.</para>
164 <para>If the address starts with an at symbol
165 (<literal>@</literal>), it is read as abstract namespace
166 socket in the <constant>AF_UNIX</constant> family. The
167 <literal>@</literal> is replaced with a
168 <constant>NUL</constant> character before binding. For
170 <citerefentry project='man-pages'><refentrytitle>unix</refentrytitle><manvolnum>7</manvolnum></citerefentry>.</para>
172 <para>If the address string is a single number, it is read as
173 port number to listen on via IPv6. Depending on the value of
174 <varname>BindIPv6Only=</varname> (see below) this might result
175 in the service being available via both IPv6 and IPv4
176 (default) or just via IPv6.
179 <para>If the address string is a string in the format
180 v.w.x.y:z, it is read as IPv4 specifier for listening on an
181 address v.w.x.y on a port z.</para>
183 <para>If the address string is a string in the format [x]:y,
184 it is read as IPv6 address x on a port y. Note that this might
185 make the service available via IPv4, too, depending on the
186 <varname>BindIPv6Only=</varname> setting (see below).
189 <para>Note that <constant>SOCK_SEQPACKET</constant> (i.e.
190 <varname>ListenSequentialPacket=</varname>) is only available
191 for <constant>AF_UNIX</constant> sockets.
192 <constant>SOCK_STREAM</constant> (i.e.
193 <varname>ListenStream=</varname>) when used for IP sockets
194 refers to TCP sockets, <constant>SOCK_DGRAM</constant> (i.e.
195 <varname>ListenDatagram=</varname>) to UDP.</para>
197 <para>These options may be specified more than once in which
198 case incoming traffic on any of the sockets will trigger
199 service activation, and all listed sockets will be passed to
200 the service, regardless of whether there is incoming traffic
201 on them or not. If the empty string is assigned to any of
202 these options, the list of addresses to listen on is reset,
203 all prior uses of any of these options will have no
206 <para>It is also possible to have more than one socket unit
207 for the same service when using <varname>Service=</varname>,
208 and the service will receive all the sockets configured in all
209 the socket units. Sockets configured in one unit are passed in
210 the order of configuration, but no ordering between socket
211 units is specified.</para>
213 <para>If an IP address is used here, it is often desirable to
214 listen on it before the interface it is configured on is up
215 and running, and even regardless of whether it will be up and
216 running at any point. To deal with this, it is recommended to
217 set the <varname>FreeBind=</varname> option described
218 below.</para></listitem>
222 <term><varname>ListenFIFO=</varname></term>
223 <listitem><para>Specifies a file system FIFO to listen on.
224 This expects an absolute file system path as argument.
225 Behavior otherwise is very similar to the
226 <varname>ListenDatagram=</varname> directive
227 above.</para></listitem>
231 <term><varname>ListenSpecial=</varname></term>
232 <listitem><para>Specifies a special file in the file system to
233 listen on. This expects an absolute file system path as
234 argument. Behavior otherwise is very similar to the
235 <varname>ListenFIFO=</varname> directive above. Use this to
236 open character device nodes as well as special files in
237 <filename>/proc</filename> and
238 <filename>/sys</filename>.</para></listitem>
242 <term><varname>ListenNetlink=</varname></term>
243 <listitem><para>Specifies a Netlink family to create a socket
244 for to listen on. This expects a short string referring to the
245 <constant>AF_NETLINK</constant> family name (such as
246 <varname>audit</varname> or <varname>kobject-uevent</varname>)
247 as argument, optionally suffixed by a whitespace followed by a
248 multicast group integer. Behavior otherwise is very similar to
249 the <varname>ListenDatagram=</varname> directive
250 above.</para></listitem>
254 <term><varname>ListenMessageQueue=</varname></term>
255 <listitem><para>Specifies a POSIX message queue name to listen
256 on. This expects a valid message queue name (i.e. beginning
257 with /). Behavior otherwise is very similar to the
258 <varname>ListenFIFO=</varname> directive above. On Linux
259 message queue descriptors are actually file descriptors and
260 can be inherited between processes.</para></listitem>
264 <term><varname>BindIPv6Only=</varname></term>
265 <listitem><para>Takes a one of <option>default</option>,
266 <option>both</option> or <option>ipv6-only</option>. Controls
267 the IPV6_V6ONLY socket option (see
268 <citerefentry><refentrytitle>ipv6</refentrytitle><manvolnum>7</manvolnum></citerefentry>
269 for details). If <option>both</option>, IPv6 sockets bound
270 will be accessible via both IPv4 and IPv6. If
271 <option>ipv6-only</option>, they will be accessible via IPv6
272 only. If <option>default</option> (which is the default,
273 surprise!), the system wide default setting is used, as
275 <filename>/proc/sys/net/ipv6/bindv6only</filename>, which in
276 turn defaults to the equivalent of
277 <option>both</option>.</para>
282 <term><varname>Backlog=</varname></term>
283 <listitem><para>Takes an unsigned integer argument. Specifies
284 the number of connections to queue that have not been accepted
285 yet. This setting matters only for stream and sequential
287 <citerefentry><refentrytitle>listen</refentrytitle><manvolnum>2</manvolnum></citerefentry>
288 for details. Defaults to SOMAXCONN (128).</para></listitem>
292 <term><varname>BindToDevice=</varname></term>
293 <listitem><para>Specifies a network interface name to bind
294 this socket to. If set, traffic will only be accepted from the
295 specified network interfaces. This controls the
296 SO_BINDTODEVICE socket option (see
297 <citerefentry><refentrytitle>socket</refentrytitle><manvolnum>7</manvolnum></citerefentry>
298 for details). If this option is used, an automatic dependency
299 from this socket unit on the network interface device unit
300 (<citerefentry><refentrytitle>systemd.device</refentrytitle><manvolnum>5</manvolnum></citerefentry>
301 is created.</para></listitem>
305 <term><varname>SocketUser=</varname></term>
306 <term><varname>SocketGroup=</varname></term>
308 <listitem><para>Takes a UNIX user/group name. When specified,
309 all AF_UNIX sockets and FIFO nodes in the file system are
310 owned by the specified user and group. If unset (the default),
311 the nodes are owned by the root user/group (if run in system
312 context) or the invoking user/group (if run in user context).
313 If only a user is specified but no group, then the group is
314 derived from the user's default group.</para></listitem>
318 <term><varname>SocketMode=</varname></term>
319 <listitem><para>If listening on a file system socket or FIFO,
320 this option specifies the file system access mode used when
321 creating the file node. Takes an access mode in octal
322 notation. Defaults to 0666.</para></listitem>
326 <term><varname>DirectoryMode=</varname></term>
327 <listitem><para>If listening on a file system socket or FIFO,
328 the parent directories are automatically created if needed.
329 This option specifies the file system access mode used when
330 creating these directories. Takes an access mode in octal
331 notation. Defaults to 0755.</para></listitem>
335 <term><varname>Accept=</varname></term>
336 <listitem><para>Takes a boolean argument. If true, a service
337 instance is spawned for each incoming connection and only the
338 connection socket is passed to it. If false, all listening
339 sockets themselves are passed to the started service unit, and
340 only one service unit is spawned for all connections (also see
341 above). This value is ignored for datagram sockets and FIFOs
342 where a single service unit unconditionally handles all
343 incoming traffic. Defaults to <option>false</option>. For
344 performance reasons, it is recommended to write new daemons
345 only in a way that is suitable for
346 <option>Accept=false</option>. A daemon listening on an
347 <constant>AF_UNIX</constant> socket may, but does not need to,
349 <citerefentry><refentrytitle>close</refentrytitle><manvolnum>2</manvolnum></citerefentry>
350 on the received socket before exiting. However, it must not
351 unlink the socket from a file system. It should not invoke
352 <citerefentry><refentrytitle>shutdown</refentrytitle><manvolnum>2</manvolnum></citerefentry>
353 on sockets it got with <varname>Accept=false</varname>, but it
354 may do so for sockets it got with
355 <varname>Accept=true</varname> set. Setting
356 <varname>Accept=true</varname> is mostly useful to allow
357 daemons designed for usage with
358 <citerefentry><refentrytitle>inetd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
359 to work unmodified with systemd socket
360 activation.</para></listitem>
364 <term><varname>MaxConnections=</varname></term>
365 <listitem><para>The maximum number of connections to
366 simultaneously run services instances for, when
367 <option>Accept=true</option> is set. If more concurrent
368 connections are coming in, they will be refused until at least
369 one existing connection is terminated. This setting has no
370 effect on sockets configured with
371 <option>Accept=false</option> or datagram sockets. Defaults to
372 64.</para></listitem>
376 <term><varname>KeepAlive=</varname></term>
377 <listitem><para>Takes a boolean argument. If true, the TCP/IP
378 stack will send a keep alive message after 2h (depending on
380 <filename>/proc/sys/net/ipv4/tcp_keepalive_time</filename>)
381 for all TCP streams accepted on this socket. This controls the
382 SO_KEEPALIVE socket option (see
383 <citerefentry><refentrytitle>socket</refentrytitle><manvolnum>7</manvolnum></citerefentry>
385 url="http://www.tldp.org/HOWTO/html_single/TCP-Keepalive-HOWTO/">TCP
386 Keepalive HOWTO</ulink> for details.) Defaults to
387 <option>false</option>.</para></listitem>
391 <term><varname>KeepAliveTimeSec=</varname></term>
392 <listitem><para>Takes time (in seconds) as argument . The connection needs to remain
393 idle before TCP starts sending keepalive probes. This controls the TCP_KEEPIDLE
395 <citerefentry><refentrytitle>socket</refentrytitle><manvolnum>7</manvolnum></citerefentry>
397 url="http://www.tldp.org/HOWTO/html_single/TCP-Keepalive-HOWTO/">TCP
398 Keepalive HOWTO</ulink> for details.)
399 Defaults value is 7200 seconds (2 hours).</para></listitem>
403 <term><varname>KeepAliveIntervalSec=</varname></term>
404 <listitem><para>Takes time (in seconds) as argument between
405 individual keepalive probes, if the socket option SO_KEEPALIVE
406 has been set on this socket seconds as argument. This controls
407 the TCP_KEEPINTVL socket option (see
408 <citerefentry><refentrytitle>socket</refentrytitle><manvolnum>7</manvolnum></citerefentry>
410 url="http://www.tldp.org/HOWTO/html_single/TCP-Keepalive-HOWTO/">TCP
411 Keepalive HOWTO</ulink> for details.) Defaults value is 75
412 seconds.</para></listitem>
416 <term><varname>KeepAliveProbes=</varname></term>
417 <listitem><para>Takes integer as argument. It's the number of
418 unacknowledged probes to send before considering the
419 connection dead and notifying the application layer. This
420 controls the TCP_KEEPCNT socket option (see
421 <citerefentry><refentrytitle>socket</refentrytitle><manvolnum>7</manvolnum></citerefentry>
423 url="http://www.tldp.org/HOWTO/html_single/TCP-Keepalive-HOWTO/">TCP
424 Keepalive HOWTO</ulink> for details.) Defaults value is
429 <term><varname>NoDelay=</varname></term>
430 <listitem><para>Takes a boolean argument. TCP Nagle's
431 algorithm works by combining a number of small outgoing
432 messages, and sending them all at once. This controls the
433 TCP_NODELAY socket option (see
434 <citerefentry><refentrytitle>tcp</refentrytitle><manvolnum>7</manvolnum></citerefentry>
435 Defaults to <option>false</option>.</para></listitem>
439 <term><varname>Priority=</varname></term>
440 <listitem><para>Takes an integer argument controlling the
441 priority for all traffic sent from this socket. This controls
442 the SO_PRIORITY socket option (see
443 <citerefentry><refentrytitle>socket</refentrytitle><manvolnum>7</manvolnum></citerefentry>
444 for details.).</para></listitem>
448 <term><varname>DeferAcceptSec=</varname></term>
450 <listitem><para>Takes time (in seconds) as argument. If set,
451 the listening process will be awakened only when data arrives
452 on the socket, and not immediately when connection is
453 established. When this option is set, the
454 <constant>TCP_DEFER_ACCEPT</constant> socket option will be
456 <citerefentry><refentrytitle>tcp</refentrytitle><manvolnum>7</manvolnum></citerefentry>),
457 and the kernel will ignore initial ACK packets without any
458 data. The argument specifies the approximate amount of time
459 the kernel should wait for incoming data before falling back
460 to the normal behaviour of honouring empty ACK packets. This
461 option is beneficial for protocols where the client sends the
462 data first (e.g. HTTP, in contrast to SMTP), because the
463 server process will not be woken up unnecessarily before it
467 <para>If the client also uses the
468 <constant>TCP_DEFER_ACCEPT</constant> option, the latency of
469 the initial connection may be reduced, because the kernel will
470 send data in the final packet establishing the connection (the
471 third packet in the "three-way handshake").</para>
473 <para>Disabled by default.</para>
478 <term><varname>ReceiveBuffer=</varname></term>
479 <term><varname>SendBuffer=</varname></term>
480 <listitem><para>Takes an integer argument controlling the
481 receive or send buffer sizes of this socket, respectively.
482 This controls the SO_RCVBUF and SO_SNDBUF socket options (see
483 <citerefentry><refentrytitle>socket</refentrytitle><manvolnum>7</manvolnum></citerefentry>
484 for details.). The usual suffixes K, M, G are supported and
485 are understood to the base of 1024.</para></listitem>
489 <term><varname>IPTOS=</varname></term>
490 <listitem><para>Takes an integer argument controlling the IP
491 Type-Of-Service field for packets generated from this socket.
492 This controls the IP_TOS socket option (see
493 <citerefentry><refentrytitle>ip</refentrytitle><manvolnum>7</manvolnum></citerefentry>
494 for details.). Either a numeric string or one of
495 <option>low-delay</option>, <option>throughput</option>,
496 <option>reliability</option> or <option>low-cost</option> may
497 be specified.</para></listitem>
501 <term><varname>IPTTL=</varname></term>
502 <listitem><para>Takes an integer argument controlling the IPv4
503 Time-To-Live/IPv6 Hop-Count field for packets generated from
504 this socket. This sets the IP_TTL/IPV6_UNICAST_HOPS socket
506 <citerefentry><refentrytitle>ip</refentrytitle><manvolnum>7</manvolnum></citerefentry>
508 <citerefentry><refentrytitle>ipv6</refentrytitle><manvolnum>7</manvolnum></citerefentry>
509 for details.)</para></listitem>
513 <term><varname>Mark=</varname></term>
514 <listitem><para>Takes an integer value. Controls the firewall
515 mark of packets generated by this socket. This can be used in
516 the firewall logic to filter packets from this socket. This
517 sets the SO_MARK socket option. See
518 <citerefentry><refentrytitle>iptables</refentrytitle><manvolnum>8</manvolnum></citerefentry>
519 for details.</para></listitem>
523 <term><varname>ReusePort=</varname></term>
524 <listitem><para>Takes a boolean value. If true, allows
526 <citerefentry><refentrytitle>bind</refentrytitle><manvolnum>2</manvolnum></citerefentry>s
527 to this TCP or UDP port. This controls the SO_REUSEPORT socket
529 <citerefentry><refentrytitle>socket</refentrytitle><manvolnum>7</manvolnum></citerefentry>
530 for details.</para></listitem>
534 <term><varname>SmackLabel=</varname></term>
535 <term><varname>SmackLabelIPIn=</varname></term>
536 <term><varname>SmackLabelIPOut=</varname></term>
537 <listitem><para>Takes a string value. Controls the extended
538 attributes <literal>security.SMACK64</literal>,
539 <literal>security.SMACK64IPIN</literal> and
540 <literal>security.SMACK64IPOUT</literal>, respectively, i.e.
541 the security label of the FIFO, or the security label for the
542 incoming or outgoing connections of the socket, respectively.
544 url="https://www.kernel.org/doc/Documentation/security/Smack.txt">Smack.txt</ulink>
545 for details.</para></listitem>
549 <term><varname>SELinuxContextFromNet=</varname></term>
550 <listitem><para>Takes a boolean argument. When true, systemd
551 will attempt to figure out the SELinux label used for the
552 instantiated service from the information handed by the peer
553 over the network. Note that only the security level is used
554 from the information provided by the peer. Other parts of the
555 resulting SELinux context originate from either the target
556 binary that is effectively triggered by socket unit or from
557 the value of the <varname>SELinuxContext=</varname> option.
558 This configuration option only affects sockets with
559 <varname>Accept=</varname> mode set to
560 <literal>true</literal>. Also note that this option is useful
561 only when MLS/MCS SELinux policy is deployed. Defaults to
562 <literal>false</literal>. </para></listitem>
566 <term><varname>PipeSize=</varname></term>
567 <listitem><para>Takes a size in bytes. Controls the pipe
568 buffer size of FIFOs configured in this socket unit. See
569 <citerefentry><refentrytitle>fcntl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
570 for details. The usual suffixes K, M, G are supported and are
571 understood to the base of 1024.</para></listitem>
575 <term><varname>MessageQueueMaxMessages=</varname>,
576 <varname>MessageQueueMessageSize=</varname></term>
577 <listitem><para>These two settings take integer values and
578 control the mq_maxmsg field or the mq_msgsize field,
579 respectively, when creating the message queue. Note that
580 either none or both of these variables need to be set. See
581 <citerefentry><refentrytitle>mq_setattr</refentrytitle><manvolnum>3</manvolnum></citerefentry>
582 for details.</para></listitem>
586 <term><varname>FreeBind=</varname></term>
587 <listitem><para>Takes a boolean value. Controls whether the
588 socket can be bound to non-local IP addresses. This is useful
589 to configure sockets listening on specific IP addresses before
590 those IP addresses are successfully configured on a network
591 interface. This sets the IP_FREEBIND socket option. For
592 robustness reasons it is recommended to use this option
593 whenever you bind a socket to a specific IP address. Defaults
594 to <option>false</option>.</para></listitem>
598 <term><varname>Transparent=</varname></term>
599 <listitem><para>Takes a boolean value. Controls the
600 IP_TRANSPARENT socket option. Defaults to
601 <option>false</option>.</para></listitem>
605 <term><varname>Broadcast=</varname></term>
606 <listitem><para>Takes a boolean value. This controls the
607 SO_BROADCAST socket option, which allows broadcast datagrams
608 to be sent from this socket. Defaults to
609 <option>false</option>.</para></listitem>
613 <term><varname>PassCredentials=</varname></term>
614 <listitem><para>Takes a boolean value. This controls the
615 SO_PASSCRED socket option, which allows
616 <constant>AF_UNIX</constant> sockets to receive the
617 credentials of the sending process in an ancillary message.
618 Defaults to <option>false</option>.</para></listitem>
622 <term><varname>PassSecurity=</varname></term>
623 <listitem><para>Takes a boolean value. This controls the
624 SO_PASSSEC socket option, which allows
625 <constant>AF_UNIX</constant> sockets to receive the security
626 context of the sending process in an ancillary message.
627 Defaults to <option>false</option>.</para></listitem>
631 <term><varname>TCPCongestion=</varname></term>
632 <listitem><para>Takes a string value. Controls the TCP
633 congestion algorithm used by this socket. Should be one of
634 "westwood", "veno", "cubic", "lp" or any other available
635 algorithm supported by the IP stack. This setting applies only
636 to stream sockets.</para></listitem>
640 <term><varname>ExecStartPre=</varname></term>
641 <term><varname>ExecStartPost=</varname></term>
642 <listitem><para>Takes one or more command lines, which are
643 executed before or after the listening sockets/FIFOs are
644 created and bound, respectively. The first token of the
645 command line must be an absolute filename, then followed by
646 arguments for the process. Multiple command lines may be
647 specified following the same scheme as used for
648 <varname>ExecStartPre=</varname> of service unit
649 files.</para></listitem>
653 <term><varname>ExecStopPre=</varname></term>
654 <term><varname>ExecStopPost=</varname></term>
655 <listitem><para>Additional commands that are executed before
656 or after the listening sockets/FIFOs are closed and removed,
657 respectively. Multiple command lines may be specified
658 following the same scheme as used for
659 <varname>ExecStartPre=</varname> of service unit
660 files.</para></listitem>
664 <term><varname>TimeoutSec=</varname></term>
665 <listitem><para>Configures the time to wait for the commands
666 specified in <varname>ExecStartPre=</varname>,
667 <varname>ExecStartPost=</varname>,
668 <varname>ExecStopPre=</varname> and
669 <varname>ExecStopPost=</varname> to finish. If a command does
670 not exit within the configured time, the socket will be
671 considered failed and be shut down again. All commands still
672 running will be terminated forcibly via
673 <constant>SIGTERM</constant>, and after another delay of this
674 time with <constant>SIGKILL</constant>. (See
675 <option>KillMode=</option> in
676 <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>.)
677 Takes a unit-less value in seconds, or a time span value such
678 as "5min 20s". Pass <literal>0</literal> to disable the
679 timeout logic. Defaults to
680 <varname>DefaultTimeoutStartSec=</varname> from the manager
681 configuration file (see
682 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>).
687 <term><varname>Service=</varname></term>
688 <listitem><para>Specifies the service unit name to activate on
689 incoming traffic. This setting is only allowed for sockets
690 with <varname>Accept=no</varname>. It defaults to the service
691 that bears the same name as the socket (with the suffix
692 replaced). In most cases, it should not be necessary to use
693 this option.</para></listitem>
697 <term><varname>RemoveOnStop=</varname></term>
698 <listitem><para>Takes a boolean argument. If enabled, any file
699 nodes created by this socket unit are removed when it is
700 stopped. This applies to AF_UNIX sockets in the file system,
701 POSIX message queues, FIFOs, as well as any symlinks to them
702 configured with <varname>Symlinks=</varname>. Normally, it
703 should not be necessary to use this option, and is not
704 recommended as services might continue to run after the socket
705 unit has been terminated and it should still be possible to
706 communicate with them via their file system node. Defaults to
707 off.</para></listitem>
711 <term><varname>Symlinks=</varname></term>
712 <listitem><para>Takes a list of file system paths. The
713 specified paths will be created as symlinks to the AF_UNIX
714 socket path or FIFO path of this socket unit. If this setting
715 is used, only one AF_UNIX socket in the file system or one
716 FIFO may be configured for the socket unit. Use this option to
717 manage one or more symlinked alias names for a socket, binding
718 their lifecycle together. Defaults to the empty
719 list.</para></listitem>
725 <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
727 <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>
728 for more settings.</para>
733 <title>See Also</title>
735 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
736 <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
737 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
738 <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
739 <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
740 <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
741 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
742 <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>
746 For more extensive descriptions see the "systemd for Developers" series:
747 <ulink url="http://0pointer.de/blog/projects/socket-activation.html">Socket Activation</ulink>,
748 <ulink url="http://0pointer.de/blog/projects/socket-activation2.html">Socket Activation, part II</ulink>,
749 <ulink url="http://0pointer.de/blog/projects/inetd.html">Converting inetd Services</ulink>,
750 <ulink url="http://0pointer.de/blog/projects/socket-activated-containers.html">Socket Activated Internet Services and OS Containers</ulink>.