DescriptionUnit configuration files for services, sockets,
- mount points and swap devices share a subset of
+ mount points, and swap devices share a subset of
configuration options which define the execution
environment of spawned processes.
@@ -76,27 +76,6 @@
configuration options are configured in the [Service],
[Socket], [Mount], or [Swap] sections, depending on the unit
type.
-
- Processes started by the system systemd instance
- are executed in a clean environment in which only the
- $PATH and $LANG
- variables are set by default. In order to add
- additional variables, see the
- Environment= and
- EnvironmentFile= options below. To
- specify variables globally, see
- DefaultEnvironment= in
- systemd-system.conf5
- or the kernel option
- systemd.setenv= in
- systemd1. Processes
- started by the user systemd instances inherit all
- environment variables from the user systemd instance,
- and have $HOME,
- $USER,
- $XDG_RUNTIME_DIR defined, among
- others. In addition, $MANAGERPID
- contains the PID of the user systemd instance.
@@ -110,7 +89,7 @@
Takes an absolute
directory path. Sets the working
directory for executed processes. If
- not set defaults to the root directory
+ not set, defaults to the root directory
when systemd is running as a system
instance and the respective user's
home directory if run as
@@ -125,7 +104,7 @@
directory for executed processes, with
the
chroot2
- system call. If this is used it must
+ system call. If this is used, it must
be ensured that the process and all
its auxiliary files are available in
the chroot()
@@ -254,7 +233,7 @@
CPUSchedulingResetOnFork=Takes a boolean
- argument. If true elevated CPU
+ argument. If true, elevated CPU
scheduling priorities and policies
will be reset when the executed
processes fork, and can hence not leak
@@ -273,7 +252,7 @@
be specified more than once in which
case the specificed CPU affinity masks
are merged. If the empty string is
- assigned the mask is reset, all
+ assigned, the mask is reset, all
assignments prior to this will have no
effect. See
sched_setaffinity2
@@ -301,15 +280,15 @@
option may be specified more than once
in which case all listed variables
will be set. If the same variable is
- set twice the later setting will
+ set twice, the later setting will
override the earlier setting. If the
empty string is assigned to this
- option the list of environment
+ option, the list of environment
variables is reset, all prior
assignments have no effect.
Variable expansion is not performed
inside the strings, however, specifier
- expansion is possible. $ character has
+ expansion is possible. The $ character has
no special meaning.
If you need to assign a value containing spaces
to a variable, use double quotes (")
@@ -353,7 +332,7 @@
specified more than once in which case
all specified files are read. If the
empty string is assigned to this
- option the list of file to read is
+ option, the list of file to read is
reset, all prior assignments have no
effect.
@@ -364,7 +343,7 @@
with
Environment=. If
the same variable is set twice from
- these files the files will be read in
+ these files, the files will be read in
the order they are specified and the
later setting will override the
earlier setting.
@@ -380,19 +359,19 @@
,
or
. If
- is selected
+ is selected,
standard input will be connected to
/dev/null,
i.e. all read attempts by the process
will result in immediate EOF. If
- is selected
+ is selected,
standard input is connected to a TTY
(as configured by
TTYPath=, see
below) and the executed process
becomes the controlling process of the
terminal. If the terminal is already
- being controlled by another process the
+ being controlled by another process, the
executed process waits until the current
controlling process releases the
terminal.
@@ -414,7 +393,7 @@
file (see
systemd.socket5
for details) specifies a single socket
- only. If this option is set standard
+ only. If this option is set, standard
input will be connected to the socket
the service was activated from, which
is primarily useful for compatibility
@@ -439,19 +418,19 @@
,
or
. If set to
- the file
+ , the file
descriptor of standard input is
duplicated for standard output. If set
- to standard
+ to , standard
output will be connected to
/dev/null,
i.e. everything written to it will be
- lost. If set to
+ lost. If set to ,
standard output will be connected to a
tty (as configured via
TTYPath=, see
below). If the TTY is used for output
- only the executed process will not
+ only, the executed process will not
become the controlling process of the
terminal, and will not fail or wait
for other processes to release the
@@ -538,7 +517,7 @@
If the terminal
device specified with
TTYPath= is a
- virtual console terminal try to
+ virtual console terminal, try to
deallocate the TTY before and after
execution. This ensures that the
screen and scrollback buffer is
@@ -549,7 +528,7 @@
SyslogIdentifier=Sets the process name
to prefix log lines sent to syslog or
- the kernel log buffer with. If not set
+ the kernel log buffer with. If not set,
defaults to the process name of the
executed process. This option is only
useful when
@@ -693,13 +672,13 @@
PAMName=Sets the PAM service
- name to set up a session as. If set
+ name to set up a session as. If set,
the executed process will be
registered as a PAM session under the
specified service name. This is only
useful in conjunction with the
User= setting. If
- not set no PAM session will be opened
+ not set, no PAM session will be opened
for the executed processes. See
pam8
for details.
@@ -708,7 +687,7 @@
TCPWrapName=If this is a
- socket-activated service this sets the
+ socket-activated service, this sets the
tcpwrap service name to check the
permission for the current connection
with. This is only useful in
@@ -718,7 +697,7 @@
socket types (e.g. datagram/UDP) and
on processes unrelated to socket-based
activation. If the tcpwrap
- verification fails daemon start-up
+ verification fails, daemon start-up
will fail and the connection is
terminated. See
tcpd8
@@ -747,7 +726,7 @@
Capabilities listed will be included
in the bounding set, all others are
removed. If the list of capabilities
- is prefixed with ~
+ is prefixed with ~,
all but the listed capabilities will
be included, the effect of the
assignment inverted. Note that this
@@ -756,7 +735,7 @@
permitted and inheritable capability
sets, on top of what
Capabilities=
- does. If this option is not used the
+ does. If this option is not used, the
capability bounding set is not
modified on process execution, hence
no limits on the capabilities of the
@@ -764,11 +743,11 @@
appear more than once in which case
the bounding sets are merged. If the
empty string is assigned to this
- option the bounding set is reset to
+ option, the bounding set is reset to
the empty capability set, and all
prior settings have no effect. If set
to ~ (without any
- further argument) the bounding set is
+ further argument), the bounding set is
reset to the full set of available
capabilities, also undoing any
previous settings.
@@ -789,7 +768,7 @@
option may appear more than once in
which case the secure bits are
ORed. If the empty string is assigned
- to this option the bits are reset to
+ to this option, the bits are reset to
0.
@@ -846,7 +825,7 @@
directories listed will have limited
access from within the namespace. If
the empty string is assigned to this
- option the specific list is reset, and
+ option, the specific list is reset, and
all prior assignments have no
effect.Paths in
@@ -863,13 +842,13 @@
PrivateTmp=Takes a boolean
- argument. If true sets up a new file
+ argument. If true, sets up a new file
system namespace for the executed
processes and mounts private
/tmp and
- /var/tmp directories
- inside it, that are not shared by
- processes outside of the
+ /var/tmp
+ directories inside it that is not
+ shared by processes outside of the
namespace. This is useful to secure
access to temporary files of the
process, but makes sharing between
@@ -877,16 +856,24 @@
/tmp or
/var/tmp
impossible. All temporary data created
- by service will be removed after service
- is stopped. Defaults to
- false.
+ by service will be removed after
+ the service is stopped. Defaults to
+ false. Note that it is possible to run
+ two or more units within the same
+ private /tmp and
+ /var/tmp
+ namespace by using the
+ JoinsNamespaceOf=
+ directive, see
+ systemd.unit5
+ for details.PrivateNetwork=Takes a boolean
- argument. If true sets up a new
+ argument. If true, sets up a new
network namespace for the executed
processes and configures only the
loopback network device
@@ -895,8 +882,14 @@
available to the executed process.
This is useful to securely turn off
network access by the executed
- process. Defaults to
- false.
+ process. Defaults to false. Note that
+ it is possible to run two or more
+ units within the same private network
+ namespace by using the
+ JoinsNamespaceOf=
+ directive, see
+ systemd.unit5
+ for details.
@@ -928,7 +921,7 @@
entries must be created and cleared
before and after execution. If the
configured string is longer than four
- characters it is truncated and the
+ characters, it is truncated and the
terminal four characters are
used. This setting interprets %I style
string replacements. This setting is
@@ -976,11 +969,11 @@
termination with the
SIGSYS signal
(whitelisting). If the first character
- of the list is ~
+ of the list is ~,
the effect is inverted: only the
listed system calls will result in
immediate process termination
- (blacklisting). If this option is used
+ (blacklisting). If this option is used,
NoNewPrivileges=yes
is implied. This feature makes use of
the Secure Computing Mode 2 interfaces
@@ -997,7 +990,7 @@
option may be specified more than once
in which case the filter masks are
merged. If the empty string is
- assigned the filter is reset, all
+ assigned, the filter is reset, all
prior assignments will have no
effect.
@@ -1005,6 +998,135 @@
+
+ Environment variables in spawned processes
+
+ Processes started by the system are executed in
+ a clean environment in which select variables
+ listed below are set. System processes started by systemd
+ do not inherit variables from PID 1, but processes
+ started by user systemd instances inherit all
+ environment variables from the user systemd instance.
+
+
+
+
+ $PATH
+
+ Colon-separated list
+ of directiories to use when launching
+ executables. Systemd uses a fixed
+ value of
+ /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin.
+
+
+
+
+ $LANG
+
+ Locale. Can be set in
+ locale.conf5
+ or on the kernel command line (see
+ systemd1
+ and
+ kernel-command-line7).
+
+
+
+
+ $USER
+ $LOGNAME
+ $HOME
+ $SHELL
+
+ User name (twice), home
+ directory, and the login shell.
+ The variables are set for the units that
+ have User= set,
+ which includes user
+ systemd instances.
+ See
+ passwd5.
+
+
+
+
+ $XDG_RUNTIME_DIR
+
+ The directory for volatile
+ state. Set for the user systemd
+ instance, and also in user sessions.
+ See
+ pam_systemd8.
+
+
+
+
+ $XDG_SESSION_ID
+ $XDG_SEAT
+ $XDG_VTNR
+
+ The identifier of the
+ session, the seat name, and
+ virtual terminal of the session. Set
+ by
+ pam_systemd8
+ for login sessions.
+ $XDG_SEAT and
+ $XDG_VTNR will
+ only be set when attached to a seat and a
+ tty.
+
+
+
+ $MANAGERPID
+
+ The PID of the user
+ systemd instance,
+ set for processes spawned by it.
+
+
+
+
+ $LISTEN_FDS
+ $LISTEN_PID
+
+ Information about file
+ descriptors passed to a service for
+ socket activation. See
+ sd_listen_fds3.
+
+
+
+
+ $TERM
+
+ Terminal type, set
+ only for units connected to a terminal
+ (StandardInput=tty,
+ StandardOutput=tty,
+ or
+ StandardError=tty).
+ See
+ termcap5.
+
+
+
+
+ Additional variables may be configured by the
+ following means: for processes spawned in specific
+ units, use the Environment= and
+ EnvironmentFile= options above; to
+ specify variables globally, use
+ DefaultEnvironment= (see
+ systemd-system.conf5)
+ or the kernel option
+ systemd.setenv= (see
+ systemd1). Additional
+ variables may also be set through PAM,
+ c.f. pam_env8.
+
+
See Also
@@ -1017,8 +1139,9 @@
systemd.swap5,
systemd.mount5,
systemd.kill5,
- systemd.cgroup5,
- systemd.directives7
+ systemd.resource-control5,
+ systemd.directives7,
+ exec3