X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=man%2Fsystemd.exec.xml;h=22f076870f6f777ca3cbedf70e70d24b916c1471;hb=ead349509e325aad720bb0349521a9e56e2ac7c0;hp=784b48fff434e628d621c8125cae8369feec6018;hpb=907afa0682c8d6f00937b11b04be6b8a26a3cd41;p=elogind.git

diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index 784b48fff..22f076870 100644
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -340,9 +340,14 @@
 
                                 <para>The files listed with this
                                 directive will be read shortly before
-                                the process is executed. Settings from
-                                these files override settings made
-                                with
+                                the process is executed (more
+                                specifically, after all
+                                processes from a previous unit state
+                                terminated. This means you can
+                                generate these files in one unit
+                                state, and read it with this option in
+                                the next). Settings from these files
+                                override settings made with
                                 <varname>Environment=</varname>. If
                                 the same variable is set twice from
                                 these files, the files will be read in
@@ -686,31 +691,6 @@
                                 for details.</para></listitem>
                         </varlistentry>
 
-                        <varlistentry>
-                                <term><varname>TCPWrapName=</varname></term>
-                                <listitem><para>If this is a
-                                socket-activated service, this sets the
-                                tcpwrap service name to check the
-                                permission for the current connection
-                                with. This is only useful in
-                                conjunction with socket-activated
-                                services, and stream sockets (TCP) in
-                                particular. It has no effect on other
-                                socket types (e.g. datagram/UDP) and
-                                on processes unrelated to socket-based
-                                activation. If the tcpwrap
-                                verification fails, daemon start-up
-                                will fail and the connection is
-                                terminated. See
-                                <citerefentry><refentrytitle>tcpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
-                                for details. Note that this option may
-                                be used to do access control checks
-                                only. Shell commands and commands
-                                described in
-                                <citerefentry><refentrytitle>hosts_options</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-                                are not supported.</para></listitem>
-                        </varlistentry>
-
                         <varlistentry>
                                 <term><varname>CapabilityBoundingSet=</varname></term>
 
@@ -865,7 +845,7 @@
                                 processes via
                                 <filename>/tmp</filename> or
                                 <filename>/var/tmp</filename>
-                                impossible. If this is enabled all
+                                impossible. If this is enabled, all
                                 temporary files created by a service
                                 in these directories will be removed
                                 after the service is stopped. Defaults
@@ -962,13 +942,43 @@
                                 <option>shared</option>,
                                 <option>slave</option> or
                                 <option>private</option>, which
-                                control whether the file system
-                                namespace set up for this unit's
-                                processes will receive or propagate
-                                new mounts. See
+                                control whether mounts in the file
+                                system namespace set up for this
+                                unit's processes will receive or
+                                propagate mounts or unmounts. See
                                 <citerefentry><refentrytitle>mount</refentrytitle><manvolnum>2</manvolnum></citerefentry>
-                                for details. Default to
-                                <option>shared</option>.</para></listitem>
+                                for details. Defaults to
+                                <option>shared</option>. Use
+                                <option>shared</option> to ensure that
+                                mounts and unmounts are propagated
+                                from the host to the container and
+                                vice versa. Use <option>slave</option>
+                                to run processes so that none of their
+                                mounts and unmounts will propagate to
+                                the host. Use <option>private</option>
+                                to also ensure that no mounts and
+                                unmounts from the host will propagate
+                                into the unit processes'
+                                namespace. Note that
+                                <option>slave</option> means that file
+                                systems mounted on the host might stay
+                                mounted continously in the unit's
+                                namespace, and thus keep the device
+                                busy. Note that the file system
+                                namespace related options
+                                (<varname>PrivateTmp=</varname>,
+                                <varname>PrivateDevices=</varname>,
+                                <varname>ReadOnlyDirectories=</varname>,
+                                <varname>InaccessibleDirectories=</varname>
+                                and
+                                <varname>ReadWriteDirectories=</varname>)
+                                require that mount and unmount
+                                propagation from the unit's file
+                                system namespace is disabled, and
+                                hence downgrade
+                                <option>shared</option> to
+                                <option>slave</option>.
+                                </para></listitem>
                         </varlistentry>
 
                         <varlistentry>
@@ -1012,7 +1022,7 @@
                         <varlistentry>
                                 <term><varname>AppArmorProfile=</varname></term>
 
-                                <listitem><para>Take a profile name as argument.
+                                <listitem><para>Takes a profile name as argument.
                                 The process executed by the unit will switch to
                                 this profile when started. Profiles must already
                                 be loaded in the kernel, or the unit will fail.
@@ -1194,22 +1204,22 @@
                                 (which creates connected AF_UNIX
                                 sockets only) are unaffected. Note
                                 that this option has no effect on
-                                32bit x86 and is ignored (but works
+                                32-bit x86 and is ignored (but works
                                 correctly on x86-64). If running in user
                                 mode and this option is used,
                                 <varname>NoNewPrivileges=yes</varname>
-                                is implied. By default no
+                                is implied. By default, no
                                 restriction applies, all address
                                 families are accessible to
                                 processes. If assigned the empty
-                                string any previous list changes are
+                                string, any previous list changes are
                                 undone.</para>
 
                                 <para>Use this option to limit
                                 exposure of processes to remote
                                 systems, in particular via exotic
                                 network protocols. Note that in most
-                                cases the local
+                                cases, the local
                                 <constant>AF_UNIX</constant> address
                                 family should be included in the
                                 configured whitelist as it is
@@ -1229,8 +1239,8 @@
                                 processes. Takes one of
                                 <constant>x86</constant> and
                                 <constant>x86-64</constant>. This is
-                                useful when running 32bit services on
-                                a 64bit host system. If not specified
+                                useful when running 32-bit services on
+                                a 64-bit host system. If not specified,
                                 the personality is left unmodified and
                                 thus reflects the personality of the
                                 host system's
@@ -1242,14 +1252,14 @@
                                 <term><varname>RuntimeDirectoryMode=</varname></term>
 
                                 <listitem><para>Takes a list of
-                                directory names. If set one or more
+                                directory names. If set, one or more
                                 directories by the specified names
                                 will be created below
                                 <filename>/run</filename> (for system
                                 services) or below
                                 <varname>$XDG_RUNTIME_DIR</varname>
                                 (for user services) when the unit is
-                                started and removed when the unit is
+                                started, and removed when the unit is
                                 stopped. The directories will have the
                                 access mode specified in
                                 <varname>RuntimeDirectoryMode=</varname>,
@@ -1417,7 +1427,7 @@
                 <varname>systemd.setenv=</varname> (see
                 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>). Additional
                 variables may also be set through PAM,
-                c.f. <citerefentry><refentrytitle>pam_env</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
+                cf. <citerefentry><refentrytitle>pam_env</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
         </refsect1>
 
         <refsect1>