man/systemd.exec.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <?xml-stylesheet type="text/xsl" href="http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl"?>
   3 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   4         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   5
   6 <!--
   7   This file is part of systemd.
   8
   9   Copyright 2010 Lennart Poettering
  10
  11   systemd is free software; you can redistribute it and/or modify it
  12   under the terms of the GNU Lesser General Public License as published by
  13   the Free Software Foundation; either version 2.1 of the License, or
  14   (at your option) any later version.
  15
  16   systemd is distributed in the hope that it will be useful, but
  17   WITHOUT ANY WARRANTY; without even the implied warranty of
  18   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  19   Lesser General Public License for more details.
  20
  21   You should have received a copy of the GNU Lesser General Public License
  22   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  23 -->
  24
  25 <refentry id="systemd.exec">
  26         <refentryinfo>
  27                 <title>systemd.exec</title>
  28                 <productname>systemd</productname>
  29
  30                 <authorgroup>
  31                         <author>
  32                                 <contrib>Developer</contrib>
  33                                 <firstname>Lennart</firstname>
  34                                 <surname>Poettering</surname>
  35                                 <email>lennart@poettering.net</email>
  36                         </author>
  37                 </authorgroup>
  38         </refentryinfo>
  39
  40         <refmeta>
  41                 <refentrytitle>systemd.exec</refentrytitle>
  42                 <manvolnum>5</manvolnum>
  43         </refmeta>
  44
  45         <refnamediv>
  46                 <refname>systemd.exec</refname>
  47                 <refpurpose>Execution environment configuration</refpurpose>
  48         </refnamediv>
  49
  50         <refsynopsisdiv>
  51                 <para><filename><replaceable>service</replaceable>.service</filename>,
  52                 <filename><replaceable>socket</replaceable>.socket</filename>,
  53                 <filename><replaceable>mount</replaceable>.mount</filename>,
  54                 <filename><replaceable>swap</replaceable>.swap</filename></para>
  55         </refsynopsisdiv>
  56
  57         <refsect1>
  58                 <title>Description</title>
  59
  60                 <para>Unit configuration files for services, sockets,
  61                 mount points and swap devices share a subset of
  62                 configuration options which define the execution
  63                 environment of spawned processes.</para>
  64
  65                 <para>This man page lists the configuration options
  66                 shared by these four unit types. See
  67                 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
  68                 for the common options of all unit configuration
  69                 files, and
  70                 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
  71                 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
  72                 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
  73                 and
  74                 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>
  75                 for more information on the specific unit
  76                 configuration files. The execution specific
  77                 configuration options are configured in the [Service],
  78                 [Socket], [Mount], or [Swap] sections, depending on the unit
  79                 type.</para>
  80         </refsect1>
  81
  82         <refsect1>
  83                 <title>Options</title>
  84
  85                 <variablelist class='unit-directives'>
  86
  87                         <varlistentry>
  88                                 <term><varname>WorkingDirectory=</varname></term>
  89
  90                                 <listitem><para>Takes an absolute
  91                                 directory path. Sets the working
  92                                 directory for executed processes. If
  93                                 not set defaults to the root directory
  94                                 when systemd is running as a system
  95                                 instance and the respective user's
  96                                 home directory if run as
  97                                 user.</para></listitem>
  98                         </varlistentry>
  99
 100                         <varlistentry>
 101                                 <term><varname>RootDirectory=</varname></term>
 102
 103                                 <listitem><para>Takes an absolute
 104                                 directory path. Sets the root
 105                                 directory for executed processes, with
 106                                 the
 107                                 <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 108                                 system call. If this is used it must
 109                                 be ensured that the process and all
 110                                 its auxiliary files are available in
 111                                 the <function>chroot()</function>
 112                                 jail.</para></listitem>
 113                         </varlistentry>
 114
 115                         <varlistentry>
 116                                 <term><varname>User=</varname></term>
 117                                 <term><varname>Group=</varname></term>
 118
 119                                 <listitem><para>Sets the Unix user
 120                                 or group that the processes are executed
 121                                 as, respectively. Takes a single user or group
 122                                 name or ID as argument. If no group is
 123                                 set, the default group of the user is
 124                                 chosen.</para></listitem>
 125                         </varlistentry>
 126
 127                         <varlistentry>
 128                                 <term><varname>SupplementaryGroups=</varname></term>
 129
 130                                 <listitem><para>Sets the supplementary
 131                                 Unix groups the processes are executed
 132                                 as. This takes a space-separated list
 133                                 of group names or IDs. This option may
 134                                 be specified more than once in which
 135                                 case all listed groups are set as
 136                                 supplementary groups. When the empty
 137                                 string is assigned the list of
 138                                 supplementary groups is reset, and all
 139                                 assignments prior to this one will
 140                                 have no effect. In any way, this
 141                                 option does not override, but extends
 142                                 the list of supplementary groups
 143                                 configured in the system group
 144                                 database for the
 145                                 user.</para></listitem>
 146                         </varlistentry>
 147
 148                         <varlistentry>
 149                                 <term><varname>Nice=</varname></term>
 150
 151                                 <listitem><para>Sets the default nice
 152                                 level (scheduling priority) for
 153                                 executed processes. Takes an integer
 154                                 between -20 (highest priority) and 19
 155                                 (lowest priority). See
 156                                 <citerefentry><refentrytitle>setpriority</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 157                                 for details.</para></listitem>
 158                         </varlistentry>
 159
 160                         <varlistentry>
 161                                 <term><varname>OOMScoreAdjust=</varname></term>
 162
 163                                 <listitem><para>Sets the adjustment
 164                                 level for the Out-Of-Memory killer for
 165                                 executed processes. Takes an integer
 166                                 between -1000 (to disable OOM killing
 167                                 for this process) and 1000 (to make
 168                                 killing of this process under memory
 169                                 pressure very likely). See <ulink
 170                                 url="https://www.kernel.org/doc/Documentation/filesystems/proc.txt">proc.txt</ulink>
 171                                 for details.</para></listitem>
 172                         </varlistentry>
 173
 174                         <varlistentry>
 175                                 <term><varname>IOSchedulingClass=</varname></term>
 176
 177                                 <listitem><para>Sets the IO scheduling
 178                                 class for executed processes. Takes an
 179                                 integer between 0 and 3 or one of the
 180                                 strings <option>none</option>,
 181                                 <option>realtime</option>,
 182                                 <option>best-effort</option> or
 183                                 <option>idle</option>. See
 184                                 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 185                                 for details.</para></listitem>
 186                         </varlistentry>
 187
 188                         <varlistentry>
 189                                 <term><varname>IOSchedulingPriority=</varname></term>
 190
 191                                 <listitem><para>Sets the IO scheduling
 192                                 priority for executed processes. Takes
 193                                 an integer between 0 (highest
 194                                 priority) and 7 (lowest priority). The
 195                                 available priorities depend on the
 196                                 selected IO scheduling class (see
 197                                 above). See
 198                                 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 199                                 for details.</para></listitem>
 200                         </varlistentry>
 201
 202                         <varlistentry>
 203                                 <term><varname>CPUSchedulingPolicy=</varname></term>
 204
 205                                 <listitem><para>Sets the CPU
 206                                 scheduling policy for executed
 207                                 processes. Takes one of
 208                                 <option>other</option>,
 209                                 <option>batch</option>,
 210                                 <option>idle</option>,
 211                                 <option>fifo</option> or
 212                                 <option>rr</option>. See
 213                                 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 214                                 for details.</para></listitem>
 215                         </varlistentry>
 216
 217                         <varlistentry>
 218                                 <term><varname>CPUSchedulingPriority=</varname></term>
 219
 220                                 <listitem><para>Sets the CPU
 221                                 scheduling priority for executed
 222                                 processes. The available priority
 223                                 range depends on the selected CPU
 224                                 scheduling policy (see above). For
 225                                 real-time scheduling policies an
 226                                 integer between 1 (lowest priority)
 227                                 and 99 (highest priority) can be used.
 228                                 See <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 229                                 for details.
 230                                 </para></listitem>
 231                         </varlistentry>
 232
 233                         <varlistentry>
 234                                 <term><varname>CPUSchedulingResetOnFork=</varname></term>
 235
 236                                 <listitem><para>Takes a boolean
 237                                 argument. If true elevated CPU
 238                                 scheduling priorities and policies
 239                                 will be reset when the executed
 240                                 processes fork, and can hence not leak
 241                                 into child processes. See
 242                                 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 243                                 for details. Defaults to false.</para></listitem>
 244                         </varlistentry>
 245
 246                         <varlistentry>
 247                                 <term><varname>CPUAffinity=</varname></term>
 248
 249                                 <listitem><para>Controls the CPU
 250                                 affinity of the executed
 251                                 processes. Takes a space-separated
 252                                 list of CPU indexes. This option may
 253                                 be specified more than once in which
 254                                 case the specificed CPU affinity masks
 255                                 are merged. If the empty string is
 256                                 assigned the mask is reset, all
 257                                 assignments prior to this will have no
 258                                 effect. See
 259                                 <citerefentry><refentrytitle>sched_setaffinity</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 260                                 for details.</para></listitem>
 261                         </varlistentry>
 262
 263                         <varlistentry>
 264                                 <term><varname>UMask=</varname></term>
 265
 266                                 <listitem><para>Controls the file mode
 267                                 creation mask. Takes an access mode in
 268                                 octal notation. See
 269                                 <citerefentry><refentrytitle>umask</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 270                                 for details. Defaults to
 271                                 0022.</para></listitem>
 272                         </varlistentry>
 273
 274                         <varlistentry>
 275                                 <term><varname>Environment=</varname></term>
 276
 277                                 <listitem><para>Sets environment
 278                                 variables for executed
 279                                 processes. Takes a space-separated
 280                                 list of variable assignments. This
 281                                 option may be specified more than once
 282                                 in which case all listed variables
 283                                 will be set. If the same variable is
 284                                 set twice the later setting will
 285                                 override the earlier setting. If the
 286                                 empty string is assigned to this
 287                                 option the list of environment
 288                                 variables is reset, all prior
 289                                 assignments have no effect.
 290                                 Variable expansion is not performed
 291                                 inside the strings, however, specifier
 292                                 expansion is possible. $ character has
 293                                 no special meaning.
 294                                 If you need to assign a value containing spaces
 295                                 to a variable, use double quotes (")
 296                                 for the assignment.</para>
 297
 298                                 <para>Example:
 299                                 <programlisting>Environment="VAR1=word1 word2" VAR2=word3 "VAR3=word 5 6"</programlisting>
 300                                 gives three variables <literal>VAR1</literal>,
 301                                 <literal>VAR2</literal>, <literal>VAR3</literal>.
 302                                 </para>
 303
 304                                 <para>
 305                                 See
 306                                 <citerefentry><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 307                                 for details about environment variables.</para></listitem>
 308                         </varlistentry>
 309                         <varlistentry>
 310                                 <term><varname>EnvironmentFile=</varname></term>
 311                                 <listitem><para>Similar to
 312                                 <varname>Environment=</varname> but
 313                                 reads the environment variables from a
 314                                 text file. The text file should
 315                                 contain new-line-separated variable
 316                                 assignments. Empty lines and lines
 317                                 starting with ; or # will be ignored,
 318                                 which may be used for commenting. A line
 319                                 ending with a backslash will be concatenated
 320                                 with the following one, allowing multiline variable
 321                                 definitions. The parser strips leading
 322                                 and trailing whitespace from the values
 323                                 of assignments, unless you use
 324                                 double quotes (").</para>
 325
 326                                 <para>The argument passed should be an
 327                                 absolute filename or wildcard
 328                                 expression, optionally prefixed with
 329                                 <literal>-</literal>, which indicates
 330                                 that if the file does not exist it
 331                                 won't be read and no error or warning
 332                                 message is logged.  This option may be
 333                                 specified more than once in which case
 334                                 all specified files are read. If the
 335                                 empty string is assigned to this
 336                                 option the list of file to read is
 337                                 reset, all prior assignments have no
 338                                 effect.</para>
 339
 340                                 <para>The files listed with this
 341                                 directive will be read shortly before
 342                                 the process is executed. Settings from
 343                                 these files override settings made
 344                                 with
 345                                 <varname>Environment=</varname>. If
 346                                 the same variable is set twice from
 347                                 these files the files will be read in
 348                                 the order they are specified and the
 349                                 later setting will override the
 350                                 earlier setting.</para></listitem>
 351                         </varlistentry>
 352
 353                         <varlistentry>
 354                                 <term><varname>StandardInput=</varname></term>
 355                                 <listitem><para>Controls where file
 356                                 descriptor 0 (STDIN) of the executed
 357                                 processes is connected to. Takes one
 358                                 of <option>null</option>,
 359                                 <option>tty</option>,
 360                                 <option>tty-force</option>,
 361                                 <option>tty-fail</option> or
 362                                 <option>socket</option>. If
 363                                 <option>null</option> is selected
 364                                 standard input will be connected to
 365                                 <filename>/dev/null</filename>,
 366                                 i.e. all read attempts by the process
 367                                 will result in immediate EOF. If
 368                                 <option>tty</option> is selected
 369                                 standard input is connected to a TTY
 370                                 (as configured by
 371                                 <varname>TTYPath=</varname>, see
 372                                 below) and the executed process
 373                                 becomes the controlling process of the
 374                                 terminal. If the terminal is already
 375                                 being controlled by another process the
 376                                 executed process waits until the current
 377                                 controlling process releases the
 378                                 terminal.
 379                                 <option>tty-force</option>
 380                                 is similar to <option>tty</option>,
 381                                 but the executed process is forcefully
 382                                 and immediately made the controlling
 383                                 process of the terminal, potentially
 384                                 removing previous controlling
 385                                 processes from the
 386                                 terminal. <option>tty-fail</option> is
 387                                 similar to <option>tty</option> but if
 388                                 the terminal already has a controlling
 389                                 process start-up of the executed
 390                                 process fails.  The
 391                                 <option>socket</option> option is only
 392                                 valid in socket-activated services,
 393                                 and only when the socket configuration
 394                                 file (see
 395                                 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 396                                 for details) specifies a single socket
 397                                 only. If this option is set standard
 398                                 input will be connected to the socket
 399                                 the service was activated from, which
 400                                 is primarily useful for compatibility
 401                                 with daemons designed for use with the
 402                                 traditional
 403                                 <citerefentry><refentrytitle>inetd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 404                                 daemon. This setting defaults to
 405                                 <option>null</option>.</para></listitem>
 406                         </varlistentry>
 407                         <varlistentry>
 408                                 <term><varname>StandardOutput=</varname></term>
 409                                 <listitem><para>Controls where file
 410                                 descriptor 1 (STDOUT) of the executed
 411                                 processes is connected to. Takes one
 412                                 of <option>inherit</option>,
 413                                 <option>null</option>,
 414                                 <option>tty</option>,
 415                                 <option>syslog</option>,
 416                                 <option>kmsg</option>,
 417                                 <option>journal</option>,
 418                                 <option>syslog+console</option>,
 419                                 <option>kmsg+console</option>,
 420                                 <option>journal+console</option> or
 421                                 <option>socket</option>. If set to
 422                                 <option>inherit</option> the file
 423                                 descriptor of standard input is
 424                                 duplicated for standard output. If set
 425                                 to <option>null</option> standard
 426                                 output will be connected to
 427                                 <filename>/dev/null</filename>,
 428                                 i.e. everything written to it will be
 429                                 lost. If set to <option>tty</option>
 430                                 standard output will be connected to a
 431                                 tty (as configured via
 432                                 <varname>TTYPath=</varname>, see
 433                                 below). If the TTY is used for output
 434                                 only the executed process will not
 435                                 become the controlling process of the
 436                                 terminal, and will not fail or wait
 437                                 for other processes to release the
 438                                 terminal. <option>syslog</option>
 439                                 connects standard output to the
 440                                 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
 441                                 system syslog
 442                                 service. <option>kmsg</option>
 443                                 connects it with the kernel log buffer
 444                                 which is accessible via
 445                                 <citerefentry><refentrytitle>dmesg</refentrytitle><manvolnum>1</manvolnum></citerefentry>. <option>journal</option>
 446                                 connects it with the journal which is
 447                                 accessible via
 448                                 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 449                                 (Note that everything that is written
 450                                 to syslog or kmsg is implicitly stored
 451                                 in the journal as well, those options
 452                                 are hence supersets of this
 453                                 one). <option>syslog+console</option>,
 454                                 <option>journal+console</option> and
 455                                 <option>kmsg+console</option> work
 456                                 similarly but copy the output to the
 457                                 system console as
 458                                 well. <option>socket</option> connects
 459                                 standard output to a socket from
 460                                 socket activation, semantics are
 461                                 similar to the respective option of
 462                                 <varname>StandardInput=</varname>.
 463                                 This setting defaults to the value set
 464                                 with
 465                                 <option>DefaultStandardOutput=</option>
 466                                 in
 467                                 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 468                                 which defaults to
 469                                 <option>journal</option>.</para></listitem>
 470                         </varlistentry>
 471                         <varlistentry>
 472                                 <term><varname>StandardError=</varname></term>
 473                                 <listitem><para>Controls where file
 474                                 descriptor 2 (STDERR) of the executed
 475                                 processes is connected to. The
 476                                 available options are identical to
 477                                 those of
 478                                 <varname>StandardOutput=</varname>,
 479                                 with one exception: if set to
 480                                 <option>inherit</option> the file
 481                                 descriptor used for standard output is
 482                                 duplicated for standard error. This
 483                                 setting defaults to the value set with
 484                                 <option>DefaultStandardError=</option>
 485                                 in
 486                                 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 487                                 which defaults to
 488                                 <option>inherit</option>.</para></listitem>
 489                         </varlistentry>
 490                         <varlistentry>
 491                                 <term><varname>TTYPath=</varname></term>
 492                                 <listitem><para>Sets the terminal
 493                                 device node to use if standard input,
 494                                 output or stderr are connected to a
 495                                 TTY (see above). Defaults to
 496                                 <filename>/dev/console</filename>.</para></listitem>
 497                         </varlistentry>
 498                         <varlistentry>
 499                                 <term><varname>TTYReset=</varname></term>
 500                                 <listitem><para>Reset the terminal
 501                                 device specified with
 502                                 <varname>TTYPath=</varname> before and
 503                                 after execution. Defaults to
 504                                 <literal>no</literal>.</para></listitem>
 505                         </varlistentry>
 506                         <varlistentry>
 507                                 <term><varname>TTYVHangup=</varname></term>
 508                                 <listitem><para>Disconnect all clients
 509                                 which have opened the terminal device
 510                                 specified with
 511                                 <varname>TTYPath=</varname>
 512                                 before and after execution. Defaults
 513                                 to
 514                                 <literal>no</literal>.</para></listitem>
 515                         </varlistentry>
 516                         <varlistentry>
 517                                 <term><varname>TTYVTDisallocate=</varname></term>
 518                                 <listitem><para>If the terminal
 519                                 device specified with
 520                                 <varname>TTYPath=</varname> is a
 521                                 virtual console terminal try to
 522                                 deallocate the TTY before and after
 523                                 execution. This ensures that the
 524                                 screen and scrollback buffer is
 525                                 cleared. Defaults to
 526                                 <literal>no</literal>.</para></listitem>
 527                         </varlistentry>
 528                         <varlistentry>
 529                                 <term><varname>SyslogIdentifier=</varname></term>
 530                                 <listitem><para>Sets the process name
 531                                 to prefix log lines sent to syslog or
 532                                 the kernel log buffer with. If not set
 533                                 defaults to the process name of the
 534                                 executed process. This option is only
 535                                 useful when
 536                                 <varname>StandardOutput=</varname> or
 537                                 <varname>StandardError=</varname> are
 538                                 set to <option>syslog</option> or
 539                                 <option>kmsg</option>.</para></listitem>
 540                         </varlistentry>
 541                         <varlistentry>
 542                                 <term><varname>SyslogFacility=</varname></term>
 543                                 <listitem><para>Sets the syslog
 544                                 facility to use when logging to
 545                                 syslog. One of <option>kern</option>,
 546                                 <option>user</option>,
 547                                 <option>mail</option>,
 548                                 <option>daemon</option>,
 549                                 <option>auth</option>,
 550                                 <option>syslog</option>,
 551                                 <option>lpr</option>,
 552                                 <option>news</option>,
 553                                 <option>uucp</option>,
 554                                 <option>cron</option>,
 555                                 <option>authpriv</option>,
 556                                 <option>ftp</option>,
 557                                 <option>local0</option>,
 558                                 <option>local1</option>,
 559                                 <option>local2</option>,
 560                                 <option>local3</option>,
 561                                 <option>local4</option>,
 562                                 <option>local5</option>,
 563                                 <option>local6</option> or
 564                                 <option>local7</option>. See
 565                                 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
 566                                 for details. This option is only
 567                                 useful when
 568                                 <varname>StandardOutput=</varname> or
 569                                 <varname>StandardError=</varname> are
 570                                 set to <option>syslog</option>.
 571                                 Defaults to
 572                                 <option>daemon</option>.</para></listitem>
 573                         </varlistentry>
 574                         <varlistentry>
 575                                 <term><varname>SyslogLevel=</varname></term>
 576                                 <listitem><para>Default syslog level
 577                                 to use when logging to syslog or the
 578                                 kernel log buffer. One of
 579                                 <option>emerg</option>,
 580                                 <option>alert</option>,
 581                                 <option>crit</option>,
 582                                 <option>err</option>,
 583                                 <option>warning</option>,
 584                                 <option>notice</option>,
 585                                 <option>info</option>,
 586                                 <option>debug</option>. See
 587                                 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
 588                                 for details. This option is only
 589                                 useful when
 590                                 <varname>StandardOutput=</varname> or
 591                                 <varname>StandardError=</varname> are
 592                                 set to <option>syslog</option> or
 593                                 <option>kmsg</option>. Note that
 594                                 individual lines output by the daemon
 595                                 might be prefixed with a different log
 596                                 level which can be used to override
 597                                 the default log level specified
 598                                 here. The interpretation of these
 599                                 prefixes may be disabled with
 600                                 <varname>SyslogLevelPrefix=</varname>,
 601                                 see below. For details see
 602                                 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
 603
 604                                 Defaults to
 605                                 <option>info</option>.</para></listitem>
 606                         </varlistentry>
 607
 608                         <varlistentry>
 609                                 <term><varname>SyslogLevelPrefix=</varname></term>
 610                                 <listitem><para>Takes a boolean
 611                                 argument. If true and
 612                                 <varname>StandardOutput=</varname> or
 613                                 <varname>StandardError=</varname> are
 614                                 set to <option>syslog</option>,
 615                                 <option>kmsg</option> or
 616                                 <option>journal</option>, log lines
 617                                 written by the executed process that
 618                                 are prefixed with a log level will be
 619                                 passed on to syslog with this log
 620                                 level set but the prefix removed. If
 621                                 set to false, the interpretation of
 622                                 these prefixes is disabled and the
 623                                 logged lines are passed on as-is. For
 624                                 details about this prefixing see
 625                                 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
 626                                 Defaults to true.</para></listitem>
 627                         </varlistentry>
 628
 629                         <varlistentry>
 630                                 <term><varname>TimerSlackNSec=</varname></term>
 631                                 <listitem><para>Sets the timer slack
 632                                 in nanoseconds for the executed
 633                                 processes. The timer slack controls
 634                                 the accuracy of wake-ups triggered by
 635                                 timers. See
 636                                 <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 637                                 for more information. Note that in
 638                                 contrast to most other time span
 639                                 definitions this parameter takes an
 640                                 integer value in nano-seconds if no
 641                                 unit is specified. The usual time
 642                                 units are understood
 643                                 too.</para></listitem>
 644                         </varlistentry>
 645
 646                         <varlistentry>
 647                                 <term><varname>LimitCPU=</varname></term>
 648                                 <term><varname>LimitFSIZE=</varname></term>
 649                                 <term><varname>LimitDATA=</varname></term>
 650                                 <term><varname>LimitSTACK=</varname></term>
 651                                 <term><varname>LimitCORE=</varname></term>
 652                                 <term><varname>LimitRSS=</varname></term>
 653                                 <term><varname>LimitNOFILE=</varname></term>
 654                                 <term><varname>LimitAS=</varname></term>
 655                                 <term><varname>LimitNPROC=</varname></term>
 656                                 <term><varname>LimitMEMLOCK=</varname></term>
 657                                 <term><varname>LimitLOCKS=</varname></term>
 658                                 <term><varname>LimitSIGPENDING=</varname></term>
 659                                 <term><varname>LimitMSGQUEUE=</varname></term>
 660                                 <term><varname>LimitNICE=</varname></term>
 661                                 <term><varname>LimitRTPRIO=</varname></term>
 662                                 <term><varname>LimitRTTIME=</varname></term>
 663                                 <listitem><para>These settings control
 664                                 various resource limits for executed
 665                                 processes. See
 666                                 <citerefentry><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 667                                 for details. Use the string
 668                                 <varname>infinity</varname> to
 669                                 configure no limit on a specific
 670                                 resource.</para></listitem>
 671                         </varlistentry>
 672
 673                         <varlistentry>
 674                                 <term><varname>PAMName=</varname></term>
 675                                 <listitem><para>Sets the PAM service
 676                                 name to set up a session as. If set
 677                                 the executed process will be
 678                                 registered as a PAM session under the
 679                                 specified service name. This is only
 680                                 useful in conjunction with the
 681                                 <varname>User=</varname> setting. If
 682                                 not set no PAM session will be opened
 683                                 for the executed processes. See
 684                                 <citerefentry><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 685                                 for details.</para></listitem>
 686                         </varlistentry>
 687
 688                         <varlistentry>
 689                                 <term><varname>TCPWrapName=</varname></term>
 690                                 <listitem><para>If this is a
 691                                 socket-activated service this sets the
 692                                 tcpwrap service name to check the
 693                                 permission for the current connection
 694                                 with. This is only useful in
 695                                 conjunction with socket-activated
 696                                 services, and stream sockets (TCP) in
 697                                 particular. It has no effect on other
 698                                 socket types (e.g. datagram/UDP) and
 699                                 on processes unrelated to socket-based
 700                                 activation. If the tcpwrap
 701                                 verification fails daemon start-up
 702                                 will fail and the connection is
 703                                 terminated. See
 704                                 <citerefentry><refentrytitle>tcpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 705                                 for details. Note that this option may
 706                                 be used to do access control checks
 707                                 only. Shell commands and commands
 708                                 described in
 709                                 <citerefentry><refentrytitle>hosts_options</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 710                                 are not supported.</para></listitem>
 711                         </varlistentry>
 712
 713                         <varlistentry>
 714                                 <term><varname>CapabilityBoundingSet=</varname></term>
 715
 716                                 <listitem><para>Controls which
 717                                 capabilities to include in the
 718                                 capability bounding set for the
 719                                 executed process. See
 720                                 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 721                                 for details. Takes a whitespace-separated
 722                                 list of capability names as read by
 723                                 <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 724                                 e.g. <constant>CAP_SYS_ADMIN</constant>,
 725                                 <constant>CAP_DAC_OVERRIDE</constant>,
 726                                 <constant>CAP_SYS_PTRACE</constant>.
 727                                 Capabilities listed will be included
 728                                 in the bounding set, all others are
 729                                 removed. If the list of capabilities
 730                                 is prefixed with <literal>~</literal>
 731                                 all but the listed capabilities will
 732                                 be included, the effect of the
 733                                 assignment inverted. Note that this
 734                                 option also affects the respective
 735                                 capabilities in the effective,
 736                                 permitted and inheritable capability
 737                                 sets, on top of what
 738                                 <varname>Capabilities=</varname>
 739                                 does. If this option is not used the
 740                                 capability bounding set is not
 741                                 modified on process execution, hence
 742                                 no limits on the capabilities of the
 743                                 process are enforced. This option may
 744                                 appear more than once in which case
 745                                 the bounding sets are merged. If the
 746                                 empty string is assigned to this
 747                                 option the bounding set is reset to
 748                                 the empty capability set, and all
 749                                 prior settings have no effect. If set
 750                                 to <literal>~</literal> (without any
 751                                 further argument) the bounding set is
 752                                 reset to the full set of available
 753                                 capabilities, also undoing any
 754                                 previous settings.</para></listitem>
 755                         </varlistentry>
 756
 757                         <varlistentry>
 758                                 <term><varname>SecureBits=</varname></term>
 759                                 <listitem><para>Controls the secure
 760                                 bits set for the executed process. See
 761                                 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 762                                 for details. Takes a list of strings:
 763                                 <option>keep-caps</option>,
 764                                 <option>keep-caps-locked</option>,
 765                                 <option>no-setuid-fixup</option>,
 766                                 <option>no-setuid-fixup-locked</option>,
 767                                 <option>noroot</option> and/or
 768                                 <option>noroot-locked</option>. This
 769                                 option may appear more than once in
 770                                 which case the secure bits are
 771                                 ORed. If the empty string is assigned
 772                                 to this option the bits are reset to
 773                                 0.</para></listitem>
 774                         </varlistentry>
 775
 776                         <varlistentry>
 777                                 <term><varname>Capabilities=</varname></term>
 778                                 <listitem><para>Controls the
 779                                 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 780                                 set for the executed process. Take a
 781                                 capability string describing the
 782                                 effective, permitted and inherited
 783                                 capability sets as documented in
 784                                 <citerefentry><refentrytitle>cap_from_text</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
 785                                 Note that these capability sets are
 786                                 usually influenced by the capabilities
 787                                 attached to the executed file. Due to
 788                                 that
 789                                 <varname>CapabilityBoundingSet=</varname>
 790                                 is probably the much more useful
 791                                 setting.</para></listitem>
 792                         </varlistentry>
 793
 794                         <varlistentry>
 795                                 <term><varname>ReadWriteDirectories=</varname></term>
 796                                 <term><varname>ReadOnlyDirectories=</varname></term>
 797                                 <term><varname>InaccessibleDirectories=</varname></term>
 798
 799                                 <listitem><para>Sets up a new
 800                                 file system namespace for executed
 801                                 processes. These options may be used
 802                                 to limit access a process might have
 803                                 to the main file system
 804                                 hierarchy. Each setting takes a
 805                                 space-separated list of absolute
 806                                 directory paths. Directories listed in
 807                                 <varname>ReadWriteDirectories=</varname>
 808                                 are accessible from within the
 809                                 namespace with the same access rights
 810                                 as from outside. Directories listed in
 811                                 <varname>ReadOnlyDirectories=</varname>
 812                                 are accessible for reading only,
 813                                 writing will be refused even if the
 814                                 usual file access controls would
 815                                 permit this. Directories listed in
 816                                 <varname>InaccessibleDirectories=</varname>
 817                                 will be made inaccessible for
 818                                 processes inside the namespace. Note
 819                                 that restricting access with these
 820                                 options does not extend to submounts
 821                                 of a directory. You must list
 822                                 submounts separately in these settings
 823                                 to ensure the same limited
 824                                 access. These options may be specified
 825                                 more than once in which case all
 826                                 directories listed will have limited
 827                                 access from within the namespace. If
 828                                 the empty string is assigned to this
 829                                 option the specific list is reset, and
 830                                 all prior assignments have no
 831                                 effect.</para></listitem>
 832                         </varlistentry>
 833
 834                         <varlistentry>
 835                                 <term><varname>PrivateTmp=</varname></term>
 836
 837                                 <listitem><para>Takes a boolean
 838                                 argument. If true sets up a new file
 839                                 system namespace for the executed
 840                                 processes and mounts private
 841                                 <filename>/tmp</filename> and
 842                                 <filename>/var/tmp</filename> directories
 843                                 inside it, that are not shared by
 844                                 processes outside of the
 845                                 namespace. This is useful to secure
 846                                 access to temporary files of the
 847                                 process, but makes sharing between
 848                                 processes via
 849                                 <filename>/tmp</filename> or
 850                                 <filename>/var/tmp</filename>
 851                                 impossible. All temporary data created
 852                                 by service will be removed after service
 853                                 is stopped. Defaults to
 854                                 false.</para></listitem>
 855                         </varlistentry>
 856
 857                         <varlistentry>
 858                                 <term><varname>PrivateNetwork=</varname></term>
 859
 860                                 <listitem><para>Takes a boolean
 861                                 argument. If true sets up a new
 862                                 network namespace for the executed
 863                                 processes and configures only the
 864                                 loopback network device
 865                                 <literal>lo</literal> inside it. No
 866                                 other network devices will be
 867                                 available to the executed process.
 868                                 This is useful to securely turn off
 869                                 network access by the executed
 870                                 process. Defaults to
 871                                 false.</para></listitem>
 872                         </varlistentry>
 873
 874                         <varlistentry>
 875                                 <term><varname>MountFlags=</varname></term>
 876
 877                                 <listitem><para>Takes a mount
 878                                 propagation flag:
 879                                 <option>shared</option>,
 880                                 <option>slave</option> or
 881                                 <option>private</option>, which
 882                                 control whether the file system
 883                                 namespace set up for this unit's
 884                                 processes will receive or propagate
 885                                 new mounts. See
 886                                 <citerefentry><refentrytitle>mount</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 887                                 for details. Default to
 888                                 <option>shared</option>.</para></listitem>
 889                         </varlistentry>
 890
 891                         <varlistentry>
 892                                 <term><varname>UtmpIdentifier=</varname></term>
 893
 894                                 <listitem><para>Takes a four
 895                                 character identifier string for an
 896                                 utmp/wtmp entry for this service. This
 897                                 should only be set for services such
 898                                 as <command>getty</command>
 899                                 implementations where utmp/wtmp
 900                                 entries must be created and cleared
 901                                 before and after execution. If the
 902                                 configured string is longer than four
 903                                 characters it is truncated and the
 904                                 terminal four characters are
 905                                 used. This setting interprets %I style
 906                                 string replacements. This setting is
 907                                 unset by default, i.e. no utmp/wtmp
 908                                 entries are created or cleaned up for
 909                                 this service.</para></listitem>
 910                         </varlistentry>
 911
 912                         <varlistentry>
 913                                 <term><varname>IgnoreSIGPIPE=</varname></term>
 914
 915                                 <listitem><para>Takes a boolean
 916                                 argument. If true, causes <constant>SIGPIPE</constant> to be
 917                                 ignored in the executed
 918                                 process. Defaults to true because
 919                                 <constant>SIGPIPE</constant> generally is useful only in
 920                                 shell pipelines.</para></listitem>
 921                         </varlistentry>
 922
 923                         <varlistentry>
 924                                 <term><varname>NoNewPrivileges=</varname></term>
 925
 926                                 <listitem><para>Takes a boolean
 927                                 argument. If true, ensures that the
 928                                 service process and all its children
 929                                 can never gain new privileges. This
 930                                 option is more powerful than the respective
 931                                 secure bits flags (see above), as it
 932                                 also prohibits UID changes of any
 933                                 kind. This is the simplest, most
 934                                 effective way to ensure that a process
 935                                 and its children can never elevate
 936                                 privileges again.</para></listitem>
 937                         </varlistentry>
 938
 939                         <varlistentry>
 940                                 <term><varname>SystemCallFilter=</varname></term>
 941
 942                                 <listitem><para>Takes a space-separated
 943                                 list of system call
 944                                 names. If this setting is used, all
 945                                 system calls executed by the unit
 946                                 process except for the listed ones
 947                                 will result in immediate process
 948                                 termination with the
 949                                 <constant>SIGSYS</constant> signal
 950                                 (whitelisting). If the first character
 951                                 of the list is <literal>~</literal>
 952                                 the effect is inverted: only the
 953                                 listed system calls will result in
 954                                 immediate process termination
 955                                 (blacklisting). If this option is used
 956                                 <varname>NoNewPrivileges=yes</varname>
 957                                 is implied. This feature makes use of
 958                                 the Secure Computing Mode 2 interfaces
 959                                 of the kernel ('seccomp filtering')
 960                                 and is useful for enforcing a minimal
 961                                 sandboxing environment. Note that the
 962                                 <function>execve</function>,
 963                                 <function>rt_sigreturn</function>,
 964                                 <function>sigreturn</function>,
 965                                 <function>exit_group</function>,
 966                                 <function>exit</function> system calls
 967                                 are implicitly whitelisted and don't
 968                                 need to be listed explicitly. This
 969                                 option may be specified more than once
 970                                 in which case the filter masks are
 971                                 merged. If the empty string is
 972                                 assigned the filter is reset, all
 973                                 prior assignments will have no
 974                                 effect.</para></listitem>
 975                         </varlistentry>
 976
 977                 </variablelist>
 978         </refsect1>
 979
 980         <refsect1>
 981                   <title>See Also</title>
 982                   <para>
 983                           <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 984                           <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 985                           <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
 986                           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 987                           <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 988                           <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 989                           <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 990                           <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 991                           <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 992                           <citerefentry><refentrytitle>systemd.cgroup</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 993                           <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 994                   </para>
 995         </refsect1>
 996
 997 </refentry>