chiark / gitweb /
exec: properly apply capability bounding set, add inverted bounding sets
[elogind.git] / man / systemd.exec.xml
1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <?xml-stylesheet type="text/xsl" href="http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl"?>
3 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
4         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
5
6 <!--
7   This file is part of systemd.
8
9   Copyright 2010 Lennart Poettering
10
11   systemd is free software; you can redistribute it and/or modify it
12   under the terms of the GNU General Public License as published by
13   the Free Software Foundation; either version 2 of the License, or
14   (at your option) any later version.
15
16   systemd is distributed in the hope that it will be useful, but
17   WITHOUT ANY WARRANTY; without even the implied warranty of
18   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
19   General Public License for more details.
20
21   You should have received a copy of the GNU General Public License
22   along with systemd; If not, see <http://www.gnu.org/licenses/>.
23 -->
24
25 <refentry id="systemd.exec">
26         <refentryinfo>
27                 <title>systemd.exec</title>
28                 <productname>systemd</productname>
29
30                 <authorgroup>
31                         <author>
32                                 <contrib>Developer</contrib>
33                                 <firstname>Lennart</firstname>
34                                 <surname>Poettering</surname>
35                                 <email>lennart@poettering.net</email>
36                         </author>
37                 </authorgroup>
38         </refentryinfo>
39
40         <refmeta>
41                 <refentrytitle>systemd.exec</refentrytitle>
42                 <manvolnum>5</manvolnum>
43         </refmeta>
44
45         <refnamediv>
46                 <refname>systemd.exec</refname>
47                 <refpurpose>systemd execution environment configuration</refpurpose>
48         </refnamediv>
49
50         <refsynopsisdiv>
51                 <para><filename>systemd.service</filename>,
52                 <filename>systemd.socket</filename>,
53                 <filename>systemd.mount</filename>,
54                 <filename>systemd.swap</filename></para>
55         </refsynopsisdiv>
56
57         <refsect1>
58                 <title>Description</title>
59
60                 <para>Unit configuration files for services, sockets
61                 mount points and swap devices share a subset of
62                 configuration options which define the execution
63                 environment of spawned processes.</para>
64
65                 <para>This man page lists the configuration options
66                 shared by these three unit types. See
67                 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
68                 for the common options of all unit configuration
69                 files, and
70                 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
71                 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
72                 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>
73                 and
74                 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>
75                 for more information on the specific unit
76                 configuration files. The execution specific
77                 configuration options are configured in the [Service],
78                 [Socket], [Mount] resp. [Swap] section, depending on the unit
79                 type.</para>
80         </refsect1>
81
82         <refsect1>
83                 <title>Options</title>
84
85                 <variablelist>
86
87                         <varlistentry>
88                                 <term><varname>WorkingDirectory=</varname></term>
89
90                                 <listitem><para>Takes an absolute
91                                 directory path. Sets the working
92                                 directory for executed
93                                 processes.</para></listitem>
94                         </varlistentry>
95
96                         <varlistentry>
97                                 <term><varname>RootDirectory=</varname></term>
98
99                                 <listitem><para>Takes an absolute
100                                 directory path. Sets the root
101                                 directory for executed processes, with
102                                 the
103                                 <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry>
104                                 system call. If this is used it must
105                                 be ensured that the process and all
106                                 its auxiliary files are available in
107                                 the <function>chroot()</function>
108                                 jail.</para></listitem>
109                         </varlistentry>
110
111                         <varlistentry>
112                                 <term><varname>User=</varname></term>
113                                 <term><varname>Group=</varname></term>
114
115                                 <listitem><para>Sets the Unix user
116                                 resp. group the processes are executed
117                                 as. Takes a single user resp. group
118                                 name or ID as argument. If no group is
119                                 set the default group of the user is
120                                 chosen.</para></listitem>
121                         </varlistentry>
122
123                         <varlistentry>
124                                 <term><varname>SupplementaryGroups=</varname></term>
125
126                                 <listitem><para>Sets the supplementary
127                                 Unix groups the processes are executed
128                                 as. This takes a space separated list
129                                 of group names or IDs. This option may
130                                 be specified more than once in which
131                                 case all listed groups are set as
132                                 supplementary groups. This option does
133                                 not override but extends the list of
134                                 supplementary groups configured in the
135                                 system group database for the
136                                 user.</para></listitem>
137                         </varlistentry>
138
139                         <varlistentry>
140                                 <term><varname>Nice=</varname></term>
141
142                                 <listitem><para>Sets the default nice
143                                 level (scheduling priority) for
144                                 executed processes. Takes an integer
145                                 between -20 (highest priority) and 19
146                                 (lowest priority). See
147                                 <citerefentry><refentrytitle>setpriority</refentrytitle><manvolnum>2</manvolnum></citerefentry>
148                                 for details.</para></listitem>
149                         </varlistentry>
150
151                         <varlistentry>
152                                 <term><varname>OOMScoreAdjust=</varname></term>
153
154                                 <listitem><para>Sets the adjustment
155                                 level for the Out-Of-Memory killer for
156                                 executed processes. Takes an integer
157                                 between -1000 (to disable OOM killing
158                                 for this process) and 1000 (to make
159                                 killing of this process under memory
160                                 pressure very likely). See <ulink
161                                 url="http://www.kernel.org/doc/Documentation/filesystems/proc.txt">proc.txt</ulink>
162                                 for details.</para></listitem>
163                         </varlistentry>
164
165                         <varlistentry>
166                                 <term><varname>IOSchedulingClass=</varname></term>
167
168                                 <listitem><para>Sets the IO scheduling
169                                 class for executed processes. Takes an
170                                 integer between 0 and 3 or one of the
171                                 strings <option>none</option>,
172                                 <option>realtime</option>,
173                                 <option>best-effort</option> or
174                                 <option>idle</option>. See
175                                 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
176                                 for details.</para></listitem>
177                         </varlistentry>
178
179                         <varlistentry>
180                                 <term><varname>IOSchedulingPriority=</varname></term>
181
182                                 <listitem><para>Sets the IO scheduling
183                                 priority for executed processes. Takes
184                                 an integer between 0 (highest
185                                 priority) and 7 (lowest priority). The
186                                 available priorities depend on the
187                                 selected IO scheduling class (see
188                                 above). See
189                                 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
190                                 for details.</para></listitem>
191                         </varlistentry>
192
193                         <varlistentry>
194                                 <term><varname>CPUSchedulingPolicy=</varname></term>
195
196                                 <listitem><para>Sets the CPU
197                                 scheduling policy for executed
198                                 processes. Takes one of
199                                 <option>other</option>,
200                                 <option>batch</option>,
201                                 <option>idle</option>,
202                                 <option>fifo</option> or
203                                 <option>rr</option>. See
204                                 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
205                                 for details.</para></listitem>
206                         </varlistentry>
207
208                         <varlistentry>
209                                 <term><varname>CPUSchedulingPriority=</varname></term>
210
211                                 <listitem><para>Sets the CPU
212                                 scheduling priority for executed
213                                 processes. Takes an integer between 1
214                                 (lowest priority) and 99 (highest
215                                 priority). The available priority
216                                 range depends on the selected CPU
217                                 scheduling policy (see above). See
218                                 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
219                                 for details.</para></listitem>
220                         </varlistentry>
221
222                         <varlistentry>
223                                 <term><varname>CPUSchedulingResetOnFork=</varname></term>
224
225                                 <listitem><para>Takes a boolean
226                                 argument. If true elevated CPU
227                                 scheduling priorities and policies
228                                 will be reset when the executed
229                                 processes fork, and can hence not leak
230                                 into child processes. See
231                                 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
232                                 for details. Defaults to false.</para></listitem>
233                         </varlistentry>
234
235                         <varlistentry>
236                                 <term><varname>CPUAffinity=</varname></term>
237
238                                 <listitem><para>Controls the CPU
239                                 affinity of the executed
240                                 processes. Takes a space-separated
241                                 list of CPU indexes. See
242                                 <citerefentry><refentrytitle>sched_setaffinity</refentrytitle><manvolnum>2</manvolnum></citerefentry>
243                                 for details.</para></listitem>
244                         </varlistentry>
245
246                         <varlistentry>
247                                 <term><varname>UMask=</varname></term>
248
249                                 <listitem><para>Controls the file mode
250                                 creation mask. Takes an access mode in
251                                 octal notation. See
252                                 <citerefentry><refentrytitle>umask</refentrytitle><manvolnum>2</manvolnum></citerefentry>
253                                 for details. Defaults to
254                                 0002.</para></listitem>
255                         </varlistentry>
256
257                         <varlistentry>
258                                 <term><varname>Environment=</varname></term>
259
260                                 <listitem><para>Sets environment
261                                 variables for executed
262                                 processes. Takes a space-separated
263                                 list of variable assignments. This
264                                 option may be specified more than once
265                                 in which case all listed variables
266                                 will be set. If the same variable is
267                                 set twice the later setting will
268                                 override the earlier setting. See
269                                 <citerefentry><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>
270                                 for details.</para></listitem>
271                         </varlistentry>
272                         <varlistentry>
273                                 <term><varname>EnvironmentFile=</varname></term>
274                                 <listitem><para>Similar to
275                                 <varname>Environment=</varname> but
276                                 reads the environment variables from a
277                                 text file. The text file should
278                                 contain new-line separated variable
279                                 assignments. Empty lines and lines
280                                 starting with ; or # will be ignored,
281                                 which may be used for commenting. The
282                                 argument passed should be an absolute
283                                 file name, optionally prefixed with
284                                 "-", which indicates that if the file
285                                 does not exist it won't be read and no
286                                 error or warning message is
287                                 logged. The files listed with this
288                                 directive will be read shortly before
289                                 the process is executed. Settings from
290                                 these files override settings made
291                                 with
292                                 <varname>Environment=</varname>. If
293                                 the same variable is set twice from
294                                 these files the files will be read in
295                                 the order they are specified and the
296                                 later setting will override the
297                                 earlier setting. </para></listitem>
298                         </varlistentry>
299
300                         <varlistentry>
301                                 <term><varname>StandardInput=</varname></term>
302                                 <listitem><para>Controls where file
303                                 descriptor 0 (STDIN) of the executed
304                                 processes is connected to. Takes one
305                                 of <option>null</option>,
306                                 <option>tty</option>,
307                                 <option>tty-force</option>,
308                                 <option>tty-fail</option> or
309                                 <option>socket</option>. If
310                                 <option>null</option> is selected
311                                 standard input will be connected to
312                                 <filename>/dev/null</filename>,
313                                 i.e. all read attempts by the process
314                                 will result in immediate EOF. If
315                                 <option>tty</option> is selected
316                                 standard input is connected to a TTY
317                                 (as configured by
318                                 <varname>TTYPath=</varname>, see
319                                 below) and the executed process
320                                 becomes the controlling process of the
321                                 terminal. If the terminal is already
322                                 being controlled by another process the
323                                 executed process waits until the current
324                                 controlling process releases the
325                                 terminal.
326                                 <option>tty-force</option>
327                                 is similar to <option>tty</option>,
328                                 but the executed process is forcefully
329                                 and immediately made the controlling
330                                 process of the terminal, potentially
331                                 removing previous controlling
332                                 processes from the
333                                 terminal. <option>tty-fail</option> is
334                                 similar to <option>tty</option> but if
335                                 the terminal already has a controlling
336                                 process start-up of the executed
337                                 process fails.  The
338                                 <option>socket</option> option is only
339                                 valid in socket-activated services,
340                                 and only when the socket configuration
341                                 file (see
342                                 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>
343                                 for details) specifies a single socket
344                                 only. If this option is set standard
345                                 input will be connected to the socket
346                                 the service was activated from, which
347                                 is primarily useful for compatibility
348                                 with daemons designed for use with the
349                                 traditional
350                                 <citerefentry><refentrytitle>inetd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
351                                 daemon. This setting defaults to
352                                 <option>null</option>.</para></listitem>
353                         </varlistentry>
354                         <varlistentry>
355                                 <term><varname>StandardOutput=</varname></term>
356                                 <listitem><para>Controls where file
357                                 descriptor 1 (STDOUT) of the executed
358                                 processes is connected to. Takes one
359                                 of <option>inherit</option>,
360                                 <option>null</option>,
361                                 <option>tty</option>,
362                                 <option>syslog</option>,
363                                 <option>kmsg</option>,
364                                 <option>kmsg+console</option>,
365                                 <option>syslog+console</option> or
366                                 <option>socket</option>. If set to
367                                 <option>inherit</option> the file
368                                 descriptor of standard input is
369                                 duplicated for standard output. If set
370                                 to <option>null</option> standard
371                                 output will be connected to
372                                 <filename>/dev/null</filename>,
373                                 i.e. everything written to it will be
374                                 lost. If set to <option>tty</option>
375                                 standard output will be connected to a
376                                 tty (as configured via
377                                 <varname>TTYPath=</varname>, see
378                                 below). If the TTY is used for output
379                                 only the executed process will not
380                                 become the controlling process of the
381                                 terminal, and will not fail or wait
382                                 for other processes to release the
383                                 terminal. <option>syslog</option>
384                                 connects standard output to the
385                                 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
386                                 system logger. <option>kmsg</option>
387                                 connects it with the kernel log buffer
388                                 which is accessible via
389                                 <citerefentry><refentrytitle>dmesg</refentrytitle><manvolnum>1</manvolnum></citerefentry>. <option>syslog+console</option>
390                                 and <option>kmsg+console</option> work
391                                 similarly but copy the output to the
392                                 system console as
393                                 well. <option>socket</option> connects
394                                 standard output to a socket from
395                                 socket activation, semantics are
396                                 similar to the respective option of
397                                 <varname>StandardInput=</varname>.
398                                 This setting defaults to
399                                 <option>inherit</option>.</para></listitem>
400                         </varlistentry>
401                         <varlistentry>
402                                 <term><varname>StandardError=</varname></term>
403                                 <listitem><para>Controls where file
404                                 descriptor 2 (STDERR) of the executed
405                                 processes is connected to. The
406                                 available options are identical to
407                                 those of
408                                 <varname>StandardOutput=</varname>,
409                                 with one exception: if set to
410                                 <option>inherit</option> the file
411                                 descriptor used for standard output is
412                                 duplicated for standard error. This
413                                 setting defaults to
414                                 <option>inherit</option>.</para></listitem>
415                         </varlistentry>
416                         <varlistentry>
417                                 <term><varname>TTYPath=</varname></term>
418                                 <listitem><para>Sets the terminal
419                                 device node to use if standard input,
420                                 output or stderr are connected to a
421                                 TTY (see above). Defaults to
422                                 <filename>/dev/console</filename>.</para></listitem>
423                         </varlistentry>
424                         <varlistentry>
425                                 <term><varname>SyslogIdentifier=</varname></term>
426                                 <listitem><para>Sets the process name
427                                 to prefix log lines sent to syslog or
428                                 the kernel log buffer with. If not set
429                                 defaults to the process name of the
430                                 executed process. This option is only
431                                 useful when
432                                 <varname>StandardOutput=</varname> or
433                                 <varname>StandardError=</varname> are
434                                 set to <option>syslog</option> or
435                                 <option>kmsg</option>.</para></listitem>
436                         </varlistentry>
437                         <varlistentry>
438                                 <term><varname>SyslogFacility=</varname></term>
439                                 <listitem><para>Sets the syslog
440                                 facility to use when logging to
441                                 syslog. One of <option>kern</option>,
442                                 <option>user</option>,
443                                 <option>mail</option>,
444                                 <option>daemon</option>,
445                                 <option>auth</option>,
446                                 <option>syslog</option>,
447                                 <option>lpr</option>,
448                                 <option>news</option>,
449                                 <option>uucp</option>,
450                                 <option>cron</option>,
451                                 <option>authpriv</option>,
452                                 <option>ftp</option>,
453                                 <option>local0</option>,
454                                 <option>local1</option>,
455                                 <option>local2</option>,
456                                 <option>local3</option>,
457                                 <option>local4</option>,
458                                 <option>local5</option>,
459                                 <option>local6</option> or
460                                 <option>local7</option>. See
461                                 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
462                                 for details. This option is only
463                                 useful when
464                                 <varname>StandardOutput=</varname> or
465                                 <varname>StandardError=</varname> are
466                                 set to <option>syslog</option>.
467                                 Defaults to
468                                 <option>daemon</option>.</para></listitem>
469                         </varlistentry>
470                         <varlistentry>
471                                 <term><varname>SyslogLevel=</varname></term>
472                                 <listitem><para>Default syslog level
473                                 to use when logging to syslog or the
474                                 kernel log buffer. One of
475                                 <option>emerg</option>,
476                                 <option>alert</option>,
477                                 <option>crit</option>,
478                                 <option>err</option>,
479                                 <option>warning</option>,
480                                 <option>notice</option>,
481                                 <option>info</option>,
482                                 <option>debug</option>. See
483                                 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
484                                 for details. This option is only
485                                 useful when
486                                 <varname>StandardOutput=</varname> or
487                                 <varname>StandardError=</varname> are
488                                 set to <option>syslog</option> or
489                                 <option>kmsg</option>. Note that
490                                 individual lines output by the daemon
491                                 might be prefixed with a different log
492                                 level which can be used to override
493                                 the default log level specified
494                                 here. The interpretation of these
495                                 prefixes may be disabled with
496                                 <varname>SyslogLevelPrefix=</varname>,
497                                 see below. For details see
498                                 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
499
500                                 Defaults to
501                                 <option>info</option>.</para></listitem>
502                         </varlistentry>
503
504                         <varlistentry>
505                                 <term><varname>SyslogLevelPrefix=</varname></term>
506                                 <listitem><para>Takes a boolean
507                                 argument. If true and
508                                 <varname>StandardOutput=</varname> or
509                                 <varname>StandardError=</varname> are
510                                 set to <option>syslog</option> or
511                                 <option>kmsg</option> log lines
512                                 written by the executed process that
513                                 are prefixed with a log level will be
514                                 passed on to syslog with this log
515                                 level set but the prefix removed. If
516                                 set to false, the interpretation of
517                                 these prefixes is disabled and the
518                                 logged lines are passed on as-is. For
519                                 details about this prefixing see
520                                 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
521                                 Defaults to true.</para></listitem>
522                         </varlistentry>
523
524                         <varlistentry>
525                                 <term><varname>TimerSlackNSec=</varname></term>
526                                 <listitem><para>Sets the timer slack
527                                 in nanoseconds for the executed
528                                 processes. The timer slack controls the
529                                 accuracy of wake-ups triggered by
530                                 timers. See
531                                 <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
532                                 for more information. Note that in
533                                 contrast to most other time span
534                                 definitions this parameter takes an
535                                 integer value in nano-seconds and does
536                                 not understand any other
537                                 units.</para></listitem>
538                         </varlistentry>
539
540                         <varlistentry>
541                                 <term><varname>LimitCPU=</varname></term>
542                                 <term><varname>LimitFSIZE=</varname></term>
543                                 <term><varname>LimitDATA=</varname></term>
544                                 <term><varname>LimitSTACK=</varname></term>
545                                 <term><varname>LimitCORE=</varname></term>
546                                 <term><varname>LimitRSS=</varname></term>
547                                 <term><varname>LimitNOFILE=</varname></term>
548                                 <term><varname>LimitAS=</varname></term>
549                                 <term><varname>LimitNPROC=</varname></term>
550                                 <term><varname>LimitMEMLOCK=</varname></term>
551                                 <term><varname>LimitLOCKS=</varname></term>
552                                 <term><varname>LimitSIGPENDING=</varname></term>
553                                 <term><varname>LimitMSGQUEUE=</varname></term>
554                                 <term><varname>LimitNICE=</varname></term>
555                                 <term><varname>LimitRTPRIO=</varname></term>
556                                 <term><varname>LimitRTTIME=</varname></term>
557                                 <listitem><para>These settings control
558                                 various resource limits for executed
559                                 processes. See
560                                 <citerefentry><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry>
561                                 for details.</para></listitem>
562                         </varlistentry>
563
564                         <varlistentry>
565                                 <term><varname>PAMName=</varname></term>
566                                 <listitem><para>Sets the PAM service
567                                 name to set up a session as. If set
568                                 the executed process will be
569                                 registered as a PAM session under the
570                                 specified service name. This is only
571                                 useful in conjunction with the
572                                 <varname>User=</varname> setting. If
573                                 not set no PAM session will be opened
574                                 for the executed processes. See
575                                 <citerefentry><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>
576                                 for details.</para></listitem>
577                         </varlistentry>
578
579                         <varlistentry>
580                                 <term><varname>TCPWrapName=</varname></term>
581                                 <listitem><para>If this is a
582                                 socket-activated service this sets the
583                                 tcpwrap service name to check the
584                                 permission for the current connection
585                                 with. This is only useful in
586                                 conjunction with socket-activated
587                                 services, and stream sockets (TCP) in
588                                 particular. It has no effect on other
589                                 socket types (e.g. datagram/UDP) and on processes
590                                 unrelated to socket-based
591                                 activation. If the tcpwrap
592                                 verification fails daemon start-up
593                                 will fail and the connection is
594                                 terminated. See
595                                 <citerefentry><refentrytitle>tcpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
596                                 for details.</para></listitem>
597                         </varlistentry>
598
599                         <varlistentry>
600                                 <term><varname>CapabilityBoundingSet=</varname></term>
601
602                                 <listitem><para>Controls which
603                                 capabilities to include in the
604                                 capability bounding set for the
605                                 executed process. See
606                                 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
607                                 for details. Takes a whitespace
608                                 seperated list of capability names as
609                                 read by
610                                 <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
611                                 Capabilities listed will be included
612                                 in the bounding set, all others are
613                                 removed. If the list of capabilities
614                                 is prefixed with ~ all but the listed
615                                 capabilities will be included, the
616                                 effect of this assignment
617                                 inverted. Note that this option does
618                                 not actually set or unset any
619                                 capabilities in the effective,
620                                 permitted or inherited capability
621                                 sets. That's what
622                                 <varname>Capabilities=</varname> is
623                                 for. If this option is not used the
624                                 capability bounding set is not
625                                 modified on process execution, hence
626                                 no limits on the capabilities of the
627                                 process are enforced.</para></listitem>
628                         </varlistentry>
629
630                         <varlistentry>
631                                 <term><varname>SecureBits=</varname></term>
632                                 <listitem><para>Controls the secure
633                                 bits set for the executed process. See
634                                 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
635                                 for details. Takes a list of strings:
636                                 <option>keep-caps</option>,
637                                 <option>keep-caps-locked</option>,
638                                 <option>no-setuid-fixup</option>,
639                                 <option>no-setuid-fixup-locked</option>,
640                                 <option>no-setuid-noroot</option> and/or
641                                 <option>no-setuid-noroot-locked</option>.
642                                 </para></listitem>
643                         </varlistentry>
644
645                         <varlistentry>
646                                 <term><varname>Capabilities=</varname></term>
647                                 <listitem><para>Controls the
648                                 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
649                                 set for the executed process. Take a
650                                 capability string describing the
651                                 effective, permitted and inherited
652                                 capability sets as documented in
653                                 <citerefentry><refentrytitle>cap_from_text</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
654                                 Note that these capability sets are
655                                 usually influenced by the capabilities
656                                 attached to the executed file. Due to
657                                 that
658                                 <varname>CapabilityBoundingSet=</varname>
659                                 is probably the much more useful
660                                 setting.</para></listitem>
661                         </varlistentry>
662
663                         <varlistentry>
664                                 <term><varname>ControlGroup=</varname></term>
665
666                                 <listitem><para>Controls the control
667                                 groups the executed processes shall be
668                                 made members of. Takes a
669                                 space-separated list of cgroup
670                                 identifiers. A cgroup identifier has a
671                                 format like
672                                 <filename>cpu:/foo/bar</filename>,
673                                 where "cpu" identifies the kernel
674                                 control group controller used, and
675                                 <filename>/foo/bar</filename> is the
676                                 control group path. The controller name
677                                 and ":" may be omitted in which case
678                                 the named systemd control group
679                                 hierarchy is implied. Alternatively,
680                                 the path and ":" may be omitted, in
681                                 which case the default control group
682                                 path for this unit is implied. This
683                                 option may be used to place executed
684                                 processes in arbitrary groups in
685                                 arbitrary hierachies -- which can be
686                                 configured externally with additional execution limits. By default
687                                 systemd will place all executed
688                                 processes in separate per-unit control
689                                 groups (named after the unit) in the
690                                 systemd named hierarchy. Since every
691                                 process can be in one group per
692                                 hierarchy only overriding the control group
693                                 path in the named systemd hierarchy
694                                 will disable automatic placement in
695                                 the default group. For details about control
696                                 groups see <ulink
697                                 url="http://www.kernel.org/doc/Documentation/cgroups/cgroups.txt">cgroups.txt</ulink>.</para></listitem>
698                         </varlistentry>
699
700                         <varlistentry>
701                                 <term><varname>ReadWriteDirectories=</varname></term>
702                                 <term><varname>ReadOnlyDirectories=</varname></term>
703                                 <term><varname>InaccessibleDirectories=</varname></term>
704
705                                 <listitem><para>Sets up a new
706                                 file-system name space for executed
707                                 processes. These options may be used
708                                 to limit access a process might have
709                                 to the main file-system
710                                 hierarchy. Each setting takes a
711                                 space-separated list of absolute
712                                 directory paths. Directories listed in
713                                 <varname>ReadWriteDirectories=</varname>
714                                 are accessible from within the
715                                 namespace with the same access rights
716                                 as from outside. Directories listed in
717                                 <varname>ReadOnlyDirectories=</varname>
718                                 are accessible for reading only,
719                                 writing will be refused even if the
720                                 usual file access controls would
721                                 permit this. Directories listed in
722                                 <varname>InaccessibleDirectories=</varname>
723                                 will be made inaccesible for processes
724                                 inside the namespace. Note that
725                                 restricting access with these options
726                                 does not extend to submounts of a
727                                 directory. You must list submounts
728                                 separately in these settings to
729                                 ensure the same limited access. These
730                                 options may be specified more than
731                                 once in which case all directories
732                                 listed will have limited access from
733                                 within the
734                                 namespace.</para></listitem>
735                         </varlistentry>
736
737                         <varlistentry>
738                                 <term><varname>PrivateTmp=</varname></term>
739
740                                 <listitem><para>Takes a boolean
741                                 argument. If true sets up a new
742                                 namespace for the executed processes
743                                 and mounts a private
744                                 <filename>/tmp</filename> directory
745                                 inside it, that is not shared by
746                                 processes outside of the
747                                 namespace. This is useful to secure
748                                 access to temporary files of the
749                                 process, but makes sharing between
750                                 processes via
751                                 <filename>/tmp</filename>
752                                 impossible. Defaults to false.</para></listitem>
753                         </varlistentry>
754
755                         <varlistentry>
756                                 <term><varname>MountFlags=</varname></term>
757
758                                 <listitem><para>Takes a mount
759                                 propagation flag:
760                                 <option>shared</option>,
761                                 <option>slave</option> or
762                                 <option>private</option>, which
763                                 control whether namespaces set up with
764                                 <varname>ReadWriteDirectories=</varname>,
765                                 <varname>ReadOnlyDirectories=</varname>
766                                 and
767                                 <varname>InaccessibleDirectories=</varname>
768                                 receive or propagate new mounts
769                                 from/to the main namespace. See
770                                 <citerefentry><refentrytitle>mount</refentrytitle><manvolnum>1</manvolnum></citerefentry>
771                                 for details. Defaults to
772                                 <option>shared</option>, i.e. the new
773                                 namespace will both receive new mount
774                                 points from the main namespace as well
775                                 as propagate new mounts to
776                                 it.</para></listitem>
777                         </varlistentry>
778
779                         <varlistentry>
780                                 <term><varname>UtmpIdentifier=</varname></term>
781
782                                 <listitem><para>Takes a a four
783                                 character identifier string for an
784                                 utmp/wtmp entry for this service. This
785                                 should only be set for services such
786                                 as <command>getty</command>
787                                 implementations where utmp/wtmp
788                                 entries must be created and cleared
789                                 before and after execution. If the
790                                 configured string is longer than four
791                                 characters it is truncated and the
792                                 terminal four characters are
793                                 used. This setting interprets %I style
794                                 string replacements. This setting is
795                                 unset by default, i.e. no utmp/wtmp
796                                 entries are created or cleaned up for
797                                 this service.</para></listitem>
798                         </varlistentry>
799
800                 </variablelist>
801         </refsect1>
802
803         <refsect1>
804                   <title>See Also</title>
805                   <para>
806                           <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
807                           <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
808                           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
809                           <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
810                           <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
811                           <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
812                           <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>
813                   </para>
814         </refsect1>
815
816 </refentry>