chiark / gitweb /
mount/service: drop FsckPassNo support
[elogind.git] / man / systemd.socket.xml
1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <?xml-stylesheet type="text/xsl" href="http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl"?>
3 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
4         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
5
6 <!--
7   This file is part of systemd.
8
9   Copyright 2010 Lennart Poettering
10
11   systemd is free software; you can redistribute it and/or modify it
12   under the terms of the GNU Lesser General Public License as published by
13   the Free Software Foundation; either version 2.1 of the License, or
14   (at your option) any later version.
15
16   systemd is distributed in the hope that it will be useful, but
17   WITHOUT ANY WARRANTY; without even the implied warranty of
18   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
19   Lesser General Public License for more details.
20
21   You should have received a copy of the GNU Lesser General Public License
22   along with systemd; If not, see <http://www.gnu.org/licenses/>.
23 -->
24
25 <refentry id="systemd.socket">
26         <refentryinfo>
27                 <title>systemd.socket</title>
28                 <productname>systemd</productname>
29
30                 <authorgroup>
31                         <author>
32                                 <contrib>Developer</contrib>
33                                 <firstname>Lennart</firstname>
34                                 <surname>Poettering</surname>
35                                 <email>lennart@poettering.net</email>
36                         </author>
37                 </authorgroup>
38         </refentryinfo>
39
40         <refmeta>
41                 <refentrytitle>systemd.socket</refentrytitle>
42                 <manvolnum>5</manvolnum>
43         </refmeta>
44
45         <refnamediv>
46                 <refname>systemd.socket</refname>
47                 <refpurpose>Socket unit configuration</refpurpose>
48         </refnamediv>
49
50         <refsynopsisdiv>
51                 <para><filename><replaceable>socket</replaceable>.socket</filename></para>
52         </refsynopsisdiv>
53
54         <refsect1>
55                 <title>Description</title>
56
57                 <para>A unit configuration file whose name ends in
58                 <literal>.socket</literal> encodes information about
59                 an IPC or network socket or a file system FIFO
60                 controlled and supervised by systemd, for socket-based
61                 activation.</para>
62
63                 <para>This man page lists the configuration options
64                 specific to this unit type. See
65                 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
66                 for the common options of all unit configuration
67                 files. The common configuration items are configured
68                 in the generic [Unit] and [Install] sections. The
69                 socket specific configuration options are configured
70                 in the [Socket] section.</para>
71
72                 <para>Additional options are listed in
73                 <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
74                 which define the execution environment the
75                 <option>ExecStartPre=</option>,
76                 <option>ExecStartPost=</option>,
77                 <option>ExecStopPre=</option> and
78                 <option>ExecStopPost=</option> commands are executed
79                 in, and in
80                 <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
81                 which define the way the processes are terminated, and
82                 in
83                 <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
84                 which configure resource control settings for the
85                 processes of the socket.</para>
86
87                 <para>For each socket file a matching service file
88                 (see
89                 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
90                 for details) must exist, describing the service to
91                 start on incoming traffic on the socket. Depending on
92                 the setting of <option>Accept=</option> (see below),
93                 this must either be named like the socket unit, but
94                 with the suffix replaced; or it must be a template
95                 file named the same way. Example: a socket file
96                 <filename>foo.socket</filename> needs a matching
97                 service <filename>foo.service</filename> if
98                 <option>Accept=false</option> is set. If
99                 <option>Accept=true</option> is set, a service template
100                 file <filename>foo@.service</filename> must exist from
101                 which services are instantiated for each incoming
102                 connection.</para>
103
104                 <para>Unless <varname>DefaultDependencies=</varname>
105                 is set to <option>false</option>, socket units will
106                 implicitly have dependencies of type
107                 <varname>Requires=</varname> and
108                 <varname>After=</varname> on
109                 <filename>sysinit.target</filename> as well as
110                 dependencies of type <varname>Conflicts=</varname> and
111                 <varname>Before=</varname> on
112                 <filename>shutdown.target</filename>. These ensure
113                 that socket units pull in basic system
114                 initialization, and are terminated cleanly prior to
115                 system shutdown. Only sockets involved with early
116                 boot or late system shutdown should disable this
117                 option.</para>
118
119                 <para>Socket units may be used to implement on-demand
120                 starting of services, as well as parallelized starting
121                 of services.</para>
122
123                 <para>Note that the daemon software configured for
124                 socket activation with socket units needs to be able
125                 to accept sockets from systemd, either via systemd's
126                 native socket passing interface (see
127                 <citerefentry><refentrytitle>sd_listen_fds</refentrytitle><manvolnum>3</manvolnum></citerefentry>
128                 for details) or via the traditional
129                 <citerefentry><refentrytitle>inetd</refentrytitle><manvolnum>8</manvolnum></citerefentry>-style
130                 socket passing (i.e. sockets passed in via STDIN and
131                 STDOUT, using <varname>StandardInput=socket</varname>
132                 in the service file).</para>
133         </refsect1>
134
135         <refsect1>
136                 <title>Options</title>
137
138                 <para>Socket files must include a [Socket] section,
139                 which carries information about the socket or FIFO it
140                 supervises. A number of options that may be used in
141                 this section are shared with other unit types. These
142                 options are documented in
143                 <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
144                 and
145                 <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>. The
146                 options specific to the [Socket] section of socket
147                 units are the following:</para>
148
149                 <variablelist class='unit-directives'>
150                         <varlistentry>
151                                 <term><varname>ListenStream=</varname></term>
152                                 <term><varname>ListenDatagram=</varname></term>
153                                 <term><varname>ListenSequentialPacket=</varname></term>
154                                 <listitem><para>Specifies an address
155                                 to listen on for a stream
156                                 (<constant>SOCK_STREAM</constant>), datagram (<constant>SOCK_DGRAM</constant>),
157                                 or sequential packet
158                                 (<constant>SOCK_SEQPACKET</constant>) socket, respectively. The address
159                                 can be written in various formats:</para>
160
161                                 <para>If the address starts with a
162                                 slash (<literal>/</literal>), it is read as file system
163                                 socket in the <constant>AF_UNIX</constant> socket
164                                 family.</para>
165
166                                 <para>If the address starts with an at
167                                 symbol (<literal>@</literal>), it is read as abstract
168                                 namespace socket in the
169                                 <constant>AF_UNIX</constant>
170                                 family. The <literal>@</literal> is
171                                 replaced with a
172                                 <constant>NUL</constant> character
173                                 before binding. For details, see
174                                 <citerefentry><refentrytitle>unix</refentrytitle><manvolnum>7</manvolnum></citerefentry>.</para>
175
176                                 <para>If the address string is a
177                                 single number, it is read as port
178                                 number to listen on via
179                                 IPv6. Depending on the value of
180                                 <varname>BindIPv6Only=</varname> (see below) this
181                                 might result in the service being
182                                 available via both IPv6 and IPv4 (default) or
183                                 just via IPv6.
184                                 </para>
185
186                                 <para>If the address string is a
187                                 string in the format v.w.x.y:z, it is
188                                 read as IPv4 specifier for listening
189                                 on an address v.w.x.y on a port
190                                 z.</para>
191
192                                 <para>If the address string is a
193                                 string in the format [x]:y, it is read
194                                 as IPv6 address x on a port y. Note
195                                 that this might make the service
196                                 available via IPv4, too, depending on
197                                 the <varname>BindIPv6Only=</varname>
198                                 setting (see below).
199                                 </para>
200
201                                 <para>Note that <constant>SOCK_SEQPACKET</constant>
202                                 (i.e. <varname>ListenSequentialPacket=</varname>)
203                                 is only available for <constant>AF_UNIX</constant>
204                                 sockets. <constant>SOCK_STREAM</constant>
205                                 (i.e. <varname>ListenStream=</varname>)
206                                 when used for IP sockets refers to TCP
207                                 sockets, <constant>SOCK_DGRAM</constant>
208                                 (i.e. <varname>ListenDatagram=</varname>)
209                                 to UDP.</para>
210
211                                 <para>These options may be specified
212                                 more than once in which case incoming
213                                 traffic on any of the sockets will
214                                 trigger service activation, and all
215                                 listed sockets will be passed to the
216                                 service, regardless whether there is
217                                 incoming traffic on them or not. If
218                                 the empty string is assigned to any of
219                                 these options, the list of addresses
220                                 to listen on is reset, all prior uses
221                                 of any of these options will have no
222                                 effect.</para>
223
224                                 <para>If an IP address is used here,
225                                 it is often desirable to listen on it
226                                 before the interface it is configured
227                                 on is up and running, and even
228                                 regardless whether it will be up and
229                                 running ever at all. To deal with this
230                                 it is recommended to set the
231                                 <varname>FreeBind=</varname> option
232                                 described below.</para></listitem>
233                         </varlistentry>
234
235                         <varlistentry>
236                                 <term><varname>ListenFIFO=</varname></term>
237                                 <listitem><para>Specifies a file
238                                 system FIFO to listen on. This expects
239                                 an absolute file system path as
240                                 argument. Behavior otherwise is very
241                                 similar to the
242                                 <varname>ListenDatagram=</varname>
243                                 directive above.</para></listitem>
244                         </varlistentry>
245
246                         <varlistentry>
247                                 <term><varname>ListenSpecial=</varname></term>
248                                 <listitem><para>Specifies a special
249                                 file in the file system to listen
250                                 on. This expects an absolute file
251                                 system path as argument. Behavior
252                                 otherwise is very similar to the
253                                 <varname>ListenFIFO=</varname>
254                                 directive above. Use this to open
255                                 character device nodes as well as
256                                 special files in
257                                 <filename>/proc</filename> and
258                                 <filename>/sys</filename>.</para></listitem>
259                         </varlistentry>
260
261                         <varlistentry>
262                                 <term><varname>ListenNetlink=</varname></term>
263                                 <listitem><para>Specifies a Netlink
264                                 family to create a socket for to
265                                 listen on. This expects a short string
266                                 referring to the <constant>AF_NETLINK</constant> family
267                                 name (such as <varname>audit</varname>
268                                 or <varname>kobject-uevent</varname>)
269                                 as argument, optionally suffixed by a
270                                 whitespace followed by a multicast
271                                 group integer. Behavior otherwise is
272                                 very similar to the
273                                 <varname>ListenDatagram=</varname>
274                                 directive above.</para></listitem>
275                         </varlistentry>
276
277                         <varlistentry>
278                                 <term><varname>ListenMessageQueue=</varname></term>
279                                 <listitem><para>Specifies a POSIX
280                                 message queue name to listen on. This
281                                 expects a valid message queue name
282                                 (i.e. beginning with /). Behavior
283                                 otherwise is very similar to the
284                                 <varname>ListenFIFO=</varname>
285                                 directive above. On Linux message
286                                 queue descriptors are actually file
287                                 descriptors and can be inherited
288                                 between processes.</para></listitem>
289                         </varlistentry>
290
291                         <varlistentry>
292                                 <term><varname>BindIPv6Only=</varname></term>
293                                 <listitem><para>Takes a one of
294                                 <option>default</option>,
295                                 <option>both</option> or
296                                 <option>ipv6-only</option>. Controls
297                                 the IPV6_V6ONLY socket option (see
298                                 <citerefentry><refentrytitle>ipv6</refentrytitle><manvolnum>7</manvolnum></citerefentry>
299                                 for details). If
300                                 <option>both</option>, IPv6 sockets
301                                 bound will be accessible via both IPv4
302                                 and IPv6. If
303                                 <option>ipv6-only</option>, they will
304                                 be accessible via IPv6 only. If
305                                 <option>default</option> (which is the
306                                 default, surprise!), the system wide
307                                 default setting is used, as controlled
308                                 by
309                                 <filename>/proc/sys/net/ipv6/bindv6only</filename>,
310                                 which in turn defaults to the
311                                 equivalent of
312                                 <option>both</option>.</para>
313                                 </listitem>
314                         </varlistentry>
315
316                         <varlistentry>
317                                 <term><varname>Backlog=</varname></term>
318                                 <listitem><para>Takes an unsigned
319                                 integer argument. Specifies the number
320                                 of connections to queue that have not
321                                 been accepted yet. This setting
322                                 matters only for stream and sequential
323                                 packet sockets. See
324                                 <citerefentry><refentrytitle>listen</refentrytitle><manvolnum>2</manvolnum></citerefentry>
325                                 for details. Defaults to SOMAXCONN
326                                 (128).</para></listitem>
327                         </varlistentry>
328
329                         <varlistentry>
330                                 <term><varname>BindToDevice=</varname></term>
331                                 <listitem><para>Specifies a network
332                                 interface name to bind this socket
333                                 to. If set, traffic will only be
334                                 accepted from the specified network
335                                 interfaces. This controls the
336                                 SO_BINDTODEVICE socket option (see
337                                 <citerefentry><refentrytitle>socket</refentrytitle><manvolnum>7</manvolnum></citerefentry>
338                                 for details). If this option is used,
339                                 an automatic dependency from this
340                                 socket unit on the network interface
341                                 device unit
342                                 (<citerefentry><refentrytitle>systemd.device</refentrytitle><manvolnum>5</manvolnum></citerefentry>
343                                 is created.</para></listitem>
344                         </varlistentry>
345
346                         <varlistentry>
347                                 <term><varname>DirectoryMode=</varname></term>
348                                 <listitem><para>If listening on a file
349                                 system socket or FIFO, the parent
350                                 directories are automatically created
351                                 if needed. This option specifies the
352                                 file system access mode used when
353                                 creating these directories. Takes an
354                                 access mode in octal
355                                 notation. Defaults to
356                                 0755.</para></listitem>
357                         </varlistentry>
358
359                         <varlistentry>
360                                 <term><varname>SocketMode=</varname></term>
361                                 <listitem><para>If listening on a file
362                                 system socket or FIFO, this option
363                                 specifies the file system access mode
364                                 used when creating the file
365                                 node. Takes an access mode in octal
366                                 notation. Defaults to
367                                 0666.</para></listitem>
368                         </varlistentry>
369
370                         <varlistentry>
371                                 <term><varname>Accept=</varname></term>
372                                 <listitem><para>Takes a boolean
373                                 argument. If true, a service instance
374                                 is spawned for each incoming
375                                 connection and only the connection
376                                 socket is passed to it. If false, all
377                                 listening sockets themselves are
378                                 passed to the started service unit,
379                                 and only one service unit is spawned
380                                 for all connections (also see
381                                 above). This value is ignored for
382                                 datagram sockets and FIFOs where a
383                                 single service unit unconditionally
384                                 handles all incoming traffic. Defaults
385                                 to <option>false</option>. For
386                                 performance reasons, it is recommended
387                                 to write new daemons only in a way
388                                 that is suitable for
389                                 <option>Accept=false</option>. A
390                                 daemon listening on an <constant>AF_UNIX</constant> socket
391                                 may, but does not need to, call
392                                 <citerefentry><refentrytitle>close</refentrytitle><manvolnum>2</manvolnum></citerefentry>
393                                 on the received socket before
394                                 exiting. However, it must not unlink
395                                 the socket from a file system. It
396                                 should not invoke
397                                 <citerefentry><refentrytitle>shutdown</refentrytitle><manvolnum>2</manvolnum></citerefentry>
398                                 on sockets it got with
399                                 <varname>Accept=false</varname>, but
400                                 it may do so for sockets it got with
401                                 <varname>Accept=true</varname> set.
402                                 Setting <varname>Accept=true</varname>
403                                 is mostly useful to allow daemons
404                                 designed for usage with
405                                 <citerefentry><refentrytitle>inetd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
406                                 to work unmodified with systemd socket
407                                 activation.</para></listitem>
408                         </varlistentry>
409
410                         <varlistentry>
411                                 <term><varname>MaxConnections=</varname></term>
412                                 <listitem><para>The maximum number of
413                                 connections to simultaneously run
414                                 services instances for, when
415                                 <option>Accept=true</option> is
416                                 set. If more concurrent connections
417                                 are coming in, they will be refused
418                                 until at least one existing connection
419                                 is terminated. This setting has no
420                                 effect on sockets configured with
421                                 <option>Accept=false</option> or datagram
422                                 sockets. Defaults to
423                                 64.</para></listitem>
424                         </varlistentry>
425
426                         <varlistentry>
427                                 <term><varname>KeepAlive=</varname></term>
428                                 <listitem><para>Takes a boolean
429                                 argument. If true, the TCP/IP stack
430                                 will send a keep alive message after
431                                 2h (depending on the configuration of
432                                 <filename>/proc/sys/net/ipv4/tcp_keepalive_time</filename>)
433                                 for all TCP streams accepted on this
434                                 socket. This controls the SO_KEEPALIVE
435                                 socket option (see
436                                 <citerefentry><refentrytitle>socket</refentrytitle><manvolnum>7</manvolnum></citerefentry>
437                                 and the <ulink
438                                 url="http://www.tldp.org/HOWTO/html_single/TCP-Keepalive-HOWTO/">TCP
439                                 Keepalive HOWTO</ulink> for details.)
440                                 Defaults to
441                                 <option>false</option>.</para></listitem>
442                         </varlistentry>
443
444                         <varlistentry>
445                                 <term><varname>Priority=</varname></term>
446                                 <listitem><para>Takes an integer
447                                 argument controlling the priority for
448                                 all traffic sent from this
449                                 socket. This controls the SO_PRIORITY
450                                 socket option (see
451                                 <citerefentry><refentrytitle>socket</refentrytitle><manvolnum>7</manvolnum></citerefentry>
452                                 for details.).</para></listitem>
453                         </varlistentry>
454
455                         <varlistentry>
456                                 <term><varname>ReceiveBuffer=</varname></term>
457                                 <term><varname>SendBuffer=</varname></term>
458                                 <listitem><para>Takes an integer
459                                 argument controlling the receive
460                                 or send buffer sizes of this
461                                 socket, respectively. This controls the SO_RCVBUF
462                                 and SO_SNDBUF socket options (see
463                                 <citerefentry><refentrytitle>socket</refentrytitle><manvolnum>7</manvolnum></citerefentry>
464                                 for details.).</para></listitem>
465                         </varlistentry>
466
467                         <varlistentry>
468                                 <term><varname>IPTOS=</varname></term>
469                                 <listitem><para>Takes an integer
470                                 argument controlling the IP
471                                 Type-Of-Service field for packets
472                                 generated from this socket. This
473                                 controls the IP_TOS socket option (see
474                                 <citerefentry><refentrytitle>ip</refentrytitle><manvolnum>7</manvolnum></citerefentry>
475                                 for details.). Either a numeric string
476                                 or one of <option>low-delay</option>,
477                                 <option>throughput</option>,
478                                 <option>reliability</option> or
479                                 <option>low-cost</option> may be
480                                 specified.</para></listitem>
481                         </varlistentry>
482
483                         <varlistentry>
484                                 <term><varname>IPTTL=</varname></term>
485                                 <listitem><para>Takes an integer
486                                 argument controlling the IPv4
487                                 Time-To-Live/IPv6 Hop-Count field for
488                                 packets generated from this
489                                 socket. This sets the
490                                 IP_TTL/IPV6_UNICAST_HOPS socket
491                                 options (see
492                                 <citerefentry><refentrytitle>ip</refentrytitle><manvolnum>7</manvolnum></citerefentry>
493                                 and
494                                 <citerefentry><refentrytitle>ipv6</refentrytitle><manvolnum>7</manvolnum></citerefentry>
495                                 for details.)</para></listitem>
496                         </varlistentry>
497
498                         <varlistentry>
499                                 <term><varname>Mark=</varname></term>
500                                 <listitem><para>Takes an integer
501                                 value. Controls the firewall mark of
502                                 packets generated by this socket. This
503                                 can be used in the firewall logic to
504                                 filter packets from this socket. This
505                                 sets the SO_MARK socket option. See
506                                 <citerefentry><refentrytitle>iptables</refentrytitle><manvolnum>8</manvolnum></citerefentry>
507                                 for details.</para></listitem>
508                         </varlistentry>
509
510                         <varlistentry>
511                                 <term><varname>ReusePort=</varname></term>
512                                 <listitem><para>Takes a boolean
513                                 value. If true, allows multiple <citerefentry><refentrytitle>bind</refentrytitle><manvolnum>2</manvolnum></citerefentry>s
514                                 to this TCP or UDP port.  This
515                                 controls the SO_REUSEPORT socket
516                                 option.  See
517                                 <citerefentry><refentrytitle>socket</refentrytitle><manvolnum>7</manvolnum></citerefentry>
518                                 for details.</para></listitem>
519                         </varlistentry>
520
521                         <varlistentry>
522                                 <term><varname>SmackLabel=</varname></term>
523                                 <term><varname>SmackLabelIPIn=</varname></term>
524                                 <term><varname>SmackLabelIPOut=</varname></term>
525                                 <listitem><para>Takes a string
526                                 value. Controls the extended
527                                 attributes
528                                 <literal>security.SMACK64</literal>,
529                                 <literal>security.SMACK64IPIN</literal>
530                                 and
531                                 <literal>security.SMACK64IPOUT</literal>,
532                                 respectively, i.e. the security label
533                                 of the FIFO, or the security label for
534                                 the incoming or outgoing connections
535                                 of the socket, respectively. See
536                                 <ulink
537                                 url="https://www.kernel.org/doc/Documentation/security/Smack.txt">Smack.txt</ulink>
538                                 for details.</para></listitem>
539                         </varlistentry>
540
541                         <varlistentry>
542                                 <term><varname>PipeSize=</varname></term>
543                                 <listitem><para>Takes an integer
544                                 value. Controls the pipe buffer size
545                                 of FIFOs configured in this socket
546                                 unit. See
547                                 <citerefentry><refentrytitle>fcntl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
548                                 for details.</para></listitem>
549                         </varlistentry>
550
551                         <varlistentry>
552                                 <term><varname>MessageQueueMaxMessages=</varname>,
553                                 <varname>MessageQueueMessageSize=</varname></term>
554                                 <listitem><para>These two settings
555                                 take integer values and control the
556                                 mq_maxmsg field or the mq_msgsize field, respectively, when
557                                 creating the message queue. Note that
558                                 either none or both of these variables
559                                 need to be set. See
560                                 <citerefentry><refentrytitle>mq_setattr</refentrytitle><manvolnum>3</manvolnum></citerefentry>
561                                 for details.</para></listitem>
562                         </varlistentry>
563
564                         <varlistentry>
565                                 <term><varname>FreeBind=</varname></term>
566                                 <listitem><para>Takes a boolean
567                                 value. Controls whether the socket can
568                                 be bound to non-local IP
569                                 addresses. This is useful to configure
570                                 sockets listening on specific IP
571                                 addresses before those IP addresses
572                                 are successfully configured on a
573                                 network interface. This sets the
574                                 IP_FREEBIND socket option. For
575                                 robustness reasons it is recommended
576                                 to use this option whenever you bind a
577                                 socket to a specific IP
578                                 address. Defaults to <option>false</option>.</para></listitem>
579                         </varlistentry>
580
581                         <varlistentry>
582                                 <term><varname>Transparent=</varname></term>
583                                 <listitem><para>Takes a boolean
584                                 value. Controls the IP_TRANSPARENT
585                                 socket option. Defaults to
586                                 <option>false</option>.</para></listitem>
587                         </varlistentry>
588
589                         <varlistentry>
590                                 <term><varname>Broadcast=</varname></term>
591                                 <listitem><para>Takes a boolean
592                                 value. This controls the SO_BROADCAST
593                                 socket option, which allows broadcast
594                                 datagrams to be sent from this
595                                 socket. Defaults to
596                                 <option>false</option>.</para></listitem>
597                         </varlistentry>
598
599                         <varlistentry>
600                                 <term><varname>PassCredentials=</varname></term>
601                                 <listitem><para>Takes a boolean
602                                 value. This controls the SO_PASSCRED
603                                 socket option, which allows <constant>AF_UNIX</constant> sockets to
604                                 receive the credentials of the sending
605                                 process in an ancillary message.
606                                 Defaults to
607                                 <option>false</option>.</para></listitem>
608                         </varlistentry>
609
610                         <varlistentry>
611                                 <term><varname>PassSecurity=</varname></term>
612                                 <listitem><para>Takes a boolean
613                                 value. This controls the SO_PASSSEC
614                                 socket option, which allows <constant>AF_UNIX</constant>
615                                 sockets to receive the security
616                                 context of the sending process in an
617                                 ancillary message. Defaults to
618                                 <option>false</option>.</para></listitem>
619                         </varlistentry>
620
621                         <varlistentry>
622                                 <term><varname>TCPCongestion=</varname></term>
623                                 <listitem><para>Takes a string
624                                 value. Controls the TCP congestion
625                                 algorithm used by this socket. Should
626                                 be one of "westwood", "veno", "cubic",
627                                 "lp" or any other available algorithm
628                                 supported by the IP stack. This
629                                 setting applies only to stream
630                                 sockets.</para></listitem>
631                         </varlistentry>
632
633                         <varlistentry>
634                                 <term><varname>ExecStartPre=</varname></term>
635                                 <term><varname>ExecStartPost=</varname></term>
636                                 <listitem><para>Takes one or more
637                                 command lines, which are executed
638                                 before or after the listening
639                                 sockets/FIFOs are created and
640                                 bound, respectively. The first token of the command
641                                 line must be an absolute filename,
642                                 then followed by arguments for the
643                                 process. Multiple command lines may be
644                                 specified following the same scheme as
645                                 used for
646                                 <varname>ExecStartPre=</varname> of
647                                 service unit files.</para></listitem>
648                         </varlistentry>
649
650                         <varlistentry>
651                                 <term><varname>ExecStopPre=</varname></term>
652                                 <term><varname>ExecStopPost=</varname></term>
653                                 <listitem><para>Additional commands
654                                 that are executed before or after
655                                 the listening sockets/FIFOs are closed
656                                 and removed, respectively. Multiple command lines
657                                 may be specified following the same
658                                 scheme as used for
659                                 <varname>ExecStartPre=</varname> of
660                                 service unit files.</para></listitem>
661                         </varlistentry>
662
663                         <varlistentry>
664                                 <term><varname>TimeoutSec=</varname></term>
665                                 <listitem><para>Configures the time to
666                                 wait for the commands specified in
667                                 <varname>ExecStartPre=</varname>,
668                                 <varname>ExecStartPost=</varname>,
669                                 <varname>ExecStopPre=</varname> and
670                                 <varname>ExecStopPost=</varname> to
671                                 finish. If a command does not exit
672                                 within the configured time, the socket
673                                 will be considered failed and be shut
674                                 down again. All commands still running,
675                                 will be terminated forcibly via
676                                 <constant>SIGTERM</constant>, and after another delay of
677                                 this time with <constant>SIGKILL</constant>. (See
678                                 <option>KillMode=</option> in <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>.)
679                                 Takes a unit-less value in seconds, or
680                                 a time span value such as "5min
681                                 20s". Pass 0 to disable the timeout
682                                 logic. Defaults to
683                                 90s.</para></listitem>
684                         </varlistentry>
685
686                         <varlistentry>
687                                 <term><varname>Service=</varname></term>
688                                 <listitem><para>Specifies the service
689                                 unit name to activate on incoming
690                                 traffic. This defaults to the service
691                                 that bears the same name as the socket
692                                 (ignoring the different suffixes). In
693                                 most cases it should not be necessary
694                                 to use this option.</para></listitem>
695                         </varlistentry>
696
697                 </variablelist>
698
699                 <para>Check
700                 <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
701                 and
702                 <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>
703                 for more settings.</para>
704
705         </refsect1>
706
707         <refsect1>
708                   <title>See Also</title>
709                   <para>
710                           <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
711                           <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
712                           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
713                           <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
714                           <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
715                           <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
716                           <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
717                           <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>
718                   </para>
719
720                   <para>
721                           For more extensive descriptions see the "systemd for Developers" series:
722                           <ulink url="http://0pointer.de/blog/projects/socket-activation.html">Socket Activation</ulink>,
723                           <ulink url="http://0pointer.de/blog/projects/socket-activation2.html">Socket Activation, part II</ulink>,
724                           <ulink url="http://0pointer.de/blog/projects/inetd.html">Converting inetd Services</ulink>,
725                           <ulink url="http://0pointer.de/blog/projects/socket-activated-containers.html">Socket Activated Internet Services and OS Containers</ulink>.
726                   </para>
727         </refsect1>
728
729 </refentry>