man: systemd.exec - mention mount(2)

[elogind.git] / man / systemd.exec.xml

diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index e6f49c9fd0769b49454c5d6a80fbcac8c055c13a..6ca74056870a7048122c5d83ec0e97c7da4831a1 100644 (file)
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -9,16 +9,16 @@
   Copyright 2010 Lennart Poettering
 
   systemd is free software; you can redistribute it and/or modify it
   Copyright 2010 Lennart Poettering
 
   systemd is free software; you can redistribute it and/or modify it

-  under the terms of the GNU General Public License as published by
-  the Free Software Foundation; either version 2 of the License, or
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or

   (at your option) any later version.
 
   systemd is distributed in the hope that it will be useful, but
   WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
   (at your option) any later version.
 
   systemd is distributed in the hope that it will be useful, but
   WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

-  General Public License for more details.
+  Lesser General Public License for more details.

 
 

-  You should have received a copy of the GNU General Public License
+  You should have received a copy of the GNU Lesser General Public License

   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 -->
 
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 -->
 


@@ -44,7 +44,7 @@
 
         <refnamediv>
                 <refname>systemd.exec</refname>
 
         <refnamediv>
                 <refname>systemd.exec</refname>

-                <refpurpose>systemd execution environment configuration</refpurpose>
+                <refpurpose>Execution environment configuration</refpurpose>

         </refnamediv>
 
         <refsynopsisdiv>
         </refnamediv>
 
         <refsynopsisdiv>


@@ -75,7 +75,7 @@
                 for more information on the specific unit
                 configuration files. The execution specific
                 configuration options are configured in the [Service],
                 for more information on the specific unit
                 configuration files. The execution specific
                 configuration options are configured in the [Service],

-                [Socket], [Mount] resp. [Swap] section, depending on the unit
+                [Socket], [Mount], or [Swap] sections, depending on the unit

                 type.</para>
         </refsect1>
 
                 type.</para>
         </refsect1>
 


@@ -89,8 +89,12 @@
 
                                 <listitem><para>Takes an absolute
                                 directory path. Sets the working
 
                                 <listitem><para>Takes an absolute
                                 directory path. Sets the working

-                                directory for executed
-                                processes.</para></listitem>
+                                directory for executed processes. If
+                                not set defaults to the root directory
+                                when systemd is running as a system
+                                instance and the respective user's
+                                home directory if run as
+                                user.</para></listitem>

                         </varlistentry>
 
                         <varlistentry>
                         </varlistentry>
 
                         <varlistentry>


@@ -113,10 +117,10 @@
                                 <term><varname>Group=</varname></term>
 
                                 <listitem><para>Sets the Unix user
                                 <term><varname>Group=</varname></term>
 
                                 <listitem><para>Sets the Unix user

-                                resp. group the processes are executed
-                                as. Takes a single user resp. group
+                                or group that the processes are executed
+                                as, respectively. Takes a single user or group

                                 name or ID as argument. If no group is
                                 name or ID as argument. If no group is

-                                set the default group of the user is
+                                set, the default group of the user is

                                 chosen.</para></listitem>
                         </varlistentry>
 
                                 chosen.</para></listitem>
                         </varlistentry>
 


@@ -210,13 +214,15 @@
 
                                 <listitem><para>Sets the CPU
                                 scheduling priority for executed
 
                                 <listitem><para>Sets the CPU
                                 scheduling priority for executed

-                                processes. Takes an integer between 1
-                                (lowest priority) and 99 (highest
-                                priority). The available priority
+                                processes. The available priority

                                 range depends on the selected CPU
                                 range depends on the selected CPU

-                                scheduling policy (see above). See
-                                <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
-                                for details.</para></listitem>
+                                scheduling policy (see above). For
+                                real-time scheduling policies an
+                                integer between 1 (lowest priority)
+                                and 99 (highest priority) can be used.
+                                See <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
+                                for details.
+                                </para></listitem>

                         </varlistentry>
 
                         <varlistentry>
                         </varlistentry>
 
                         <varlistentry>


@@ -467,7 +473,7 @@
                         </varlistentry>
                         <varlistentry>
                                 <term><varname>TTYVTDisallocate=</varname></term>
                         </varlistentry>
                         <varlistentry>
                                 <term><varname>TTYVTDisallocate=</varname></term>

-                                <listitem><para>If the the terminal
+                                <listitem><para>If the terminal

                                 device specified with
                                 <varname>TTYPath=</varname> is a
                                 virtual console terminal try to
                                 device specified with
                                 <varname>TTYPath=</varname> is a
                                 virtual console terminal try to


@@ -551,7 +557,7 @@
                                 prefixes may be disabled with
                                 <varname>SyslogLevelPrefix=</varname>,
                                 see below. For details see
                                 prefixes may be disabled with
                                 <varname>SyslogLevelPrefix=</varname>,
                                 see below. For details see

-                                <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
+                                <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.

 
                                 Defaults to
                                 <option>info</option>.</para></listitem>
 
                                 Defaults to
                                 <option>info</option>.</para></listitem>


@@ -563,8 +569,9 @@
                                 argument. If true and
                                 <varname>StandardOutput=</varname> or
                                 <varname>StandardError=</varname> are
                                 argument. If true and
                                 <varname>StandardOutput=</varname> or
                                 <varname>StandardError=</varname> are

-                                set to <option>syslog</option> or
-                                <option>kmsg</option> log lines
+                                set to <option>syslog</option>,
+                                <option>kmsg</option> or
+                                <option>journal</option>, log lines

                                 written by the executed process that
                                 are prefixed with a log level will be
                                 passed on to syslog with this log
                                 written by the executed process that
                                 are prefixed with a log level will be
                                 passed on to syslog with this log


@@ -573,7 +580,7 @@
                                 these prefixes is disabled and the
                                 logged lines are passed on as-is. For
                                 details about this prefixing see
                                 these prefixes is disabled and the
                                 logged lines are passed on as-is. For
                                 details about this prefixing see

-                                <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
+                                <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.

                                 Defaults to true.</para></listitem>
                         </varlistentry>
 
                                 Defaults to true.</para></listitem>
                         </varlistentry>
 


@@ -581,16 +588,17 @@
                                 <term><varname>TimerSlackNSec=</varname></term>
                                 <listitem><para>Sets the timer slack
                                 in nanoseconds for the executed
                                 <term><varname>TimerSlackNSec=</varname></term>
                                 <listitem><para>Sets the timer slack
                                 in nanoseconds for the executed

-                                processes. The timer slack controls the
-                                accuracy of wake-ups triggered by
+                                processes. The timer slack controls
+                                the accuracy of wake-ups triggered by

                                 timers. See
                                 <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
                                 for more information. Note that in
                                 contrast to most other time span
                                 definitions this parameter takes an
                                 timers. See
                                 <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
                                 for more information. Note that in
                                 contrast to most other time span
                                 definitions this parameter takes an

-                                integer value in nano-seconds and does
-                                not understand any other
-                                units.</para></listitem>
+                                integer value in nano-seconds if no
+                                unit is specified. The usual time
+                                units are understood
+                                too.</para></listitem>

                         </varlistentry>
 
                         <varlistentry>
                         </varlistentry>
 
                         <varlistentry>


@@ -678,17 +686,17 @@
                                 is prefixed with ~ all but the listed
                                 capabilities will be included, the
                                 effect of the assignment
                                 is prefixed with ~ all but the listed
                                 capabilities will be included, the
                                 effect of the assignment

-                                inverted. Note that this option does
-                                not actually set or unset any
-                                capabilities in the effective,
-                                permitted or inherited capability
-                                sets. That's what
-                                <varname>Capabilities=</varname> is
-                                for. If this option is not used the
+                                inverted. Note that this option also
+                                effects the respective capabilities in
+                                the effective, permitted and
+                                inheritable capability sets, on top of
+                                what <varname>Capabilities=</varname>
+                                does. If this option is not used the

                                 capability bounding set is not
                                 modified on process execution, hence
                                 no limits on the capabilities of the
                                 capability bounding set is not
                                 modified on process execution, hence
                                 no limits on the capabilities of the

-                                process are enforced.</para></listitem>
+                                process are
+                                enforced.</para></listitem>

                         </varlistentry>
 
                         <varlistentry>
                         </varlistentry>
 
                         <varlistentry>


@@ -801,7 +809,7 @@
 
                                 <listitem><para>Set a specific control
                                 group attribute for executed
 
                                 <listitem><para>Set a specific control
                                 group attribute for executed

-                                processes, and (if needed) add the the
+                                processes, and (if needed) add the

                                 executed processes to a cgroup in the
                                 hierarchy of the controller the
                                 attribute belongs to. Takes two
                                 executed processes to a cgroup in the
                                 hierarchy of the controller the
                                 attribute belongs to. Takes two


@@ -863,8 +871,8 @@
                                 the value is suffixed with K, M, G or
                                 T the specified memory size is parsed
                                 as Kilobytes, Megabytes, Gigabytes,
                                 the value is suffixed with K, M, G or
                                 T the specified memory size is parsed
                                 as Kilobytes, Megabytes, Gigabytes,

-                                resp. Terabytes (to the base
-                                1024). This controls the
+                                or Terabytes (to the base
+                                1024), respectively. This controls the

                                 <literal>memory.limit_in_bytes</literal>
                                 and
                                 <literal>memory.soft_limit_in_bytes</literal>
                                 <literal>memory.limit_in_bytes</literal>
                                 and
                                 <literal>memory.soft_limit_in_bytes</literal>


@@ -884,9 +892,9 @@
                                 path (such as
                                 <filename>/dev/null</filename>)
                                 followed by a combination of r, w, m
                                 path (such as
                                 <filename>/dev/null</filename>)
                                 followed by a combination of r, w, m

-                                to control reading, writing resp.
+                                to control reading, writing, or

                                 creating of the specific device node
                                 creating of the specific device node

-                                by the unit. This controls the
+                                by the unit, respectively. This controls the

                                 <literal>devices.allow</literal>
                                 and
                                 <literal>devices.deny</literal>
                                 <literal>devices.allow</literal>
                                 and
                                 <literal>devices.deny</literal>


@@ -930,27 +938,27 @@
                                 <term><varname>BlockIOWriteBandwidth=</varname></term>
 
                                 <listitem><para>Set the per-device
                                 <term><varname>BlockIOWriteBandwidth=</varname></term>
 
                                 <listitem><para>Set the per-device

-                                overall block IO bandwith limit for
+                                overall block IO bandwidth limit for

                                 the executed processes. Takes a space
                                 separated pair of a file path and a
                                 the executed processes. Takes a space
                                 separated pair of a file path and a

-                                bandwith value (in bytes per second)
+                                bandwidth value (in bytes per second)

                                 to specify the device specific
                                 bandwidth. The file path may be
                                 specified as path to a block device
                                 node or as any other file in which
                                 case the backing block device of the
                                 file system of the file is determined.
                                 to specify the device specific
                                 bandwidth. The file path may be
                                 specified as path to a block device
                                 node or as any other file in which
                                 case the backing block device of the
                                 file system of the file is determined.

-                                If the bandwith is suffixed with K, M,
-                                G, or T the specified bandwith is
+                                If the bandwidth is suffixed with K, M,
+                                G, or T the specified bandwidth is

                                 parsed as Kilobytes, Megabytes,
                                 parsed as Kilobytes, Megabytes,

-                                Gigabytes, resp. Terabytes (Example:
+                                Gigabytes, or Terabytes, respectively (Example:

                                 "/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0
                                 5M"). This controls the
                                 <literal>blkio.read_bps_device</literal>
                                 and
                                 <literal>blkio.write_bps_device</literal>
                                 control group attributes. Use this
                                 "/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0
                                 5M"). This controls the
                                 <literal>blkio.read_bps_device</literal>
                                 and
                                 <literal>blkio.write_bps_device</literal>
                                 control group attributes. Use this

-                                option multiple times to set bandwith
+                                option multiple times to set bandwidth

                                 limits for multiple devices. For
                                 details about these control group
                                 attributes see <ulink
                                 limits for multiple devices. For
                                 details about these control group
                                 attributes see <ulink


@@ -1038,26 +1046,19 @@
                                 <option>shared</option>,
                                 <option>slave</option> or
                                 <option>private</option>, which
                                 <option>shared</option>,
                                 <option>slave</option> or
                                 <option>private</option>, which

-                                control whether namespaces set up with
-                                <varname>ReadWriteDirectories=</varname>,
-                                <varname>ReadOnlyDirectories=</varname>
-                                and
-                                <varname>InaccessibleDirectories=</varname>
-                                receive or propagate new mounts
-                                from/to the main namespace. See
-                                <citerefentry><refentrytitle>mount</refentrytitle><manvolnum>1</manvolnum></citerefentry>
-                                for details. Defaults to
-                                <option>shared</option>, i.e. the new
-                                namespace will both receive new mount
-                                points from the main namespace as well
-                                as propagate new mounts to
-                                it.</para></listitem>
+                                control whether the file system
+                                namespace set up for this unit's
+                                processes will receive or propagate
+                                new mounts. See
+                                <citerefentry><refentrytitle>mount</refentrytitle><manvolnum>2</manvolnum></citerefentry>
+                                for details. Default to
+                                <option>shared</option>.</para></listitem>

                         </varlistentry>
 
                         <varlistentry>
                                 <term><varname>UtmpIdentifier=</varname></term>
 
                         </varlistentry>
 
                         <varlistentry>
                                 <term><varname>UtmpIdentifier=</varname></term>
 

-                                <listitem><para>Takes a a four
+                                <listitem><para>Takes a four

                                 character identifier string for an
                                 utmp/wtmp entry for this service. This
                                 should only be set for services such
                                 character identifier string for an
                                 utmp/wtmp entry for this service. This
                                 should only be set for services such


@@ -1086,6 +1087,54 @@
                                 shell pipelines.</para></listitem>
                         </varlistentry>
 
                                 shell pipelines.</para></listitem>
                         </varlistentry>
 

+                        <varlistentry>
+                                <term><varname>NoNewPrivileges=</varname></term>
+
+                                <listitem><para>Takes a boolean
+                                argument. If true ensures that the
+                                service process and all its children
+                                can never gain new privileges. This
+                                option is more powerful than the respective
+                                secure bits flags (see above), as it
+                                also prohibits UID changes of any
+                                kind. This is the simplest, most
+                                effective way to ensure that a process
+                                and its children can never elevate
+                                privileges again.</para></listitem>
+                        </varlistentry>
+
+                        <varlistentry>
+                                <term><varname>SystemCallFilter=</varname></term>
+
+                                <listitem><para>Takes a space
+                                separated list of system call
+                                names. If this setting is used all
+                                system calls executed by the unit
+                                process except for the listed ones
+                                will result in immediate process
+                                termination with the SIGSYS signal
+                                (whitelisting). If the first character
+                                of the list is <literal>~</literal>
+                                the effect is inverted: only the
+                                listed system calls will result in
+                                immediate process termination
+                                (blacklisting). If this option is used
+                                <varname>NoNewPrivileges=yes</varname>
+                                is implied. This feature makes use of
+                                the Secure Computing Mode 2 interfaces
+                                of the kernel ('seccomp filtering')
+                                and is useful for enforcing a minimal
+                                sandboxing environment. Note that the
+                                <function>execve</function>,
+                                <function>rt_sigreturn</function>,
+                                <function>sigreturn</function>,
+                                <function>exit_group</function>,
+                                <function>exit</function> system calls
+                                are implicitly whitelisted and don't
+                                need to be listed
+                                explicitly.</para></listitem>
+                        </varlistentry>
+

                 </variablelist>
         </refsect1>
 
                 </variablelist>
         </refsect1>
 


@@ -1099,7 +1148,8 @@
                           <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
                           <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
                           <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
                           <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
                           <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
                           <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,

-                          <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+                          <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+                          <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>

                   </para>
         </refsect1>
 
                   </para>
         </refsect1>