for details. Takes a whitespace
separated list of capability names as
read by
- <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
+ <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
+ e.g. <literal>CAP_SYS_ADMIN
+ CAP_DAC_OVERRIDE
+ CAP_SYS_PTRACE</literal>.
Capabilities listed will be included
in the bounding set, all others are
removed. If the list of capabilities
- is prefixed with ~ all but the listed
- capabilities will be included, the
- effect of the assignment
- inverted. Note that this option also
- effects the respective capabilities in
- the effective, permitted and
- inheritable capability sets, on top of
- what <varname>Capabilities=</varname>
+ is prefixed with <literal>~</literal>
+ all but the listed capabilities will
+ be included, the effect of the
+ assignment inverted. Note that this
+ option also affects the respective
+ capabilities in the effective,
+ permitted and inheritable capability
+ sets, on top of what
+ <varname>Capabilities=</varname>
does. If this option is not used the
capability bounding set is not
modified on process execution, hence
no limits on the capabilities of the
process are enforced. This option may
appear more than once in which case
- the bounding sets are merged. If the empty
- string is assigned to this option the
- bounding set is reset, and all prior
- settings have no
- effect.</para></listitem>
+ the bounding sets are merged. If the
+ empty string is assigned to this
+ option the bounding set is reset to
+ the empty capability set, and all
+ prior settings have no effect. If set
+ to <literal>~</literal> (without any
+ further argument) the bounding set is
+ reset to the full set of available
+ capabilities, also undoing any
+ previous settings.</para></listitem>
</varlistentry>
<varlistentry>
space-separated list of cgroup
identifiers. A cgroup identifier is
formatted like
- <filename>cpu:/foo/bar</filename>,
+ <filename noindex='true'>cpu:/foo/bar</filename>,
where "cpu" indicates the kernel
control group controller used, and
- <filename>/foo/bar</filename> is the
+ <filename noindex='true'>/foo/bar</filename> is the
control group path. The controller
name and ":" may be omitted in which
case the named systemd control group
in specific paths in specific kernel
controller hierarchies. It is not
recommended to manipulate the service
- control group path in the systemd
- named hierarchy. For details about
+ control group path in the private
+ systemd named hierarchy
+ (i.e. <literal>name=systemd</literal>),
+ and doing this might result in
+ undefined behaviour. For details about
control groups see <ulink
url="http://www.kernel.org/doc/Documentation/cgroups/cgroups.txt">cgroups.txt</ulink>.</para>
<term><varname>InaccessibleDirectories=</varname></term>
<listitem><para>Sets up a new
- file-system name space for executed
+ file system namespace for executed
processes. These options may be used
to limit access a process might have
- to the main file-system
+ to the main file system
hierarchy. Each setting takes a
space-separated list of absolute
directory paths. Directories listed in
processes via
<filename>/tmp</filename> or
<filename>/var/tmp</filename>
- impossible. Defaults to
+ impossible. All temporary data created
+ by service will be removed after service
+ is stopped. Defaults to
false.</para></listitem>
</varlistentry>
~ianmdlvl / elogind.git / blobdiff