X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=man%2Fsystemd.exec.xml;h=230c4a31f7d3991da64222e3a8a3a76e940690cc;hp=d6ac5aed89d6828e6746facee8eda4c0e432a515;hb=8ab49c12dcab02d9d83e63a93676d4fc8f709516;hpb=afe4bfe2c1ed28a3e75c627edf458d2f40ff16f8
diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index d6ac5aed8..230c4a31f 100644
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -50,29 +50,32 @@
systemd.service,
systemd.socket,
- systemd.mount
+ systemd.mount,
+ systemd.swapDescription
- Unit configuration files for services, sockets
- and mount points share a subset of configuration
- options which define the execution environment of
- spawned processes.
+ Unit configuration files for services, sockets,
+ mount points and swap devices share a subset of
+ configuration options which define the execution
+ environment of spawned processes.This man page lists the configuration options
- shared by these three unit types. See
+ shared by these four unit types. See
systemd.unit5
for the common options of all unit configuration
files, and
- systemd.service5, systemd.socket5
+ systemd.service5,
+ systemd.socket5,
+ systemd.swap5
and
systemd.mount5
for more information on the specific unit
configuration files. The execution specific
configuration options are configured in the [Service],
- [Socket] resp. [Mount] section, depending on the unit
+ [Socket], [Mount] resp. [Swap] section, depending on the unit
type.
@@ -248,7 +251,7 @@
octal notation. See
umask2
for details. Defaults to
- 0002.
+ 0022.
@@ -276,12 +279,27 @@
assignments. Empty lines and lines
starting with ; or # will be ignored,
which may be used for commenting. The
+ parser strips leading and
+ trailing whitespace from the values
+ of assignments, unless you use
+ double quotes (").
+ The
argument passed should be an absolute
file name, optionally prefixed with
"-", which indicates that if the file
does not exist it won't be read and no
error or warning message is
- logged.
+ logged. The files listed with this
+ directive will be read shortly before
+ the process is executed. Settings from
+ these files override settings made
+ with
+ Environment=. If
+ the same variable is set twice from
+ these files the files will be read in
+ the order they are specified and the
+ later setting will override the
+ earlier setting.
@@ -347,7 +365,9 @@
,
,
,
- or
+ ,
+ ,
+ or
. If set to
the file
descriptor of standard input is
@@ -368,16 +388,26 @@
terminal.
connects standard output to the
syslog3
- system logger.
+ system syslog
+ service.
connects it with the kernel log buffer
which is accessible via
- dmesg1.
- connects standard output to a socket
- from socket activation, semantics are
+ dmesg1.
+ and work
+ similarly but copy the output to the
+ system console as
+ well. connects
+ standard output to a socket from
+ socket activation, semantics are
similar to the respective option of
StandardInput=.
- This setting defaults to
- .
+ This setting defaults to the value set
+ with
+
+ in
+ systemd.conf5,
+ which defaults to
+ .
StandardError=
@@ -391,7 +421,11 @@
the file
descriptor used for standard output is
duplicated for standard error. This
- setting defaults to
+ setting defaults to the value set with
+
+ in
+ systemd.conf5,
+ which defaults to
.
@@ -403,7 +437,37 @@
/dev/console.
- SyslogIdentifer=
+ TTYReset=
+ Reset the terminal
+ device specified with
+ TTYPath= before and
+ after execution. Defaults to
+ no.
+
+
+ TTYVHangup=
+ Disconnect all clients
+ which have opened the terminal device
+ specified with
+ TTYPath=
+ before and after execution. Defaults
+ to
+ no.
+
+
+ TTYVTDisallocate=
+ If the the terminal
+ device specified with
+ TTYPath= is a
+ virtual console terminal try to
+ deallocate the TTY before and after
+ execution. This ensures that the
+ screen and scrollback buffer is
+ cleared. Defaults to
+ no.
+
+
+ SyslogIdentifier=Sets the process name
to prefix log lines sent to syslog or
the kernel log buffer with. If not set
@@ -539,7 +603,10 @@
various resource limits for executed
processes. See
setrlimit2
- for details.
+ for details. Use the string
+ infinity to
+ configure no limit on a specific
+ resource.
@@ -578,16 +645,34 @@
- Capabilities=
- Controls the
+ CapabilityBoundingSet=
+
+ Controls which
+ capabilities to include in the
+ capability bounding set for the
+ executed process. See
capabilities7
- set for the executed process. Take a
- capability string as described in
- cap_from_text3.
- Note that this capability set is
- usually influenced by the capabilities
- attached to the executed
- file.
+ for details. Takes a whitespace
+ separated list of capability names as
+ read by
+ cap_from_name3.
+ Capabilities listed will be included
+ in the bounding set, all others are
+ removed. If the list of capabilities
+ is prefixed with ~ all but the listed
+ capabilities will be included, the
+ effect of the assignment
+ inverted. Note that this option does
+ not actually set or unset any
+ capabilities in the effective,
+ permitted or inherited capability
+ sets. That's what
+ Capabilities= is
+ for. If this option is not used the
+ capability bounding set is not
+ modified on process execution, hence
+ no limits on the capabilities of the
+ process are enforced.
@@ -600,22 +685,27 @@
,
,
,
- and/or
- .
+ and/or
+ .
- CapabilityBoundingSetDrop=
-
+ Capabilities=Controls the
- capability bounding set drop set for
- the executed process. See
capabilities7
- for details. Takes a list of
- capability names as read by
- cap_from_name3.
-
+ set for the executed process. Take a
+ capability string describing the
+ effective, permitted and inherited
+ capability sets as documented in
+ cap_from_text3.
+ Note that these capability sets are
+ usually influenced by the capabilities
+ attached to the executed file. Due to
+ that
+ CapabilityBoundingSet=
+ is probably the much more useful
+ setting.
@@ -631,30 +721,211 @@
where "cpu" identifies the kernel
control group controller used, and
/foo/bar is the
- control group path. The controller name
- and ":" may be omitted in which case
- the named systemd control group
+ control group path. The controller
+ name and ":" may be omitted in which
+ case the named systemd control group
hierarchy is implied. Alternatively,
the path and ":" may be omitted, in
which case the default control group
path for this unit is implied. This
option may be used to place executed
processes in arbitrary groups in
- arbitrary hierachies -- which can be
- configured externally with additional execution limits. By default
- systemd will place all executed
- processes in separate per-unit control
- groups (named after the unit) in the
- systemd named hierarchy. Since every
- process can be in one group per
- hierarchy only overriding the control group
- path in the named systemd hierarchy
- will disable automatic placement in
- the default group. For details about control
- groups see cgroups.txt.
+
+ ControlGroupModify=
+ Takes a boolean
+ argument. If true, the control groups
+ created for this unit will be owned by
+ the user specified with
+ User= (and the
+ appropriate group), and he/she can create
+ subgroups as well as add processes to
+ the group.
+
+
+
+ ControlGroupAttribute=
+
+ Set a specific control
+ group attribute for executed
+ processes, and (if needed) add the the
+ executed processes to a cgroup in the
+ hierarchy of the controller the
+ attribute belongs to. Takes two
+ space-separated arguments: the
+ attribute name (syntax is
+ cpu.shares where
+ cpu refers to a
+ specific controller and
+ shares to the
+ attribute name), and the attribute
+ value. Example:
+ ControlGroupAttribute=cpu.shares
+ 512. If this option is used
+ for an attribute that belongs to a
+ kernel controller hierarchy the unit
+ is not already configured to be added
+ to (for example via the
+ ControlGroup=
+ option) then the unit will be added to
+ the controller and the default unit
+ cgroup path is implied. Thus, using
+ ControlGroupAttribute=
+ is in most case sufficient to make use
+ of control group enforcements,
+ explicit
+ ControlGroup= are
+ only necessary in case the implied
+ default control group path for a
+ service is not desirable. For details
+ about control group attributes see
+ cgroups.txt. This
+ option may appear more than once, in
+ order to set multiple control group
+ attributes.
+
+
+
+ CPUShares=
+
+ Assign the specified
+ overall CPU time shares to the
+ processes executed. Takes an integer
+ value. This controls the
+ cpu.shares control
+ group attribute, which defaults to
+ 1024. For details about this control
+ group attribute see sched-design-CFS.txt.
+
+
+
+ MemoryLimit=
+ MemorySoftLimit=
+
+ Limit the overall memory usage
+ of the executed processes to a certain
+ size. Takes a memory size in bytes. If
+ the value is suffixed with K, M, G or
+ T the specified memory size is parsed
+ as Kilobytes, Megabytes, Gigabytes,
+ resp. Terabytes (to the base
+ 1024). This controls the
+ memory.limit_in_bytes
+ and
+ memory.soft_limit_in_bytes
+ control group attributes. For details
+ about these control group attributes
+ see memory.txt.
+
+
+
+ DeviceAllow=
+ DeviceDeny=
+
+ Control access to
+ specific device nodes by the executed processes. Takes two
+ space separated strings: a device node
+ path (such as
+ /dev/null)
+ followed by a combination of r, w, m
+ to control reading, writing resp.
+ creating of the specific device node
+ by the unit. This controls the
+ devices.allow
+ and
+ devices.deny
+ control group attributes. For details
+ about these control group attributes
+ see devices.txt.
+
+
+
+ BlockIOWeight=
+
+ Set the default or
+ per-device overall block IO weight
+ value for the executed
+ processes. Takes either a single
+ weight value (between 10 and 1000) to
+ set the default block IO weight, or a
+ space separated pair of a file path
+ and a weight value to specify the
+ device specific weight value (Example:
+ "/dev/sda 500"). The file path may be
+ specified as path to a block device
+ node or as any other file in which
+ case the backing block device of the
+ file system of the file is
+ determined. This controls the
+ blkio.weight and
+ blkio.weight_device
+ control group attributes, which
+ default to 1000. Use this option
+ multiple times to set weights for
+ multiple devices. For details about
+ these control group attributes see
+ blkio-controller.txt.
+
+
+
+ BlockIOReadBandwidth=
+ BlockIOWriteBandwidth=
+
+ Set the per-device
+ overall block IO bandwith limit for
+ the executed processes. Takes a space
+ separated pair of a file path and a
+ bandwith value (in bytes per second)
+ to specify the device specific
+ bandwidth. The file path may be
+ specified as path to a block device
+ node or as any other file in which
+ case the backing block device of the
+ file system of the file is determined.
+ If the bandwith is suffixed with K, M,
+ G, or T the specified bandwith is
+ parsed as Kilobytes, Megabytes,
+ Gigabytes, resp. Terabytes (Example:
+ "/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0
+ 5M"). This controls the
+ blkio.read_bps_device
+ and
+ blkio.write_bps_device
+ control group attributes. Use this
+ option multiple times to set bandwith
+ limits for multiple devices. For
+ details about these control group
+ attributes see blkio-controller.txt.
+
+
ReadWriteDirectories=ReadOnlyDirectories=
@@ -678,7 +949,7 @@
usual file access controls would
permit this. Directories listed in
InaccessibleDirectories=
- will be made inaccesible for processes
+ will be made inaccessible for processes
inside the namespace. Note that
restricting access with these options
does not extend to submounts of a
@@ -696,9 +967,9 @@
PrivateTmp=Takes a boolean
- argument. If true sets up a new
- namespace for the executed processes
- and mounts a private
+ argument. If true sets up a new file
+ system namespace for the executed
+ processes and mounts a private
/tmp directory
inside it, that is not shared by
processes outside of the
@@ -707,7 +978,25 @@
process, but makes sharing between
processes via
/tmp
- impossible. Defaults to false.
+ impossible. Defaults to
+ false.
+
+
+
+ PrivateNetwork=
+
+ Takes a boolean
+ argument. If true sets up a new
+ network namespace for the executed
+ processes and configures only the
+ loopback network device
+ lo inside it. No
+ other network devices will be
+ available to the executed process.
+ This is useful to securely turn off
+ network access by the executed
+ process. Defaults to
+ false.
@@ -766,6 +1055,7 @@
systemd.unit5,
systemd.service5,
systemd.socket5,
+ systemd.swap5,
systemd.mount5