1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <?xml-stylesheet type="text/xsl" href="http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl"?>
3 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
4 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
7 This file is part of systemd.
9 Copyright 2010 Lennart Poettering
11 systemd is free software; you can redistribute it and/or modify it
12 under the terms of the GNU Lesser General Public License as published by
13 the Free Software Foundation; either version 2.1 of the License, or
14 (at your option) any later version.
16 systemd is distributed in the hope that it will be useful, but
17 WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
19 Lesser General Public License for more details.
21 You should have received a copy of the GNU Lesser General Public License
22 along with systemd; If not, see <http://www.gnu.org/licenses/>.
25 <refentry id="systemd.exec">
27 <title>systemd.exec</title>
28 <productname>systemd</productname>
32 <contrib>Developer</contrib>
33 <firstname>Lennart</firstname>
34 <surname>Poettering</surname>
35 <email>lennart@poettering.net</email>
41 <refentrytitle>systemd.exec</refentrytitle>
42 <manvolnum>5</manvolnum>
46 <refname>systemd.exec</refname>
47 <refpurpose>Execution environment configuration</refpurpose>
51 <para><filename><replaceable>service</replaceable>.service</filename>,
52 <filename><replaceable>socket</replaceable>.socket</filename>,
53 <filename><replaceable>mount</replaceable>.mount</filename>,
54 <filename><replaceable>swap</replaceable>.swap</filename></para>
58 <title>Description</title>
60 <para>Unit configuration files for services, sockets,
61 mount points and swap devices share a subset of
62 configuration options which define the execution
63 environment of spawned processes.</para>
65 <para>This man page lists the configuration options
66 shared by these four unit types. See
67 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
68 for the common options of all unit configuration
70 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
71 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
72 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>
74 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>
75 for more information on the specific unit
76 configuration files. The execution specific
77 configuration options are configured in the [Service],
78 [Socket], [Mount], or [Swap] sections, depending on the unit
83 <title>Options</title>
85 <variablelist class='unit-directives'>
88 <term><varname>WorkingDirectory=</varname></term>
90 <listitem><para>Takes an absolute
91 directory path. Sets the working
92 directory for executed processes. If
93 not set defaults to the root directory
94 when systemd is running as a system
95 instance and the respective user's
96 home directory if run as
97 user.</para></listitem>
101 <term><varname>RootDirectory=</varname></term>
103 <listitem><para>Takes an absolute
104 directory path. Sets the root
105 directory for executed processes, with
107 <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry>
108 system call. If this is used it must
109 be ensured that the process and all
110 its auxiliary files are available in
111 the <function>chroot()</function>
112 jail.</para></listitem>
116 <term><varname>User=</varname></term>
117 <term><varname>Group=</varname></term>
119 <listitem><para>Sets the Unix user
120 or group that the processes are executed
121 as, respectively. Takes a single user or group
122 name or ID as argument. If no group is
123 set, the default group of the user is
124 chosen.</para></listitem>
128 <term><varname>SupplementaryGroups=</varname></term>
130 <listitem><para>Sets the supplementary
131 Unix groups the processes are executed
132 as. This takes a space separated list
133 of group names or IDs. This option may
134 be specified more than once in which
135 case all listed groups are set as
136 supplementary groups. When the empty
137 string is assigned the list of
138 supplementary groups is reset, and all
139 assignments prior to this one will
140 have no effect. In any way, this
141 option does not override, but extends
142 the list of supplementary groups
143 configured in the system group
145 user.</para></listitem>
149 <term><varname>Nice=</varname></term>
151 <listitem><para>Sets the default nice
152 level (scheduling priority) for
153 executed processes. Takes an integer
154 between -20 (highest priority) and 19
155 (lowest priority). See
156 <citerefentry><refentrytitle>setpriority</refentrytitle><manvolnum>2</manvolnum></citerefentry>
157 for details.</para></listitem>
161 <term><varname>OOMScoreAdjust=</varname></term>
163 <listitem><para>Sets the adjustment
164 level for the Out-Of-Memory killer for
165 executed processes. Takes an integer
166 between -1000 (to disable OOM killing
167 for this process) and 1000 (to make
168 killing of this process under memory
169 pressure very likely). See <ulink
170 url="http://www.kernel.org/doc/Documentation/filesystems/proc.txt">proc.txt</ulink>
171 for details.</para></listitem>
175 <term><varname>IOSchedulingClass=</varname></term>
177 <listitem><para>Sets the IO scheduling
178 class for executed processes. Takes an
179 integer between 0 and 3 or one of the
180 strings <option>none</option>,
181 <option>realtime</option>,
182 <option>best-effort</option> or
183 <option>idle</option>. See
184 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
185 for details.</para></listitem>
189 <term><varname>IOSchedulingPriority=</varname></term>
191 <listitem><para>Sets the IO scheduling
192 priority for executed processes. Takes
193 an integer between 0 (highest
194 priority) and 7 (lowest priority). The
195 available priorities depend on the
196 selected IO scheduling class (see
198 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
199 for details.</para></listitem>
203 <term><varname>CPUSchedulingPolicy=</varname></term>
205 <listitem><para>Sets the CPU
206 scheduling policy for executed
207 processes. Takes one of
208 <option>other</option>,
209 <option>batch</option>,
210 <option>idle</option>,
211 <option>fifo</option> or
212 <option>rr</option>. See
213 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
214 for details.</para></listitem>
218 <term><varname>CPUSchedulingPriority=</varname></term>
220 <listitem><para>Sets the CPU
221 scheduling priority for executed
222 processes. The available priority
223 range depends on the selected CPU
224 scheduling policy (see above). For
225 real-time scheduling policies an
226 integer between 1 (lowest priority)
227 and 99 (highest priority) can be used.
228 See <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
234 <term><varname>CPUSchedulingResetOnFork=</varname></term>
236 <listitem><para>Takes a boolean
237 argument. If true elevated CPU
238 scheduling priorities and policies
239 will be reset when the executed
240 processes fork, and can hence not leak
241 into child processes. See
242 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
243 for details. Defaults to false.</para></listitem>
247 <term><varname>CPUAffinity=</varname></term>
249 <listitem><para>Controls the CPU
250 affinity of the executed
251 processes. Takes a space-separated
252 list of CPU indexes. This option may
253 be specified more than once in which
254 case the specificed CPU affinity masks
255 are merged. If the empty string is
256 assigned the mask is reset, all
257 assignments prior to this will have no
259 <citerefentry><refentrytitle>sched_setaffinity</refentrytitle><manvolnum>2</manvolnum></citerefentry>
260 for details.</para></listitem>
264 <term><varname>UMask=</varname></term>
266 <listitem><para>Controls the file mode
267 creation mask. Takes an access mode in
269 <citerefentry><refentrytitle>umask</refentrytitle><manvolnum>2</manvolnum></citerefentry>
270 for details. Defaults to
271 0022.</para></listitem>
275 <term><varname>Environment=</varname></term>
277 <listitem><para>Sets environment
278 variables for executed
279 processes. Takes a space-separated
280 list of variable assignments. This
281 option may be specified more than once
282 in which case all listed variables
283 will be set. If the same variable is
284 set twice the later setting will
285 override the earlier setting. If the
286 empty string is assigned to this
287 option the list of environment
288 variables is reset, all prior
289 assignments have no effect.
290 Variable expansion is not performed
291 inside the strings, however, specifier
292 expansion is possible. $ character has
294 If you need to assign a value containing spaces
295 to a variable, use double quotes (")
296 for the assignment.</para>
299 <programlisting>Environment="VAR1=word1 word2" VAR2=word3 "VAR3=word 5 6"</programlisting>
300 gives three variables <literal>VAR1</literal>,
301 <literal>VAR2</literal>, <literal>VAR3</literal>.
306 <citerefentry><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>
307 for details about environment variables.</para></listitem>
310 <term><varname>EnvironmentFile=</varname></term>
311 <listitem><para>Similar to
312 <varname>Environment=</varname> but
313 reads the environment variables from a
314 text file. The text file should
315 contain new-line separated variable
316 assignments. Empty lines and lines
317 starting with ; or # will be ignored,
318 which may be used for commenting. A line
319 ending with a backslash will be concatenated
320 with the following one, allowing multiline variable
321 definitions. The parser strips leading
322 and trailing whitespace from the values
323 of assignments, unless you use
324 double quotes (").</para>
326 <para>The argument passed should be an
327 absolute file name or wildcard
328 expression, optionally prefixed with
329 "-", which indicates that if the file
330 does not exist it won't be read and no
331 error or warning message is logged.
332 This option may be specified more than
333 once in which case all specified files
334 are read. If the empty string is
335 assigned to this option the list of
336 file to read is reset, all prior
337 assignments have no effect.</para>
339 <para>The files listed with this
340 directive will be read shortly before
341 the process is executed. Settings from
342 these files override settings made
344 <varname>Environment=</varname>. If
345 the same variable is set twice from
346 these files the files will be read in
347 the order they are specified and the
348 later setting will override the
349 earlier setting.</para></listitem>
353 <term><varname>StandardInput=</varname></term>
354 <listitem><para>Controls where file
355 descriptor 0 (STDIN) of the executed
356 processes is connected to. Takes one
357 of <option>null</option>,
358 <option>tty</option>,
359 <option>tty-force</option>,
360 <option>tty-fail</option> or
361 <option>socket</option>. If
362 <option>null</option> is selected
363 standard input will be connected to
364 <filename>/dev/null</filename>,
365 i.e. all read attempts by the process
366 will result in immediate EOF. If
367 <option>tty</option> is selected
368 standard input is connected to a TTY
370 <varname>TTYPath=</varname>, see
371 below) and the executed process
372 becomes the controlling process of the
373 terminal. If the terminal is already
374 being controlled by another process the
375 executed process waits until the current
376 controlling process releases the
378 <option>tty-force</option>
379 is similar to <option>tty</option>,
380 but the executed process is forcefully
381 and immediately made the controlling
382 process of the terminal, potentially
383 removing previous controlling
385 terminal. <option>tty-fail</option> is
386 similar to <option>tty</option> but if
387 the terminal already has a controlling
388 process start-up of the executed
390 <option>socket</option> option is only
391 valid in socket-activated services,
392 and only when the socket configuration
394 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>
395 for details) specifies a single socket
396 only. If this option is set standard
397 input will be connected to the socket
398 the service was activated from, which
399 is primarily useful for compatibility
400 with daemons designed for use with the
402 <citerefentry><refentrytitle>inetd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
403 daemon. This setting defaults to
404 <option>null</option>.</para></listitem>
407 <term><varname>StandardOutput=</varname></term>
408 <listitem><para>Controls where file
409 descriptor 1 (STDOUT) of the executed
410 processes is connected to. Takes one
411 of <option>inherit</option>,
412 <option>null</option>,
413 <option>tty</option>,
414 <option>syslog</option>,
415 <option>kmsg</option>,
416 <option>journal</option>,
417 <option>syslog+console</option>,
418 <option>kmsg+console</option>,
419 <option>journal+console</option> or
420 <option>socket</option>. If set to
421 <option>inherit</option> the file
422 descriptor of standard input is
423 duplicated for standard output. If set
424 to <option>null</option> standard
425 output will be connected to
426 <filename>/dev/null</filename>,
427 i.e. everything written to it will be
428 lost. If set to <option>tty</option>
429 standard output will be connected to a
430 tty (as configured via
431 <varname>TTYPath=</varname>, see
432 below). If the TTY is used for output
433 only the executed process will not
434 become the controlling process of the
435 terminal, and will not fail or wait
436 for other processes to release the
437 terminal. <option>syslog</option>
438 connects standard output to the
439 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
441 service. <option>kmsg</option>
442 connects it with the kernel log buffer
443 which is accessible via
444 <citerefentry><refentrytitle>dmesg</refentrytitle><manvolnum>1</manvolnum></citerefentry>. <option>journal</option>
445 connects it with the journal which is
447 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
448 (Note that everything that is written
449 to syslog or kmsg is implicitly stored
450 in the journal as well, those options
451 are hence supersets of this
452 one). <option>syslog+console</option>,
453 <option>journal+console</option> and
454 <option>kmsg+console</option> work
455 similarly but copy the output to the
457 well. <option>socket</option> connects
458 standard output to a socket from
459 socket activation, semantics are
460 similar to the respective option of
461 <varname>StandardInput=</varname>.
462 This setting defaults to the value set
464 <option>DefaultStandardOutput=</option>
466 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
468 <option>journal</option>.</para></listitem>
471 <term><varname>StandardError=</varname></term>
472 <listitem><para>Controls where file
473 descriptor 2 (STDERR) of the executed
474 processes is connected to. The
475 available options are identical to
477 <varname>StandardOutput=</varname>,
478 with one exception: if set to
479 <option>inherit</option> the file
480 descriptor used for standard output is
481 duplicated for standard error. This
482 setting defaults to the value set with
483 <option>DefaultStandardError=</option>
485 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
487 <option>inherit</option>.</para></listitem>
490 <term><varname>TTYPath=</varname></term>
491 <listitem><para>Sets the terminal
492 device node to use if standard input,
493 output or stderr are connected to a
494 TTY (see above). Defaults to
495 <filename>/dev/console</filename>.</para></listitem>
498 <term><varname>TTYReset=</varname></term>
499 <listitem><para>Reset the terminal
500 device specified with
501 <varname>TTYPath=</varname> before and
502 after execution. Defaults to
503 <literal>no</literal>.</para></listitem>
506 <term><varname>TTYVHangup=</varname></term>
507 <listitem><para>Disconnect all clients
508 which have opened the terminal device
510 <varname>TTYPath=</varname>
511 before and after execution. Defaults
513 <literal>no</literal>.</para></listitem>
516 <term><varname>TTYVTDisallocate=</varname></term>
517 <listitem><para>If the terminal
518 device specified with
519 <varname>TTYPath=</varname> is a
520 virtual console terminal try to
521 deallocate the TTY before and after
522 execution. This ensures that the
523 screen and scrollback buffer is
525 <literal>no</literal>.</para></listitem>
528 <term><varname>SyslogIdentifier=</varname></term>
529 <listitem><para>Sets the process name
530 to prefix log lines sent to syslog or
531 the kernel log buffer with. If not set
532 defaults to the process name of the
533 executed process. This option is only
535 <varname>StandardOutput=</varname> or
536 <varname>StandardError=</varname> are
537 set to <option>syslog</option> or
538 <option>kmsg</option>.</para></listitem>
541 <term><varname>SyslogFacility=</varname></term>
542 <listitem><para>Sets the syslog
543 facility to use when logging to
544 syslog. One of <option>kern</option>,
545 <option>user</option>,
546 <option>mail</option>,
547 <option>daemon</option>,
548 <option>auth</option>,
549 <option>syslog</option>,
550 <option>lpr</option>,
551 <option>news</option>,
552 <option>uucp</option>,
553 <option>cron</option>,
554 <option>authpriv</option>,
555 <option>ftp</option>,
556 <option>local0</option>,
557 <option>local1</option>,
558 <option>local2</option>,
559 <option>local3</option>,
560 <option>local4</option>,
561 <option>local5</option>,
562 <option>local6</option> or
563 <option>local7</option>. See
564 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
565 for details. This option is only
567 <varname>StandardOutput=</varname> or
568 <varname>StandardError=</varname> are
569 set to <option>syslog</option>.
571 <option>daemon</option>.</para></listitem>
574 <term><varname>SyslogLevel=</varname></term>
575 <listitem><para>Default syslog level
576 to use when logging to syslog or the
577 kernel log buffer. One of
578 <option>emerg</option>,
579 <option>alert</option>,
580 <option>crit</option>,
581 <option>err</option>,
582 <option>warning</option>,
583 <option>notice</option>,
584 <option>info</option>,
585 <option>debug</option>. See
586 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
587 for details. This option is only
589 <varname>StandardOutput=</varname> or
590 <varname>StandardError=</varname> are
591 set to <option>syslog</option> or
592 <option>kmsg</option>. Note that
593 individual lines output by the daemon
594 might be prefixed with a different log
595 level which can be used to override
596 the default log level specified
597 here. The interpretation of these
598 prefixes may be disabled with
599 <varname>SyslogLevelPrefix=</varname>,
600 see below. For details see
601 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
604 <option>info</option>.</para></listitem>
608 <term><varname>SyslogLevelPrefix=</varname></term>
609 <listitem><para>Takes a boolean
610 argument. If true and
611 <varname>StandardOutput=</varname> or
612 <varname>StandardError=</varname> are
613 set to <option>syslog</option>,
614 <option>kmsg</option> or
615 <option>journal</option>, log lines
616 written by the executed process that
617 are prefixed with a log level will be
618 passed on to syslog with this log
619 level set but the prefix removed. If
620 set to false, the interpretation of
621 these prefixes is disabled and the
622 logged lines are passed on as-is. For
623 details about this prefixing see
624 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
625 Defaults to true.</para></listitem>
629 <term><varname>TimerSlackNSec=</varname></term>
630 <listitem><para>Sets the timer slack
631 in nanoseconds for the executed
632 processes. The timer slack controls
633 the accuracy of wake-ups triggered by
635 <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
636 for more information. Note that in
637 contrast to most other time span
638 definitions this parameter takes an
639 integer value in nano-seconds if no
640 unit is specified. The usual time
642 too.</para></listitem>
646 <term><varname>LimitCPU=</varname></term>
647 <term><varname>LimitFSIZE=</varname></term>
648 <term><varname>LimitDATA=</varname></term>
649 <term><varname>LimitSTACK=</varname></term>
650 <term><varname>LimitCORE=</varname></term>
651 <term><varname>LimitRSS=</varname></term>
652 <term><varname>LimitNOFILE=</varname></term>
653 <term><varname>LimitAS=</varname></term>
654 <term><varname>LimitNPROC=</varname></term>
655 <term><varname>LimitMEMLOCK=</varname></term>
656 <term><varname>LimitLOCKS=</varname></term>
657 <term><varname>LimitSIGPENDING=</varname></term>
658 <term><varname>LimitMSGQUEUE=</varname></term>
659 <term><varname>LimitNICE=</varname></term>
660 <term><varname>LimitRTPRIO=</varname></term>
661 <term><varname>LimitRTTIME=</varname></term>
662 <listitem><para>These settings control
663 various resource limits for executed
665 <citerefentry><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry>
666 for details. Use the string
667 <varname>infinity</varname> to
668 configure no limit on a specific
669 resource.</para></listitem>
673 <term><varname>PAMName=</varname></term>
674 <listitem><para>Sets the PAM service
675 name to set up a session as. If set
676 the executed process will be
677 registered as a PAM session under the
678 specified service name. This is only
679 useful in conjunction with the
680 <varname>User=</varname> setting. If
681 not set no PAM session will be opened
682 for the executed processes. See
683 <citerefentry><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>
684 for details.</para></listitem>
688 <term><varname>TCPWrapName=</varname></term>
689 <listitem><para>If this is a
690 socket-activated service this sets the
691 tcpwrap service name to check the
692 permission for the current connection
693 with. This is only useful in
694 conjunction with socket-activated
695 services, and stream sockets (TCP) in
696 particular. It has no effect on other
697 socket types (e.g. datagram/UDP) and
698 on processes unrelated to socket-based
699 activation. If the tcpwrap
700 verification fails daemon start-up
701 will fail and the connection is
703 <citerefentry><refentrytitle>tcpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
704 for details. Note that this option may
705 be used to do access control checks
706 only. Shell commands and commands
708 <citerefentry><refentrytitle>hosts_options</refentrytitle><manvolnum>5</manvolnum></citerefentry>
709 are not supported.</para></listitem>
713 <term><varname>CapabilityBoundingSet=</varname></term>
715 <listitem><para>Controls which
716 capabilities to include in the
717 capability bounding set for the
718 executed process. See
719 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
720 for details. Takes a whitespace
721 separated list of capability names as
723 <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
724 e.g. <constant>CAP_SYS_ADMIN</constant>,
725 <constant>CAP_DAC_OVERRIDE</constant>,
726 <constant>CAP_SYS_PTRACE</constant>.
727 Capabilities listed will be included
728 in the bounding set, all others are
729 removed. If the list of capabilities
730 is prefixed with <literal>~</literal>
731 all but the listed capabilities will
732 be included, the effect of the
733 assignment inverted. Note that this
734 option also affects the respective
735 capabilities in the effective,
736 permitted and inheritable capability
738 <varname>Capabilities=</varname>
739 does. If this option is not used the
740 capability bounding set is not
741 modified on process execution, hence
742 no limits on the capabilities of the
743 process are enforced. This option may
744 appear more than once in which case
745 the bounding sets are merged. If the
746 empty string is assigned to this
747 option the bounding set is reset to
748 the empty capability set, and all
749 prior settings have no effect. If set
750 to <literal>~</literal> (without any
751 further argument) the bounding set is
752 reset to the full set of available
753 capabilities, also undoing any
754 previous settings.</para></listitem>
758 <term><varname>SecureBits=</varname></term>
759 <listitem><para>Controls the secure
760 bits set for the executed process. See
761 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
762 for details. Takes a list of strings:
763 <option>keep-caps</option>,
764 <option>keep-caps-locked</option>,
765 <option>no-setuid-fixup</option>,
766 <option>no-setuid-fixup-locked</option>,
767 <option>noroot</option> and/or
768 <option>noroot-locked</option>. This
769 option may appear more than once in
770 which case the secure bits are
771 ORed. If the empty string is assigned
772 to this option the bits are reset to
777 <term><varname>Capabilities=</varname></term>
778 <listitem><para>Controls the
779 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
780 set for the executed process. Take a
781 capability string describing the
782 effective, permitted and inherited
783 capability sets as documented in
784 <citerefentry><refentrytitle>cap_from_text</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
785 Note that these capability sets are
786 usually influenced by the capabilities
787 attached to the executed file. Due to
789 <varname>CapabilityBoundingSet=</varname>
790 is probably the much more useful
791 setting.</para></listitem>
795 <term><varname>ControlGroup=</varname></term>
797 <listitem><para>Controls the control
798 groups the executed processes shall be
799 made members of. Takes a
800 space-separated list of cgroup
801 identifiers. A cgroup identifier is
803 <filename noindex='true'>cpu:/foo/bar</filename>,
804 where "cpu" indicates the kernel
805 control group controller used, and
806 <filename noindex='true'>/foo/bar</filename> is the
807 control group path. The controller
808 name and ":" may be omitted in which
809 case the named systemd control group
810 hierarchy is implied. Alternatively,
811 the path and ":" may be omitted, in
812 which case the default control group
813 path for this unit is implied.</para>
815 <para>This option may be used to place
816 executed processes in arbitrary groups
817 in arbitrary hierarchies -- which may
818 then be externally configured with
819 additional execution limits. By
820 default systemd will place all
821 executed processes in separate
822 per-unit control groups (named after
823 the unit) in the systemd named
824 hierarchy. This option is primarily
825 intended to place executed processes
826 in specific paths in specific kernel
827 controller hierarchies. It is not
828 recommended to manipulate the service
829 control group path in the private
830 systemd named hierarchy
831 (i.e. <literal>name=systemd</literal>),
832 and doing this might result in
833 undefined behaviour. For details about
834 control groups see <ulink
835 url="http://www.kernel.org/doc/Documentation/cgroups/cgroups.txt">cgroups.txt</ulink>.</para>
837 <para>This option may appear more than
838 once, in which case the list of
839 control group assignments is
840 merged. If the same hierarchy gets two
841 different paths assigned only the
842 later setting will take effect. If the
843 empty string is assigned to this
844 option the list of control group
845 assignments is reset, all previous
846 assignments will have no
849 <para>Note that the list of control
850 group assignments of a unit is
851 extended implicitly based on the
853 <varname>DefaultControllers=</varname>
855 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
857 <varname>ControlGroup=</varname>
858 setting for a specific controller
859 takes precedence.</para></listitem>
863 <term><varname>ControlGroupModify=</varname></term>
864 <listitem><para>Takes a boolean
865 argument. If true, the control groups
866 created for this unit will be owned by
867 the user specified with
868 <varname>User=</varname> (and the
869 appropriate group), and he/she can create
870 subgroups as well as add processes to
871 the group.</para></listitem>
875 <term><varname>ControlGroupPersistent=</varname></term>
876 <listitem><para>Takes a boolean
877 argument. If true, the control groups
878 created for this unit will be marked
879 to be persistent, i.e. systemd will
880 not remove them when stopping the
881 unit. The default is false, meaning
882 that the control groups will be
883 removed when the unit is stopped. For
884 details about the semantics of this
886 url="http://www.freedesktop.org/wiki/Software/systemd/PaxControlGroups">PaxControlGroups</ulink>.</para></listitem>
890 <term><varname>ControlGroupAttribute=</varname></term>
892 <listitem><para>Set a specific control
893 group attribute for executed
894 processes, and (if needed) add the
895 executed processes to a cgroup in the
896 hierarchy of the controller the
897 attribute belongs to. Takes two
898 space-separated arguments: the
899 attribute name (syntax is
900 <literal>cpu.shares</literal> where
901 <literal>cpu</literal> refers to a
902 specific controller and
903 <literal>shares</literal> to the
904 attribute name), and the attribute
906 <literal>ControlGroupAttribute=cpu.shares
907 512</literal>. If this option is used
908 for an attribute that belongs to a
909 kernel controller hierarchy the unit
910 is not already configured to be added
911 to (for example via the
912 <literal>ControlGroup=</literal>
913 option) then the unit will be added to
914 the controller and the default unit
915 cgroup path is implied. Thus, using
916 <varname>ControlGroupAttribute=</varname>
917 is in most cases sufficient to make
918 use of control group enforcements,
920 <varname>ControlGroup=</varname> are
921 only necessary in case the implied
922 default control group path for a
923 service is not desirable. For details
924 about control group attributes see
926 url="http://www.kernel.org/doc/Documentation/cgroups/cgroups.txt">cgroups.txt</ulink>. This
927 option may appear more than once, in
928 order to set multiple control group
929 attributes. If this option is used
930 multiple times for the same cgroup
931 attribute only the later setting takes
932 effect. If the empty string is
933 assigned to this option the list of
934 attributes is reset, all previous
935 cgroup attribute settings have no
936 effect, including those done with
937 <varname>CPUShares=</varname>,
938 <varname>MemoryLimit=</varname>,
939 <varname>MemorySoftLimit</varname>,
940 <varname>DeviceAllow=</varname>,
941 <varname>DeviceDeny=</varname>,
942 <varname>BlockIOWeight=</varname>,
943 <varname>BlockIOReadBandwidth=</varname>,
944 <varname>BlockIOWriteBandwidth=</varname>.
949 <term><varname>CPUShares=</varname></term>
951 <listitem><para>Assign the specified
952 overall CPU time shares to the
953 processes executed. Takes an integer
954 value. This controls the
955 <literal>cpu.shares</literal> control
956 group attribute, which defaults to
957 1024. For details about this control
958 group attribute see <ulink
959 url="http://www.kernel.org/doc/Documentation/scheduler/sched-design-CFS.txt">sched-design-CFS.txt</ulink>.</para></listitem>
963 <term><varname>MemoryLimit=</varname></term>
964 <term><varname>MemorySoftLimit=</varname></term>
966 <listitem><para>Limit the overall memory usage
967 of the executed processes to a certain
968 size. Takes a memory size in bytes. If
969 the value is suffixed with K, M, G or
970 T the specified memory size is parsed
971 as Kilobytes, Megabytes, Gigabytes,
972 or Terabytes (to the base
973 1024), respectively. This controls the
974 <literal>memory.limit_in_bytes</literal>
976 <literal>memory.soft_limit_in_bytes</literal>
977 control group attributes. For details
978 about these control group attributes
980 url="http://www.kernel.org/doc/Documentation/cgroups/memory.txt">memory.txt</ulink>.</para></listitem>
984 <term><varname>DeviceAllow=</varname></term>
985 <term><varname>DeviceDeny=</varname></term>
987 <listitem><para>Control access to
988 specific device nodes by the executed processes. Takes two
989 space separated strings: a device node
991 <filename>/dev/null</filename>)
992 followed by a combination of r, w, m
993 to control reading, writing, or
994 creating of the specific device node
995 by the unit, respectively. This controls the
996 <literal>devices.allow</literal>
998 <literal>devices.deny</literal>
999 control group attributes. For details
1000 about these control group attributes
1002 url="http://www.kernel.org/doc/Documentation/cgroups/devices.txt">devices.txt</ulink>.</para></listitem>
1006 <term><varname>BlockIOWeight=</varname></term>
1008 <listitem><para>Set the default or
1009 per-device overall block IO weight
1010 value for the executed
1011 processes. Takes either a single
1012 weight value (between 10 and 1000) to
1013 set the default block IO weight, or a
1014 space separated pair of a file path
1015 and a weight value to specify the
1016 device specific weight value (Example:
1017 "/dev/sda 500"). The file path may be
1018 specified as path to a block device
1019 node or as any other file in which
1020 case the backing block device of the
1021 file system of the file is
1022 determined. This controls the
1023 <literal>blkio.weight</literal> and
1024 <literal>blkio.weight_device</literal>
1025 control group attributes, which
1026 default to 1000. Use this option
1027 multiple times to set weights for
1028 multiple devices. For details about
1029 these control group attributes see
1031 url="http://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt">blkio-controller.txt</ulink>.</para></listitem>
1035 <term><varname>BlockIOReadBandwidth=</varname></term>
1036 <term><varname>BlockIOWriteBandwidth=</varname></term>
1038 <listitem><para>Set the per-device
1039 overall block IO bandwidth limit for
1040 the executed processes. Takes a space
1041 separated pair of a file path and a
1042 bandwidth value (in bytes per second)
1043 to specify the device specific
1044 bandwidth. The file path may be
1045 specified as path to a block device
1046 node or as any other file in which
1047 case the backing block device of the
1048 file system of the file is determined.
1049 If the bandwidth is suffixed with K, M,
1050 G, or T the specified bandwidth is
1051 parsed as Kilobytes, Megabytes,
1052 Gigabytes, or Terabytes, respectively (Example:
1053 "/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0
1054 5M"). This controls the
1055 <literal>blkio.read_bps_device</literal>
1057 <literal>blkio.write_bps_device</literal>
1058 control group attributes. Use this
1059 option multiple times to set bandwidth
1060 limits for multiple devices. For
1061 details about these control group
1062 attributes see <ulink
1063 url="http://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt">blkio-controller.txt</ulink>.</para></listitem>
1067 <term><varname>ReadWriteDirectories=</varname></term>
1068 <term><varname>ReadOnlyDirectories=</varname></term>
1069 <term><varname>InaccessibleDirectories=</varname></term>
1071 <listitem><para>Sets up a new
1072 file system namespace for executed
1073 processes. These options may be used
1074 to limit access a process might have
1075 to the main file system
1076 hierarchy. Each setting takes a
1077 space-separated list of absolute
1078 directory paths. Directories listed in
1079 <varname>ReadWriteDirectories=</varname>
1080 are accessible from within the
1081 namespace with the same access rights
1082 as from outside. Directories listed in
1083 <varname>ReadOnlyDirectories=</varname>
1084 are accessible for reading only,
1085 writing will be refused even if the
1086 usual file access controls would
1087 permit this. Directories listed in
1088 <varname>InaccessibleDirectories=</varname>
1089 will be made inaccessible for
1090 processes inside the namespace. Note
1091 that restricting access with these
1092 options does not extend to submounts
1093 of a directory. You must list
1094 submounts separately in these settings
1095 to ensure the same limited
1096 access. These options may be specified
1097 more than once in which case all
1098 directories listed will have limited
1099 access from within the namespace. If
1100 the empty string is assigned to this
1101 option the specific list is reset, and
1102 all prior assignments have no
1103 effect.</para></listitem>
1107 <term><varname>PrivateTmp=</varname></term>
1109 <listitem><para>Takes a boolean
1110 argument. If true sets up a new file
1111 system namespace for the executed
1112 processes and mounts private
1113 <filename>/tmp</filename> and
1114 <filename>/var/tmp</filename> directories
1115 inside it, that are not shared by
1116 processes outside of the
1117 namespace. This is useful to secure
1118 access to temporary files of the
1119 process, but makes sharing between
1121 <filename>/tmp</filename> or
1122 <filename>/var/tmp</filename>
1123 impossible. All temporary data created
1124 by service will be removed after service
1125 is stopped. Defaults to
1126 false.</para></listitem>
1130 <term><varname>PrivateNetwork=</varname></term>
1132 <listitem><para>Takes a boolean
1133 argument. If true sets up a new
1134 network namespace for the executed
1135 processes and configures only the
1136 loopback network device
1137 <literal>lo</literal> inside it. No
1138 other network devices will be
1139 available to the executed process.
1140 This is useful to securely turn off
1141 network access by the executed
1142 process. Defaults to
1143 false.</para></listitem>
1147 <term><varname>MountFlags=</varname></term>
1149 <listitem><para>Takes a mount
1151 <option>shared</option>,
1152 <option>slave</option> or
1153 <option>private</option>, which
1154 control whether the file system
1155 namespace set up for this unit's
1156 processes will receive or propagate
1158 <citerefentry><refentrytitle>mount</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1159 for details. Default to
1160 <option>shared</option>.</para></listitem>
1164 <term><varname>UtmpIdentifier=</varname></term>
1166 <listitem><para>Takes a four
1167 character identifier string for an
1168 utmp/wtmp entry for this service. This
1169 should only be set for services such
1170 as <command>getty</command>
1171 implementations where utmp/wtmp
1172 entries must be created and cleared
1173 before and after execution. If the
1174 configured string is longer than four
1175 characters it is truncated and the
1176 terminal four characters are
1177 used. This setting interprets %I style
1178 string replacements. This setting is
1179 unset by default, i.e. no utmp/wtmp
1180 entries are created or cleaned up for
1181 this service.</para></listitem>
1185 <term><varname>IgnoreSIGPIPE=</varname></term>
1187 <listitem><para>Takes a boolean
1188 argument. If true causes SIGPIPE to be
1189 ignored in the executed
1190 process. Defaults to true, since
1191 SIGPIPE generally is useful only in
1192 shell pipelines.</para></listitem>
1196 <term><varname>NoNewPrivileges=</varname></term>
1198 <listitem><para>Takes a boolean
1199 argument. If true ensures that the
1200 service process and all its children
1201 can never gain new privileges. This
1202 option is more powerful than the respective
1203 secure bits flags (see above), as it
1204 also prohibits UID changes of any
1205 kind. This is the simplest, most
1206 effective way to ensure that a process
1207 and its children can never elevate
1208 privileges again.</para></listitem>
1212 <term><varname>SystemCallFilter=</varname></term>
1214 <listitem><para>Takes a space
1215 separated list of system call
1216 names. If this setting is used all
1217 system calls executed by the unit
1218 process except for the listed ones
1219 will result in immediate process
1220 termination with the
1221 <constant>SIGSYS</constant> signal
1222 (whitelisting). If the first character
1223 of the list is <literal>~</literal>
1224 the effect is inverted: only the
1225 listed system calls will result in
1226 immediate process termination
1227 (blacklisting). If this option is used
1228 <varname>NoNewPrivileges=yes</varname>
1229 is implied. This feature makes use of
1230 the Secure Computing Mode 2 interfaces
1231 of the kernel ('seccomp filtering')
1232 and is useful for enforcing a minimal
1233 sandboxing environment. Note that the
1234 <function>execve</function>,
1235 <function>rt_sigreturn</function>,
1236 <function>sigreturn</function>,
1237 <function>exit_group</function>,
1238 <function>exit</function> system calls
1239 are implicitly whitelisted and don't
1240 need to be listed explicitly. This
1241 option may be specified more than once
1242 in which case the filter masks are
1243 merged. If the empty string is
1244 assigned the filter is reset, all
1245 prior assignments will have no
1246 effect.</para></listitem>
1253 <title>See Also</title>
1255 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1256 <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1257 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1258 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1259 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1260 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1261 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1262 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1263 <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1264 <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>