chiark / gitweb /
doc: fix stale references to systemd-verify
[elogind.git] / man / systemd.exec.xml
1 <?xml-stylesheet type="text/xsl" href="http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl"?>
2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
4
5 <!--
6   This file is part of systemd.
7
8   Copyright 2010 Lennart Poettering
9
10   systemd is free software; you can redistribute it and/or modify it
11   under the terms of the GNU Lesser General Public License as published by
12   the Free Software Foundation; either version 2.1 of the License, or
13   (at your option) any later version.
14
15   systemd is distributed in the hope that it will be useful, but
16   WITHOUT ANY WARRANTY; without even the implied warranty of
17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18   Lesser General Public License for more details.
19
20   You should have received a copy of the GNU Lesser General Public License
21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
22 -->
23
24 <refentry id="systemd.exec">
25         <refentryinfo>
26                 <title>systemd.exec</title>
27                 <productname>systemd</productname>
28
29                 <authorgroup>
30                         <author>
31                                 <contrib>Developer</contrib>
32                                 <firstname>Lennart</firstname>
33                                 <surname>Poettering</surname>
34                                 <email>lennart@poettering.net</email>
35                         </author>
36                 </authorgroup>
37         </refentryinfo>
38
39         <refmeta>
40                 <refentrytitle>systemd.exec</refentrytitle>
41                 <manvolnum>5</manvolnum>
42         </refmeta>
43
44         <refnamediv>
45                 <refname>systemd.exec</refname>
46                 <refpurpose>Execution environment configuration</refpurpose>
47         </refnamediv>
48
49         <refsynopsisdiv>
50                 <para><filename><replaceable>service</replaceable>.service</filename>,
51                 <filename><replaceable>socket</replaceable>.socket</filename>,
52                 <filename><replaceable>mount</replaceable>.mount</filename>,
53                 <filename><replaceable>swap</replaceable>.swap</filename></para>
54         </refsynopsisdiv>
55
56         <refsect1>
57                 <title>Description</title>
58
59                 <para>Unit configuration files for services, sockets,
60                 mount points, and swap devices share a subset of
61                 configuration options which define the execution
62                 environment of spawned processes.</para>
63
64                 <para>This man page lists the configuration options
65                 shared by these four unit types. See
66                 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
67                 for the common options of all unit configuration
68                 files, and
69                 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
70                 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
71                 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
72                 and
73                 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>
74                 for more information on the specific unit
75                 configuration files. The execution specific
76                 configuration options are configured in the [Service],
77                 [Socket], [Mount], or [Swap] sections, depending on the unit
78                 type.</para>
79         </refsect1>
80
81         <refsect1>
82                 <title>Options</title>
83
84                 <variablelist class='unit-directives'>
85
86                         <varlistentry>
87                                 <term><varname>WorkingDirectory=</varname></term>
88
89                                 <listitem><para>Takes an absolute
90                                 directory path. Sets the working
91                                 directory for executed processes. If
92                                 not set, defaults to the root directory
93                                 when systemd is running as a system
94                                 instance and the respective user's
95                                 home directory if run as
96                                 user.</para></listitem>
97                         </varlistentry>
98
99                         <varlistentry>
100                                 <term><varname>RootDirectory=</varname></term>
101
102                                 <listitem><para>Takes an absolute
103                                 directory path. Sets the root
104                                 directory for executed processes, with
105                                 the
106                                 <citerefentry project='man-pages'><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry>
107                                 system call. If this is used, it must
108                                 be ensured that the process and all
109                                 its auxiliary files are available in
110                                 the <function>chroot()</function>
111                                 jail.</para></listitem>
112                         </varlistentry>
113
114                         <varlistentry>
115                                 <term><varname>User=</varname></term>
116                                 <term><varname>Group=</varname></term>
117
118                                 <listitem><para>Sets the Unix user
119                                 or group that the processes are executed
120                                 as, respectively. Takes a single user or group
121                                 name or ID as argument. If no group is
122                                 set, the default group of the user is
123                                 chosen.</para></listitem>
124                         </varlistentry>
125
126                         <varlistentry>
127                                 <term><varname>SupplementaryGroups=</varname></term>
128
129                                 <listitem><para>Sets the supplementary
130                                 Unix groups the processes are executed
131                                 as. This takes a space-separated list
132                                 of group names or IDs. This option may
133                                 be specified more than once in which
134                                 case all listed groups are set as
135                                 supplementary groups. When the empty
136                                 string is assigned the list of
137                                 supplementary groups is reset, and all
138                                 assignments prior to this one will
139                                 have no effect. In any way, this
140                                 option does not override, but extends
141                                 the list of supplementary groups
142                                 configured in the system group
143                                 database for the
144                                 user.</para></listitem>
145                         </varlistentry>
146
147                         <varlistentry>
148                                 <term><varname>Nice=</varname></term>
149
150                                 <listitem><para>Sets the default nice
151                                 level (scheduling priority) for
152                                 executed processes. Takes an integer
153                                 between -20 (highest priority) and 19
154                                 (lowest priority). See
155                                 <citerefentry><refentrytitle>setpriority</refentrytitle><manvolnum>2</manvolnum></citerefentry>
156                                 for details.</para></listitem>
157                         </varlistentry>
158
159                         <varlistentry>
160                                 <term><varname>OOMScoreAdjust=</varname></term>
161
162                                 <listitem><para>Sets the adjustment
163                                 level for the Out-Of-Memory killer for
164                                 executed processes. Takes an integer
165                                 between -1000 (to disable OOM killing
166                                 for this process) and 1000 (to make
167                                 killing of this process under memory
168                                 pressure very likely). See <ulink
169                                 url="https://www.kernel.org/doc/Documentation/filesystems/proc.txt">proc.txt</ulink>
170                                 for details.</para></listitem>
171                         </varlistentry>
172
173                         <varlistentry>
174                                 <term><varname>IOSchedulingClass=</varname></term>
175
176                                 <listitem><para>Sets the IO scheduling
177                                 class for executed processes. Takes an
178                                 integer between 0 and 3 or one of the
179                                 strings <option>none</option>,
180                                 <option>realtime</option>,
181                                 <option>best-effort</option> or
182                                 <option>idle</option>. See
183                                 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
184                                 for details.</para></listitem>
185                         </varlistentry>
186
187                         <varlistentry>
188                                 <term><varname>IOSchedulingPriority=</varname></term>
189
190                                 <listitem><para>Sets the IO scheduling
191                                 priority for executed processes. Takes
192                                 an integer between 0 (highest
193                                 priority) and 7 (lowest priority). The
194                                 available priorities depend on the
195                                 selected IO scheduling class (see
196                                 above). See
197                                 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
198                                 for details.</para></listitem>
199                         </varlistentry>
200
201                         <varlistentry>
202                                 <term><varname>CPUSchedulingPolicy=</varname></term>
203
204                                 <listitem><para>Sets the CPU
205                                 scheduling policy for executed
206                                 processes. Takes one of
207                                 <option>other</option>,
208                                 <option>batch</option>,
209                                 <option>idle</option>,
210                                 <option>fifo</option> or
211                                 <option>rr</option>. See
212                                 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
213                                 for details.</para></listitem>
214                         </varlistentry>
215
216                         <varlistentry>
217                                 <term><varname>CPUSchedulingPriority=</varname></term>
218
219                                 <listitem><para>Sets the CPU
220                                 scheduling priority for executed
221                                 processes. The available priority
222                                 range depends on the selected CPU
223                                 scheduling policy (see above). For
224                                 real-time scheduling policies an
225                                 integer between 1 (lowest priority)
226                                 and 99 (highest priority) can be used.
227                                 See <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
228                                 for details.
229                                 </para></listitem>
230                         </varlistentry>
231
232                         <varlistentry>
233                                 <term><varname>CPUSchedulingResetOnFork=</varname></term>
234
235                                 <listitem><para>Takes a boolean
236                                 argument. If true, elevated CPU
237                                 scheduling priorities and policies
238                                 will be reset when the executed
239                                 processes fork, and can hence not leak
240                                 into child processes. See
241                                 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
242                                 for details. Defaults to false.</para></listitem>
243                         </varlistentry>
244
245                         <varlistentry>
246                                 <term><varname>CPUAffinity=</varname></term>
247
248                                 <listitem><para>Controls the CPU
249                                 affinity of the executed
250                                 processes. Takes a space-separated
251                                 list of CPU indices. This option may
252                                 be specified more than once in which
253                                 case the specified CPU affinity masks
254                                 are merged. If the empty string is
255                                 assigned, the mask is reset, all
256                                 assignments prior to this will have no
257                                 effect. See
258                                 <citerefentry><refentrytitle>sched_setaffinity</refentrytitle><manvolnum>2</manvolnum></citerefentry>
259                                 for details.</para></listitem>
260                         </varlistentry>
261
262                         <varlistentry>
263                                 <term><varname>UMask=</varname></term>
264
265                                 <listitem><para>Controls the file mode
266                                 creation mask. Takes an access mode in
267                                 octal notation. See
268                                 <citerefentry><refentrytitle>umask</refentrytitle><manvolnum>2</manvolnum></citerefentry>
269                                 for details. Defaults to
270                                 0022.</para></listitem>
271                         </varlistentry>
272
273                         <varlistentry>
274                                 <term><varname>Environment=</varname></term>
275
276                                 <listitem><para>Sets environment
277                                 variables for executed
278                                 processes. Takes a space-separated
279                                 list of variable assignments. This
280                                 option may be specified more than once
281                                 in which case all listed variables
282                                 will be set. If the same variable is
283                                 set twice, the later setting will
284                                 override the earlier setting. If the
285                                 empty string is assigned to this
286                                 option, the list of environment
287                                 variables is reset, all prior
288                                 assignments have no effect.
289                                 Variable expansion is not performed
290                                 inside the strings, however, specifier
291                                 expansion is possible. The $ character has
292                                 no special meaning.
293                                 If you need to assign a value containing spaces
294                                 to a variable, use double quotes (")
295                                 for the assignment.</para>
296
297                                 <para>Example:
298                                 <programlisting>Environment="VAR1=word1 word2" VAR2=word3 "VAR3=$word 5 6"</programlisting>
299                                 gives three variables <literal>VAR1</literal>,
300                                 <literal>VAR2</literal>, <literal>VAR3</literal>
301                                 with the values <literal>word1 word2</literal>,
302                                 <literal>word3</literal>, <literal>$word 5 6</literal>.
303                                 </para>
304
305                                 <para>
306                                 See
307                                 <citerefentry project='man-pages'><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>
308                                 for details about environment variables.</para></listitem>
309                         </varlistentry>
310                         <varlistentry>
311                                 <term><varname>EnvironmentFile=</varname></term>
312                                 <listitem><para>Similar to
313                                 <varname>Environment=</varname> but
314                                 reads the environment variables from a
315                                 text file. The text file should
316                                 contain new-line-separated variable
317                                 assignments. Empty lines and lines
318                                 starting with ; or # will be ignored,
319                                 which may be used for commenting. A line
320                                 ending with a backslash will be concatenated
321                                 with the following one, allowing multiline variable
322                                 definitions. The parser strips leading
323                                 and trailing whitespace from the values
324                                 of assignments, unless you use
325                                 double quotes (").</para>
326
327                                 <para>The argument passed should be an
328                                 absolute filename or wildcard
329                                 expression, optionally prefixed with
330                                 <literal>-</literal>, which indicates
331                                 that if the file does not exist, it
332                                 will not be read and no error or warning
333                                 message is logged.  This option may be
334                                 specified more than once in which case
335                                 all specified files are read. If the
336                                 empty string is assigned to this
337                                 option, the list of file to read is
338                                 reset, all prior assignments have no
339                                 effect.</para>
340
341                                 <para>The files listed with this
342                                 directive will be read shortly before
343                                 the process is executed (more
344                                 specifically, after all
345                                 processes from a previous unit state
346                                 terminated. This means you can
347                                 generate these files in one unit
348                                 state, and read it with this option in
349                                 the next). Settings from these files
350                                 override settings made with
351                                 <varname>Environment=</varname>. If
352                                 the same variable is set twice from
353                                 these files, the files will be read in
354                                 the order they are specified and the
355                                 later setting will override the
356                                 earlier setting.</para></listitem>
357                         </varlistentry>
358
359                         <varlistentry>
360                                 <term><varname>StandardInput=</varname></term>
361                                 <listitem><para>Controls where file
362                                 descriptor 0 (STDIN) of the executed
363                                 processes is connected to. Takes one
364                                 of <option>null</option>,
365                                 <option>tty</option>,
366                                 <option>tty-force</option>,
367                                 <option>tty-fail</option> or
368                                 <option>socket</option>.</para>
369
370                                 <para>If <option>null</option> is
371                                 selected, standard input will be
372                                 connected to
373                                 <filename>/dev/null</filename>,
374                                 i.e. all read attempts by the process
375                                 will result in immediate EOF.</para>
376
377                                 <para>If <option>tty</option> is
378                                 selected, standard input is connected
379                                 to a TTY (as configured by
380                                 <varname>TTYPath=</varname>, see
381                                 below) and the executed process
382                                 becomes the controlling process of the
383                                 terminal. If the terminal is already
384                                 being controlled by another process,
385                                 the executed process waits until the
386                                 current controlling process releases
387                                 the terminal.</para>
388
389                                 <para><option>tty-force</option> is similar
390                                 to <option>tty</option>, but the
391                                 executed process is forcefully and
392                                 immediately made the controlling
393                                 process of the terminal, potentially
394                                 removing previous controlling
395                                 processes from the
396                                 terminal.</para>
397
398                                 <para><option>tty-fail</option> is
399                                 similar to <option>tty</option> but if
400                                 the terminal already has a controlling
401                                 process start-up of the executed
402                                 process fails.</para>
403
404                                 <para>The <option>socket</option>
405                                 option is only valid in
406                                 socket-activated services, and only
407                                 when the socket configuration file
408                                 (see
409                                 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>
410                                 for details) specifies a single socket
411                                 only. If this option is set, standard
412                                 input will be connected to the socket
413                                 the service was activated from, which
414                                 is primarily useful for compatibility
415                                 with daemons designed for use with the
416                                 traditional
417                                 <citerefentry><refentrytitle>inetd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
418                                 daemon.</para>
419
420                                 <para>This setting defaults to
421                                 <option>null</option>.</para></listitem>
422                         </varlistentry>
423                         <varlistentry>
424                                 <term><varname>StandardOutput=</varname></term>
425                                 <listitem><para>Controls where file
426                                 descriptor 1 (STDOUT) of the executed
427                                 processes is connected to. Takes one
428                                 of <option>inherit</option>,
429                                 <option>null</option>,
430                                 <option>tty</option>,
431                                 <option>journal</option>,
432                                 <option>syslog</option>,
433                                 <option>kmsg</option>,
434                                 <option>journal+console</option>,
435                                 <option>syslog+console</option>,
436                                 <option>kmsg+console</option> or
437                                 <option>socket</option>.</para>
438
439                                 <para><option>inherit</option>
440                                 duplicates the file descriptor of
441                                 standard input for standard
442                                 output.</para>
443
444                                 <para><option>null</option> connects
445                                 standard output to
446                                 <filename>/dev/null</filename>,
447                                 i.e. everything written to it will be
448                                 lost.</para>
449
450                                 <para><option>tty</option> connects
451                                 standard output to a tty (as
452                                 configured via
453                                 <varname>TTYPath=</varname>, see
454                                 below). If the TTY is used for output
455                                 only, the executed process will not
456                                 become the controlling process of the
457                                 terminal, and will not fail or wait
458                                 for other processes to release the
459                                 terminal.</para>
460
461                                 <para><option>journal</option>
462                                 connects standard output with the
463                                 journal which is accessible via
464                                 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
465                                 Note that everything that is written
466                                 to syslog or kmsg (see below) is
467                                 implicitly stored in the journal as
468                                 well, the specific two options listed
469                                 below are hence supersets of this
470                                 one.</para>
471
472                                 <para><option>syslog</option> connects
473                                 standard output to the <citerefentry
474                                 project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
475                                 system syslog service, in addition to
476                                 the journal. Note that the journal
477                                 daemon is usually configured to
478                                 forward everything it receives to
479                                 syslog anyway, in which case this
480                                 option is no different from
481                                 <option>journal</option>.</para>
482
483                                 <para><option>kmsg</option> connects
484                                 standard output with the kernel log
485                                 buffer which is accessible via
486                                 <citerefentry
487                                 project='man-pages'><refentrytitle>dmesg</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
488                                 in addition to the journal. The
489                                 journal daemon might be configured to
490                                 send all logs to kmsg anyway, in which
491                                 case this option is no different from
492                                 <option>journal</option>.</para>
493
494                                 <para><option>journal+console</option>,
495                                 <option>syslog+console</option> and
496                                 <option>kmsg+console</option> work in
497                                 a similar way as the three options
498                                 above but copy the output to the
499                                 system console as well.</para>
500
501                                 <para><option>socket</option> connects
502                                 standard output to a socket acquired
503                                 via socket activation. The semantics
504                                 are similar to the same option of
505                                 <varname>StandardInput=</varname>.</para>
506
507                                 <para>This setting defaults to the
508                                 value set with
509                                 <option>DefaultStandardOutput=</option>
510                                 in
511                                 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
512                                 which defaults to
513                                 <option>journal</option>.</para></listitem>
514                         </varlistentry>
515                         <varlistentry>
516                                 <term><varname>StandardError=</varname></term>
517                                 <listitem><para>Controls where file
518                                 descriptor 2 (STDERR) of the
519                                 executed processes is connected to.
520                                 The available options are identical to
521                                 those of
522                                 <varname>StandardOutput=</varname>,
523                                 with one exception: if set to
524                                 <option>inherit</option> the file
525                                 descriptor used for standard output is
526                                 duplicated for standard error. This
527                                 setting defaults to the value set with
528                                 <option>DefaultStandardError=</option>
529                                 in
530                                 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
531                                 which defaults to
532                                 <option>inherit</option>.</para></listitem>
533                         </varlistentry>
534                         <varlistentry>
535                                 <term><varname>TTYPath=</varname></term>
536                                 <listitem><para>Sets the terminal
537                                 device node to use if standard input, output,
538                                 or error are connected to a
539                                 TTY (see above). Defaults to
540                                 <filename>/dev/console</filename>.</para></listitem>
541                         </varlistentry>
542                         <varlistentry>
543                                 <term><varname>TTYReset=</varname></term>
544                                 <listitem><para>Reset the terminal
545                                 device specified with
546                                 <varname>TTYPath=</varname> before and
547                                 after execution. Defaults to
548                                 <literal>no</literal>.</para></listitem>
549                         </varlistentry>
550                         <varlistentry>
551                                 <term><varname>TTYVHangup=</varname></term>
552                                 <listitem><para>Disconnect all clients
553                                 which have opened the terminal device
554                                 specified with
555                                 <varname>TTYPath=</varname>
556                                 before and after execution. Defaults
557                                 to
558                                 <literal>no</literal>.</para></listitem>
559                         </varlistentry>
560                         <varlistentry>
561                                 <term><varname>TTYVTDisallocate=</varname></term>
562                                 <listitem><para>If the terminal
563                                 device specified with
564                                 <varname>TTYPath=</varname> is a
565                                 virtual console terminal, try to
566                                 deallocate the TTY before and after
567                                 execution. This ensures that the
568                                 screen and scrollback buffer is
569                                 cleared. Defaults to
570                                 <literal>no</literal>.</para></listitem>
571                         </varlistentry>
572                         <varlistentry>
573                                 <term><varname>SyslogIdentifier=</varname></term>
574                                 <listitem><para>Sets the process name
575                                 to prefix log lines sent to the
576                                 logging system or the kernel log
577                                 buffer with. If not set, defaults to
578                                 the process name of the executed
579                                 process. This option is only useful
580                                 when
581                                 <varname>StandardOutput=</varname> or
582                                 <varname>StandardError=</varname> are
583                                 set to <option>syslog</option>,
584                                 <option>journal</option> or
585                                 <option>kmsg</option> (or to the same
586                                 settings in combination with
587                                 <option>+console</option>).</para></listitem>
588                         </varlistentry>
589                         <varlistentry>
590                                 <term><varname>SyslogFacility=</varname></term>
591                                 <listitem><para>Sets the syslog
592                                 facility to use when logging to
593                                 syslog. One of <option>kern</option>,
594                                 <option>user</option>,
595                                 <option>mail</option>,
596                                 <option>daemon</option>,
597                                 <option>auth</option>,
598                                 <option>syslog</option>,
599                                 <option>lpr</option>,
600                                 <option>news</option>,
601                                 <option>uucp</option>,
602                                 <option>cron</option>,
603                                 <option>authpriv</option>,
604                                 <option>ftp</option>,
605                                 <option>local0</option>,
606                                 <option>local1</option>,
607                                 <option>local2</option>,
608                                 <option>local3</option>,
609                                 <option>local4</option>,
610                                 <option>local5</option>,
611                                 <option>local6</option> or
612                                 <option>local7</option>. See
613                                 <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
614                                 for details. This option is only
615                                 useful when
616                                 <varname>StandardOutput=</varname> or
617                                 <varname>StandardError=</varname> are
618                                 set to <option>syslog</option>.
619                                 Defaults to
620                                 <option>daemon</option>.</para></listitem>
621                         </varlistentry>
622                         <varlistentry>
623                                 <term><varname>SyslogLevel=</varname></term>
624                                 <listitem><para>Default syslog level
625                                 to use when logging to syslog or the
626                                 kernel log buffer. One of
627                                 <option>emerg</option>,
628                                 <option>alert</option>,
629                                 <option>crit</option>,
630                                 <option>err</option>,
631                                 <option>warning</option>,
632                                 <option>notice</option>,
633                                 <option>info</option>,
634                                 <option>debug</option>. See
635                                 <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
636                                 for details. This option is only
637                                 useful when
638                                 <varname>StandardOutput=</varname> or
639                                 <varname>StandardError=</varname> are
640                                 set to <option>syslog</option> or
641                                 <option>kmsg</option>. Note that
642                                 individual lines output by the daemon
643                                 might be prefixed with a different log
644                                 level which can be used to override
645                                 the default log level specified
646                                 here. The interpretation of these
647                                 prefixes may be disabled with
648                                 <varname>SyslogLevelPrefix=</varname>,
649                                 see below. For details see
650                                 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
651
652                                 Defaults to
653                                 <option>info</option>.</para></listitem>
654                         </varlistentry>
655
656                         <varlistentry>
657                                 <term><varname>SyslogLevelPrefix=</varname></term>
658                                 <listitem><para>Takes a boolean
659                                 argument. If true and
660                                 <varname>StandardOutput=</varname> or
661                                 <varname>StandardError=</varname> are
662                                 set to <option>syslog</option>,
663                                 <option>kmsg</option> or
664                                 <option>journal</option>, log lines
665                                 written by the executed process that
666                                 are prefixed with a log level will be
667                                 passed on to syslog with this log
668                                 level set but the prefix removed. If
669                                 set to false, the interpretation of
670                                 these prefixes is disabled and the
671                                 logged lines are passed on as-is. For
672                                 details about this prefixing see
673                                 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
674                                 Defaults to true.</para></listitem>
675                         </varlistentry>
676
677                         <varlistentry>
678                                 <term><varname>TimerSlackNSec=</varname></term>
679                                 <listitem><para>Sets the timer slack
680                                 in nanoseconds for the executed
681                                 processes. The timer slack controls
682                                 the accuracy of wake-ups triggered by
683                                 timers. See
684                                 <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
685                                 for more information. Note that in
686                                 contrast to most other time span
687                                 definitions this parameter takes an
688                                 integer value in nano-seconds if no
689                                 unit is specified. The usual time
690                                 units are understood
691                                 too.</para></listitem>
692                         </varlistentry>
693
694                         <varlistentry>
695                                 <term><varname>LimitCPU=</varname></term>
696                                 <term><varname>LimitFSIZE=</varname></term>
697                                 <term><varname>LimitDATA=</varname></term>
698                                 <term><varname>LimitSTACK=</varname></term>
699                                 <term><varname>LimitCORE=</varname></term>
700                                 <term><varname>LimitRSS=</varname></term>
701                                 <term><varname>LimitNOFILE=</varname></term>
702                                 <term><varname>LimitAS=</varname></term>
703                                 <term><varname>LimitNPROC=</varname></term>
704                                 <term><varname>LimitMEMLOCK=</varname></term>
705                                 <term><varname>LimitLOCKS=</varname></term>
706                                 <term><varname>LimitSIGPENDING=</varname></term>
707                                 <term><varname>LimitMSGQUEUE=</varname></term>
708                                 <term><varname>LimitNICE=</varname></term>
709                                 <term><varname>LimitRTPRIO=</varname></term>
710                                 <term><varname>LimitRTTIME=</varname></term>
711                                 <listitem><para>These settings set both
712                                 soft and hard limits of various resources for
713                                 executed processes. See
714                                 <citerefentry><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry>
715                                 for details. Use the string
716                                 <varname>infinity</varname> to
717                                 configure no limit on a specific
718                                 resource.</para></listitem>
719
720                                 <table>
721                                         <title>Limit directives and their equivalent with ulimit</title>
722
723                                         <tgroup cols='2'>
724                                                 <colspec colname='directive' />
725                                                 <colspec colname='equivalent' />
726                                                 <thead>
727                                                         <row>
728                                                                 <entry>Directive</entry>
729                                                                 <entry>ulimit equivalent</entry>
730                                                         </row>
731                                                 </thead>
732                                                 <tbody>
733                                                         <row>
734                                                                 <entry>LimitCPU</entry>
735                                                                 <entry>ulimit -t</entry>
736                                                         </row>
737                                                         <row>
738                                                                 <entry>LimitFSIZE</entry>
739                                                                 <entry>ulimit -f</entry>
740                                                         </row>
741                                                         <row>
742                                                                 <entry>LimitDATA</entry>
743                                                                 <entry>ulimit -d</entry>
744                                                         </row>
745                                                         <row>
746                                                                 <entry>LimitSTACK</entry>
747                                                                 <entry>ulimit -s</entry>
748                                                         </row>
749                                                         <row>
750                                                                 <entry>LimitCORE</entry>
751                                                                 <entry>ulimit -c</entry>
752                                                         </row>
753                                                         <row>
754                                                                 <entry>LimitRSS</entry>
755                                                                 <entry>ulimit -m</entry>
756                                                         </row>
757                                                         <row>
758                                                                 <entry>LimitNOFILE</entry>
759                                                                 <entry>ulimit -n</entry>
760                                                         </row>
761                                                         <row>
762                                                                 <entry>LimitAS</entry>
763                                                                 <entry>ulimit -v</entry>
764                                                         </row>
765                                                         <row>
766                                                                 <entry>LimitNPROC</entry>
767                                                                 <entry>ulimit -u</entry>
768                                                         </row>
769                                                         <row>
770                                                                 <entry>LimitMEMLOCK</entry>
771                                                                 <entry>ulimit -l</entry>
772                                                         </row>
773                                                         <row>
774                                                                 <entry>LimitLOCKS</entry>
775                                                                 <entry>ulimit -x</entry>
776                                                         </row>
777                                                         <row>
778                                                                 <entry>LimitSIGPENDING</entry>
779                                                                 <entry>ulimit -i</entry>
780                                                         </row>
781                                                         <row>
782                                                                 <entry>LimitMSGQUEUE</entry>
783                                                                 <entry>ulimit -q</entry>
784                                                         </row>
785                                                         <row>
786                                                                 <entry>LimitNICE</entry>
787                                                                 <entry>ulimit -e</entry>
788                                                         </row>
789                                                         <row>
790                                                                 <entry>LimitRTPRIO</entry>
791                                                                 <entry>ulimit -r</entry>
792                                                         </row>
793                                                         <row>
794                                                                 <entry>LimitRTTIME</entry>
795                                                                 <entry>No equivalent</entry>
796                                                         </row>
797                                                 </tbody>
798                                         </tgroup>
799                                 </table>
800                         </varlistentry>
801
802                         <varlistentry>
803                                 <term><varname>PAMName=</varname></term>
804                                 <listitem><para>Sets the PAM service
805                                 name to set up a session as. If set,
806                                 the executed process will be
807                                 registered as a PAM session under the
808                                 specified service name. This is only
809                                 useful in conjunction with the
810                                 <varname>User=</varname> setting. If
811                                 not set, no PAM session will be opened
812                                 for the executed processes. See
813                                 <citerefentry project='man-pages'><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>
814                                 for details.</para></listitem>
815                         </varlistentry>
816
817                         <varlistentry>
818                                 <term><varname>CapabilityBoundingSet=</varname></term>
819
820                                 <listitem><para>Controls which
821                                 capabilities to include in the
822                                 capability bounding set for the
823                                 executed process. See
824                                 <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
825                                 for details. Takes a whitespace-separated
826                                 list of capability names as read by
827                                 <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
828                                 e.g. <constant>CAP_SYS_ADMIN</constant>,
829                                 <constant>CAP_DAC_OVERRIDE</constant>,
830                                 <constant>CAP_SYS_PTRACE</constant>.
831                                 Capabilities listed will be included
832                                 in the bounding set, all others are
833                                 removed. If the list of capabilities
834                                 is prefixed with <literal>~</literal>,
835                                 all but the listed capabilities will
836                                 be included, the effect of the
837                                 assignment inverted. Note that this
838                                 option also affects the respective
839                                 capabilities in the effective,
840                                 permitted and inheritable capability
841                                 sets, on top of what
842                                 <varname>Capabilities=</varname>
843                                 does. If this option is not used, the
844                                 capability bounding set is not
845                                 modified on process execution, hence
846                                 no limits on the capabilities of the
847                                 process are enforced. This option may
848                                 appear more than once in which case
849                                 the bounding sets are merged. If the
850                                 empty string is assigned to this
851                                 option, the bounding set is reset to
852                                 the empty capability set, and all
853                                 prior settings have no effect. If set
854                                 to <literal>~</literal> (without any
855                                 further argument), the bounding set is
856                                 reset to the full set of available
857                                 capabilities, also undoing any
858                                 previous settings.</para></listitem>
859                         </varlistentry>
860
861                         <varlistentry>
862                                 <term><varname>SecureBits=</varname></term>
863                                 <listitem><para>Controls the secure
864                                 bits set for the executed process.
865                                 Takes a space-separated combination of
866                                 options from the following list:
867                                 <option>keep-caps</option>,
868                                 <option>keep-caps-locked</option>,
869                                 <option>no-setuid-fixup</option>,
870                                 <option>no-setuid-fixup-locked</option>,
871                                 <option>noroot</option>, and
872                                 <option>noroot-locked</option>. This
873                                 option may appear more than once in
874                                 which case the secure bits are ORed.
875                                 If the empty string is assigned to
876                                 this option, the bits are reset to 0.
877                                 See <citerefentry
878                                 project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
879                                 for details.</para></listitem>
880                         </varlistentry>
881
882                         <varlistentry>
883                                 <term><varname>Capabilities=</varname></term>
884                                 <listitem><para>Controls the
885                                 <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
886                                 set for the executed process. Take a
887                                 capability string describing the
888                                 effective, permitted and inherited
889                                 capability sets as documented in
890                                 <citerefentry><refentrytitle>cap_from_text</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
891                                 Note that these capability sets are
892                                 usually influenced (and filtered) by the capabilities
893                                 attached to the executed file. Due to
894                                 that
895                                 <varname>CapabilityBoundingSet=</varname>
896                                 is probably a much more useful
897                                 setting.</para></listitem>
898                         </varlistentry>
899
900                         <varlistentry>
901                                 <term><varname>ReadWriteDirectories=</varname></term>
902                                 <term><varname>ReadOnlyDirectories=</varname></term>
903                                 <term><varname>InaccessibleDirectories=</varname></term>
904
905                                 <listitem><para>Sets up a new file
906                                 system namespace for executed
907                                 processes. These options may be used
908                                 to limit access a process might have
909                                 to the main file system
910                                 hierarchy. Each setting takes a
911                                 space-separated list of absolute
912                                 directory paths. Directories listed in
913                                 <varname>ReadWriteDirectories=</varname>
914                                 are accessible from within the
915                                 namespace with the same access rights
916                                 as from outside. Directories listed in
917                                 <varname>ReadOnlyDirectories=</varname>
918                                 are accessible for reading only,
919                                 writing will be refused even if the
920                                 usual file access controls would
921                                 permit this. Directories listed in
922                                 <varname>InaccessibleDirectories=</varname>
923                                 will be made inaccessible for
924                                 processes inside the namespace. Note
925                                 that restricting access with these
926                                 options does not extend to submounts
927                                 of a directory that are created later
928                                 on. These options may be specified
929                                 more than once in which case all
930                                 directories listed will have limited
931                                 access from within the namespace. If
932                                 the empty string is assigned to this
933                                 option, the specific list is reset,
934                                 and all prior assignments have no
935                                 effect.</para>
936                                 <para>Paths in
937                                 <varname>ReadOnlyDirectories=</varname>
938                                 and
939                                 <varname>InaccessibleDirectories=</varname>
940                                 may be prefixed with
941                                 <literal>-</literal>, in which case
942                                 they will be ignored when they do not
943                                 exist. Note that using this
944                                 setting will disconnect propagation of
945                                 mounts from the service to the host
946                                 (propagation in the opposite direction
947                                 continues to work). This means that
948                                 this setting may not be used for
949                                 services which shall be able to
950                                 install mount points in the main mount
951                                 namespace.</para></listitem>
952                         </varlistentry>
953
954                         <varlistentry>
955                                 <term><varname>PrivateTmp=</varname></term>
956
957                                 <listitem><para>Takes a boolean
958                                 argument. If true, sets up a new file
959                                 system namespace for the executed
960                                 processes and mounts private
961                                 <filename>/tmp</filename> and
962                                 <filename>/var/tmp</filename>
963                                 directories inside it that is not
964                                 shared by processes outside of the
965                                 namespace. This is useful to secure
966                                 access to temporary files of the
967                                 process, but makes sharing between
968                                 processes via
969                                 <filename>/tmp</filename> or
970                                 <filename>/var/tmp</filename>
971                                 impossible. If this is enabled, all
972                                 temporary files created by a service
973                                 in these directories will be removed
974                                 after the service is stopped. Defaults
975                                 to false. It is possible to run two or
976                                 more units within the same private
977                                 <filename>/tmp</filename> and
978                                 <filename>/var/tmp</filename>
979                                 namespace by using the
980                                 <varname>JoinsNamespaceOf=</varname>
981                                 directive, see
982                                 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
983                                 for details. Note that using this
984                                 setting will disconnect propagation of
985                                 mounts from the service to the host
986                                 (propagation in the opposite direction
987                                 continues to work). This means that
988                                 this setting may not be used for
989                                 services which shall be able to install
990                                 mount points in the main mount
991                                 namespace.</para></listitem>
992                         </varlistentry>
993
994                         <varlistentry>
995                                 <term><varname>PrivateDevices=</varname></term>
996
997                                 <listitem><para>Takes a boolean
998                                 argument. If true, sets up a new /dev
999                                 namespace for the executed processes
1000                                 and only adds API pseudo devices such
1001                                 as <filename>/dev/null</filename>,
1002                                 <filename>/dev/zero</filename> or
1003                                 <filename>/dev/random</filename> (as
1004                                 well as the pseudo TTY subsystem) to
1005                                 it, but no physical devices such as
1006                                 <filename>/dev/sda</filename>. This is
1007                                 useful to securely turn off physical
1008                                 device access by the executed
1009                                 process. Defaults to false. Enabling
1010                                 this option will also remove
1011                                 <constant>CAP_MKNOD</constant> from
1012                                 the capability bounding set for the
1013                                 unit (see above), and set
1014                                 <varname>DevicePolicy=closed</varname>
1015                                 (see
1016                                 <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1017                                 for details). Note that using this
1018                                 setting will disconnect propagation of
1019                                 mounts from the service to the host
1020                                 (propagation in the opposite direction
1021                                 continues to work). This means that
1022                                 this setting may not be used for
1023                                 services which shall be able to
1024                                 install mount points in the main mount
1025                                 namespace.</para></listitem>
1026                         </varlistentry>
1027
1028                         <varlistentry>
1029                                 <term><varname>PrivateNetwork=</varname></term>
1030
1031                                 <listitem><para>Takes a boolean
1032                                 argument. If true, sets up a new
1033                                 network namespace for the executed
1034                                 processes and configures only the
1035                                 loopback network device
1036                                 <literal>lo</literal> inside it. No
1037                                 other network devices will be
1038                                 available to the executed process.
1039                                 This is useful to securely turn off
1040                                 network access by the executed
1041                                 process. Defaults to false. It is
1042                                 possible to run two or more units
1043                                 within the same private network
1044                                 namespace by using the
1045                                 <varname>JoinsNamespaceOf=</varname>
1046                                 directive, see
1047                                 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1048                                 for details. Note that this option
1049                                 will disconnect all socket families
1050                                 from the host, this includes
1051                                 AF_NETLINK and AF_UNIX. The latter has
1052                                 the effect that AF_UNIX sockets in the
1053                                 abstract socket namespace will become
1054                                 unavailable to the processes (however,
1055                                 those located in the file system will
1056                                 continue to be
1057                                 accessible).</para></listitem>
1058                         </varlistentry>
1059
1060                         <varlistentry>
1061                                 <term><varname>ProtectSystem=</varname></term>
1062
1063                                 <listitem><para>Takes a boolean
1064                                 argument or
1065                                 <literal>full</literal>. If true,
1066                                 mounts the <filename>/usr</filename>
1067                                 directory read-only for processes
1068                                 invoked by this unit. If set to
1069                                 <literal>full</literal>, the
1070                                 <filename>/etc</filename> directory is mounted
1071                                 read-only, too. This setting ensures
1072                                 that any modification of the vendor
1073                                 supplied operating system (and
1074                                 optionally its configuration) is
1075                                 prohibited for the service. It is
1076                                 recommended to enable this setting for
1077                                 all long-running services, unless they
1078                                 are involved with system updates or
1079                                 need to modify the operating system in
1080                                 other ways. Note however that
1081                                 processes retaining the CAP_SYS_ADMIN
1082                                 capability can undo the effect of this
1083                                 setting. This setting is hence
1084                                 particularly useful for daemons which
1085                                 have this capability removed, for
1086                                 example with
1087                                 <varname>CapabilityBoundingSet=</varname>. Defaults
1088                                 to off.</para></listitem>
1089                         </varlistentry>
1090
1091                         <varlistentry>
1092                                 <term><varname>ProtectHome=</varname></term>
1093
1094                                 <listitem><para>Takes a boolean
1095                                 argument or
1096                                 <literal>read-only</literal>. If true,
1097                                 the directories
1098                                 <filename>/home</filename> and
1099                                 <filename>/run/user</filename> are
1100                                 made inaccessible and empty for
1101                                 processes invoked by this unit. If set
1102                                 to <literal>read-only</literal>, the
1103                                 two directories are made read-only
1104                                 instead. It is recommended to enable
1105                                 this setting for all long-running
1106                                 services (in particular network-facing
1107                                 ones), to ensure they cannot get access
1108                                 to private user data, unless the
1109                                 services actually require access to
1110                                 the user's private data. Note however
1111                                 that processes retaining the
1112                                 CAP_SYS_ADMIN capability can undo the
1113                                 effect of this setting. This setting
1114                                 is hence particularly useful for
1115                                 daemons which have this capability
1116                                 removed, for example with
1117                                 <varname>CapabilityBoundingSet=</varname>. Defaults
1118                                 to off.</para></listitem>
1119                         </varlistentry>
1120
1121                         <varlistentry>
1122                                 <term><varname>MountFlags=</varname></term>
1123
1124                                 <listitem><para>Takes a mount
1125                                 propagation flag:
1126                                 <option>shared</option>,
1127                                 <option>slave</option> or
1128                                 <option>private</option>, which
1129                                 control whether mounts in the file
1130                                 system namespace set up for this
1131                                 unit's processes will receive or
1132                                 propagate mounts or unmounts. See
1133                                 <citerefentry><refentrytitle>mount</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1134                                 for details. Defaults to
1135                                 <option>shared</option>. Use
1136                                 <option>shared</option> to ensure that
1137                                 mounts and unmounts are propagated
1138                                 from the host to the container and
1139                                 vice versa. Use <option>slave</option>
1140                                 to run processes so that none of their
1141                                 mounts and unmounts will propagate to
1142                                 the host. Use <option>private</option>
1143                                 to also ensure that no mounts and
1144                                 unmounts from the host will propagate
1145                                 into the unit processes'
1146                                 namespace. Note that
1147                                 <option>slave</option> means that file
1148                                 systems mounted on the host might stay
1149                                 mounted continuously in the unit's
1150                                 namespace, and thus keep the device
1151                                 busy. Note that the file system
1152                                 namespace related options
1153                                 (<varname>PrivateTmp=</varname>,
1154                                 <varname>PrivateDevices=</varname>,
1155                                 <varname>ProtectSystem=</varname>,
1156                                 <varname>ProtectHome=</varname>,
1157                                 <varname>ReadOnlyDirectories=</varname>,
1158                                 <varname>InaccessibleDirectories=</varname>
1159                                 and
1160                                 <varname>ReadWriteDirectories=</varname>)
1161                                 require that mount and unmount
1162                                 propagation from the unit's file
1163                                 system namespace is disabled, and
1164                                 hence downgrade
1165                                 <option>shared</option> to
1166                                 <option>slave</option>.
1167                                 </para></listitem>
1168                         </varlistentry>
1169
1170                         <varlistentry>
1171                                 <term><varname>UtmpIdentifier=</varname></term>
1172
1173                                 <listitem><para>Takes a four
1174                                 character identifier string for an
1175                                 utmp/wtmp entry for this service. This
1176                                 should only be set for services such
1177                                 as <command>getty</command>
1178                                 implementations where utmp/wtmp
1179                                 entries must be created and cleared
1180                                 before and after execution. If the
1181                                 configured string is longer than four
1182                                 characters, it is truncated and the
1183                                 terminal four characters are
1184                                 used. This setting interprets %I style
1185                                 string replacements. This setting is
1186                                 unset by default, i.e. no utmp/wtmp
1187                                 entries are created or cleaned up for
1188                                 this service.</para></listitem>
1189                         </varlistentry>
1190
1191                         <varlistentry>
1192                                 <term><varname>SELinuxContext=</varname></term>
1193
1194                                 <listitem><para>Set the SELinux
1195                                 security context of the executed
1196                                 process. If set, this will override
1197                                 the automated domain
1198                                 transition. However, the policy still
1199                                 needs to authorize the transition. This
1200                                 directive is ignored if SELinux is
1201                                 disabled. If prefixed by
1202                                 <literal>-</literal>, all errors will
1203                                 be ignored. See
1204                                 <citerefentry><refentrytitle>setexeccon</refentrytitle><manvolnum>3</manvolnum></citerefentry>
1205                                 for details.</para></listitem>
1206                         </varlistentry>
1207
1208                         <varlistentry>
1209                                 <term><varname>AppArmorProfile=</varname></term>
1210
1211                                 <listitem><para>Takes a profile name as argument.
1212                                 The process executed by the unit will switch to
1213                                 this profile when started. Profiles must already
1214                                 be loaded in the kernel, or the unit will fail.
1215                                 This result in a non operation if AppArmor is not
1216                                 enabled. If prefixed by <literal>-</literal>, all errors
1217                                 will be ignored.
1218                                 </para></listitem>
1219                         </varlistentry>
1220
1221                         <varlistentry>
1222                                 <term><varname>SmackProcessLabel=</varname></term>
1223
1224                                 <listitem><para>Takes a
1225                                 <option>SMACK64</option> security
1226                                 label as argument. The process
1227                                 executed by the unit will be started
1228                                 under this label and SMACK will decide
1229                                 whether the processes is allowed to
1230                                 run or not based on it. The process
1231                                 will continue to run under the label
1232                                 specified here unless the executable
1233                                 has its own
1234                                 <option>SMACK64EXEC</option> label, in
1235                                 which case the process will transition
1236                                 to run under that label. When not
1237                                 specified, the label that systemd is
1238                                 running under is used. This directive
1239                                 is ignored if SMACK is
1240                                 disabled.</para>
1241
1242                                 <para>The value may be prefixed by
1243                                 <literal>-</literal>, in which case
1244                                 all errors will be ignored. An empty
1245                                 value may be specified to unset
1246                                 previous assignments.</para>
1247                                 </listitem>
1248                         </varlistentry>
1249
1250                         <varlistentry>
1251                                 <term><varname>IgnoreSIGPIPE=</varname></term>
1252
1253                                 <listitem><para>Takes a boolean
1254                                 argument. If true, causes <constant>SIGPIPE</constant> to be
1255                                 ignored in the executed
1256                                 process. Defaults to true because
1257                                 <constant>SIGPIPE</constant> generally is useful only in
1258                                 shell pipelines.</para></listitem>
1259                         </varlistentry>
1260
1261                         <varlistentry>
1262                                 <term><varname>NoNewPrivileges=</varname></term>
1263
1264                                 <listitem><para>Takes a boolean
1265                                 argument. If true, ensures that the
1266                                 service process and all its children
1267                                 can never gain new privileges. This
1268                                 option is more powerful than the respective
1269                                 secure bits flags (see above), as it
1270                                 also prohibits UID changes of any
1271                                 kind. This is the simplest, most
1272                                 effective way to ensure that a process
1273                                 and its children can never elevate
1274                                 privileges again.</para></listitem>
1275                         </varlistentry>
1276
1277                         <varlistentry>
1278                                 <term><varname>SystemCallFilter=</varname></term>
1279
1280                                 <listitem><para>Takes a
1281                                 space-separated list of system call
1282                                 names. If this setting is used, all
1283                                 system calls executed by the unit
1284                                 processes except for the listed ones
1285                                 will result in immediate process
1286                                 termination with the
1287                                 <constant>SIGSYS</constant> signal
1288                                 (whitelisting). If the first character
1289                                 of the list is <literal>~</literal>,
1290                                 the effect is inverted: only the
1291                                 listed system calls will result in
1292                                 immediate process termination
1293                                 (blacklisting). If running in user
1294                                 mode and this option is used,
1295                                 <varname>NoNewPrivileges=yes</varname>
1296                                 is implied. This feature makes use of the
1297                                 Secure Computing Mode 2 interfaces of
1298                                 the kernel ('seccomp filtering') and
1299                                 is useful for enforcing a minimal
1300                                 sandboxing environment. Note that the
1301                                 <function>execve</function>,
1302                                 <function>rt_sigreturn</function>,
1303                                 <function>sigreturn</function>,
1304                                 <function>exit_group</function>,
1305                                 <function>exit</function> system calls
1306                                 are implicitly whitelisted and do not
1307                                 need to be listed explicitly. This
1308                                 option may be specified more than once
1309                                 in which case the filter masks are
1310                                 merged. If the empty string is
1311                                 assigned, the filter is reset, all
1312                                 prior assignments will have no
1313                                 effect.</para>
1314
1315                                 <para>If you specify both types of
1316                                 this option (i.e. whitelisting and
1317                                 blacklisting), the first encountered
1318                                 will take precedence and will dictate
1319                                 the default action (termination or
1320                                 approval of a system call). Then the
1321                                 next occurrences of this option will
1322                                 add or delete the listed system calls
1323                                 from the set of the filtered system
1324                                 calls, depending of its type and the
1325                                 default action. (For example, if you have started
1326                                 with a whitelisting of
1327                                 <function>read</function> and
1328                                 <function>write</function>, and right
1329                                 after it add a blacklisting of
1330                                 <function>write</function>, then
1331                                 <function>write</function> will be
1332                                 removed from the set.)
1333                                 </para></listitem>
1334                         </varlistentry>
1335
1336                         <varlistentry>
1337                                 <term><varname>SystemCallErrorNumber=</varname></term>
1338
1339                                 <listitem><para>Takes an
1340                                 <literal>errno</literal> error number
1341                                 name to return when the system call
1342                                 filter configured with
1343                                 <varname>SystemCallFilter=</varname>
1344                                 is triggered, instead of terminating
1345                                 the process immediately. Takes an
1346                                 error name such as
1347                                 <constant>EPERM</constant>,
1348                                 <constant>EACCES</constant> or
1349                                 <constant>EUCLEAN</constant>. When this
1350                                 setting is not used, or when the empty
1351                                 string is assigned, the process will be
1352                                 terminated immediately when the filter
1353                                 is triggered.</para></listitem>
1354                         </varlistentry>
1355
1356                         <varlistentry>
1357                                 <term><varname>SystemCallArchitectures=</varname></term>
1358
1359                                 <listitem><para>Takes a space
1360                                 separated list of architecture
1361                                 identifiers to include in the system
1362                                 call filter. The known architecture
1363                                 identifiers are
1364                                 <constant>x86</constant>,
1365                                 <constant>x86-64</constant>,
1366                                 <constant>x32</constant>,
1367                                 <constant>arm</constant> as well as
1368                                 the special identifier
1369                                 <constant>native</constant>. Only
1370                                 system calls of the specified
1371                                 architectures will be permitted to
1372                                 processes of this unit. This is an
1373                                 effective way to disable compatibility
1374                                 with non-native architectures for
1375                                 processes, for example to prohibit
1376                                 execution of 32-bit x86 binaries on
1377                                 64-bit x86-64 systems. The special
1378                                 <constant>native</constant> identifier
1379                                 implicitly maps to the native
1380                                 architecture of the system (or more
1381                                 strictly: to the architecture the
1382                                 system manager is compiled for). If
1383                                 running in user mode and this option
1384                                 is used,
1385                                 <varname>NoNewPrivileges=yes</varname>
1386                                 is implied. Note that setting this
1387                                 option to a non-empty list implies
1388                                 that <constant>native</constant> is
1389                                 included too. By default, this option
1390                                 is set to the empty list, i.e. no
1391                                 architecture system call filtering is
1392                                 applied.</para></listitem>
1393                         </varlistentry>
1394
1395                         <varlistentry>
1396                                 <term><varname>RestrictAddressFamilies=</varname></term>
1397
1398                                 <listitem><para>Restricts the set of
1399                                 socket address families accessible to
1400                                 the processes of this unit. Takes a
1401                                 space-separated list of address family
1402                                 names to whitelist, such as
1403                                 <constant>AF_UNIX</constant>,
1404                                 <constant>AF_INET</constant> or
1405                                 <constant>AF_INET6</constant>. When
1406                                 prefixed with <constant>~</constant>
1407                                 the listed address families will be
1408                                 applied as blacklist, otherwise as
1409                                 whitelist. Note that this restricts
1410                                 access to the
1411                                 <citerefentry><refentrytitle>socket</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1412                                 system call only. Sockets passed into
1413                                 the process by other means (for
1414                                 example, by using socket activation
1415                                 with socket units, see
1416                                 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>)
1417                                 are unaffected. Also, sockets created
1418                                 with <function>socketpair()</function>
1419                                 (which creates connected AF_UNIX
1420                                 sockets only) are unaffected. Note
1421                                 that this option has no effect on
1422                                 32-bit x86 and is ignored (but works
1423                                 correctly on x86-64). If running in user
1424                                 mode and this option is used,
1425                                 <varname>NoNewPrivileges=yes</varname>
1426                                 is implied. By default, no
1427                                 restriction applies, all address
1428                                 families are accessible to
1429                                 processes. If assigned the empty
1430                                 string, any previous list changes are
1431                                 undone.</para>
1432
1433                                 <para>Use this option to limit
1434                                 exposure of processes to remote
1435                                 systems, in particular via exotic
1436                                 network protocols. Note that in most
1437                                 cases, the local
1438                                 <constant>AF_UNIX</constant> address
1439                                 family should be included in the
1440                                 configured whitelist as it is
1441                                 frequently used for local
1442                                 communication, including for
1443                                 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1444                                 logging.</para></listitem>
1445                         </varlistentry>
1446
1447                         <varlistentry>
1448                                 <term><varname>Personality=</varname></term>
1449
1450                                 <listitem><para>Controls which
1451                                 kernel architecture
1452                                 <citerefentry><refentrytitle>uname</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1453                                 shall report, when invoked by unit
1454                                 processes. Takes one of
1455                                 <constant>x86</constant> and
1456                                 <constant>x86-64</constant>. This is
1457                                 useful when running 32-bit services on
1458                                 a 64-bit host system. If not specified,
1459                                 the personality is left unmodified and
1460                                 thus reflects the personality of the
1461                                 host system's
1462                                 kernel.</para></listitem>
1463                         </varlistentry>
1464
1465                         <varlistentry>
1466                                 <term><varname>RuntimeDirectory=</varname></term>
1467                                 <term><varname>RuntimeDirectoryMode=</varname></term>
1468
1469                                 <listitem><para>Takes a list of
1470                                 directory names. If set, one or more
1471                                 directories by the specified names
1472                                 will be created below
1473                                 <filename>/run</filename> (for system
1474                                 services) or below
1475                                 <varname>$XDG_RUNTIME_DIR</varname>
1476                                 (for user services) when the unit is
1477                                 started, and removed when the unit is
1478                                 stopped. The directories will have the
1479                                 access mode specified in
1480                                 <varname>RuntimeDirectoryMode=</varname>,
1481                                 and will be owned by the user and
1482                                 group specified in
1483                                 <varname>User=</varname> and
1484                                 <varname>Group=</varname>. Use this to
1485                                 manage one or more runtime directories
1486                                 of the unit and bind their lifetime to
1487                                 the daemon runtime. The specified
1488                                 directory names must be relative, and
1489                                 may not include a
1490                                 <literal>/</literal>, i.e. must refer
1491                                 to simple directories to create or
1492                                 remove. This is particularly useful
1493                                 for unprivileged daemons that cannot
1494                                 create runtime directories in
1495                                 <filename>/run</filename> due to lack
1496                                 of privileges, and to make sure the
1497                                 runtime directory is cleaned up
1498                                 automatically after use. For runtime
1499                                 directories that require more complex
1500                                 or different configuration or lifetime
1501                                 guarantees, please consider using
1502                                 <citerefentry><refentrytitle>tmpfiles.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para></listitem>
1503                         </varlistentry>
1504
1505                 </variablelist>
1506         </refsect1>
1507
1508         <refsect1>
1509                 <title>Environment variables in spawned processes</title>
1510
1511                 <para>Processes started by the system are executed in
1512                 a clean environment in which select variables
1513                 listed below are set. System processes started by systemd
1514                 do not inherit variables from PID 1, but processes
1515                 started by user systemd instances inherit all
1516                 environment variables from the user systemd instance.
1517                 </para>
1518
1519                 <variablelist class='environment-variables'>
1520                         <varlistentry>
1521                                 <term><varname>$PATH</varname></term>
1522
1523                                 <listitem><para>Colon-separated list
1524                                 of directories to use when launching
1525                                 executables. Systemd uses a fixed
1526                                 value of
1527                                 <filename>/usr/local/sbin</filename>:<filename>/usr/local/bin</filename>:<filename>/usr/sbin</filename>:<filename>/usr/bin</filename>:<filename>/sbin</filename>:<filename>/bin</filename>.
1528                                 </para></listitem>
1529                         </varlistentry>
1530
1531                         <varlistentry>
1532                                 <term><varname>$LANG</varname></term>
1533
1534                                 <listitem><para>Locale. Can be set in
1535                                 <citerefentry><refentrytitle>locale.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1536                                 or on the kernel command line (see
1537                                 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
1538                                 and
1539                                 <citerefentry><refentrytitle>kernel-command-line</refentrytitle><manvolnum>7</manvolnum></citerefentry>).
1540                                 </para></listitem>
1541                         </varlistentry>
1542
1543                         <varlistentry>
1544                                 <term><varname>$USER</varname></term>
1545                                 <term><varname>$LOGNAME</varname></term>
1546                                 <term><varname>$HOME</varname></term>
1547                                 <term><varname>$SHELL</varname></term>
1548
1549                                 <listitem><para>User name (twice), home
1550                                 directory, and the login shell.
1551                                 The variables are set for the units that
1552                                 have <varname>User=</varname> set,
1553                                 which includes user
1554                                 <command>systemd</command> instances.
1555                                 See
1556                                 <citerefentry><refentrytitle>passwd</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
1557                                 </para></listitem>
1558                         </varlistentry>
1559
1560                         <varlistentry>
1561                                 <term><varname>$XDG_RUNTIME_DIR</varname></term>
1562
1563                                 <listitem><para>The directory for volatile
1564                                 state. Set for the user <command>systemd</command>
1565                                 instance, and also in user sessions.
1566                                 See
1567                                 <citerefentry><refentrytitle>pam_systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
1568                                 </para></listitem>
1569                         </varlistentry>
1570
1571                         <varlistentry>
1572                                 <term><varname>$XDG_SESSION_ID</varname></term>
1573                                 <term><varname>$XDG_SEAT</varname></term>
1574                                 <term><varname>$XDG_VTNR</varname></term>
1575
1576                                 <listitem><para>The identifier of the
1577                                 session, the seat name, and
1578                                 virtual terminal of the session. Set
1579                                 by
1580                                 <citerefentry><refentrytitle>pam_systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
1581                                 for login sessions.
1582                                 <varname>$XDG_SEAT</varname> and
1583                                 <varname>$XDG_VTNR</varname> will
1584                                 only be set when attached to a seat and a
1585                                 tty.</para></listitem>
1586                         </varlistentry>
1587
1588                         <varlistentry>
1589                                 <term><varname>$MAINPID</varname></term>
1590
1591                                 <listitem><para>The PID of the units
1592                                 main process if it is known. This is
1593                                 only set for control processes as
1594                                 invoked by
1595                                 <varname>ExecReload=</varname> and
1596                                 similar.  </para></listitem>
1597                         </varlistentry>
1598
1599                         <varlistentry>
1600                                 <term><varname>$MANAGERPID</varname></term>
1601
1602                                 <listitem><para>The PID of the user
1603                                 <command>systemd</command> instance,
1604                                 set for processes spawned by it.
1605                                 </para></listitem>
1606                         </varlistentry>
1607
1608                         <varlistentry>
1609                                 <term><varname>$LISTEN_FDS</varname></term>
1610                                 <term><varname>$LISTEN_PID</varname></term>
1611
1612                                 <listitem><para>Information about file
1613                                 descriptors passed to a service for
1614                                 socket activation.  See
1615                                 <citerefentry><refentrytitle>sd_listen_fds</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
1616                                 </para></listitem>
1617                         </varlistentry>
1618
1619                         <varlistentry>
1620                                 <term><varname>$TERM</varname></term>
1621
1622                                 <listitem><para>Terminal type, set
1623                                 only for units connected to a terminal
1624                                 (<varname>StandardInput=tty</varname>,
1625                                 <varname>StandardOutput=tty</varname>,
1626                                 or
1627                                 <varname>StandardError=tty</varname>).
1628                                 See
1629                                 <citerefentry project='man-pages'><refentrytitle>termcap</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
1630                                 </para></listitem>
1631                         </varlistentry>
1632                 </variablelist>
1633
1634                 <para>Additional variables may be configured by the
1635                 following means: for processes spawned in specific
1636                 units, use the <varname>Environment=</varname> and
1637                 <varname>EnvironmentFile=</varname> options above; to
1638                 specify variables globally, use
1639                 <varname>DefaultEnvironment=</varname> (see
1640                 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>)
1641                 or the kernel option
1642                 <varname>systemd.setenv=</varname> (see
1643                 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>). Additional
1644                 variables may also be set through PAM,
1645                 cf. <citerefentry project='man-pages'><refentrytitle>pam_env</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
1646         </refsect1>
1647
1648         <refsect1>
1649                   <title>See Also</title>
1650                   <para>
1651                           <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1652                           <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1653                           <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1654                           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1655                           <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1656                           <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1657                           <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1658                           <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1659                           <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1660                           <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1661                           <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
1662                           <citerefentry><refentrytitle>tmpfiles.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1663                           <citerefentry project='man-pages'><refentrytitle>exec</refentrytitle><manvolnum>3</manvolnum></citerefentry>
1664                   </para>
1665         </refsect1>
1666
1667 </refentry>