1 <?xml version='1.0'?> <!--*-nxml-*-->
2 <?xml-stylesheet type="text/xsl" href="http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl"?>
3 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
4 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
7 This file is part of systemd.
9 Copyright 2010 Lennart Poettering
11 systemd is free software; you can redistribute it and/or modify it
12 under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 2 of the License, or
14 (at your option) any later version.
16 systemd is distributed in the hope that it will be useful, but
17 WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
19 General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with systemd; If not, see <http://www.gnu.org/licenses/>.
25 <refentry id="systemd.exec">
27 <title>systemd.exec</title>
28 <productname>systemd</productname>
32 <contrib>Developer</contrib>
33 <firstname>Lennart</firstname>
34 <surname>Poettering</surname>
35 <email>lennart@poettering.net</email>
41 <refentrytitle>systemd.exec</refentrytitle>
42 <manvolnum>5</manvolnum>
46 <refname>systemd.exec</refname>
47 <refpurpose>systemd execution environment configuration</refpurpose>
51 <para><filename>systemd.service</filename>,
52 <filename>systemd.socket</filename>,
53 <filename>systemd.mount</filename>,
54 <filename>systemd.swap</filename></para>
58 <title>Description</title>
60 <para>Unit configuration files for services, sockets,
61 mount points and swap devices share a subset of
62 configuration options which define the execution
63 environment of spawned processes.</para>
65 <para>This man page lists the configuration options
66 shared by these four unit types. See
67 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
68 for the common options of all unit configuration
70 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
71 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
72 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>
74 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>
75 for more information on the specific unit
76 configuration files. The execution specific
77 configuration options are configured in the [Service],
78 [Socket], [Mount] resp. [Swap] section, depending on the unit
83 <title>Options</title>
88 <term><varname>WorkingDirectory=</varname></term>
90 <listitem><para>Takes an absolute
91 directory path. Sets the working
92 directory for executed
93 processes.</para></listitem>
97 <term><varname>RootDirectory=</varname></term>
99 <listitem><para>Takes an absolute
100 directory path. Sets the root
101 directory for executed processes, with
103 <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry>
104 system call. If this is used it must
105 be ensured that the process and all
106 its auxiliary files are available in
107 the <function>chroot()</function>
108 jail.</para></listitem>
112 <term><varname>User=</varname></term>
113 <term><varname>Group=</varname></term>
115 <listitem><para>Sets the Unix user
116 resp. group the processes are executed
117 as. Takes a single user resp. group
118 name or ID as argument. If no group is
119 set the default group of the user is
120 chosen.</para></listitem>
124 <term><varname>SupplementaryGroups=</varname></term>
126 <listitem><para>Sets the supplementary
127 Unix groups the processes are executed
128 as. This takes a space separated list
129 of group names or IDs. This option may
130 be specified more than once in which
131 case all listed groups are set as
132 supplementary groups. This option does
133 not override but extends the list of
134 supplementary groups configured in the
135 system group database for the
136 user.</para></listitem>
140 <term><varname>Nice=</varname></term>
142 <listitem><para>Sets the default nice
143 level (scheduling priority) for
144 executed processes. Takes an integer
145 between -20 (highest priority) and 19
146 (lowest priority). See
147 <citerefentry><refentrytitle>setpriority</refentrytitle><manvolnum>2</manvolnum></citerefentry>
148 for details.</para></listitem>
152 <term><varname>OOMScoreAdjust=</varname></term>
154 <listitem><para>Sets the adjustment
155 level for the Out-Of-Memory killer for
156 executed processes. Takes an integer
157 between -1000 (to disable OOM killing
158 for this process) and 1000 (to make
159 killing of this process under memory
160 pressure very likely). See <ulink
161 url="http://www.kernel.org/doc/Documentation/filesystems/proc.txt">proc.txt</ulink>
162 for details.</para></listitem>
166 <term><varname>IOSchedulingClass=</varname></term>
168 <listitem><para>Sets the IO scheduling
169 class for executed processes. Takes an
170 integer between 0 and 3 or one of the
171 strings <option>none</option>,
172 <option>realtime</option>,
173 <option>best-effort</option> or
174 <option>idle</option>. See
175 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
176 for details.</para></listitem>
180 <term><varname>IOSchedulingPriority=</varname></term>
182 <listitem><para>Sets the IO scheduling
183 priority for executed processes. Takes
184 an integer between 0 (highest
185 priority) and 7 (lowest priority). The
186 available priorities depend on the
187 selected IO scheduling class (see
189 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
190 for details.</para></listitem>
194 <term><varname>CPUSchedulingPolicy=</varname></term>
196 <listitem><para>Sets the CPU
197 scheduling policy for executed
198 processes. Takes one of
199 <option>other</option>,
200 <option>batch</option>,
201 <option>idle</option>,
202 <option>fifo</option> or
203 <option>rr</option>. See
204 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
205 for details.</para></listitem>
209 <term><varname>CPUSchedulingPriority=</varname></term>
211 <listitem><para>Sets the CPU
212 scheduling priority for executed
213 processes. Takes an integer between 1
214 (lowest priority) and 99 (highest
215 priority). The available priority
216 range depends on the selected CPU
217 scheduling policy (see above). See
218 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
219 for details.</para></listitem>
223 <term><varname>CPUSchedulingResetOnFork=</varname></term>
225 <listitem><para>Takes a boolean
226 argument. If true elevated CPU
227 scheduling priorities and policies
228 will be reset when the executed
229 processes fork, and can hence not leak
230 into child processes. See
231 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
232 for details. Defaults to false.</para></listitem>
236 <term><varname>CPUAffinity=</varname></term>
238 <listitem><para>Controls the CPU
239 affinity of the executed
240 processes. Takes a space-separated
241 list of CPU indexes. See
242 <citerefentry><refentrytitle>sched_setaffinity</refentrytitle><manvolnum>2</manvolnum></citerefentry>
243 for details.</para></listitem>
247 <term><varname>UMask=</varname></term>
249 <listitem><para>Controls the file mode
250 creation mask. Takes an access mode in
252 <citerefentry><refentrytitle>umask</refentrytitle><manvolnum>2</manvolnum></citerefentry>
253 for details. Defaults to
254 0022.</para></listitem>
258 <term><varname>Environment=</varname></term>
260 <listitem><para>Sets environment
261 variables for executed
262 processes. Takes a space-separated
263 list of variable assignments. This
264 option may be specified more than once
265 in which case all listed variables
266 will be set. If the same variable is
267 set twice the later setting will
268 override the earlier setting. See
269 <citerefentry><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>
270 for details.</para></listitem>
273 <term><varname>EnvironmentFile=</varname></term>
274 <listitem><para>Similar to
275 <varname>Environment=</varname> but
276 reads the environment variables from a
277 text file. The text file should
278 contain new-line separated variable
279 assignments. Empty lines and lines
280 starting with ; or # will be ignored,
281 which may be used for commenting. The
282 parser strips leading and
283 trailing whitespace from the values
284 of assignments, unless you use
287 argument passed should be an absolute
288 file name, optionally prefixed with
289 "-", which indicates that if the file
290 does not exist it won't be read and no
291 error or warning message is
292 logged. The files listed with this
293 directive will be read shortly before
294 the process is executed. Settings from
295 these files override settings made
297 <varname>Environment=</varname>. If
298 the same variable is set twice from
299 these files the files will be read in
300 the order they are specified and the
301 later setting will override the
302 earlier setting. </para></listitem>
306 <term><varname>StandardInput=</varname></term>
307 <listitem><para>Controls where file
308 descriptor 0 (STDIN) of the executed
309 processes is connected to. Takes one
310 of <option>null</option>,
311 <option>tty</option>,
312 <option>tty-force</option>,
313 <option>tty-fail</option> or
314 <option>socket</option>. If
315 <option>null</option> is selected
316 standard input will be connected to
317 <filename>/dev/null</filename>,
318 i.e. all read attempts by the process
319 will result in immediate EOF. If
320 <option>tty</option> is selected
321 standard input is connected to a TTY
323 <varname>TTYPath=</varname>, see
324 below) and the executed process
325 becomes the controlling process of the
326 terminal. If the terminal is already
327 being controlled by another process the
328 executed process waits until the current
329 controlling process releases the
331 <option>tty-force</option>
332 is similar to <option>tty</option>,
333 but the executed process is forcefully
334 and immediately made the controlling
335 process of the terminal, potentially
336 removing previous controlling
338 terminal. <option>tty-fail</option> is
339 similar to <option>tty</option> but if
340 the terminal already has a controlling
341 process start-up of the executed
343 <option>socket</option> option is only
344 valid in socket-activated services,
345 and only when the socket configuration
347 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>
348 for details) specifies a single socket
349 only. If this option is set standard
350 input will be connected to the socket
351 the service was activated from, which
352 is primarily useful for compatibility
353 with daemons designed for use with the
355 <citerefentry><refentrytitle>inetd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
356 daemon. This setting defaults to
357 <option>null</option>.</para></listitem>
360 <term><varname>StandardOutput=</varname></term>
361 <listitem><para>Controls where file
362 descriptor 1 (STDOUT) of the executed
363 processes is connected to. Takes one
364 of <option>inherit</option>,
365 <option>null</option>,
366 <option>tty</option>,
367 <option>syslog</option>,
368 <option>kmsg</option>,
369 <option>journal</option>,
370 <option>syslog+console</option>,
371 <option>kmsg+console</option>,
372 <option>journal+console</option> or
373 <option>socket</option>. If set to
374 <option>inherit</option> the file
375 descriptor of standard input is
376 duplicated for standard output. If set
377 to <option>null</option> standard
378 output will be connected to
379 <filename>/dev/null</filename>,
380 i.e. everything written to it will be
381 lost. If set to <option>tty</option>
382 standard output will be connected to a
383 tty (as configured via
384 <varname>TTYPath=</varname>, see
385 below). If the TTY is used for output
386 only the executed process will not
387 become the controlling process of the
388 terminal, and will not fail or wait
389 for other processes to release the
390 terminal. <option>syslog</option>
391 connects standard output to the
392 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
394 service. <option>kmsg</option>
395 connects it with the kernel log buffer
396 which is accessible via
397 <citerefentry><refentrytitle>dmesg</refentrytitle><manvolnum>1</manvolnum></citerefentry>. <option>journal</option>
398 connects it with the journal which is
400 <citerefentry><refentrytitle>systemd-journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
401 (Note that everything that is written
402 to syslog or kmsg is implicitly stored
403 in the journal as well, those options
404 are hence supersets of this
405 one). <option>syslog+console</option>,
406 <option>journal+console</option> and
407 <option>kmsg+console</option> work
408 similarly but copy the output to the
410 well. <option>socket</option> connects
411 standard output to a socket from
412 socket activation, semantics are
413 similar to the respective option of
414 <varname>StandardInput=</varname>.
415 This setting defaults to the value set
417 <option>DefaultStandardOutput=</option>
419 <citerefentry><refentrytitle>systemd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
421 <option>journal</option>.</para></listitem>
424 <term><varname>StandardError=</varname></term>
425 <listitem><para>Controls where file
426 descriptor 2 (STDERR) of the executed
427 processes is connected to. The
428 available options are identical to
430 <varname>StandardOutput=</varname>,
431 with one exception: if set to
432 <option>inherit</option> the file
433 descriptor used for standard output is
434 duplicated for standard error. This
435 setting defaults to the value set with
436 <option>DefaultStandardError=</option>
438 <citerefentry><refentrytitle>systemd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
440 <option>inherit</option>.</para></listitem>
443 <term><varname>TTYPath=</varname></term>
444 <listitem><para>Sets the terminal
445 device node to use if standard input,
446 output or stderr are connected to a
447 TTY (see above). Defaults to
448 <filename>/dev/console</filename>.</para></listitem>
451 <term><varname>TTYReset=</varname></term>
452 <listitem><para>Reset the terminal
453 device specified with
454 <varname>TTYPath=</varname> before and
455 after execution. Defaults to
456 <literal>no</literal>.</para></listitem>
459 <term><varname>TTYVHangup=</varname></term>
460 <listitem><para>Disconnect all clients
461 which have opened the terminal device
463 <varname>TTYPath=</varname>
464 before and after execution. Defaults
466 <literal>no</literal>.</para></listitem>
469 <term><varname>TTYVTDisallocate=</varname></term>
470 <listitem><para>If the the terminal
471 device specified with
472 <varname>TTYPath=</varname> is a
473 virtual console terminal try to
474 deallocate the TTY before and after
475 execution. This ensures that the
476 screen and scrollback buffer is
478 <literal>no</literal>.</para></listitem>
481 <term><varname>SyslogIdentifier=</varname></term>
482 <listitem><para>Sets the process name
483 to prefix log lines sent to syslog or
484 the kernel log buffer with. If not set
485 defaults to the process name of the
486 executed process. This option is only
488 <varname>StandardOutput=</varname> or
489 <varname>StandardError=</varname> are
490 set to <option>syslog</option> or
491 <option>kmsg</option>.</para></listitem>
494 <term><varname>SyslogFacility=</varname></term>
495 <listitem><para>Sets the syslog
496 facility to use when logging to
497 syslog. One of <option>kern</option>,
498 <option>user</option>,
499 <option>mail</option>,
500 <option>daemon</option>,
501 <option>auth</option>,
502 <option>syslog</option>,
503 <option>lpr</option>,
504 <option>news</option>,
505 <option>uucp</option>,
506 <option>cron</option>,
507 <option>authpriv</option>,
508 <option>ftp</option>,
509 <option>local0</option>,
510 <option>local1</option>,
511 <option>local2</option>,
512 <option>local3</option>,
513 <option>local4</option>,
514 <option>local5</option>,
515 <option>local6</option> or
516 <option>local7</option>. See
517 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
518 for details. This option is only
520 <varname>StandardOutput=</varname> or
521 <varname>StandardError=</varname> are
522 set to <option>syslog</option>.
524 <option>daemon</option>.</para></listitem>
527 <term><varname>SyslogLevel=</varname></term>
528 <listitem><para>Default syslog level
529 to use when logging to syslog or the
530 kernel log buffer. One of
531 <option>emerg</option>,
532 <option>alert</option>,
533 <option>crit</option>,
534 <option>err</option>,
535 <option>warning</option>,
536 <option>notice</option>,
537 <option>info</option>,
538 <option>debug</option>. See
539 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
540 for details. This option is only
542 <varname>StandardOutput=</varname> or
543 <varname>StandardError=</varname> are
544 set to <option>syslog</option> or
545 <option>kmsg</option>. Note that
546 individual lines output by the daemon
547 might be prefixed with a different log
548 level which can be used to override
549 the default log level specified
550 here. The interpretation of these
551 prefixes may be disabled with
552 <varname>SyslogLevelPrefix=</varname>,
553 see below. For details see
554 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
557 <option>info</option>.</para></listitem>
561 <term><varname>SyslogLevelPrefix=</varname></term>
562 <listitem><para>Takes a boolean
563 argument. If true and
564 <varname>StandardOutput=</varname> or
565 <varname>StandardError=</varname> are
566 set to <option>syslog</option> or
567 <option>kmsg</option> log lines
568 written by the executed process that
569 are prefixed with a log level will be
570 passed on to syslog with this log
571 level set but the prefix removed. If
572 set to false, the interpretation of
573 these prefixes is disabled and the
574 logged lines are passed on as-is. For
575 details about this prefixing see
576 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
577 Defaults to true.</para></listitem>
581 <term><varname>TimerSlackNSec=</varname></term>
582 <listitem><para>Sets the timer slack
583 in nanoseconds for the executed
584 processes. The timer slack controls the
585 accuracy of wake-ups triggered by
587 <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
588 for more information. Note that in
589 contrast to most other time span
590 definitions this parameter takes an
591 integer value in nano-seconds and does
592 not understand any other
593 units.</para></listitem>
597 <term><varname>LimitCPU=</varname></term>
598 <term><varname>LimitFSIZE=</varname></term>
599 <term><varname>LimitDATA=</varname></term>
600 <term><varname>LimitSTACK=</varname></term>
601 <term><varname>LimitCORE=</varname></term>
602 <term><varname>LimitRSS=</varname></term>
603 <term><varname>LimitNOFILE=</varname></term>
604 <term><varname>LimitAS=</varname></term>
605 <term><varname>LimitNPROC=</varname></term>
606 <term><varname>LimitMEMLOCK=</varname></term>
607 <term><varname>LimitLOCKS=</varname></term>
608 <term><varname>LimitSIGPENDING=</varname></term>
609 <term><varname>LimitMSGQUEUE=</varname></term>
610 <term><varname>LimitNICE=</varname></term>
611 <term><varname>LimitRTPRIO=</varname></term>
612 <term><varname>LimitRTTIME=</varname></term>
613 <listitem><para>These settings control
614 various resource limits for executed
616 <citerefentry><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry>
617 for details. Use the string
618 <varname>infinity</varname> to
619 configure no limit on a specific
620 resource.</para></listitem>
624 <term><varname>PAMName=</varname></term>
625 <listitem><para>Sets the PAM service
626 name to set up a session as. If set
627 the executed process will be
628 registered as a PAM session under the
629 specified service name. This is only
630 useful in conjunction with the
631 <varname>User=</varname> setting. If
632 not set no PAM session will be opened
633 for the executed processes. See
634 <citerefentry><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>
635 for details.</para></listitem>
639 <term><varname>TCPWrapName=</varname></term>
640 <listitem><para>If this is a
641 socket-activated service this sets the
642 tcpwrap service name to check the
643 permission for the current connection
644 with. This is only useful in
645 conjunction with socket-activated
646 services, and stream sockets (TCP) in
647 particular. It has no effect on other
648 socket types (e.g. datagram/UDP) and on processes
649 unrelated to socket-based
650 activation. If the tcpwrap
651 verification fails daemon start-up
652 will fail and the connection is
654 <citerefentry><refentrytitle>tcpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
655 for details.</para></listitem>
659 <term><varname>CapabilityBoundingSet=</varname></term>
661 <listitem><para>Controls which
662 capabilities to include in the
663 capability bounding set for the
664 executed process. See
665 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
666 for details. Takes a whitespace
667 separated list of capability names as
669 <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
670 Capabilities listed will be included
671 in the bounding set, all others are
672 removed. If the list of capabilities
673 is prefixed with ~ all but the listed
674 capabilities will be included, the
675 effect of the assignment
676 inverted. Note that this option does
677 not actually set or unset any
678 capabilities in the effective,
679 permitted or inherited capability
681 <varname>Capabilities=</varname> is
682 for. If this option is not used the
683 capability bounding set is not
684 modified on process execution, hence
685 no limits on the capabilities of the
686 process are enforced.</para></listitem>
690 <term><varname>SecureBits=</varname></term>
691 <listitem><para>Controls the secure
692 bits set for the executed process. See
693 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
694 for details. Takes a list of strings:
695 <option>keep-caps</option>,
696 <option>keep-caps-locked</option>,
697 <option>no-setuid-fixup</option>,
698 <option>no-setuid-fixup-locked</option>,
699 <option>noroot</option> and/or
700 <option>noroot-locked</option>.
705 <term><varname>Capabilities=</varname></term>
706 <listitem><para>Controls the
707 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
708 set for the executed process. Take a
709 capability string describing the
710 effective, permitted and inherited
711 capability sets as documented in
712 <citerefentry><refentrytitle>cap_from_text</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
713 Note that these capability sets are
714 usually influenced by the capabilities
715 attached to the executed file. Due to
717 <varname>CapabilityBoundingSet=</varname>
718 is probably the much more useful
719 setting.</para></listitem>
723 <term><varname>ControlGroup=</varname></term>
725 <listitem><para>Controls the control
726 groups the executed processes shall be
727 made members of. Takes a
728 space-separated list of cgroup
729 identifiers. A cgroup identifier has a
731 <filename>cpu:/foo/bar</filename>,
732 where "cpu" identifies the kernel
733 control group controller used, and
734 <filename>/foo/bar</filename> is the
735 control group path. The controller
736 name and ":" may be omitted in which
737 case the named systemd control group
738 hierarchy is implied. Alternatively,
739 the path and ":" may be omitted, in
740 which case the default control group
741 path for this unit is implied. This
742 option may be used to place executed
743 processes in arbitrary groups in
744 arbitrary hierarchies -- which can be
745 configured externally with additional
746 execution limits. By default systemd
747 will place all executed processes in
748 separate per-unit control groups
749 (named after the unit) in the systemd
750 named hierarchy. Since every process
751 can be in one group per hierarchy only
752 overriding the control group path in
753 the named systemd hierarchy will
754 disable automatic placement in the
755 default group. This option is
756 primarily intended to place executed
757 processes in specific paths in
758 specific kernel controller
759 hierarchies. It is however not
760 recommended to manipulate the service
761 control group path in the systemd
762 named hierarchy. For details about
763 control groups see <ulink
764 url="http://www.kernel.org/doc/Documentation/cgroups/cgroups.txt">cgroups.txt</ulink>.</para></listitem>
768 <term><varname>ControlGroupModify=</varname></term>
769 <listitem><para>Takes a boolean
770 argument. If true, the control groups
771 created for this unit will be owned by
772 the user specified with
773 <varname>User=</varname> (and the
774 appropriate group), and he/she can create
775 subgroups as well as add processes to
776 the group.</para></listitem>
780 <term><varname>ControlGroupAttribute=</varname></term>
782 <listitem><para>Set a specific control
783 group attribute for executed
784 processes, and (if needed) add the the
785 executed processes to a cgroup in the
786 hierarchy of the controller the
787 attribute belongs to. Takes two
788 space-separated arguments: the
789 attribute name (syntax is
790 <literal>cpu.shares</literal> where
791 <literal>cpu</literal> refers to a
792 specific controller and
793 <literal>shares</literal> to the
794 attribute name), and the attribute
796 <literal>ControlGroupAttribute=cpu.shares
797 512</literal>. If this option is used
798 for an attribute that belongs to a
799 kernel controller hierarchy the unit
800 is not already configured to be added
801 to (for example via the
802 <literal>ControlGroup=</literal>
803 option) then the unit will be added to
804 the controller and the default unit
805 cgroup path is implied. Thus, using
806 <varname>ControlGroupAttribute=</varname>
807 is in most case sufficient to make use
808 of control group enforcements,
810 <varname>ControlGroup=</varname> are
811 only necessary in case the implied
812 default control group path for a
813 service is not desirable. For details
814 about control group attributes see
816 url="http://www.kernel.org/doc/Documentation/cgroups/cgroups.txt">cgroups.txt</ulink>. This
817 option may appear more than once, in
818 order to set multiple control group
819 attributes.</para></listitem>
823 <term><varname>CPUShares=</varname></term>
825 <listitem><para>Assign the specified
826 overall CPU time shares to the
827 processes executed. Takes an integer
828 value. This controls the
829 <literal>cpu.shares</literal> control
830 group attribute, which defaults to
831 1024. For details about this control
832 group attribute see <ulink
833 url="http://www.kernel.org/doc/Documentation/scheduler/sched-design-CFS.txt">sched-design-CFS.txt</ulink>.</para></listitem>
837 <term><varname>MemoryLimit=</varname></term>
838 <term><varname>MemorySoftLimit=</varname></term>
840 <listitem><para>Limit the overall memory usage
841 of the executed processes to a certain
842 size. Takes a memory size in bytes. If
843 the value is suffixed with K, M, G or
844 T the specified memory size is parsed
845 as Kilobytes, Megabytes, Gigabytes,
846 resp. Terabytes (to the base
847 1024). This controls the
848 <literal>memory.limit_in_bytes</literal>
850 <literal>memory.soft_limit_in_bytes</literal>
851 control group attributes. For details
852 about these control group attributes
854 url="http://www.kernel.org/doc/Documentation/cgroups/memory.txt">memory.txt</ulink>.</para></listitem>
858 <term><varname>DeviceAllow=</varname></term>
859 <term><varname>DeviceDeny=</varname></term>
861 <listitem><para>Control access to
862 specific device nodes by the executed processes. Takes two
863 space separated strings: a device node
865 <filename>/dev/null</filename>)
866 followed by a combination of r, w, m
867 to control reading, writing resp.
868 creating of the specific device node
869 by the unit. This controls the
870 <literal>devices.allow</literal>
872 <literal>devices.deny</literal>
873 control group attributes. For details
874 about these control group attributes
876 url="http://www.kernel.org/doc/Documentation/cgroups/devices.txt">devices.txt</ulink>.</para></listitem>
880 <term><varname>BlockIOWeight=</varname></term>
882 <listitem><para>Set the default or
883 per-device overall block IO weight
884 value for the executed
885 processes. Takes either a single
886 weight value (between 10 and 1000) to
887 set the default block IO weight, or a
888 space separated pair of a file path
889 and a weight value to specify the
890 device specific weight value (Example:
891 "/dev/sda 500"). The file path may be
892 specified as path to a block device
893 node or as any other file in which
894 case the backing block device of the
895 file system of the file is
896 determined. This controls the
897 <literal>blkio.weight</literal> and
898 <literal>blkio.weight_device</literal>
899 control group attributes, which
900 default to 1000. Use this option
901 multiple times to set weights for
902 multiple devices. For details about
903 these control group attributes see
905 url="http://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt">blkio-controller.txt</ulink>.</para></listitem>
909 <term><varname>BlockIOReadBandwidth=</varname></term>
910 <term><varname>BlockIOWriteBandwidth=</varname></term>
912 <listitem><para>Set the per-device
913 overall block IO bandwith limit for
914 the executed processes. Takes a space
915 separated pair of a file path and a
916 bandwith value (in bytes per second)
917 to specify the device specific
918 bandwidth. The file path may be
919 specified as path to a block device
920 node or as any other file in which
921 case the backing block device of the
922 file system of the file is determined.
923 If the bandwith is suffixed with K, M,
924 G, or T the specified bandwith is
925 parsed as Kilobytes, Megabytes,
926 Gigabytes, resp. Terabytes (Example:
927 "/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0
928 5M"). This controls the
929 <literal>blkio.read_bps_device</literal>
931 <literal>blkio.write_bps_device</literal>
932 control group attributes. Use this
933 option multiple times to set bandwith
934 limits for multiple devices. For
935 details about these control group
936 attributes see <ulink
937 url="http://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt">blkio-controller.txt</ulink>.</para></listitem>
941 <term><varname>ReadWriteDirectories=</varname></term>
942 <term><varname>ReadOnlyDirectories=</varname></term>
943 <term><varname>InaccessibleDirectories=</varname></term>
945 <listitem><para>Sets up a new
946 file-system name space for executed
947 processes. These options may be used
948 to limit access a process might have
949 to the main file-system
950 hierarchy. Each setting takes a
951 space-separated list of absolute
952 directory paths. Directories listed in
953 <varname>ReadWriteDirectories=</varname>
954 are accessible from within the
955 namespace with the same access rights
956 as from outside. Directories listed in
957 <varname>ReadOnlyDirectories=</varname>
958 are accessible for reading only,
959 writing will be refused even if the
960 usual file access controls would
961 permit this. Directories listed in
962 <varname>InaccessibleDirectories=</varname>
963 will be made inaccessible for processes
964 inside the namespace. Note that
965 restricting access with these options
966 does not extend to submounts of a
967 directory. You must list submounts
968 separately in these settings to
969 ensure the same limited access. These
970 options may be specified more than
971 once in which case all directories
972 listed will have limited access from
974 namespace.</para></listitem>
978 <term><varname>PrivateTmp=</varname></term>
980 <listitem><para>Takes a boolean
981 argument. If true sets up a new file
982 system namespace for the executed
983 processes and mounts a private
984 <filename>/tmp</filename> directory
985 inside it, that is not shared by
986 processes outside of the
987 namespace. This is useful to secure
988 access to temporary files of the
989 process, but makes sharing between
991 <filename>/tmp</filename>
992 impossible. Defaults to
993 false.</para></listitem>
997 <term><varname>PrivateNetwork=</varname></term>
999 <listitem><para>Takes a boolean
1000 argument. If true sets up a new
1001 network namespace for the executed
1002 processes and configures only the
1003 loopback network device
1004 <literal>lo</literal> inside it. No
1005 other network devices will be
1006 available to the executed process.
1007 This is useful to securely turn off
1008 network access by the executed
1009 process. Defaults to
1010 false.</para></listitem>
1014 <term><varname>MountFlags=</varname></term>
1016 <listitem><para>Takes a mount
1018 <option>shared</option>,
1019 <option>slave</option> or
1020 <option>private</option>, which
1021 control whether namespaces set up with
1022 <varname>ReadWriteDirectories=</varname>,
1023 <varname>ReadOnlyDirectories=</varname>
1025 <varname>InaccessibleDirectories=</varname>
1026 receive or propagate new mounts
1027 from/to the main namespace. See
1028 <citerefentry><refentrytitle>mount</refentrytitle><manvolnum>1</manvolnum></citerefentry>
1029 for details. Defaults to
1030 <option>shared</option>, i.e. the new
1031 namespace will both receive new mount
1032 points from the main namespace as well
1033 as propagate new mounts to
1034 it.</para></listitem>
1038 <term><varname>UtmpIdentifier=</varname></term>
1040 <listitem><para>Takes a a four
1041 character identifier string for an
1042 utmp/wtmp entry for this service. This
1043 should only be set for services such
1044 as <command>getty</command>
1045 implementations where utmp/wtmp
1046 entries must be created and cleared
1047 before and after execution. If the
1048 configured string is longer than four
1049 characters it is truncated and the
1050 terminal four characters are
1051 used. This setting interprets %I style
1052 string replacements. This setting is
1053 unset by default, i.e. no utmp/wtmp
1054 entries are created or cleaned up for
1055 this service.</para></listitem>
1062 <title>See Also</title>
1064 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1065 <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1066 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1067 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1068 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1069 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1070 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>