X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=man%2Fsystemd.exec.xml;h=2ccc470e26af0285b11c7d6d04bd84face0f0a1c;hb=74d005783e355acc784d123024e33bbb66ef9ef1;hp=c25d96e9fdde0c9aa4fb0dbfb6a1d809d937b85e;hpb=fbc15b7663730fd8c8c5cfcd54878a2e764c46ea;p=elogind.git diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index c25d96e9f..2ccc470e2 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -288,8 +288,9 @@ variables is reset, all prior assignments have no effect. Variable expansion is not performed - inside the strings, and $ has no special - meaning. + inside the strings, however, specifier + expansion is possible. $ character has + no special meaning. If you need to assign a value containing spaces to a variable, use double quotes (") for the assignment. @@ -720,9 +721,9 @@ separated list of capability names as read by cap_from_name3, - e.g. CAP_SYS_ADMIN - CAP_DAC_OVERRIDE - CAP_SYS_PTRACE. + e.g. CAP_SYS_ADMIN, + CAP_DAC_OVERRIDE, + CAP_SYS_PTRACE. Capabilities listed will be included in the bounding set, all others are removed. If the list of capabilities @@ -799,10 +800,10 @@ space-separated list of cgroup identifiers. A cgroup identifier is formatted like - cpu:/foo/bar, + cpu:/foo/bar, where "cpu" indicates the kernel control group controller used, and - /foo/bar is the + /foo/bar is the control group path. The controller name and ":" may be omitted in which case the named systemd control group @@ -1068,10 +1069,10 @@ InaccessibleDirectories= Sets up a new - file-system name space for executed + file system namespace for executed processes. These options may be used to limit access a process might have - to the main file-system + to the main file system hierarchy. Each setting takes a space-separated list of absolute directory paths. Directories listed in @@ -1216,7 +1217,8 @@ system calls executed by the unit process except for the listed ones will result in immediate process - termination with the SIGSYS signal + termination with the + SIGSYS signal (whitelisting). If the first character of the list is ~ the effect is inverted: only the