man/systemd.exec.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <?xml-stylesheet type="text/xsl" href="http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl"?>
   3 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   4         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   5
   6 <!--
   7   This file is part of systemd.
   8
   9   Copyright 2010 Lennart Poettering
  10
  11   systemd is free software; you can redistribute it and/or modify it
  12   under the terms of the GNU Lesser General Public License as published by
  13   the Free Software Foundation; either version 2.1 of the License, or
  14   (at your option) any later version.
  15
  16   systemd is distributed in the hope that it will be useful, but
  17   WITHOUT ANY WARRANTY; without even the implied warranty of
  18   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  19   Lesser General Public License for more details.
  20
  21   You should have received a copy of the GNU Lesser General Public License
  22   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  23 -->
  24
  25 <refentry id="systemd.exec">
  26         <refentryinfo>
  27                 <title>systemd.exec</title>
  28                 <productname>systemd</productname>
  29
  30                 <authorgroup>
  31                         <author>
  32                                 <contrib>Developer</contrib>
  33                                 <firstname>Lennart</firstname>
  34                                 <surname>Poettering</surname>
  35                                 <email>lennart@poettering.net</email>
  36                         </author>
  37                 </authorgroup>
  38         </refentryinfo>
  39
  40         <refmeta>
  41                 <refentrytitle>systemd.exec</refentrytitle>
  42                 <manvolnum>5</manvolnum>
  43         </refmeta>
  44
  45         <refnamediv>
  46                 <refname>systemd.exec</refname>
  47                 <refpurpose>systemd execution environment configuration</refpurpose>
  48         </refnamediv>
  49
  50         <refsynopsisdiv>
  51                 <para><filename>systemd.service</filename>,
  52                 <filename>systemd.socket</filename>,
  53                 <filename>systemd.mount</filename>,
  54                 <filename>systemd.swap</filename></para>
  55         </refsynopsisdiv>
  56
  57         <refsect1>
  58                 <title>Description</title>
  59
  60                 <para>Unit configuration files for services, sockets,
  61                 mount points and swap devices share a subset of
  62                 configuration options which define the execution
  63                 environment of spawned processes.</para>
  64
  65                 <para>This man page lists the configuration options
  66                 shared by these four unit types. See
  67                 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
  68                 for the common options of all unit configuration
  69                 files, and
  70                 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
  71                 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
  72                 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>
  73                 and
  74                 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>
  75                 for more information on the specific unit
  76                 configuration files. The execution specific
  77                 configuration options are configured in the [Service],
  78                 [Socket], [Mount] resp. [Swap] section, depending on the unit
  79                 type.</para>
  80         </refsect1>
  81
  82         <refsect1>
  83                 <title>Options</title>
  84
  85                 <variablelist>
  86
  87                         <varlistentry>
  88                                 <term><varname>WorkingDirectory=</varname></term>
  89
  90                                 <listitem><para>Takes an absolute
  91                                 directory path. Sets the working
  92                                 directory for executed
  93                                 processes.</para></listitem>
  94                         </varlistentry>
  95
  96                         <varlistentry>
  97                                 <term><varname>RootDirectory=</varname></term>
  98
  99                                 <listitem><para>Takes an absolute
 100                                 directory path. Sets the root
 101                                 directory for executed processes, with
 102                                 the
 103                                 <citerefentry><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 104                                 system call. If this is used it must
 105                                 be ensured that the process and all
 106                                 its auxiliary files are available in
 107                                 the <function>chroot()</function>
 108                                 jail.</para></listitem>
 109                         </varlistentry>
 110
 111                         <varlistentry>
 112                                 <term><varname>User=</varname></term>
 113                                 <term><varname>Group=</varname></term>
 114
 115                                 <listitem><para>Sets the Unix user
 116                                 resp. group the processes are executed
 117                                 as. Takes a single user resp. group
 118                                 name or ID as argument. If no group is
 119                                 set the default group of the user is
 120                                 chosen.</para></listitem>
 121                         </varlistentry>
 122
 123                         <varlistentry>
 124                                 <term><varname>SupplementaryGroups=</varname></term>
 125
 126                                 <listitem><para>Sets the supplementary
 127                                 Unix groups the processes are executed
 128                                 as. This takes a space separated list
 129                                 of group names or IDs. This option may
 130                                 be specified more than once in which
 131                                 case all listed groups are set as
 132                                 supplementary groups. This option does
 133                                 not override but extends the list of
 134                                 supplementary groups configured in the
 135                                 system group database for the
 136                                 user.</para></listitem>
 137                         </varlistentry>
 138
 139                         <varlistentry>
 140                                 <term><varname>Nice=</varname></term>
 141
 142                                 <listitem><para>Sets the default nice
 143                                 level (scheduling priority) for
 144                                 executed processes. Takes an integer
 145                                 between -20 (highest priority) and 19
 146                                 (lowest priority). See
 147                                 <citerefentry><refentrytitle>setpriority</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 148                                 for details.</para></listitem>
 149                         </varlistentry>
 150
 151                         <varlistentry>
 152                                 <term><varname>OOMScoreAdjust=</varname></term>
 153
 154                                 <listitem><para>Sets the adjustment
 155                                 level for the Out-Of-Memory killer for
 156                                 executed processes. Takes an integer
 157                                 between -1000 (to disable OOM killing
 158                                 for this process) and 1000 (to make
 159                                 killing of this process under memory
 160                                 pressure very likely). See <ulink
 161                                 url="http://www.kernel.org/doc/Documentation/filesystems/proc.txt">proc.txt</ulink>
 162                                 for details.</para></listitem>
 163                         </varlistentry>
 164
 165                         <varlistentry>
 166                                 <term><varname>IOSchedulingClass=</varname></term>
 167
 168                                 <listitem><para>Sets the IO scheduling
 169                                 class for executed processes. Takes an
 170                                 integer between 0 and 3 or one of the
 171                                 strings <option>none</option>,
 172                                 <option>realtime</option>,
 173                                 <option>best-effort</option> or
 174                                 <option>idle</option>. See
 175                                 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 176                                 for details.</para></listitem>
 177                         </varlistentry>
 178
 179                         <varlistentry>
 180                                 <term><varname>IOSchedulingPriority=</varname></term>
 181
 182                                 <listitem><para>Sets the IO scheduling
 183                                 priority for executed processes. Takes
 184                                 an integer between 0 (highest
 185                                 priority) and 7 (lowest priority). The
 186                                 available priorities depend on the
 187                                 selected IO scheduling class (see
 188                                 above). See
 189                                 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 190                                 for details.</para></listitem>
 191                         </varlistentry>
 192
 193                         <varlistentry>
 194                                 <term><varname>CPUSchedulingPolicy=</varname></term>
 195
 196                                 <listitem><para>Sets the CPU
 197                                 scheduling policy for executed
 198                                 processes. Takes one of
 199                                 <option>other</option>,
 200                                 <option>batch</option>,
 201                                 <option>idle</option>,
 202                                 <option>fifo</option> or
 203                                 <option>rr</option>. See
 204                                 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 205                                 for details.</para></listitem>
 206                         </varlistentry>
 207
 208                         <varlistentry>
 209                                 <term><varname>CPUSchedulingPriority=</varname></term>
 210
 211                                 <listitem><para>Sets the CPU
 212                                 scheduling priority for executed
 213                                 processes. Takes an integer between 1
 214                                 (lowest priority) and 99 (highest
 215                                 priority). The available priority
 216                                 range depends on the selected CPU
 217                                 scheduling policy (see above). See
 218                                 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 219                                 for details.</para></listitem>
 220                         </varlistentry>
 221
 222                         <varlistentry>
 223                                 <term><varname>CPUSchedulingResetOnFork=</varname></term>
 224
 225                                 <listitem><para>Takes a boolean
 226                                 argument. If true elevated CPU
 227                                 scheduling priorities and policies
 228                                 will be reset when the executed
 229                                 processes fork, and can hence not leak
 230                                 into child processes. See
 231                                 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 232                                 for details. Defaults to false.</para></listitem>
 233                         </varlistentry>
 234
 235                         <varlistentry>
 236                                 <term><varname>CPUAffinity=</varname></term>
 237
 238                                 <listitem><para>Controls the CPU
 239                                 affinity of the executed
 240                                 processes. Takes a space-separated
 241                                 list of CPU indexes. See
 242                                 <citerefentry><refentrytitle>sched_setaffinity</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 243                                 for details.</para></listitem>
 244                         </varlistentry>
 245
 246                         <varlistentry>
 247                                 <term><varname>UMask=</varname></term>
 248
 249                                 <listitem><para>Controls the file mode
 250                                 creation mask. Takes an access mode in
 251                                 octal notation. See
 252                                 <citerefentry><refentrytitle>umask</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 253                                 for details. Defaults to
 254                                 0022.</para></listitem>
 255                         </varlistentry>
 256
 257                         <varlistentry>
 258                                 <term><varname>Environment=</varname></term>
 259
 260                                 <listitem><para>Sets environment
 261                                 variables for executed
 262                                 processes. Takes a space-separated
 263                                 list of variable assignments. This
 264                                 option may be specified more than once
 265                                 in which case all listed variables
 266                                 will be set. If the same variable is
 267                                 set twice the later setting will
 268                                 override the earlier setting. See
 269                                 <citerefentry><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 270                                 for details.</para></listitem>
 271                         </varlistentry>
 272                         <varlistentry>
 273                                 <term><varname>EnvironmentFile=</varname></term>
 274                                 <listitem><para>Similar to
 275                                 <varname>Environment=</varname> but
 276                                 reads the environment variables from a
 277                                 text file. The text file should
 278                                 contain new-line separated variable
 279                                 assignments. Empty lines and lines
 280                                 starting with ; or # will be ignored,
 281                                 which may be used for commenting. The
 282                                 parser strips leading and
 283                                 trailing whitespace from the values
 284                                 of assignments, unless you use
 285                                 double quotes (").
 286                                 The
 287                                 argument passed should be an absolute
 288                                 file name, optionally prefixed with
 289                                 "-", which indicates that if the file
 290                                 does not exist it won't be read and no
 291                                 error or warning message is
 292                                 logged. The files listed with this
 293                                 directive will be read shortly before
 294                                 the process is executed. Settings from
 295                                 these files override settings made
 296                                 with
 297                                 <varname>Environment=</varname>. If
 298                                 the same variable is set twice from
 299                                 these files the files will be read in
 300                                 the order they are specified and the
 301                                 later setting will override the
 302                                 earlier setting. </para></listitem>
 303                         </varlistentry>
 304
 305                         <varlistentry>
 306                                 <term><varname>StandardInput=</varname></term>
 307                                 <listitem><para>Controls where file
 308                                 descriptor 0 (STDIN) of the executed
 309                                 processes is connected to. Takes one
 310                                 of <option>null</option>,
 311                                 <option>tty</option>,
 312                                 <option>tty-force</option>,
 313                                 <option>tty-fail</option> or
 314                                 <option>socket</option>. If
 315                                 <option>null</option> is selected
 316                                 standard input will be connected to
 317                                 <filename>/dev/null</filename>,
 318                                 i.e. all read attempts by the process
 319                                 will result in immediate EOF. If
 320                                 <option>tty</option> is selected
 321                                 standard input is connected to a TTY
 322                                 (as configured by
 323                                 <varname>TTYPath=</varname>, see
 324                                 below) and the executed process
 325                                 becomes the controlling process of the
 326                                 terminal. If the terminal is already
 327                                 being controlled by another process the
 328                                 executed process waits until the current
 329                                 controlling process releases the
 330                                 terminal.
 331                                 <option>tty-force</option>
 332                                 is similar to <option>tty</option>,
 333                                 but the executed process is forcefully
 334                                 and immediately made the controlling
 335                                 process of the terminal, potentially
 336                                 removing previous controlling
 337                                 processes from the
 338                                 terminal. <option>tty-fail</option> is
 339                                 similar to <option>tty</option> but if
 340                                 the terminal already has a controlling
 341                                 process start-up of the executed
 342                                 process fails.  The
 343                                 <option>socket</option> option is only
 344                                 valid in socket-activated services,
 345                                 and only when the socket configuration
 346                                 file (see
 347                                 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 348                                 for details) specifies a single socket
 349                                 only. If this option is set standard
 350                                 input will be connected to the socket
 351                                 the service was activated from, which
 352                                 is primarily useful for compatibility
 353                                 with daemons designed for use with the
 354                                 traditional
 355                                 <citerefentry><refentrytitle>inetd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 356                                 daemon. This setting defaults to
 357                                 <option>null</option>.</para></listitem>
 358                         </varlistentry>
 359                         <varlistentry>
 360                                 <term><varname>StandardOutput=</varname></term>
 361                                 <listitem><para>Controls where file
 362                                 descriptor 1 (STDOUT) of the executed
 363                                 processes is connected to. Takes one
 364                                 of <option>inherit</option>,
 365                                 <option>null</option>,
 366                                 <option>tty</option>,
 367                                 <option>syslog</option>,
 368                                 <option>kmsg</option>,
 369                                 <option>journal</option>,
 370                                 <option>syslog+console</option>,
 371                                 <option>kmsg+console</option>,
 372                                 <option>journal+console</option> or
 373                                 <option>socket</option>. If set to
 374                                 <option>inherit</option> the file
 375                                 descriptor of standard input is
 376                                 duplicated for standard output. If set
 377                                 to <option>null</option> standard
 378                                 output will be connected to
 379                                 <filename>/dev/null</filename>,
 380                                 i.e. everything written to it will be
 381                                 lost. If set to <option>tty</option>
 382                                 standard output will be connected to a
 383                                 tty (as configured via
 384                                 <varname>TTYPath=</varname>, see
 385                                 below). If the TTY is used for output
 386                                 only the executed process will not
 387                                 become the controlling process of the
 388                                 terminal, and will not fail or wait
 389                                 for other processes to release the
 390                                 terminal. <option>syslog</option>
 391                                 connects standard output to the
 392                                 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
 393                                 system syslog
 394                                 service. <option>kmsg</option>
 395                                 connects it with the kernel log buffer
 396                                 which is accessible via
 397                                 <citerefentry><refentrytitle>dmesg</refentrytitle><manvolnum>1</manvolnum></citerefentry>. <option>journal</option>
 398                                 connects it with the journal which is
 399                                 accessible via
 400                                 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
 401                                 (Note that everything that is written
 402                                 to syslog or kmsg is implicitly stored
 403                                 in the journal as well, those options
 404                                 are hence supersets of this
 405                                 one). <option>syslog+console</option>,
 406                                 <option>journal+console</option> and
 407                                 <option>kmsg+console</option> work
 408                                 similarly but copy the output to the
 409                                 system console as
 410                                 well. <option>socket</option> connects
 411                                 standard output to a socket from
 412                                 socket activation, semantics are
 413                                 similar to the respective option of
 414                                 <varname>StandardInput=</varname>.
 415                                 This setting defaults to the value set
 416                                 with
 417                                 <option>DefaultStandardOutput=</option>
 418                                 in
 419                                 <citerefentry><refentrytitle>systemd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 420                                 which defaults to
 421                                 <option>journal</option>.</para></listitem>
 422                         </varlistentry>
 423                         <varlistentry>
 424                                 <term><varname>StandardError=</varname></term>
 425                                 <listitem><para>Controls where file
 426                                 descriptor 2 (STDERR) of the executed
 427                                 processes is connected to. The
 428                                 available options are identical to
 429                                 those of
 430                                 <varname>StandardOutput=</varname>,
 431                                 with one exception: if set to
 432                                 <option>inherit</option> the file
 433                                 descriptor used for standard output is
 434                                 duplicated for standard error. This
 435                                 setting defaults to the value set with
 436                                 <option>DefaultStandardError=</option>
 437                                 in
 438                                 <citerefentry><refentrytitle>systemd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 439                                 which defaults to
 440                                 <option>inherit</option>.</para></listitem>
 441                         </varlistentry>
 442                         <varlistentry>
 443                                 <term><varname>TTYPath=</varname></term>
 444                                 <listitem><para>Sets the terminal
 445                                 device node to use if standard input,
 446                                 output or stderr are connected to a
 447                                 TTY (see above). Defaults to
 448                                 <filename>/dev/console</filename>.</para></listitem>
 449                         </varlistentry>
 450                         <varlistentry>
 451                                 <term><varname>TTYReset=</varname></term>
 452                                 <listitem><para>Reset the terminal
 453                                 device specified with
 454                                 <varname>TTYPath=</varname> before and
 455                                 after execution. Defaults to
 456                                 <literal>no</literal>.</para></listitem>
 457                         </varlistentry>
 458                         <varlistentry>
 459                                 <term><varname>TTYVHangup=</varname></term>
 460                                 <listitem><para>Disconnect all clients
 461                                 which have opened the terminal device
 462                                 specified with
 463                                 <varname>TTYPath=</varname>
 464                                 before and after execution. Defaults
 465                                 to
 466                                 <literal>no</literal>.</para></listitem>
 467                         </varlistentry>
 468                         <varlistentry>
 469                                 <term><varname>TTYVTDisallocate=</varname></term>
 470                                 <listitem><para>If the the terminal
 471                                 device specified with
 472                                 <varname>TTYPath=</varname> is a
 473                                 virtual console terminal try to
 474                                 deallocate the TTY before and after
 475                                 execution. This ensures that the
 476                                 screen and scrollback buffer is
 477                                 cleared. Defaults to
 478                                 <literal>no</literal>.</para></listitem>
 479                         </varlistentry>
 480                         <varlistentry>
 481                                 <term><varname>SyslogIdentifier=</varname></term>
 482                                 <listitem><para>Sets the process name
 483                                 to prefix log lines sent to syslog or
 484                                 the kernel log buffer with. If not set
 485                                 defaults to the process name of the
 486                                 executed process. This option is only
 487                                 useful when
 488                                 <varname>StandardOutput=</varname> or
 489                                 <varname>StandardError=</varname> are
 490                                 set to <option>syslog</option> or
 491                                 <option>kmsg</option>.</para></listitem>
 492                         </varlistentry>
 493                         <varlistentry>
 494                                 <term><varname>SyslogFacility=</varname></term>
 495                                 <listitem><para>Sets the syslog
 496                                 facility to use when logging to
 497                                 syslog. One of <option>kern</option>,
 498                                 <option>user</option>,
 499                                 <option>mail</option>,
 500                                 <option>daemon</option>,
 501                                 <option>auth</option>,
 502                                 <option>syslog</option>,
 503                                 <option>lpr</option>,
 504                                 <option>news</option>,
 505                                 <option>uucp</option>,
 506                                 <option>cron</option>,
 507                                 <option>authpriv</option>,
 508                                 <option>ftp</option>,
 509                                 <option>local0</option>,
 510                                 <option>local1</option>,
 511                                 <option>local2</option>,
 512                                 <option>local3</option>,
 513                                 <option>local4</option>,
 514                                 <option>local5</option>,
 515                                 <option>local6</option> or
 516                                 <option>local7</option>. See
 517                                 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
 518                                 for details. This option is only
 519                                 useful when
 520                                 <varname>StandardOutput=</varname> or
 521                                 <varname>StandardError=</varname> are
 522                                 set to <option>syslog</option>.
 523                                 Defaults to
 524                                 <option>daemon</option>.</para></listitem>
 525                         </varlistentry>
 526                         <varlistentry>
 527                                 <term><varname>SyslogLevel=</varname></term>
 528                                 <listitem><para>Default syslog level
 529                                 to use when logging to syslog or the
 530                                 kernel log buffer. One of
 531                                 <option>emerg</option>,
 532                                 <option>alert</option>,
 533                                 <option>crit</option>,
 534                                 <option>err</option>,
 535                                 <option>warning</option>,
 536                                 <option>notice</option>,
 537                                 <option>info</option>,
 538                                 <option>debug</option>. See
 539                                 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
 540                                 for details. This option is only
 541                                 useful when
 542                                 <varname>StandardOutput=</varname> or
 543                                 <varname>StandardError=</varname> are
 544                                 set to <option>syslog</option> or
 545                                 <option>kmsg</option>. Note that
 546                                 individual lines output by the daemon
 547                                 might be prefixed with a different log
 548                                 level which can be used to override
 549                                 the default log level specified
 550                                 here. The interpretation of these
 551                                 prefixes may be disabled with
 552                                 <varname>SyslogLevelPrefix=</varname>,
 553                                 see below. For details see
 554                                 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
 555
 556                                 Defaults to
 557                                 <option>info</option>.</para></listitem>
 558                         </varlistentry>
 559
 560                         <varlistentry>
 561                                 <term><varname>SyslogLevelPrefix=</varname></term>
 562                                 <listitem><para>Takes a boolean
 563                                 argument. If true and
 564                                 <varname>StandardOutput=</varname> or
 565                                 <varname>StandardError=</varname> are
 566                                 set to <option>syslog</option> or
 567                                 <option>kmsg</option> log lines
 568                                 written by the executed process that
 569                                 are prefixed with a log level will be
 570                                 passed on to syslog with this log
 571                                 level set but the prefix removed. If
 572                                 set to false, the interpretation of
 573                                 these prefixes is disabled and the
 574                                 logged lines are passed on as-is. For
 575                                 details about this prefixing see
 576                                 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>7</manvolnum></citerefentry>.
 577                                 Defaults to true.</para></listitem>
 578                         </varlistentry>
 579
 580                         <varlistentry>
 581                                 <term><varname>TimerSlackNSec=</varname></term>
 582                                 <listitem><para>Sets the timer slack
 583                                 in nanoseconds for the executed
 584                                 processes. The timer slack controls
 585                                 the accuracy of wake-ups triggered by
 586                                 timers. See
 587                                 <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 588                                 for more information. Note that in
 589                                 contrast to most other time span
 590                                 definitions this parameter takes an
 591                                 integer value in nano-seconds if no
 592                                 unit is specified. The usual time
 593                                 units are understood
 594                                 too.</para></listitem>
 595                         </varlistentry>
 596
 597                         <varlistentry>
 598                                 <term><varname>LimitCPU=</varname></term>
 599                                 <term><varname>LimitFSIZE=</varname></term>
 600                                 <term><varname>LimitDATA=</varname></term>
 601                                 <term><varname>LimitSTACK=</varname></term>
 602                                 <term><varname>LimitCORE=</varname></term>
 603                                 <term><varname>LimitRSS=</varname></term>
 604                                 <term><varname>LimitNOFILE=</varname></term>
 605                                 <term><varname>LimitAS=</varname></term>
 606                                 <term><varname>LimitNPROC=</varname></term>
 607                                 <term><varname>LimitMEMLOCK=</varname></term>
 608                                 <term><varname>LimitLOCKS=</varname></term>
 609                                 <term><varname>LimitSIGPENDING=</varname></term>
 610                                 <term><varname>LimitMSGQUEUE=</varname></term>
 611                                 <term><varname>LimitNICE=</varname></term>
 612                                 <term><varname>LimitRTPRIO=</varname></term>
 613                                 <term><varname>LimitRTTIME=</varname></term>
 614                                 <listitem><para>These settings control
 615                                 various resource limits for executed
 616                                 processes. See
 617                                 <citerefentry><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 618                                 for details. Use the string
 619                                 <varname>infinity</varname> to
 620                                 configure no limit on a specific
 621                                 resource.</para></listitem>
 622                         </varlistentry>
 623
 624                         <varlistentry>
 625                                 <term><varname>PAMName=</varname></term>
 626                                 <listitem><para>Sets the PAM service
 627                                 name to set up a session as. If set
 628                                 the executed process will be
 629                                 registered as a PAM session under the
 630                                 specified service name. This is only
 631                                 useful in conjunction with the
 632                                 <varname>User=</varname> setting. If
 633                                 not set no PAM session will be opened
 634                                 for the executed processes. See
 635                                 <citerefentry><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 636                                 for details.</para></listitem>
 637                         </varlistentry>
 638
 639                         <varlistentry>
 640                                 <term><varname>TCPWrapName=</varname></term>
 641                                 <listitem><para>If this is a
 642                                 socket-activated service this sets the
 643                                 tcpwrap service name to check the
 644                                 permission for the current connection
 645                                 with. This is only useful in
 646                                 conjunction with socket-activated
 647                                 services, and stream sockets (TCP) in
 648                                 particular. It has no effect on other
 649                                 socket types (e.g. datagram/UDP) and
 650                                 on processes unrelated to socket-based
 651                                 activation. If the tcpwrap
 652                                 verification fails daemon start-up
 653                                 will fail and the connection is
 654                                 terminated. See
 655                                 <citerefentry><refentrytitle>tcpd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 656                                 for details. Note that this option may
 657                                 be used to do access control checks
 658                                 only. Shell commands and commands
 659                                 described in
 660                                 <citerefentry><refentrytitle>hosts_options</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 661                                 are not supported.</para></listitem>
 662                         </varlistentry>
 663
 664                         <varlistentry>
 665                                 <term><varname>CapabilityBoundingSet=</varname></term>
 666
 667                                 <listitem><para>Controls which
 668                                 capabilities to include in the
 669                                 capability bounding set for the
 670                                 executed process. See
 671                                 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 672                                 for details. Takes a whitespace
 673                                 separated list of capability names as
 674                                 read by
 675                                 <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
 676                                 Capabilities listed will be included
 677                                 in the bounding set, all others are
 678                                 removed. If the list of capabilities
 679                                 is prefixed with ~ all but the listed
 680                                 capabilities will be included, the
 681                                 effect of the assignment
 682                                 inverted. Note that this option also
 683                                 effects the respective capabilities in
 684                                 the effective, permitted and
 685                                 inheritable capability sets, on top of
 686                                 what <varname>Capabilities=</varname>
 687                                 does. If this option is not used the
 688                                 capability bounding set is not
 689                                 modified on process execution, hence
 690                                 no limits on the capabilities of the
 691                                 process are
 692                                 enforced.</para></listitem>
 693                         </varlistentry>
 694
 695                         <varlistentry>
 696                                 <term><varname>SecureBits=</varname></term>
 697                                 <listitem><para>Controls the secure
 698                                 bits set for the executed process. See
 699                                 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 700                                 for details. Takes a list of strings:
 701                                 <option>keep-caps</option>,
 702                                 <option>keep-caps-locked</option>,
 703                                 <option>no-setuid-fixup</option>,
 704                                 <option>no-setuid-fixup-locked</option>,
 705                                 <option>noroot</option> and/or
 706                                 <option>noroot-locked</option>.
 707                                 </para></listitem>
 708                         </varlistentry>
 709
 710                         <varlistentry>
 711                                 <term><varname>Capabilities=</varname></term>
 712                                 <listitem><para>Controls the
 713                                 <citerefentry><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 714                                 set for the executed process. Take a
 715                                 capability string describing the
 716                                 effective, permitted and inherited
 717                                 capability sets as documented in
 718                                 <citerefentry><refentrytitle>cap_from_text</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
 719                                 Note that these capability sets are
 720                                 usually influenced by the capabilities
 721                                 attached to the executed file. Due to
 722                                 that
 723                                 <varname>CapabilityBoundingSet=</varname>
 724                                 is probably the much more useful
 725                                 setting.</para></listitem>
 726                         </varlistentry>
 727
 728                         <varlistentry>
 729                                 <term><varname>ControlGroup=</varname></term>
 730
 731                                 <listitem><para>Controls the control
 732                                 groups the executed processes shall be
 733                                 made members of. Takes a
 734                                 space-separated list of cgroup
 735                                 identifiers. A cgroup identifier has a
 736                                 format like
 737                                 <filename>cpu:/foo/bar</filename>,
 738                                 where "cpu" identifies the kernel
 739                                 control group controller used, and
 740                                 <filename>/foo/bar</filename> is the
 741                                 control group path. The controller
 742                                 name and ":" may be omitted in which
 743                                 case the named systemd control group
 744                                 hierarchy is implied. Alternatively,
 745                                 the path and ":" may be omitted, in
 746                                 which case the default control group
 747                                 path for this unit is implied. This
 748                                 option may be used to place executed
 749                                 processes in arbitrary groups in
 750                                 arbitrary hierarchies -- which can be
 751                                 configured externally with additional
 752                                 execution limits. By default systemd
 753                                 will place all executed processes in
 754                                 separate per-unit control groups
 755                                 (named after the unit) in the systemd
 756                                 named hierarchy. Since every process
 757                                 can be in one group per hierarchy only
 758                                 overriding the control group path in
 759                                 the named systemd hierarchy will
 760                                 disable automatic placement in the
 761                                 default group. This option is
 762                                 primarily intended to place executed
 763                                 processes in specific paths in
 764                                 specific kernel controller
 765                                 hierarchies. It is however not
 766                                 recommended to manipulate the service
 767                                 control group path in the systemd
 768                                 named hierarchy. For details about
 769                                 control groups see <ulink
 770                                 url="http://www.kernel.org/doc/Documentation/cgroups/cgroups.txt">cgroups.txt</ulink>.</para></listitem>
 771                         </varlistentry>
 772
 773                         <varlistentry>
 774                                 <term><varname>ControlGroupModify=</varname></term>
 775                                 <listitem><para>Takes a boolean
 776                                 argument. If true, the control groups
 777                                 created for this unit will be owned by
 778                                 the user specified with
 779                                 <varname>User=</varname> (and the
 780                                 appropriate group), and he/she can create
 781                                 subgroups as well as add processes to
 782                                 the group.</para></listitem>
 783                         </varlistentry>
 784
 785                         <varlistentry>
 786                                 <term><varname>ControlGroupPersistent=</varname></term>
 787                                 <listitem><para>Takes a boolean
 788                                 argument. If true, the control groups
 789                                 created for this unit will be marked
 790                                 to be persistent, i.e. systemd will
 791                                 not remove them when stopping the
 792                                 unit. The default is false, meaning
 793                                 that the control groups will be
 794                                 removed when the unit is stopped. For
 795                                 details about the semantics of this
 796                                 logic see <ulink
 797                                 url="http://www.freedesktop.org/wiki/Software/systemd/PaxControlGroups">PaxControlGroups</ulink>.</para></listitem>
 798                         </varlistentry>
 799
 800                         <varlistentry>
 801                                 <term><varname>ControlGroupAttribute=</varname></term>
 802
 803                                 <listitem><para>Set a specific control
 804                                 group attribute for executed
 805                                 processes, and (if needed) add the the
 806                                 executed processes to a cgroup in the
 807                                 hierarchy of the controller the
 808                                 attribute belongs to. Takes two
 809                                 space-separated arguments: the
 810                                 attribute name (syntax is
 811                                 <literal>cpu.shares</literal> where
 812                                 <literal>cpu</literal> refers to a
 813                                 specific controller and
 814                                 <literal>shares</literal> to the
 815                                 attribute name), and the attribute
 816                                 value. Example:
 817                                 <literal>ControlGroupAttribute=cpu.shares
 818                                 512</literal>. If this option is used
 819                                 for an attribute that belongs to a
 820                                 kernel controller hierarchy the unit
 821                                 is not already configured to be added
 822                                 to (for example via the
 823                                 <literal>ControlGroup=</literal>
 824                                 option) then the unit will be added to
 825                                 the controller and the default unit
 826                                 cgroup path is implied. Thus, using
 827                                 <varname>ControlGroupAttribute=</varname>
 828                                 is in most case sufficient to make use
 829                                 of control group enforcements,
 830                                 explicit
 831                                 <varname>ControlGroup=</varname> are
 832                                 only necessary in case the implied
 833                                 default control group path for a
 834                                 service is not desirable. For details
 835                                 about control group attributes see
 836                                 <ulink
 837                                 url="http://www.kernel.org/doc/Documentation/cgroups/cgroups.txt">cgroups.txt</ulink>. This
 838                                 option may appear more than once, in
 839                                 order to set multiple control group
 840                                 attributes.</para></listitem>
 841                         </varlistentry>
 842
 843                         <varlistentry>
 844                                 <term><varname>CPUShares=</varname></term>
 845
 846                                 <listitem><para>Assign the specified
 847                                 overall CPU time shares to the
 848                                 processes executed. Takes an integer
 849                                 value. This controls the
 850                                 <literal>cpu.shares</literal> control
 851                                 group attribute, which defaults to
 852                                 1024. For details about this control
 853                                 group attribute see <ulink
 854                                 url="http://www.kernel.org/doc/Documentation/scheduler/sched-design-CFS.txt">sched-design-CFS.txt</ulink>.</para></listitem>
 855                         </varlistentry>
 856
 857                         <varlistentry>
 858                                 <term><varname>MemoryLimit=</varname></term>
 859                                 <term><varname>MemorySoftLimit=</varname></term>
 860
 861                                 <listitem><para>Limit the overall memory usage
 862                                 of the executed processes to a certain
 863                                 size. Takes a memory size in bytes. If
 864                                 the value is suffixed with K, M, G or
 865                                 T the specified memory size is parsed
 866                                 as Kilobytes, Megabytes, Gigabytes,
 867                                 resp. Terabytes (to the base
 868                                 1024). This controls the
 869                                 <literal>memory.limit_in_bytes</literal>
 870                                 and
 871                                 <literal>memory.soft_limit_in_bytes</literal>
 872                                 control group attributes. For details
 873                                 about these control group attributes
 874                                 see <ulink
 875                                 url="http://www.kernel.org/doc/Documentation/cgroups/memory.txt">memory.txt</ulink>.</para></listitem>
 876                         </varlistentry>
 877
 878                         <varlistentry>
 879                                 <term><varname>DeviceAllow=</varname></term>
 880                                 <term><varname>DeviceDeny=</varname></term>
 881
 882                                 <listitem><para>Control access to
 883                                 specific device nodes by the executed processes. Takes two
 884                                 space separated strings: a device node
 885                                 path (such as
 886                                 <filename>/dev/null</filename>)
 887                                 followed by a combination of r, w, m
 888                                 to control reading, writing resp.
 889                                 creating of the specific device node
 890                                 by the unit. This controls the
 891                                 <literal>devices.allow</literal>
 892                                 and
 893                                 <literal>devices.deny</literal>
 894                                 control group attributes. For details
 895                                 about these control group attributes
 896                                 see <ulink
 897                                 url="http://www.kernel.org/doc/Documentation/cgroups/devices.txt">devices.txt</ulink>.</para></listitem>
 898                         </varlistentry>
 899
 900                         <varlistentry>
 901                                 <term><varname>BlockIOWeight=</varname></term>
 902
 903                                 <listitem><para>Set the default or
 904                                 per-device overall block IO weight
 905                                 value for the executed
 906                                 processes. Takes either a single
 907                                 weight value (between 10 and 1000) to
 908                                 set the default block IO weight, or a
 909                                 space separated pair of a file path
 910                                 and a weight value to specify the
 911                                 device specific weight value (Example:
 912                                 "/dev/sda 500"). The file path may be
 913                                 specified as path to a block device
 914                                 node or as any other file in which
 915                                 case the backing block device of the
 916                                 file system of the file is
 917                                 determined. This controls the
 918                                 <literal>blkio.weight</literal> and
 919                                 <literal>blkio.weight_device</literal>
 920                                 control group attributes, which
 921                                 default to 1000. Use this option
 922                                 multiple times to set weights for
 923                                 multiple devices. For details about
 924                                 these control group attributes see
 925                                 <ulink
 926                                 url="http://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt">blkio-controller.txt</ulink>.</para></listitem>
 927                         </varlistentry>
 928
 929                         <varlistentry>
 930                                 <term><varname>BlockIOReadBandwidth=</varname></term>
 931                                 <term><varname>BlockIOWriteBandwidth=</varname></term>
 932
 933                                 <listitem><para>Set the per-device
 934                                 overall block IO bandwith limit for
 935                                 the executed processes. Takes a space
 936                                 separated pair of a file path and a
 937                                 bandwith value (in bytes per second)
 938                                 to specify the device specific
 939                                 bandwidth. The file path may be
 940                                 specified as path to a block device
 941                                 node or as any other file in which
 942                                 case the backing block device of the
 943                                 file system of the file is determined.
 944                                 If the bandwith is suffixed with K, M,
 945                                 G, or T the specified bandwith is
 946                                 parsed as Kilobytes, Megabytes,
 947                                 Gigabytes, resp. Terabytes (Example:
 948                                 "/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0
 949                                 5M"). This controls the
 950                                 <literal>blkio.read_bps_device</literal>
 951                                 and
 952                                 <literal>blkio.write_bps_device</literal>
 953                                 control group attributes. Use this
 954                                 option multiple times to set bandwith
 955                                 limits for multiple devices. For
 956                                 details about these control group
 957                                 attributes see <ulink
 958                                 url="http://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt">blkio-controller.txt</ulink>.</para></listitem>
 959                         </varlistentry>
 960
 961                         <varlistentry>
 962                                 <term><varname>ReadWriteDirectories=</varname></term>
 963                                 <term><varname>ReadOnlyDirectories=</varname></term>
 964                                 <term><varname>InaccessibleDirectories=</varname></term>
 965
 966                                 <listitem><para>Sets up a new
 967                                 file-system name space for executed
 968                                 processes. These options may be used
 969                                 to limit access a process might have
 970                                 to the main file-system
 971                                 hierarchy. Each setting takes a
 972                                 space-separated list of absolute
 973                                 directory paths. Directories listed in
 974                                 <varname>ReadWriteDirectories=</varname>
 975                                 are accessible from within the
 976                                 namespace with the same access rights
 977                                 as from outside. Directories listed in
 978                                 <varname>ReadOnlyDirectories=</varname>
 979                                 are accessible for reading only,
 980                                 writing will be refused even if the
 981                                 usual file access controls would
 982                                 permit this. Directories listed in
 983                                 <varname>InaccessibleDirectories=</varname>
 984                                 will be made inaccessible for processes
 985                                 inside the namespace. Note that
 986                                 restricting access with these options
 987                                 does not extend to submounts of a
 988                                 directory. You must list submounts
 989                                 separately in these settings to
 990                                 ensure the same limited access. These
 991                                 options may be specified more than
 992                                 once in which case all directories
 993                                 listed will have limited access from
 994                                 within the
 995                                 namespace.</para></listitem>
 996                         </varlistentry>
 997
 998                         <varlistentry>
 999                                 <term><varname>PrivateTmp=</varname></term>
1000
1001                                 <listitem><para>Takes a boolean
1002                                 argument. If true sets up a new file
1003                                 system namespace for the executed
1004                                 processes and mounts a private
1005                                 <filename>/tmp</filename> directory
1006                                 inside it, that is not shared by
1007                                 processes outside of the
1008                                 namespace. This is useful to secure
1009                                 access to temporary files of the
1010                                 process, but makes sharing between
1011                                 processes via
1012                                 <filename>/tmp</filename>
1013                                 impossible. Defaults to
1014                                 false.</para></listitem>
1015                         </varlistentry>
1016
1017                         <varlistentry>
1018                                 <term><varname>PrivateNetwork=</varname></term>
1019
1020                                 <listitem><para>Takes a boolean
1021                                 argument. If true sets up a new
1022                                 network namespace for the executed
1023                                 processes and configures only the
1024                                 loopback network device
1025                                 <literal>lo</literal> inside it. No
1026                                 other network devices will be
1027                                 available to the executed process.
1028                                 This is useful to securely turn off
1029                                 network access by the executed
1030                                 process. Defaults to
1031                                 false.</para></listitem>
1032                         </varlistentry>
1033
1034                         <varlistentry>
1035                                 <term><varname>MountFlags=</varname></term>
1036
1037                                 <listitem><para>Takes a mount
1038                                 propagation flag:
1039                                 <option>shared</option>,
1040                                 <option>slave</option> or
1041                                 <option>private</option>, which
1042                                 control whether namespaces set up with
1043                                 <varname>ReadWriteDirectories=</varname>,
1044                                 <varname>ReadOnlyDirectories=</varname>
1045                                 and
1046                                 <varname>InaccessibleDirectories=</varname>
1047                                 receive or propagate new mounts
1048                                 from/to the main namespace. See
1049                                 <citerefentry><refentrytitle>mount</refentrytitle><manvolnum>1</manvolnum></citerefentry>
1050                                 for details. Defaults to
1051                                 <option>shared</option>, i.e. the new
1052                                 namespace will both receive new mount
1053                                 points from the main namespace as well
1054                                 as propagate new mounts to
1055                                 it.</para></listitem>
1056                         </varlistentry>
1057
1058                         <varlistentry>
1059                                 <term><varname>UtmpIdentifier=</varname></term>
1060
1061                                 <listitem><para>Takes a a four
1062                                 character identifier string for an
1063                                 utmp/wtmp entry for this service. This
1064                                 should only be set for services such
1065                                 as <command>getty</command>
1066                                 implementations where utmp/wtmp
1067                                 entries must be created and cleared
1068                                 before and after execution. If the
1069                                 configured string is longer than four
1070                                 characters it is truncated and the
1071                                 terminal four characters are
1072                                 used. This setting interprets %I style
1073                                 string replacements. This setting is
1074                                 unset by default, i.e. no utmp/wtmp
1075                                 entries are created or cleaned up for
1076                                 this service.</para></listitem>
1077                         </varlistentry>
1078
1079                         <varlistentry>
1080                                 <term><varname>IgnoreSIGPIPE=</varname></term>
1081
1082                                 <listitem><para>Takes a boolean
1083                                 argument. If true causes SIGPIPE to be
1084                                 ignored in the executed
1085                                 process. Defaults to true, since
1086                                 SIGPIPE generally is useful only in
1087                                 shell pipelines.</para></listitem>
1088                         </varlistentry>
1089
1090                 </variablelist>
1091         </refsect1>
1092
1093         <refsect1>
1094                   <title>See Also</title>
1095                   <para>
1096                           <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1097                           <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1098                           <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1099                           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1100                           <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1101                           <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1102                           <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1103                           <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1104                   </para>
1105         </refsect1>
1106
1107 </refentry>