man/systemd.exec.xml

   1 <?xml-stylesheet type="text/xsl" href="http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl"?>
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3         "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   This file is part of systemd.
   7
   8   Copyright 2010 Lennart Poettering
   9
  10   systemd is free software; you can redistribute it and/or modify it
  11   under the terms of the GNU Lesser General Public License as published by
  12   the Free Software Foundation; either version 2.1 of the License, or
  13   (at your option) any later version.
  14
  15   systemd is distributed in the hope that it will be useful, but
  16   WITHOUT ANY WARRANTY; without even the implied warranty of
  17   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  18   Lesser General Public License for more details.
  19
  20   You should have received a copy of the GNU Lesser General Public License
  21   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  22 -->
  23
  24 <refentry id="systemd.exec">
  25         <refentryinfo>
  26                 <title>systemd.exec</title>
  27                 <productname>systemd</productname>
  28
  29                 <authorgroup>
  30                         <author>
  31                                 <contrib>Developer</contrib>
  32                                 <firstname>Lennart</firstname>
  33                                 <surname>Poettering</surname>
  34                                 <email>lennart@poettering.net</email>
  35                         </author>
  36                 </authorgroup>
  37         </refentryinfo>
  38
  39         <refmeta>
  40                 <refentrytitle>systemd.exec</refentrytitle>
  41                 <manvolnum>5</manvolnum>
  42         </refmeta>
  43
  44         <refnamediv>
  45                 <refname>systemd.exec</refname>
  46                 <refpurpose>Execution environment configuration</refpurpose>
  47         </refnamediv>
  48
  49         <refsynopsisdiv>
  50                 <para><filename><replaceable>service</replaceable>.service</filename>,
  51                 <filename><replaceable>socket</replaceable>.socket</filename>,
  52                 <filename><replaceable>mount</replaceable>.mount</filename>,
  53                 <filename><replaceable>swap</replaceable>.swap</filename></para>
  54         </refsynopsisdiv>
  55
  56         <refsect1>
  57                 <title>Description</title>
  58
  59                 <para>Unit configuration files for services, sockets,
  60                 mount points, and swap devices share a subset of
  61                 configuration options which define the execution
  62                 environment of spawned processes.</para>
  63
  64                 <para>This man page lists the configuration options
  65                 shared by these four unit types. See
  66                 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
  67                 for the common options of all unit configuration
  68                 files, and
  69                 <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
  70                 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
  71                 <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
  72                 and
  73                 <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>
  74                 for more information on the specific unit
  75                 configuration files. The execution specific
  76                 configuration options are configured in the [Service],
  77                 [Socket], [Mount], or [Swap] sections, depending on the unit
  78                 type.</para>
  79         </refsect1>
  80
  81         <refsect1>
  82                 <title>Options</title>
  83
  84                 <variablelist class='unit-directives'>
  85
  86                         <varlistentry>
  87                                 <term><varname>WorkingDirectory=</varname></term>
  88
  89                                 <listitem><para>Takes an absolute
  90                                 directory path. Sets the working
  91                                 directory for executed processes. If
  92                                 not set, defaults to the root directory
  93                                 when systemd is running as a system
  94                                 instance and the respective user's
  95                                 home directory if run as
  96                                 user.</para></listitem>
  97                         </varlistentry>
  98
  99                         <varlistentry>
 100                                 <term><varname>RootDirectory=</varname></term>
 101
 102                                 <listitem><para>Takes an absolute
 103                                 directory path. Sets the root
 104                                 directory for executed processes, with
 105                                 the
 106                                 <citerefentry project='man-pages'><refentrytitle>chroot</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 107                                 system call. If this is used, it must
 108                                 be ensured that the process and all
 109                                 its auxiliary files are available in
 110                                 the <function>chroot()</function>
 111                                 jail.</para></listitem>
 112                         </varlistentry>
 113
 114                         <varlistentry>
 115                                 <term><varname>User=</varname></term>
 116                                 <term><varname>Group=</varname></term>
 117
 118                                 <listitem><para>Sets the Unix user
 119                                 or group that the processes are executed
 120                                 as, respectively. Takes a single user or group
 121                                 name or ID as argument. If no group is
 122                                 set, the default group of the user is
 123                                 chosen.</para></listitem>
 124                         </varlistentry>
 125
 126                         <varlistentry>
 127                                 <term><varname>SupplementaryGroups=</varname></term>
 128
 129                                 <listitem><para>Sets the supplementary
 130                                 Unix groups the processes are executed
 131                                 as. This takes a space-separated list
 132                                 of group names or IDs. This option may
 133                                 be specified more than once in which
 134                                 case all listed groups are set as
 135                                 supplementary groups. When the empty
 136                                 string is assigned the list of
 137                                 supplementary groups is reset, and all
 138                                 assignments prior to this one will
 139                                 have no effect. In any way, this
 140                                 option does not override, but extends
 141                                 the list of supplementary groups
 142                                 configured in the system group
 143                                 database for the
 144                                 user.</para></listitem>
 145                         </varlistentry>
 146
 147                         <varlistentry>
 148                                 <term><varname>Nice=</varname></term>
 149
 150                                 <listitem><para>Sets the default nice
 151                                 level (scheduling priority) for
 152                                 executed processes. Takes an integer
 153                                 between -20 (highest priority) and 19
 154                                 (lowest priority). See
 155                                 <citerefentry><refentrytitle>setpriority</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 156                                 for details.</para></listitem>
 157                         </varlistentry>
 158
 159                         <varlistentry>
 160                                 <term><varname>OOMScoreAdjust=</varname></term>
 161
 162                                 <listitem><para>Sets the adjustment
 163                                 level for the Out-Of-Memory killer for
 164                                 executed processes. Takes an integer
 165                                 between -1000 (to disable OOM killing
 166                                 for this process) and 1000 (to make
 167                                 killing of this process under memory
 168                                 pressure very likely). See <ulink
 169                                 url="https://www.kernel.org/doc/Documentation/filesystems/proc.txt">proc.txt</ulink>
 170                                 for details.</para></listitem>
 171                         </varlistentry>
 172
 173                         <varlistentry>
 174                                 <term><varname>IOSchedulingClass=</varname></term>
 175
 176                                 <listitem><para>Sets the IO scheduling
 177                                 class for executed processes. Takes an
 178                                 integer between 0 and 3 or one of the
 179                                 strings <option>none</option>,
 180                                 <option>realtime</option>,
 181                                 <option>best-effort</option> or
 182                                 <option>idle</option>. See
 183                                 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 184                                 for details.</para></listitem>
 185                         </varlistentry>
 186
 187                         <varlistentry>
 188                                 <term><varname>IOSchedulingPriority=</varname></term>
 189
 190                                 <listitem><para>Sets the IO scheduling
 191                                 priority for executed processes. Takes
 192                                 an integer between 0 (highest
 193                                 priority) and 7 (lowest priority). The
 194                                 available priorities depend on the
 195                                 selected IO scheduling class (see
 196                                 above). See
 197                                 <citerefentry><refentrytitle>ioprio_set</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 198                                 for details.</para></listitem>
 199                         </varlistentry>
 200
 201                         <varlistentry>
 202                                 <term><varname>CPUSchedulingPolicy=</varname></term>
 203
 204                                 <listitem><para>Sets the CPU
 205                                 scheduling policy for executed
 206                                 processes. Takes one of
 207                                 <option>other</option>,
 208                                 <option>batch</option>,
 209                                 <option>idle</option>,
 210                                 <option>fifo</option> or
 211                                 <option>rr</option>. See
 212                                 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 213                                 for details.</para></listitem>
 214                         </varlistentry>
 215
 216                         <varlistentry>
 217                                 <term><varname>CPUSchedulingPriority=</varname></term>
 218
 219                                 <listitem><para>Sets the CPU
 220                                 scheduling priority for executed
 221                                 processes. The available priority
 222                                 range depends on the selected CPU
 223                                 scheduling policy (see above). For
 224                                 real-time scheduling policies an
 225                                 integer between 1 (lowest priority)
 226                                 and 99 (highest priority) can be used.
 227                                 See <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 228                                 for details.
 229                                 </para></listitem>
 230                         </varlistentry>
 231
 232                         <varlistentry>
 233                                 <term><varname>CPUSchedulingResetOnFork=</varname></term>
 234
 235                                 <listitem><para>Takes a boolean
 236                                 argument. If true, elevated CPU
 237                                 scheduling priorities and policies
 238                                 will be reset when the executed
 239                                 processes fork, and can hence not leak
 240                                 into child processes. See
 241                                 <citerefentry><refentrytitle>sched_setscheduler</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 242                                 for details. Defaults to false.</para></listitem>
 243                         </varlistentry>
 244
 245                         <varlistentry>
 246                                 <term><varname>CPUAffinity=</varname></term>
 247
 248                                 <listitem><para>Controls the CPU
 249                                 affinity of the executed
 250                                 processes. Takes a space-separated
 251                                 list of CPU indices. This option may
 252                                 be specified more than once in which
 253                                 case the specificed CPU affinity masks
 254                                 are merged. If the empty string is
 255                                 assigned, the mask is reset, all
 256                                 assignments prior to this will have no
 257                                 effect. See
 258                                 <citerefentry><refentrytitle>sched_setaffinity</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 259                                 for details.</para></listitem>
 260                         </varlistentry>
 261
 262                         <varlistentry>
 263                                 <term><varname>UMask=</varname></term>
 264
 265                                 <listitem><para>Controls the file mode
 266                                 creation mask. Takes an access mode in
 267                                 octal notation. See
 268                                 <citerefentry><refentrytitle>umask</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 269                                 for details. Defaults to
 270                                 0022.</para></listitem>
 271                         </varlistentry>
 272
 273                         <varlistentry>
 274                                 <term><varname>Environment=</varname></term>
 275
 276                                 <listitem><para>Sets environment
 277                                 variables for executed
 278                                 processes. Takes a space-separated
 279                                 list of variable assignments. This
 280                                 option may be specified more than once
 281                                 in which case all listed variables
 282                                 will be set. If the same variable is
 283                                 set twice, the later setting will
 284                                 override the earlier setting. If the
 285                                 empty string is assigned to this
 286                                 option, the list of environment
 287                                 variables is reset, all prior
 288                                 assignments have no effect.
 289                                 Variable expansion is not performed
 290                                 inside the strings, however, specifier
 291                                 expansion is possible. The $ character has
 292                                 no special meaning.
 293                                 If you need to assign a value containing spaces
 294                                 to a variable, use double quotes (")
 295                                 for the assignment.</para>
 296
 297                                 <para>Example:
 298                                 <programlisting>Environment="VAR1=word1 word2" VAR2=word3 "VAR3=$word 5 6"</programlisting>
 299                                 gives three variables <literal>VAR1</literal>,
 300                                 <literal>VAR2</literal>, <literal>VAR3</literal>
 301                                 with the values <literal>word1 word2</literal>,
 302                                 <literal>word3</literal>, <literal>$word 5 6</literal>.
 303                                 </para>
 304
 305                                 <para>
 306                                 See
 307                                 <citerefentry project='man-pages'><refentrytitle>environ</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 308                                 for details about environment variables.</para></listitem>
 309                         </varlistentry>
 310                         <varlistentry>
 311                                 <term><varname>EnvironmentFile=</varname></term>
 312                                 <listitem><para>Similar to
 313                                 <varname>Environment=</varname> but
 314                                 reads the environment variables from a
 315                                 text file. The text file should
 316                                 contain new-line-separated variable
 317                                 assignments. Empty lines and lines
 318                                 starting with ; or # will be ignored,
 319                                 which may be used for commenting. A line
 320                                 ending with a backslash will be concatenated
 321                                 with the following one, allowing multiline variable
 322                                 definitions. The parser strips leading
 323                                 and trailing whitespace from the values
 324                                 of assignments, unless you use
 325                                 double quotes (").</para>
 326
 327                                 <para>The argument passed should be an
 328                                 absolute filename or wildcard
 329                                 expression, optionally prefixed with
 330                                 <literal>-</literal>, which indicates
 331                                 that if the file does not exist, it
 332                                 will not be read and no error or warning
 333                                 message is logged.  This option may be
 334                                 specified more than once in which case
 335                                 all specified files are read. If the
 336                                 empty string is assigned to this
 337                                 option, the list of file to read is
 338                                 reset, all prior assignments have no
 339                                 effect.</para>
 340
 341                                 <para>The files listed with this
 342                                 directive will be read shortly before
 343                                 the process is executed (more
 344                                 specifically, after all
 345                                 processes from a previous unit state
 346                                 terminated. This means you can
 347                                 generate these files in one unit
 348                                 state, and read it with this option in
 349                                 the next). Settings from these files
 350                                 override settings made with
 351                                 <varname>Environment=</varname>. If
 352                                 the same variable is set twice from
 353                                 these files, the files will be read in
 354                                 the order they are specified and the
 355                                 later setting will override the
 356                                 earlier setting.</para></listitem>
 357                         </varlistentry>
 358
 359                         <varlistentry>
 360                                 <term><varname>StandardInput=</varname></term>
 361                                 <listitem><para>Controls where file
 362                                 descriptor 0 (STDIN) of the executed
 363                                 processes is connected to. Takes one
 364                                 of <option>null</option>,
 365                                 <option>tty</option>,
 366                                 <option>tty-force</option>,
 367                                 <option>tty-fail</option> or
 368                                 <option>socket</option>.</para>
 369
 370                                 <para>If <option>null</option> is
 371                                 selected, standard input will be
 372                                 connected to
 373                                 <filename>/dev/null</filename>,
 374                                 i.e. all read attempts by the process
 375                                 will result in immediate EOF.</para>
 376
 377                                 <para>If <option>tty</option> is
 378                                 selected, standard input is connected
 379                                 to a TTY (as configured by
 380                                 <varname>TTYPath=</varname>, see
 381                                 below) and the executed process
 382                                 becomes the controlling process of the
 383                                 terminal. If the terminal is already
 384                                 being controlled by another process,
 385                                 the executed process waits until the
 386                                 current controlling process releases
 387                                 the terminal.</para>
 388
 389                                 <para><option>tty-force</option> is similar
 390                                 to <option>tty</option>, but the
 391                                 executed process is forcefully and
 392                                 immediately made the controlling
 393                                 process of the terminal, potentially
 394                                 removing previous controlling
 395                                 processes from the
 396                                 terminal.</para>
 397
 398                                 <para><option>tty-fail</option> is
 399                                 similar to <option>tty</option> but if
 400                                 the terminal already has a controlling
 401                                 process start-up of the executed
 402                                 process fails.</para>
 403
 404                                 <para>The <option>socket</option>
 405                                 option is only valid in
 406                                 socket-activated services, and only
 407                                 when the socket configuration file
 408                                 (see
 409                                 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 410                                 for details) specifies a single socket
 411                                 only. If this option is set, standard
 412                                 input will be connected to the socket
 413                                 the service was activated from, which
 414                                 is primarily useful for compatibility
 415                                 with daemons designed for use with the
 416                                 traditional
 417                                 <citerefentry><refentrytitle>inetd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 418                                 daemon.</para>
 419
 420                                 <para>This setting defaults to
 421                                 <option>null</option>.</para></listitem>
 422                         </varlistentry>
 423                         <varlistentry>
 424                                 <term><varname>StandardOutput=</varname></term>
 425                                 <listitem><para>Controls where file
 426                                 descriptor 1 (STDOUT) of the executed
 427                                 processes is connected to. Takes one
 428                                 of <option>inherit</option>,
 429                                 <option>null</option>,
 430                                 <option>tty</option>,
 431                                 <option>journal</option>,
 432                                 <option>syslog</option>,
 433                                 <option>kmsg</option>,
 434                                 <option>journal+console</option>,
 435                                 <option>syslog+console</option>,
 436                                 <option>kmsg+console</option> or
 437                                 <option>socket</option>.</para>
 438
 439                                 <para><option>inherit</option>
 440                                 duplicates the file descriptor of
 441                                 standard input for standard
 442                                 output.</para>
 443
 444                                 <para><option>null</option> connects
 445                                 standard output to
 446                                 <filename>/dev/null</filename>,
 447                                 i.e. everything written to it will be
 448                                 lost.</para>
 449
 450                                 <para><option>tty</option> connects
 451                                 standard output to a tty (as
 452                                 configured via
 453                                 <varname>TTYPath=</varname>, see
 454                                 below). If the TTY is used for output
 455                                 only, the executed process will not
 456                                 become the controlling process of the
 457                                 terminal, and will not fail or wait
 458                                 for other processes to release the
 459                                 terminal.</para>
 460
 461                                 <para><option>journal</option>
 462                                 connects standard output with the
 463                                 journal which is accessible via
 464                                 <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>.
 465                                 Note that everything that is written
 466                                 to syslog or kmsg (see below) is
 467                                 implicitly stored in the journal as
 468                                 well, the specific two options listed
 469                                 below are hence supersets of this
 470                                 one.</para>
 471
 472                                 <para><option>syslog</option> connects
 473                                 standard output to the <citerefentry
 474                                 project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
 475                                 system syslog service, in addition to
 476                                 the journal. Note that the journal
 477                                 daemon is usually configured to
 478                                 forward everything it receives to
 479                                 syslog anyway, in which case this
 480                                 option is no different from
 481                                 <option>journal</option>.</para>
 482
 483                                 <para><option>kmsg</option> connects
 484                                 standard output with the kernel log
 485                                 buffer which is accessible via
 486                                 <citerefentry
 487                                 project='man-pages'><refentrytitle>dmesg</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
 488                                 in addition to the journal. The
 489                                 journal daemon might be configured to
 490                                 send all logs to kmsg anyway, in which
 491                                 case this option is no different from
 492                                 <option>journal</option>.</para>
 493
 494                                 <para><option>journal+console</option>,
 495                                 <option>syslog+console</option> and
 496                                 <option>kmsg+console</option> work in
 497                                 a similar way as the three options
 498                                 above but copy the output to the
 499                                 system console as well.</para>
 500
 501                                 <para><option>socket</option> connects
 502                                 standard output to a socket acquired
 503                                 via socket activation. The semantics
 504                                 are similar to the same option of
 505                                 <varname>StandardInput=</varname>.</para>
 506
 507                                 <para>This setting defaults to the
 508                                 value set with
 509                                 <option>DefaultStandardOutput=</option>
 510                                 in
 511                                 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 512                                 which defaults to
 513                                 <option>journal</option>.</para></listitem>
 514                         </varlistentry>
 515                         <varlistentry>
 516                                 <term><varname>StandardError=</varname></term>
 517                                 <listitem><para>Controls where file
 518                                 descriptor 2 (STDERR) of the
 519                                 executed processes is connected to.
 520                                 The available options are identical to
 521                                 those of
 522                                 <varname>StandardOutput=</varname>,
 523                                 with one exception: if set to
 524                                 <option>inherit</option> the file
 525                                 descriptor used for standard output is
 526                                 duplicated for standard error. This
 527                                 setting defaults to the value set with
 528                                 <option>DefaultStandardError=</option>
 529                                 in
 530                                 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
 531                                 which defaults to
 532                                 <option>inherit</option>.</para></listitem>
 533                         </varlistentry>
 534                         <varlistentry>
 535                                 <term><varname>TTYPath=</varname></term>
 536                                 <listitem><para>Sets the terminal
 537                                 device node to use if standard input, output,
 538                                 or error are connected to a
 539                                 TTY (see above). Defaults to
 540                                 <filename>/dev/console</filename>.</para></listitem>
 541                         </varlistentry>
 542                         <varlistentry>
 543                                 <term><varname>TTYReset=</varname></term>
 544                                 <listitem><para>Reset the terminal
 545                                 device specified with
 546                                 <varname>TTYPath=</varname> before and
 547                                 after execution. Defaults to
 548                                 <literal>no</literal>.</para></listitem>
 549                         </varlistentry>
 550                         <varlistentry>
 551                                 <term><varname>TTYVHangup=</varname></term>
 552                                 <listitem><para>Disconnect all clients
 553                                 which have opened the terminal device
 554                                 specified with
 555                                 <varname>TTYPath=</varname>
 556                                 before and after execution. Defaults
 557                                 to
 558                                 <literal>no</literal>.</para></listitem>
 559                         </varlistentry>
 560                         <varlistentry>
 561                                 <term><varname>TTYVTDisallocate=</varname></term>
 562                                 <listitem><para>If the terminal
 563                                 device specified with
 564                                 <varname>TTYPath=</varname> is a
 565                                 virtual console terminal, try to
 566                                 deallocate the TTY before and after
 567                                 execution. This ensures that the
 568                                 screen and scrollback buffer is
 569                                 cleared. Defaults to
 570                                 <literal>no</literal>.</para></listitem>
 571                         </varlistentry>
 572                         <varlistentry>
 573                                 <term><varname>SyslogIdentifier=</varname></term>
 574                                 <listitem><para>Sets the process name
 575                                 to prefix log lines sent to syslog or
 576                                 the kernel log buffer with. If not set,
 577                                 defaults to the process name of the
 578                                 executed process. This option is only
 579                                 useful when
 580                                 <varname>StandardOutput=</varname> or
 581                                 <varname>StandardError=</varname> are
 582                                 set to <option>syslog</option> or
 583                                 <option>kmsg</option>.</para></listitem>
 584                         </varlistentry>
 585                         <varlistentry>
 586                                 <term><varname>SyslogFacility=</varname></term>
 587                                 <listitem><para>Sets the syslog
 588                                 facility to use when logging to
 589                                 syslog. One of <option>kern</option>,
 590                                 <option>user</option>,
 591                                 <option>mail</option>,
 592                                 <option>daemon</option>,
 593                                 <option>auth</option>,
 594                                 <option>syslog</option>,
 595                                 <option>lpr</option>,
 596                                 <option>news</option>,
 597                                 <option>uucp</option>,
 598                                 <option>cron</option>,
 599                                 <option>authpriv</option>,
 600                                 <option>ftp</option>,
 601                                 <option>local0</option>,
 602                                 <option>local1</option>,
 603                                 <option>local2</option>,
 604                                 <option>local3</option>,
 605                                 <option>local4</option>,
 606                                 <option>local5</option>,
 607                                 <option>local6</option> or
 608                                 <option>local7</option>. See
 609                                 <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
 610                                 for details. This option is only
 611                                 useful when
 612                                 <varname>StandardOutput=</varname> or
 613                                 <varname>StandardError=</varname> are
 614                                 set to <option>syslog</option>.
 615                                 Defaults to
 616                                 <option>daemon</option>.</para></listitem>
 617                         </varlistentry>
 618                         <varlistentry>
 619                                 <term><varname>SyslogLevel=</varname></term>
 620                                 <listitem><para>Default syslog level
 621                                 to use when logging to syslog or the
 622                                 kernel log buffer. One of
 623                                 <option>emerg</option>,
 624                                 <option>alert</option>,
 625                                 <option>crit</option>,
 626                                 <option>err</option>,
 627                                 <option>warning</option>,
 628                                 <option>notice</option>,
 629                                 <option>info</option>,
 630                                 <option>debug</option>. See
 631                                 <citerefentry project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>
 632                                 for details. This option is only
 633                                 useful when
 634                                 <varname>StandardOutput=</varname> or
 635                                 <varname>StandardError=</varname> are
 636                                 set to <option>syslog</option> or
 637                                 <option>kmsg</option>. Note that
 638                                 individual lines output by the daemon
 639                                 might be prefixed with a different log
 640                                 level which can be used to override
 641                                 the default log level specified
 642                                 here. The interpretation of these
 643                                 prefixes may be disabled with
 644                                 <varname>SyslogLevelPrefix=</varname>,
 645                                 see below. For details see
 646                                 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
 647
 648                                 Defaults to
 649                                 <option>info</option>.</para></listitem>
 650                         </varlistentry>
 651
 652                         <varlistentry>
 653                                 <term><varname>SyslogLevelPrefix=</varname></term>
 654                                 <listitem><para>Takes a boolean
 655                                 argument. If true and
 656                                 <varname>StandardOutput=</varname> or
 657                                 <varname>StandardError=</varname> are
 658                                 set to <option>syslog</option>,
 659                                 <option>kmsg</option> or
 660                                 <option>journal</option>, log lines
 661                                 written by the executed process that
 662                                 are prefixed with a log level will be
 663                                 passed on to syslog with this log
 664                                 level set but the prefix removed. If
 665                                 set to false, the interpretation of
 666                                 these prefixes is disabled and the
 667                                 logged lines are passed on as-is. For
 668                                 details about this prefixing see
 669                                 <citerefentry><refentrytitle>sd-daemon</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
 670                                 Defaults to true.</para></listitem>
 671                         </varlistentry>
 672
 673                         <varlistentry>
 674                                 <term><varname>TimerSlackNSec=</varname></term>
 675                                 <listitem><para>Sets the timer slack
 676                                 in nanoseconds for the executed
 677                                 processes. The timer slack controls
 678                                 the accuracy of wake-ups triggered by
 679                                 timers. See
 680                                 <citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 681                                 for more information. Note that in
 682                                 contrast to most other time span
 683                                 definitions this parameter takes an
 684                                 integer value in nano-seconds if no
 685                                 unit is specified. The usual time
 686                                 units are understood
 687                                 too.</para></listitem>
 688                         </varlistentry>
 689
 690                         <varlistentry>
 691                                 <term><varname>LimitCPU=</varname></term>
 692                                 <term><varname>LimitFSIZE=</varname></term>
 693                                 <term><varname>LimitDATA=</varname></term>
 694                                 <term><varname>LimitSTACK=</varname></term>
 695                                 <term><varname>LimitCORE=</varname></term>
 696                                 <term><varname>LimitRSS=</varname></term>
 697                                 <term><varname>LimitNOFILE=</varname></term>
 698                                 <term><varname>LimitAS=</varname></term>
 699                                 <term><varname>LimitNPROC=</varname></term>
 700                                 <term><varname>LimitMEMLOCK=</varname></term>
 701                                 <term><varname>LimitLOCKS=</varname></term>
 702                                 <term><varname>LimitSIGPENDING=</varname></term>
 703                                 <term><varname>LimitMSGQUEUE=</varname></term>
 704                                 <term><varname>LimitNICE=</varname></term>
 705                                 <term><varname>LimitRTPRIO=</varname></term>
 706                                 <term><varname>LimitRTTIME=</varname></term>
 707                                 <listitem><para>These settings control
 708                                 various resource limits for executed
 709                                 processes. See
 710                                 <citerefentry><refentrytitle>setrlimit</refentrytitle><manvolnum>2</manvolnum></citerefentry>
 711                                 for details. Use the string
 712                                 <varname>infinity</varname> to
 713                                 configure no limit on a specific
 714                                 resource.</para></listitem>
 715                         </varlistentry>
 716
 717                         <varlistentry>
 718                                 <term><varname>PAMName=</varname></term>
 719                                 <listitem><para>Sets the PAM service
 720                                 name to set up a session as. If set,
 721                                 the executed process will be
 722                                 registered as a PAM session under the
 723                                 specified service name. This is only
 724                                 useful in conjunction with the
 725                                 <varname>User=</varname> setting. If
 726                                 not set, no PAM session will be opened
 727                                 for the executed processes. See
 728                                 <citerefentry project='man-pages'><refentrytitle>pam</refentrytitle><manvolnum>8</manvolnum></citerefentry>
 729                                 for details.</para></listitem>
 730                         </varlistentry>
 731
 732                         <varlistentry>
 733                                 <term><varname>CapabilityBoundingSet=</varname></term>
 734
 735                                 <listitem><para>Controls which
 736                                 capabilities to include in the
 737                                 capability bounding set for the
 738                                 executed process. See
 739                                 <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 740                                 for details. Takes a whitespace-separated
 741                                 list of capability names as read by
 742                                 <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
 743                                 e.g. <constant>CAP_SYS_ADMIN</constant>,
 744                                 <constant>CAP_DAC_OVERRIDE</constant>,
 745                                 <constant>CAP_SYS_PTRACE</constant>.
 746                                 Capabilities listed will be included
 747                                 in the bounding set, all others are
 748                                 removed. If the list of capabilities
 749                                 is prefixed with <literal>~</literal>,
 750                                 all but the listed capabilities will
 751                                 be included, the effect of the
 752                                 assignment inverted. Note that this
 753                                 option also affects the respective
 754                                 capabilities in the effective,
 755                                 permitted and inheritable capability
 756                                 sets, on top of what
 757                                 <varname>Capabilities=</varname>
 758                                 does. If this option is not used, the
 759                                 capability bounding set is not
 760                                 modified on process execution, hence
 761                                 no limits on the capabilities of the
 762                                 process are enforced. This option may
 763                                 appear more than once in which case
 764                                 the bounding sets are merged. If the
 765                                 empty string is assigned to this
 766                                 option, the bounding set is reset to
 767                                 the empty capability set, and all
 768                                 prior settings have no effect. If set
 769                                 to <literal>~</literal> (without any
 770                                 further argument), the bounding set is
 771                                 reset to the full set of available
 772                                 capabilities, also undoing any
 773                                 previous settings.</para></listitem>
 774                         </varlistentry>
 775
 776                         <varlistentry>
 777                                 <term><varname>SecureBits=</varname></term>
 778                                 <listitem><para>Controls the secure
 779                                 bits set for the executed process.
 780                                 Takes a space-separated combination of
 781                                 options from the following list:
 782                                 <option>keep-caps</option>,
 783                                 <option>keep-caps-locked</option>,
 784                                 <option>no-setuid-fixup</option>,
 785                                 <option>no-setuid-fixup-locked</option>,
 786                                 <option>noroot</option>, and
 787                                 <option>noroot-locked</option>. This
 788                                 option may appear more than once in
 789                                 which case the secure bits are ORed.
 790                                 If the empty string is assigned to
 791                                 this option, the bits are reset to 0.
 792                                 See <citerefentry
 793                                 project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 794                                 for details.</para></listitem>
 795                         </varlistentry>
 796
 797                         <varlistentry>
 798                                 <term><varname>Capabilities=</varname></term>
 799                                 <listitem><para>Controls the
 800                                 <citerefentry project='man-pages'><refentrytitle>capabilities</refentrytitle><manvolnum>7</manvolnum></citerefentry>
 801                                 set for the executed process. Take a
 802                                 capability string describing the
 803                                 effective, permitted and inherited
 804                                 capability sets as documented in
 805                                 <citerefentry><refentrytitle>cap_from_text</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
 806                                 Note that these capability sets are
 807                                 usually influenced (and filtered) by the capabilities
 808                                 attached to the executed file. Due to
 809                                 that
 810                                 <varname>CapabilityBoundingSet=</varname>
 811                                 is probably a much more useful
 812                                 setting.</para></listitem>
 813                         </varlistentry>
 814
 815                         <varlistentry>
 816                                 <term><varname>ReadWriteDirectories=</varname></term>
 817                                 <term><varname>ReadOnlyDirectories=</varname></term>
 818                                 <term><varname>InaccessibleDirectories=</varname></term>
 819
 820                                 <listitem><para>Sets up a new file
 821                                 system namespace for executed
 822                                 processes. These options may be used
 823                                 to limit access a process might have
 824                                 to the main file system
 825                                 hierarchy. Each setting takes a
 826                                 space-separated list of absolute
 827                                 directory paths. Directories listed in
 828                                 <varname>ReadWriteDirectories=</varname>
 829                                 are accessible from within the
 830                                 namespace with the same access rights
 831                                 as from outside. Directories listed in
 832                                 <varname>ReadOnlyDirectories=</varname>
 833                                 are accessible for reading only,
 834                                 writing will be refused even if the
 835                                 usual file access controls would
 836                                 permit this. Directories listed in
 837                                 <varname>InaccessibleDirectories=</varname>
 838                                 will be made inaccessible for
 839                                 processes inside the namespace. Note
 840                                 that restricting access with these
 841                                 options does not extend to submounts
 842                                 of a directory that are created later
 843                                 on. These options may be specified
 844                                 more than once in which case all
 845                                 directories listed will have limited
 846                                 access from within the namespace. If
 847                                 the empty string is assigned to this
 848                                 option, the specific list is reset,
 849                                 and all prior assignments have no
 850                                 effect.</para>
 851                                 <para>Paths in
 852                                 <varname>ReadOnlyDirectories=</varname>
 853                                 and
 854                                 <varname>InaccessibleDirectories=</varname>
 855                                 may be prefixed with
 856                                 <literal>-</literal>, in which case
 857                                 they will be ignored when they do not
 858                                 exist. Note that using this
 859                                 setting will disconnect propagation of
 860                                 mounts from the service to the host
 861                                 (propagation in the opposite direction
 862                                 continues to work). This means that
 863                                 this setting may not be used for
 864                                 services which shall be able to
 865                                 install mount points in the main mount
 866                                 namespace.</para></listitem>
 867                         </varlistentry>
 868
 869                         <varlistentry>
 870                                 <term><varname>PrivateTmp=</varname></term>
 871
 872                                 <listitem><para>Takes a boolean
 873                                 argument. If true, sets up a new file
 874                                 system namespace for the executed
 875                                 processes and mounts private
 876                                 <filename>/tmp</filename> and
 877                                 <filename>/var/tmp</filename>
 878                                 directories inside it that is not
 879                                 shared by processes outside of the
 880                                 namespace. This is useful to secure
 881                                 access to temporary files of the
 882                                 process, but makes sharing between
 883                                 processes via
 884                                 <filename>/tmp</filename> or
 885                                 <filename>/var/tmp</filename>
 886                                 impossible. If this is enabled, all
 887                                 temporary files created by a service
 888                                 in these directories will be removed
 889                                 after the service is stopped. Defaults
 890                                 to false. It is possible to run two or
 891                                 more units within the same private
 892                                 <filename>/tmp</filename> and
 893                                 <filename>/var/tmp</filename>
 894                                 namespace by using the
 895                                 <varname>JoinsNamespaceOf=</varname>
 896                                 directive, see
 897                                 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 898                                 for details. Note that using this
 899                                 setting will disconnect propagation of
 900                                 mounts from the service to the host
 901                                 (propagation in the opposite direction
 902                                 continues to work). This means that
 903                                 this setting may not be used for
 904                                 services which shall be able to install
 905                                 mount points in the main mount
 906                                 namespace.</para></listitem>
 907                         </varlistentry>
 908
 909                         <varlistentry>
 910                                 <term><varname>PrivateDevices=</varname></term>
 911
 912                                 <listitem><para>Takes a boolean
 913                                 argument. If true, sets up a new /dev
 914                                 namespace for the executed processes
 915                                 and only adds API pseudo devices such
 916                                 as <filename>/dev/null</filename>,
 917                                 <filename>/dev/zero</filename> or
 918                                 <filename>/dev/random</filename> (as
 919                                 well as the pseudo TTY subsystem) to
 920                                 it, but no physical devices such as
 921                                 <filename>/dev/sda</filename>. This is
 922                                 useful to securely turn off physical
 923                                 device access by the executed
 924                                 process. Defaults to false. Enabling
 925                                 this option will also remove
 926                                 <constant>CAP_MKNOD</constant> from
 927                                 the capability bounding set for the
 928                                 unit (see above), and set
 929                                 <varname>DevicePolicy=closed</varname>
 930                                 (see
 931                                 <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 932                                 for details). Note that using this
 933                                 setting will disconnect propagation of
 934                                 mounts from the service to the host
 935                                 (propagation in the opposite direction
 936                                 continues to work). This means that
 937                                 this setting may not be used for
 938                                 services which shall be able to
 939                                 install mount points in the main mount
 940                                 namespace.</para></listitem>
 941                         </varlistentry>
 942
 943                         <varlistentry>
 944                                 <term><varname>PrivateNetwork=</varname></term>
 945
 946                                 <listitem><para>Takes a boolean
 947                                 argument. If true, sets up a new
 948                                 network namespace for the executed
 949                                 processes and configures only the
 950                                 loopback network device
 951                                 <literal>lo</literal> inside it. No
 952                                 other network devices will be
 953                                 available to the executed process.
 954                                 This is useful to securely turn off
 955                                 network access by the executed
 956                                 process. Defaults to false. It is
 957                                 possible to run two or more units
 958                                 within the same private network
 959                                 namespace by using the
 960                                 <varname>JoinsNamespaceOf=</varname>
 961                                 directive, see
 962                                 <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 963                                 for details. Note that this option
 964                                 will disconnect all socket families
 965                                 from the host, this includes
 966                                 AF_NETLINK and AF_UNIX. The latter has
 967                                 the effect that AF_UNIX sockets in the
 968                                 abstract socket namespace will become
 969                                 unavailable to the processes (however,
 970                                 those located in the file system will
 971                                 continue to be
 972                                 accessible).</para></listitem>
 973                         </varlistentry>
 974
 975                         <varlistentry>
 976                                 <term><varname>ProtectSystem=</varname></term>
 977
 978                                 <listitem><para>Takes a boolean
 979                                 argument or
 980                                 <literal>full</literal>. If true,
 981                                 mounts the <filename>/usr</filename>
 982                                 directory read-only for processes
 983                                 invoked by this unit. If set to
 984                                 <literal>full</literal>, the
 985                                 <filename>/etc</filename> directory is mounted
 986                                 read-only, too. This setting ensures
 987                                 that any modification of the vendor
 988                                 supplied operating system (and
 989                                 optionally its configuration) is
 990                                 prohibited for the service. It is
 991                                 recommended to enable this setting for
 992                                 all long-running services, unless they
 993                                 are involved with system updates or
 994                                 need to modify the operating system in
 995                                 other ways. Note however that
 996                                 processes retaining the CAP_SYS_ADMIN
 997                                 capability can undo the effect of this
 998                                 setting. This setting is hence
 999                                 particularly useful for daemons which
1000                                 have this capability removed, for
1001                                 example with
1002                                 <varname>CapabilityBoundingSet=</varname>. Defaults
1003                                 to off.</para></listitem>
1004                         </varlistentry>
1005
1006                         <varlistentry>
1007                                 <term><varname>ProtectHome=</varname></term>
1008
1009                                 <listitem><para>Takes a boolean
1010                                 argument or
1011                                 <literal>read-only</literal>. If true,
1012                                 the directories
1013                                 <filename>/home</filename> and
1014                                 <filename>/run/user</filename> are
1015                                 made inaccessible and empty for
1016                                 processes invoked by this unit. If set
1017                                 to <literal>read-only</literal>, the
1018                                 two directories are made read-only
1019                                 instead. It is recommended to enable
1020                                 this setting for all long-running
1021                                 services (in particular network-facing
1022                                 ones), to ensure they cannot get access
1023                                 to private user data, unless the
1024                                 services actually require access to
1025                                 the user's private data. Note however
1026                                 that processes retaining the
1027                                 CAP_SYS_ADMIN capability can undo the
1028                                 effect of this setting. This setting
1029                                 is hence particularly useful for
1030                                 daemons which have this capability
1031                                 removed, for example with
1032                                 <varname>CapabilityBoundingSet=</varname>. Defaults
1033                                 to off.</para></listitem>
1034                         </varlistentry>
1035
1036                         <varlistentry>
1037                                 <term><varname>MountFlags=</varname></term>
1038
1039                                 <listitem><para>Takes a mount
1040                                 propagation flag:
1041                                 <option>shared</option>,
1042                                 <option>slave</option> or
1043                                 <option>private</option>, which
1044                                 control whether mounts in the file
1045                                 system namespace set up for this
1046                                 unit's processes will receive or
1047                                 propagate mounts or unmounts. See
1048                                 <citerefentry><refentrytitle>mount</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1049                                 for details. Defaults to
1050                                 <option>shared</option>. Use
1051                                 <option>shared</option> to ensure that
1052                                 mounts and unmounts are propagated
1053                                 from the host to the container and
1054                                 vice versa. Use <option>slave</option>
1055                                 to run processes so that none of their
1056                                 mounts and unmounts will propagate to
1057                                 the host. Use <option>private</option>
1058                                 to also ensure that no mounts and
1059                                 unmounts from the host will propagate
1060                                 into the unit processes'
1061                                 namespace. Note that
1062                                 <option>slave</option> means that file
1063                                 systems mounted on the host might stay
1064                                 mounted continuously in the unit's
1065                                 namespace, and thus keep the device
1066                                 busy. Note that the file system
1067                                 namespace related options
1068                                 (<varname>PrivateTmp=</varname>,
1069                                 <varname>PrivateDevices=</varname>,
1070                                 <varname>ProtectSystem=</varname>,
1071                                 <varname>ProtectHome=</varname>,
1072                                 <varname>ReadOnlyDirectories=</varname>,
1073                                 <varname>InaccessibleDirectories=</varname>
1074                                 and
1075                                 <varname>ReadWriteDirectories=</varname>)
1076                                 require that mount and unmount
1077                                 propagation from the unit's file
1078                                 system namespace is disabled, and
1079                                 hence downgrade
1080                                 <option>shared</option> to
1081                                 <option>slave</option>.
1082                                 </para></listitem>
1083                         </varlistentry>
1084
1085                         <varlistentry>
1086                                 <term><varname>UtmpIdentifier=</varname></term>
1087
1088                                 <listitem><para>Takes a four
1089                                 character identifier string for an
1090                                 utmp/wtmp entry for this service. This
1091                                 should only be set for services such
1092                                 as <command>getty</command>
1093                                 implementations where utmp/wtmp
1094                                 entries must be created and cleared
1095                                 before and after execution. If the
1096                                 configured string is longer than four
1097                                 characters, it is truncated and the
1098                                 terminal four characters are
1099                                 used. This setting interprets %I style
1100                                 string replacements. This setting is
1101                                 unset by default, i.e. no utmp/wtmp
1102                                 entries are created or cleaned up for
1103                                 this service.</para></listitem>
1104                         </varlistentry>
1105
1106                         <varlistentry>
1107                                 <term><varname>SELinuxContext=</varname></term>
1108
1109                                 <listitem><para>Set the SELinux
1110                                 security context of the executed
1111                                 process. If set, this will override
1112                                 the automated domain
1113                                 transition. However, the policy still
1114                                 needs to autorize the transition. This
1115                                 directive is ignored if SELinux is
1116                                 disabled. If prefixed by
1117                                 <literal>-</literal>, all errors will
1118                                 be ignored. See
1119                                 <citerefentry><refentrytitle>setexeccon</refentrytitle><manvolnum>3</manvolnum></citerefentry>
1120                                 for details.</para></listitem>
1121                         </varlistentry>
1122
1123                         <varlistentry>
1124                                 <term><varname>AppArmorProfile=</varname></term>
1125
1126                                 <listitem><para>Takes a profile name as argument.
1127                                 The process executed by the unit will switch to
1128                                 this profile when started. Profiles must already
1129                                 be loaded in the kernel, or the unit will fail.
1130                                 This result in a non operation if AppArmor is not
1131                                 enabled. If prefixed by <literal>-</literal>, all errors
1132                                 will be ignored.
1133                                 </para></listitem>
1134                         </varlistentry>
1135
1136                         <varlistentry>
1137                                 <term><varname>IgnoreSIGPIPE=</varname></term>
1138
1139                                 <listitem><para>Takes a boolean
1140                                 argument. If true, causes <constant>SIGPIPE</constant> to be
1141                                 ignored in the executed
1142                                 process. Defaults to true because
1143                                 <constant>SIGPIPE</constant> generally is useful only in
1144                                 shell pipelines.</para></listitem>
1145                         </varlistentry>
1146
1147                         <varlistentry>
1148                                 <term><varname>NoNewPrivileges=</varname></term>
1149
1150                                 <listitem><para>Takes a boolean
1151                                 argument. If true, ensures that the
1152                                 service process and all its children
1153                                 can never gain new privileges. This
1154                                 option is more powerful than the respective
1155                                 secure bits flags (see above), as it
1156                                 also prohibits UID changes of any
1157                                 kind. This is the simplest, most
1158                                 effective way to ensure that a process
1159                                 and its children can never elevate
1160                                 privileges again.</para></listitem>
1161                         </varlistentry>
1162
1163                         <varlistentry>
1164                                 <term><varname>SystemCallFilter=</varname></term>
1165
1166                                 <listitem><para>Takes a
1167                                 space-separated list of system call
1168                                 names. If this setting is used, all
1169                                 system calls executed by the unit
1170                                 processes except for the listed ones
1171                                 will result in immediate process
1172                                 termination with the
1173                                 <constant>SIGSYS</constant> signal
1174                                 (whitelisting). If the first character
1175                                 of the list is <literal>~</literal>,
1176                                 the effect is inverted: only the
1177                                 listed system calls will result in
1178                                 immediate process termination
1179                                 (blacklisting). If running in user
1180                                 mode and this option is used,
1181                                 <varname>NoNewPrivileges=yes</varname>
1182                                 is implied. This feature makes use of the
1183                                 Secure Computing Mode 2 interfaces of
1184                                 the kernel ('seccomp filtering') and
1185                                 is useful for enforcing a minimal
1186                                 sandboxing environment. Note that the
1187                                 <function>execve</function>,
1188                                 <function>rt_sigreturn</function>,
1189                                 <function>sigreturn</function>,
1190                                 <function>exit_group</function>,
1191                                 <function>exit</function> system calls
1192                                 are implicitly whitelisted and do not
1193                                 need to be listed explicitly. This
1194                                 option may be specified more than once
1195                                 in which case the filter masks are
1196                                 merged. If the empty string is
1197                                 assigned, the filter is reset, all
1198                                 prior assignments will have no
1199                                 effect.</para>
1200
1201                                 <para>If you specify both types of
1202                                 this option (i.e. whitelisting and
1203                                 blacklisting), the first encountered
1204                                 will take precedence and will dictate
1205                                 the default action (termination or
1206                                 approval of a system call). Then the
1207                                 next occurrences of this option will
1208                                 add or delete the listed system calls
1209                                 from the set of the filtered system
1210                                 calls, depending of its type and the
1211                                 default action. (For example, if you have started
1212                                 with a whitelisting of
1213                                 <function>read</function> and
1214                                 <function>write</function>, and right
1215                                 after it add a blacklisting of
1216                                 <function>write</function>, then
1217                                 <function>write</function> will be
1218                                 removed from the set.)
1219                                 </para></listitem>
1220                         </varlistentry>
1221
1222                         <varlistentry>
1223                                 <term><varname>SystemCallErrorNumber=</varname></term>
1224
1225                                 <listitem><para>Takes an
1226                                 <literal>errno</literal> error number
1227                                 name to return when the system call
1228                                 filter configured with
1229                                 <varname>SystemCallFilter=</varname>
1230                                 is triggered, instead of terminating
1231                                 the process immediately. Takes an
1232                                 error name such as
1233                                 <constant>EPERM</constant>,
1234                                 <constant>EACCES</constant> or
1235                                 <constant>EUCLEAN</constant>. When this
1236                                 setting is not used, or when the empty
1237                                 string is assigned, the process will be
1238                                 terminated immediately when the filter
1239                                 is triggered.</para></listitem>
1240                         </varlistentry>
1241
1242                         <varlistentry>
1243                                 <term><varname>SystemCallArchitectures=</varname></term>
1244
1245                                 <listitem><para>Takes a space
1246                                 separated list of architecture
1247                                 identifiers to include in the system
1248                                 call filter. The known architecture
1249                                 identifiers are
1250                                 <constant>x86</constant>,
1251                                 <constant>x86-64</constant>,
1252                                 <constant>x32</constant>,
1253                                 <constant>arm</constant> as well as
1254                                 the special identifier
1255                                 <constant>native</constant>. Only
1256                                 system calls of the specified
1257                                 architectures will be permitted to
1258                                 processes of this unit. This is an
1259                                 effective way to disable compatibility
1260                                 with non-native architectures for
1261                                 processes, for example to prohibit
1262                                 execution of 32-bit x86 binaries on
1263                                 64-bit x86-64 systems. The special
1264                                 <constant>native</constant> identifier
1265                                 implicitly maps to the native
1266                                 architecture of the system (or more
1267                                 strictly: to the architecture the
1268                                 system manager is compiled for). If
1269                                 running in user mode and this option
1270                                 is used,
1271                                 <varname>NoNewPrivileges=yes</varname>
1272                                 is implied. Note that setting this
1273                                 option to a non-empty list implies
1274                                 that <constant>native</constant> is
1275                                 included too. By default, this option
1276                                 is set to the empty list, i.e. no
1277                                 architecture system call filtering is
1278                                 applied.</para></listitem>
1279                         </varlistentry>
1280
1281                         <varlistentry>
1282                                 <term><varname>RestrictAddressFamilies=</varname></term>
1283
1284                                 <listitem><para>Restricts the set of
1285                                 socket address families accessible to
1286                                 the processes of this unit. Takes a
1287                                 space-separated list of address family
1288                                 names to whitelist, such as
1289                                 <constant>AF_UNIX</constant>,
1290                                 <constant>AF_INET</constant> or
1291                                 <constant>AF_INET6</constant>. When
1292                                 prefixed with <constant>~</constant>
1293                                 the listed address families will be
1294                                 applied as blacklist, otherwise as
1295                                 whitelist. Note that this restricts
1296                                 access to the
1297                                 <citerefentry><refentrytitle>socket</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1298                                 system call only. Sockets passed into
1299                                 the process by other means (for
1300                                 example, by using socket activation
1301                                 with socket units, see
1302                                 <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>)
1303                                 are unaffected. Also, sockets created
1304                                 with <function>socketpair()</function>
1305                                 (which creates connected AF_UNIX
1306                                 sockets only) are unaffected. Note
1307                                 that this option has no effect on
1308                                 32-bit x86 and is ignored (but works
1309                                 correctly on x86-64). If running in user
1310                                 mode and this option is used,
1311                                 <varname>NoNewPrivileges=yes</varname>
1312                                 is implied. By default, no
1313                                 restriction applies, all address
1314                                 families are accessible to
1315                                 processes. If assigned the empty
1316                                 string, any previous list changes are
1317                                 undone.</para>
1318
1319                                 <para>Use this option to limit
1320                                 exposure of processes to remote
1321                                 systems, in particular via exotic
1322                                 network protocols. Note that in most
1323                                 cases, the local
1324                                 <constant>AF_UNIX</constant> address
1325                                 family should be included in the
1326                                 configured whitelist as it is
1327                                 frequently used for local
1328                                 communication, including for
1329                                 <citerefentry><refentrytitle>syslog</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1330                                 logging.</para></listitem>
1331                         </varlistentry>
1332
1333                         <varlistentry>
1334                                 <term><varname>Personality=</varname></term>
1335
1336                                 <listitem><para>Controls which
1337                                 kernel architecture
1338                                 <citerefentry><refentrytitle>uname</refentrytitle><manvolnum>2</manvolnum></citerefentry>
1339                                 shall report, when invoked by unit
1340                                 processes. Takes one of
1341                                 <constant>x86</constant> and
1342                                 <constant>x86-64</constant>. This is
1343                                 useful when running 32-bit services on
1344                                 a 64-bit host system. If not specified,
1345                                 the personality is left unmodified and
1346                                 thus reflects the personality of the
1347                                 host system's
1348                                 kernel.</para></listitem>
1349                         </varlistentry>
1350
1351                         <varlistentry>
1352                                 <term><varname>RuntimeDirectory=</varname></term>
1353                                 <term><varname>RuntimeDirectoryMode=</varname></term>
1354
1355                                 <listitem><para>Takes a list of
1356                                 directory names. If set, one or more
1357                                 directories by the specified names
1358                                 will be created below
1359                                 <filename>/run</filename> (for system
1360                                 services) or below
1361                                 <varname>$XDG_RUNTIME_DIR</varname>
1362                                 (for user services) when the unit is
1363                                 started, and removed when the unit is
1364                                 stopped. The directories will have the
1365                                 access mode specified in
1366                                 <varname>RuntimeDirectoryMode=</varname>,
1367                                 and will be owned by the user and
1368                                 group specified in
1369                                 <varname>User=</varname> and
1370                                 <varname>Group=</varname>. Use this to
1371                                 manage one or more runtime directories
1372                                 of the unit and bind their lifetime to
1373                                 the daemon runtime. The specified
1374                                 directory names must be relative, and
1375                                 may not include a
1376                                 <literal>/</literal>, i.e. must refer
1377                                 to simple directories to create or
1378                                 remove. This is particularly useful
1379                                 for unprivileged daemons that cannot
1380                                 create runtime directories in
1381                                 <filename>/run</filename> due to lack
1382                                 of privileges, and to make sure the
1383                                 runtime directory is cleaned up
1384                                 automatically after use. For runtime
1385                                 directories that require more complex
1386                                 or different configuration or lifetime
1387                                 guarantees, please consider using
1388                                 <citerefentry><refentrytitle>tmpfiles.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para></listitem>
1389                         </varlistentry>
1390
1391                 </variablelist>
1392         </refsect1>
1393
1394         <refsect1>
1395                 <title>Environment variables in spawned processes</title>
1396
1397                 <para>Processes started by the system are executed in
1398                 a clean environment in which select variables
1399                 listed below are set. System processes started by systemd
1400                 do not inherit variables from PID 1, but processes
1401                 started by user systemd instances inherit all
1402                 environment variables from the user systemd instance.
1403                 </para>
1404
1405                 <variablelist class='environment-variables'>
1406                         <varlistentry>
1407                                 <term><varname>$PATH</varname></term>
1408
1409                                 <listitem><para>Colon-separated list
1410                                 of directiories to use when launching
1411                                 executables. Systemd uses a fixed
1412                                 value of
1413                                 <filename>/usr/local/sbin</filename>:<filename>/usr/local/bin</filename>:<filename>/usr/sbin</filename>:<filename>/usr/bin</filename>:<filename>/sbin</filename>:<filename>/bin</filename>.
1414                                 </para></listitem>
1415                         </varlistentry>
1416
1417                         <varlistentry>
1418                                 <term><varname>$LANG</varname></term>
1419
1420                                 <listitem><para>Locale. Can be set in
1421                                 <citerefentry><refentrytitle>locale.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1422                                 or on the kernel command line (see
1423                                 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
1424                                 and
1425                                 <citerefentry><refentrytitle>kernel-command-line</refentrytitle><manvolnum>7</manvolnum></citerefentry>).
1426                                 </para></listitem>
1427                         </varlistentry>
1428
1429                         <varlistentry>
1430                                 <term><varname>$USER</varname></term>
1431                                 <term><varname>$LOGNAME</varname></term>
1432                                 <term><varname>$HOME</varname></term>
1433                                 <term><varname>$SHELL</varname></term>
1434
1435                                 <listitem><para>User name (twice), home
1436                                 directory, and the login shell.
1437                                 The variables are set for the units that
1438                                 have <varname>User=</varname> set,
1439                                 which includes user
1440                                 <command>systemd</command> instances.
1441                                 See
1442                                 <citerefentry><refentrytitle>passwd</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
1443                                 </para></listitem>
1444                         </varlistentry>
1445
1446                         <varlistentry>
1447                                 <term><varname>$XDG_RUNTIME_DIR</varname></term>
1448
1449                                 <listitem><para>The directory for volatile
1450                                 state. Set for the user <command>systemd</command>
1451                                 instance, and also in user sessions.
1452                                 See
1453                                 <citerefentry><refentrytitle>pam_systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
1454                                 </para></listitem>
1455                         </varlistentry>
1456
1457                         <varlistentry>
1458                                 <term><varname>$XDG_SESSION_ID</varname></term>
1459                                 <term><varname>$XDG_SEAT</varname></term>
1460                                 <term><varname>$XDG_VTNR</varname></term>
1461
1462                                 <listitem><para>The identifier of the
1463                                 session, the seat name, and
1464                                 virtual terminal of the session. Set
1465                                 by
1466                                 <citerefentry><refentrytitle>pam_systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
1467                                 for login sessions.
1468                                 <varname>$XDG_SEAT</varname> and
1469                                 <varname>$XDG_VTNR</varname> will
1470                                 only be set when attached to a seat and a
1471                                 tty.</para></listitem>
1472                         </varlistentry>
1473
1474                         <varlistentry>
1475                                 <term><varname>$MAINPID</varname></term>
1476
1477                                 <listitem><para>The PID of the units
1478                                 main process if it is known. This is
1479                                 only set for control processes as
1480                                 invoked by
1481                                 <varname>ExecReload=</varname> and
1482                                 similar.  </para></listitem>
1483                         </varlistentry>
1484
1485                         <varlistentry>
1486                                 <term><varname>$MANAGERPID</varname></term>
1487
1488                                 <listitem><para>The PID of the user
1489                                 <command>systemd</command> instance,
1490                                 set for processes spawned by it.
1491                                 </para></listitem>
1492                         </varlistentry>
1493
1494                         <varlistentry>
1495                                 <term><varname>$LISTEN_FDS</varname></term>
1496                                 <term><varname>$LISTEN_PID</varname></term>
1497
1498                                 <listitem><para>Information about file
1499                                 descriptors passed to a service for
1500                                 socket activation.  See
1501                                 <citerefentry><refentrytitle>sd_listen_fds</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
1502                                 </para></listitem>
1503                         </varlistentry>
1504
1505                         <varlistentry>
1506                                 <term><varname>$TERM</varname></term>
1507
1508                                 <listitem><para>Terminal type, set
1509                                 only for units connected to a terminal
1510                                 (<varname>StandardInput=tty</varname>,
1511                                 <varname>StandardOutput=tty</varname>,
1512                                 or
1513                                 <varname>StandardError=tty</varname>).
1514                                 See
1515                                 <citerefentry project='man-pages'><refentrytitle>termcap</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
1516                                 </para></listitem>
1517                         </varlistentry>
1518                 </variablelist>
1519
1520                 <para>Additional variables may be configured by the
1521                 following means: for processes spawned in specific
1522                 units, use the <varname>Environment=</varname> and
1523                 <varname>EnvironmentFile=</varname> options above; to
1524                 specify variables globally, use
1525                 <varname>DefaultEnvironment=</varname> (see
1526                 <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>)
1527                 or the kernel option
1528                 <varname>systemd.setenv=</varname> (see
1529                 <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>). Additional
1530                 variables may also be set through PAM,
1531                 cf. <citerefentry project='man-pages'><refentrytitle>pam_env</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
1532         </refsect1>
1533
1534         <refsect1>
1535                   <title>See Also</title>
1536                   <para>
1537                           <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1538                           <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1539                           <citerefentry><refentrytitle>journalctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1540                           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1541                           <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1542                           <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1543                           <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1544                           <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1545                           <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1546                           <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1547                           <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
1548                           <citerefentry><refentrytitle>tmpfiles.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1549                           <citerefentry project='man-pages'><refentrytitle>exec</refentrytitle><manvolnum>3</manvolnum></citerefentry>
1550                   </para>
1551         </refsect1>
1552
1553 </refentry>