summaryrefslogtreecommitdiff
path: root/man/systemd.exec.xml
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #27669 from keszybz/man-fixes-254Zbigniew Jędrzejewski-Szmek2023-05-171-8/+13
|\ | | | | Some simple man page fixes to reduce the list of issues tagged for v254
| * man: say that ProtectClock= also affects readsZbigniew Jędrzejewski-Szmek2023-05-171-8/+13
| | | | | | | | | | | | | | | | | | | | | | | | Fixes #26413: the docs said that the filter prevents writes, but it just a filter at the system call level, and some of those calls are used for writing and reading. This is confusing esp. when a higher level library call like ntp_gettime() is denied. I don't think it's realistic that we'll make the filter smarter in the near future, so let's change the docs to describe the implementation. Also, split out the advice part into a separate paragraph.
* | man: fixes for assorted issues reported by the manpage-l10n projectZbigniew Jędrzejewski-Szmek2023-05-171-11/+13
|/ | | | Fixes #26761.
* Merge pull request #25608 from poettering/dissect-moarLennart Poettering2023-04-121-0/+24
|\ | | | | dissect: add dissection policies
| * man: document image policy syntax and semantics, and the hooks in the ↵Lennart Poettering2023-04-051-0/+24
| | | | | | | | various components
* | service: tell service processes that the fdstore is available via an env varLennart Poettering2023-04-121-2/+14
|/
* man: update syscal filter group listLennart Poettering2023-03-241-0/+8
|
* core: append LogExtraFields= values to log_unit* messagesLuca Boccassi2023-03-141-2/+2
| | | | | | | This ensure messages from PID1 regarding a unit also contain those fields. For example, portable services have PORTABLE=<image> as extra fields, which is useful to identify which version of a portable image produced a log message like an error or an oomd kill.
* execute: use prctl(PR_SET_MDWE) for MemoryDenyWriteExecute=yesTopi Miettinen2023-03-131-3/+5
| | | | | | | | | | | | On some ARM platforms, the dynamic linker could use PROT_BTI memory protection flag with `mprotect(..., PROT_BTI | PROT_EXEC)` to enable additional memory protection for executable pages. But `MemoryDenyWriteExecute=yes` blocks this with seccomp filter denying all `mprotect(..., x | PROT_EXEC)`. Newly preferred method is to use prctl(PR_SET_MDWE) on supported kernels. Then in-kernel implementation can allow PROT_BTI as necessary, without weakening MDWE. In-kernel version may also be extended to more sophisticated protections in the future.
* pid1: add unit file settings to control memory pressure logicLennart Poettering2023-03-011-0/+10
|
* man: document REMOTE_ADDR/REMOTE_PORT along with the other env varsLennart Poettering2023-02-241-0/+9
|
* core/namespace: mount new sysfs when new network namespace is requestedYu Watanabe2023-02-231-0/+8
| | | | | | | | | | | | | | Even when a mount namespace is created, previously host's sysfs is used, especially with RootDirectory= or RootImage=, thus service processes can still access the properties of the network interfaces in the main network namespace through sysfs. This makes, sysfs is remounted with the new network namespace tag, except when PrivateMounts= is explicitly disabled. Hence, the properties of the network interfaces in the main network namespace cannot be accessed by service processes through sysfs. Fixes #26422.
* core: imply DeviceAllow=/dev/tpmrm0 with LoadCredentialEncryptedLuca Boccassi2023-02-081-1/+7
| | | | | | | If the device access policy is restricted, add implicitly access to the TPM if at least one encrypted credential needs to be loaded. Fixes https://github.com/systemd/systemd/issues/26042
* man: extend Personality= docs a bitLennart Poettering2023-01-241-10/+14
| | | | | | | | Let's make clear personalities are supported on ARM (as per https://github.com/systemd/systemd/pull/26152#issuecomment-1400321944). Also, clarify that on many archs this functionality is pretty pointless, i.e. where only a single native arch was ever known.
* Revert "Resolves #26142 - Fix list of supported personalities"Lennart Poettering2023-01-241-9/+3
| | | | This reverts commit fdbbb5ffc04c48e6e1b97ddfff366672c2f8a073.
* Resolves #26142 - Fix list of supported personalitiesSteve Ramage2023-01-221-3/+9
|
* man: note that cgroup-based sandboxing is not bypassed by '+'Luca Boccassi2023-01-181-1/+3
| | | | | | | | DeviceAllow= and others are applied to the whole cgroup via bpf, so using '+' on an Exec line will not bypass them. Explain this in the manpage. Fixes https://github.com/systemd/systemd/issues/26035
* man: fix issues reported by the manpage-l10n projectZbigniew Jędrzejewski-Szmek2023-01-111-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes #25780. > Man page: crypttab.5 > Issue 1: Missing fullstop > Issue 2: I<cipher=>, I<hash=>, I<size=> → B<cipher=>, B<hash=>, B<size=> > > "Force LUKS mode\\&. When this mode is used, the following options are " > "ignored since they are provided by the LUKS header on the device: " > "I<cipher=>, I<hash=>, I<size=>" Seems OK to me. The full stop is there and has been for at least a few years. And we use <option> for the markup, which is appropriate here. > Man page: crypttab.5 > Issue 1: Missing fullstop > Issue 2: I<cipher=>, I<hash=>, I<keyfile-offset=>, I<keyfile-size=>, I<size=> → B<cipher=>, B<hash=>, B<keyfile-offset=>, B<keyfile-size=>, B<size=> > > "Use TrueCrypt encryption mode\\&. When this mode is used, the following " > "options are ignored since they are provided by the TrueCrypt header on the " > "device or do not apply: I<cipher=>, I<hash=>, I<keyfile-offset=>, I<keyfile-" > "size=>, I<size=>" Same. > Man page: journalctl.1 > Issue 1: make be → may be Fixed. > Issue 2: below\\&. → below: Fixed. > Man page: journalctl.1 > Issue: Colon at the end? > > "The following commands are understood\\&. If none is specified the default " > "is to display journal records\\&." > msgstr "" > "Die folgenden Befehle werden verstanden\\&. Falls keiner festgelegt ist, ist " > "die Anzeige von Journal-Datensätzen die Vorgabe\\&." This is a bit awkward, but I'm not sure how to fix it. > Man page: kernel-install.8 > Issue: methods a fallback → methods fallback It was correct, but I added a comma to make the sense clearer. > Man page: loader.conf.5 > Issue 1: secure boot variables → Secure Boot variables > Issue 2: one → one for (multiple times) > > "Supported secure boot variables are one database for authorized images, one " > "key exchange key (KEK) and one platform key (PK)\\&. For more information, " > "refer to the \\m[blue]B<UEFI specification>\\m[]\\&\\s-2\\u[2]\\d\\s+2, " > "under Secure Boot and Driver Signing\\&. Another resource that describe the " > "interplay of the different variables is the \\m[blue]B<EDK2 " > "documentation>\\m[]\\&\\s-2\\u[3]\\d\\s+2\\&." "one of" would sound strange. "One this and one that" is OK. > Man page: loader.conf.5 > Issue: systemd-boot → B<systemd-boot>(7) Fixed. > Man page: logind.conf.5 > Issue: systemd-logind → B<systemd-logind>(8) We use <filename>systemd-logind</> on subsequent references… I think that's good enough. > Man page: nss-myhostname.8 > Issue: B<getent> → B<getent>(1) Fixed. > Man page: nss-resolve.8 > Issue: B<systemd-resolved> → B<systemd-resolved>(8) The first reference does this, subsequent are shorter. > Man page: os-release.5 > Issue: Portable Services → Portable Services Documentation? Updated. > Man page: pam_systemd_home.8 > Issue: auth and account use "reason", while session and password do not? Reworded. > Man page: portablectl.1 > Issue: In systemd-portabled.service(8): Portable Services Documentation Updated. > Man page: repart.d.5 > Issue: The partition → the partition Fixed. > Man page: repart.d.5 > Issue: B<systemd-repart> → B<systemd-repart>(8) The first reference does this. I also change this one, because it's pretty far down in the text. > Man page: systemd.1 > Issue: kernel command line twice? > > "Takes a boolean argument\\&. If false disables importing credentials from " > "the kernel command line, qemu_fw_cfg subsystem or the kernel command line\\&." Apparently this was fixed already. > Man page: systemd-boot.7 > Issue: enrollement → enrollment Fixed. > Man page: systemd-cryptenroll.1 > Issue: multiple cases: any specified → the specified Reworded. > Man page: systemd-cryptenroll.1 > Issue: If this this → If this Fixed tree-wide. > Man page: systemd-cryptsetup-generator.8 > Issue: and the initrd → and in the initrd "Is honoured by the initrd" is OK, because we often speak about the initrd as a single unit. But in the same paragraph we also used "in the initrd", which makes the other use look sloppy. I changed it to "in the initrd" everywhere in that file. > Man page: systemd.directives.7 > Issue: Why are these two quoted (but not others)? > > "B<\\*(Aqh\\*(Aq>" > > B<\\*(Aqs\\*(Aq>" > > "B<\\*(Aqy\\*(Aq>" This is autogenerated from files… We use slightly different markup in different files, and it's just too hard to make it consistent. We gave up on this. > Man page: systemd.exec.5 > Issue 1: B<at>(1p) → B<at>(1) > Issue 2: B<crontab>(1p) → B<crontab>(1) Fixed. > Man page: systemd.exec.5 > Issue: B<select()> → B<select>(2) Fixed. > Man page: systemd.exec.5 > Issue: qemu → B<qemu>(1) The man page doesn't seem to be in any of the canonical places on the web. I added a link to online docs. > Man page: systemd.exec.5 > Issue: variable → variables Seems to be fixed already. > Man page: systemd-integritysetup-generator.8 > Issue: systemd-integritysetup-generator → B<systemd-integritysetup-generator> I changed <filename> to <command>. > Man page: systemd-integritysetup-generator.8 > Issue: superfluous comma at the end Already fixed. > Man page: systemd-measure.1 > Issue: (see B<--pcr-bank=>) below → (see B<--pcr-bank=> below) Reworded. > Man page: systemd-measure.1 > Issue: =PATH> → =>I<PATH> Fixed. > Man page: systemd-measure.1.po > Issue: B<--bank=DIGEST> → B<--bank=>I<DIGEST> Fixed. > Man page: systemd.netdev.5 > Issue: os the → on the Appears to have been fixed already. > Man page: systemd.netdev.5 > Issue: Onboard → On-board (as in previous string) Updated. > Man page: systemd.network.5 > Issue: B<systemd-networkd> -> B<systemd-networkd>(8) First reference does this, subsequent do not. > Man page: systemd.network.5 > Issue: B<netlabelctl> → B<netlabelctl>(8) First reference does this, subsequent do not. > Man page: systemd.network.5 > Issue: Missing verb (aquired? configured?) in the half sentence starting with "or by a " I dropped the comma. > Man page: systemd-nspawn.1 > Issue: All host users outside of that range → All other host users Reworded. > # FIXME no effect → no effect\\&. > #. type: Plain text > #: archlinux debian-unstable fedora-rawhide mageia-cauldron opensuse-tumbleweed > msgid "" > "Whichever ID mapping option is used, the same mapping will be used for users " > "and groups IDs\\&. If B<rootidmap> is used, the group owning the bind " > "mounted directory will have no effect" A period is added. Not sure if there's some other issue. > Man page: systemd-oomd.service.8 > Issue: B<systemd> → B<systemd>(1) Done. > Man page: systemd.path.5 > Issue 1: B<systemd.exec>(1) → B<systemd.exec>(5) > Issue 2: This section does not (yet?) exist Fixed. > Man page: systemd-pcrphase.service.8 > Issue 1: indicate phases into TPM2 PCR 11 ?? > Issue 2: Colon at the end of the paragraph? Fixed. > Man page: systemd-pcrphase.service.8 > Issue: final boot phase → final shutdown phase? Updated. > Man page: systemd-pcrphase.service.8 > Issue: for the the → for the Fixed tree-wide. > Man page: systemd-portabled.service.8 > Issue: In systemd-portabled.service(8): Portable Services Documentation Updated. > Man page: systemd-pstore.service.8 > Issue: Here and the following paragraphs: . → \\&. // Upstream: What does this comment mean? // You normally write \\&. for a full dot (full stop etc.); here you write only "." (i.e. a plain dot). > > "and we look up \"localhost\", nss-dns will send the following queries to " > "systemd-resolved listening on 127.0.0.53:53: first \"localhost.foobar.com\", " > "then \"localhost.barbar.com\", and finally \"localhost\". If (hopefully) the " > "first two queries fail, systemd-resolved will synthesize an answer for the " > "third query." Looks all OK to me. > Man page: systemd.resource-control.5 > Issue: Missing closing bracket after link to Control Groups version 1 Fixed. > Man page: systemd-sysext.8 > Issue: In systemd-portabled.service(8): Portable Services Documentation Updated. > Man page: systemd.timer.5 > Issue 1: B<systemd.exec>(1) → B<systemd.exec>(5) > Issue 2: This section does not (yet?) exist Fixed. > Man page: systemd.unit.5 > Issue: that is → that are Fixed. > Man page: systemd-veritysetup-generator.8 > Issue: systemd-veritysetup-generator → B<systemd-veritysetup-generator> > > "systemd-veritysetup-generator implements B<systemd.generator>(7)\\&." > > "systemd-veritysetup-generator understands the following kernel command line " > "parameters:" Updated. > Man page: systemd-volatile-root.service.8 > Issue: initrdyes → Initrd Fixed. > Man page: sysupdate.d.5 > Issue: : → \\&. (As above in TRANSFER) Updated. > Man page: sysupdate.d.5 > Issue: some → certain Updated. > Man page: sysupdate.d.5 > Issue 1: i\\&.e\\& → I\\&.e\\& Fixed. > Issue 2: the image → the system "image" seems correct. > Man page: tmpfiles.d.5 > Issue: systemd-tmpfiles → B<systemd-tmpfiles>(8) Updated.
* man: exec,nspawn: fix typoUlrich Ölmann2023-01-101-1/+1
|
* man: document explicitly that LogRateLimit= has no effect on ↵Lennart Poettering2023-01-061-10/+15
| | | | | | StandardOutput=file:… Fixes: #25951
* man: note that DynamicUser=yes is incompatible with D-BusLuca Boccassi2023-01-041-1/+3
| | | | | | | Due to policy checks against system users this cannot currently work, and it is non-obvious. In the future it might be implemented if support is added to dbus-broker/dbus-daemon, e.g.: https://github.com/bus1/dbus-broker/issues/259
* journal: log filtering options support in PID1Quentin Deslandes2022-12-151-0/+28
| | | | | | | | | Define new unit parameter (LogFilterPatterns) to filter logs processed by journald. This option is used to store a regular expression which is carried from PID1 to systemd-journald through a cgroup xattrs: `user.journald_log_filter_patterns`.
* tree-wide: BLS and DPS are now on uapi-group websiteZbigniew Jędrzejewski-Szmek2022-11-211-3/+3
|
* man: make clear NNP has no effect on processes invoked through ↵Lennart Poettering2022-10-311-21/+22
| | | | systemd-run/at/crontab and such things
* portable: allow caller to override extension-release name checkLuca Boccassi2022-10-121-1/+3
| | | | | When the --force flag is used, do not insist that the extension-release file has to match the extension image name
* man: Minor punctuation and word tweakadrian52022-08-291-2/+2
|
* service: set TRIGGER_UNIT= and TRIGGER_TIMER_REALTIME_USEC/MONOTONIC_USEC on ↵Luca Boccassi2022-08-231-1/+3
| | | | | | activation by timer unit Same as path unit, best effort.
* service: set TRIGGER_UNIT= and TRIGGER_PATH= on activation by path unitLuca Boccassi2022-08-231-0/+13
| | | | | | | | When a service is triggered by a path unit, pass the path unit name and the path that triggered it via env vars to the spawned processes. Note that this is best-effort, as there might be many triggers at the same time, but we only get woken up by one.
* man: similar → similarlyZbigniew Jędrzejewski-Szmek2022-08-231-14/+15
| | | | | | | | | Something *is* similar Something *works* similarly Something does something, similarly to how something else does something See https://sites.ulethbridge.ca/roussel/2017/11/29/similar-and-similarly-are-they-similar/ for a clear explanation.
* docs: Correct StandartOutput documentationMax Gautier2022-07-301-1/+5
| | | | fix #2114
* man: Miscellaneous fixesJan Janssen2022-07-191-2/+2
| | | | Fixes: #24056
* pid1: import creds from SMBIOS too, not just qemu's fw_cfgLennart Poettering2022-07-151-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | | This imports credentials also via SMBIOS' "OEM vendor string" section, similar to the existing import logic from fw_cfg. Functionality-wise this is very similar to the existing fw_cfg logic, both of which are easily settable on the qemu command line. Pros and cons of each: SMBIOS OEM vendor strings: - pro: fast, because memory mapped - pro: somewhat VMM independent, at least in theory - pro: qemu upstream sees this as the future - pro: no additional kernel module needed - con: strings only, thus binary data is base64 encoded fw_cfg: - pro: has been supported for longer in qemu - pro: supports binary data - con: slow, because IO port based - con: only qemu - con: requires qemu_fw_cfg.ko kernel module - con: qemu upstream sees this as legacy
* man: explain why various resource limits don't make sense and should not be ↵Lennart Poettering2022-07-141-9/+27
| | | | used.
* tree-wide: link to docs.kernel.org for kernel documentationnl67202022-07-041-4/+4
| | | | | | | https://www.kernel.org/ links to https://docs.kernel.org/ for the documentation. See https://git.kernel.org/pub/scm/docs/kernel/website.git/commit/?id=ebc1c372850f249dd143c6d942e66c88ec610520 These URLs are shorter and nicer looking.
* tree-wide: use html links for kernel docsZbigniew Jędrzejewski-Szmek2022-07-021-3/+3
| | | | Instead of using "*.txt" as reference name, use the actual destination title.
* Revert NFTSet featureYu Watanabe2022-06-221-34/+0
| | | | | | | | | | | | | | | | | | | | | | | | This reverts PR #22587 and its follow-up commit. More specifically, 2299b1cae32c1fb8911da0ce26efced68032f4f8 (partially), e176f855278d5098d3fecc5aa24ba702147d42e0, ceb46a31a01b3d3d1d6095d857e29ea214a2776b, and 51bb9076ab8c050bebb64db5035852385accda35. The PR was merged without final approval, and has several issues: - OSS fuzz reported issues in the conf parser, - It calls synchrnous netlink call, it should not be especially in PID1, - The importance of NFTSet for CGroup and DynamicUser may be questionable, at least, there was no justification PID1 should support it. - For networkd, it should be implemented with Request object, - There is no test for the feature. Fixes #23711. Fixes #23717. Fixes #23719. Fixes #23720. Fixes #23721. Fixes #23759.
* man: Add some punctuation; remove double spaces.adrian52022-06-151-40/+40
|
* core: firewall integration with DynamicUserNFTSet=Topi Miettinen2022-06-081-0/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New directive `DynamicUserNFTSet=` provides a method for integrating configuration of dynamic users into firewall rules with NFT sets. Example: ``` table inet filter { set u { typeof meta skuid } chain service_output { meta skuid != @u drop accept } } ``` ``` /etc/systemd/system/dunft.service [Service] DynamicUser=yes DynamicUserNFTSet=inet:filter:u ExecStart=/bin/sleep 1000 [Install] WantedBy=multi-user.target ``` ``` $ sudo nft list set inet filter u table inet filter { set u { typeof meta skuid elements = { 64864 } } } $ ps -n --format user,group,pid,command -p `pgrep sleep` USER GROUP PID COMMAND 64864 64864 55158 /bin/sleep 1000 ```
* Amend documentation for LimitNPROC=Jakob Lell2022-05-051-0/+8
|
* man: correct a major missed opportunityLennart Poettering2022-05-021-5/+7
| | | | | | | | | I don't know why this didn't occur to me earlier, but of course, it *has* to be this data. (This replaces some German prose about Berlin, that i guess only very few people will get. With the new blob I think we have a much broader chance of delivering smiles.)
* doc: add new markdown docs for credentialsLennart Poettering2022-04-281-1/+4
|
* man: document the new credentials featuresLennart Poettering2022-04-281-12/+36
|
* man: make clear that encrypted credentials are also authenticatedLennart Poettering2022-04-211-11/+12
| | | | | | We use authenticated encryption, and that deserves mention. This in particular relevant as the fact they are authenticated makes the credentials useful as initrd parameterization items.
* man: Mention systemd-oomd now follows OOMPolicyNishal Kulkarni2022-03-221-1/+1
|
* man/systemd.exec: tweak markup a bitZbigniew Jędrzejewski-Szmek2022-03-181-10/+11
|
* Add tests and documentation for all remaining sandboxing in user managerLuca Boccassi2022-03-181-19/+23
|
* core: support ExtensionDirectories in user managerLuca Boccassi2022-03-101-1/+2
| | | | | | | Unprivileged overlayfs is supported since Linux 5.11. The only change needed to get ExtensionDirectories to work is to avoid hard-coding the staging directory to the system manager runtime directory, everything else just works (TM).
* core: split $MONITOR_METADATA and return it only if a single unit triggers ↵Luca Boccassi2022-03-101-48/+36
| | | | | | | | | | | OnFailure/OnSuccess Remove the list logic, and simply skip passing metadata if more than one unit triggered an OnFailure/OnSuccess handler. Instead of a single env var to loop over, provide each separate item as its own variable. Fixes https://github.com/systemd/systemd/issues/22370
* core: support MountAPIVFS and RootDirectory in user managerLuca Boccassi2022-03-101-9/+3
| | | | | | | | | | | | | | | The only piece missing was to somehow make /proc appear in the new user+mount namespace. It is not possible to mount a new /proc instance, not even with hidepid=invisible,subset=pid, in a user namespace unless a PID namespace is created too (and also at the same time as the other namespaces, it is not possible to mount a new /proc in a child process that creates a PID namespace forked from a parent that created a user+mount namespace, it has to happen at the same time). Use the host's /proc with a bind-mount as a fallback for this case. User session services would already run with it, so nothing is lost.
* man: various issues reported in #22432Zbigniew Jędrzejewski-Szmek2022-02-231-3/+1
| | | | Fixes #22432.
View Lorry Controller Status