SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #29882 from keszybz/documentation-cleanup

Browse Source 
Documentation cleanup
This commit is contained in:
Luca Boccassi
2023-11-06 21:24:08 +00:00
committed by GitHub
parent 4457a2e0ee 0155b0657d
commit 4a5bf4896f
47 changed files with 304 additions and 249 deletions
Download Patch File Download Diff File Expand all files Collapse all files
NEWS
+3 -3
View File
@@ -718,9 +718,9 @@ CHANGES WITH 254:
store enabled.
* A new service option FileDescriptorStorePreserve= has been added that
allows tuning the life-cycle of the per-service file descriptor
store. If set to "yes", the entries in the fd store are retained even
after the service has been fully stopped.
allows tuning the lifecycle of the per-service file descriptor store.
If set to "yes", the entries in the fd store are retained even after
the service has been fully stopped.
* The "systemctl clean" command may now be used to clear the fdstore of
a service.
catalog/systemd.catalog.in
+1 -1
View File
@@ -741,7 +741,7 @@ compatibility.
Note that these automatically generated compatibility unit files cannot replace
native unit files as they generally slow down the system (by creating
unnecessary, additional synchronization points), are less robust (as SysV services
cannot properly be life-cycle tracked or automatically restarted) and less
cannot properly be lifecycle tracked or automatically restarted) and less
secure (as no sandboxing restrictions can be enforced).
Compatibility support for System V services in systemd is deprecated. Please
docs/BUILDING_IMAGES.md
+1 -1
View File
@@ -5,7 +5,7 @@ layout: default
SPDX-License-Identifier: LGPL-2.1-or-later
---
# Safely Building Images
# Building Images Safely
In many scenarios OS installations are shipped as pre-built images, that
require no further installation process beyond simple `dd`-ing the image to
docs/FILE_DESCRIPTOR_STORE.md
+8 -8
View File
@@ -47,7 +47,7 @@ conveniently be used to serialize service state into and then place in the
fdstore, in order to implement service restarts with full service state being
passed over.
# Basic Mechanism
## Basic Mechanism
The fdstore is enabled per-service via the
[`FileDescriptorStoreMax=`](https://www.freedesktop.org/software/systemd/man/systemd.service.html#FileDescriptorStoreMax=)
@@ -76,7 +76,7 @@ both operates on IPv4 and IPv6 and treats both more or less the same.).
And that's already the gist of it.
# Seamless Service Restarts
## Seamless Service Restarts
A system service that provides a client-facing interface that shall be able to
seamlessly restart can make use of this in a scheme like the following:
@@ -100,14 +100,14 @@ general principle of guaranteeing a pristine execution environment, a pristine
security context, and a pristine resource management context for freshly
started services, without uncontrolled "leftovers" from previous runs. For
example: leaving processes from previous runs generally negatively affects
life-cycle management (i.e. `KillMode=none` must be set), which disables large
lifecycle management (i.e. `KillMode=none` must be set), which disables large
parts of the service managers state tracking, resource management (as resource
counters cannot start at zero during service activation anymore, since the old
processes remaining skew them), security policies (as processes with possibly
out-of-date security policies – SElinux, AppArmor, any LSM, seccomp, BPF — in
effect remain), and similar.
# File Descriptor Store Life-cycle
## File Descriptor Store Lifecycle
By default any file descriptor stored in the fdstore for which a `POLLHUP` or
`POLLERR` is seen is automatically closed and removed from the fdstore. This
@@ -148,7 +148,7 @@ way will not receive an automatic `POLLHUP` event anymore if the service code
issues `close()` on the socket. It must accompany it with an `FDSTOREREMOVE=1`
notification to the service manager, so that the fd is comprehensively closed.
# Access Control
## Access Control
Access to the fds in the file descriptor store is generally restricted to the
service code itself. Pushing fds into or removing fds from the fdstore is
@@ -160,7 +160,7 @@ By default only the main service process hence can push/remove fds, but by
setting `NotifyAccess=all` this may be relaxed to allow arbitrary service
child processes to do the same.
# Soft Reboot
## Soft Reboot
The fdstore is particularly interesting in [soft
reboot](https://www.freedesktop.org/software/systemd/man/systemd-soft-reboot.service.html)
@@ -181,7 +181,7 @@ continuously).
For further details see [Resource
Pass-Through](https://www.freedesktop.org/software/systemd/man/systemd-soft-reboot.service.html#Resource%20Pass-Through).
# initrd Transitions
## Initrd Transitions
The fdstore may also be used to pass file descriptors for resources from the
initrd context to the main system. Restarting all processes after the
@@ -198,7 +198,7 @@ The soft reboot cycle transition and the initrd→host transition are
semantically very similar, hence similar rules apply, and in both cases it is
recommended to use the fdstore if pinned resources shall be passed over.
# Debugging
## Debugging
The
[`systemd-analyze`](https://www.freedesktop.org/software/systemd/man/systemd-analyze.html#systemd-analyze%20fdstore%20%5BUNIT...%5D)
docs/PORTABLE_SERVICES.md
+1 -1
View File
@@ -5,7 +5,7 @@ layout: default
SPDX-License-Identifier: LGPL-2.1-or-later
---
# Portable Services Introduction
# Portable Services
systemd (since version 239) supports a concept of "Portable Services".
"Portable Services" are a delivery method for system services that uses
man/crypttab.xml
+6 -4
View File
@@ -556,8 +556,9 @@
<para>Note that VeraCrypt enforces a minimal allowed PIM value depending on the
password strength and the hash algorithm used for key derivation, however
<option>veracrypt-pim=</option> is not checked against these bounds.
<ulink url="https://www.veracrypt.fr/en/Personal%20Iterations%20Multiplier%20%28PIM%29.html">See
documentation</ulink> for more information.</para>
See
<ulink url="https://www.veracrypt.fr/en/Personal%20Iterations%20Multiplier%20%28PIM%29.html">Veracrypt Personal Iterations Multiplier</ulink>
documentation for more information.</para>
<xi:include href="version-info.xml" xpointer="v254"/>
</listitem>
@@ -980,8 +981,9 @@ external /dev/sda3 keyfile:LABEL=keydev keyfile-timeout=10s,cipher=xchac
<itemizedlist>
<listitem><para>We use RSA2048, which is the longest key size current Yubikeys support</para></listitem>
<listitem><para>We use Yubikey key slot 9d, since that's apparently the keyslot to use for decryption purposes,
<ulink url="https://developers.yubico.com/PIV/Introduction/Certificate_slots.html">see
documentation</ulink>.</para></listitem>
see
<ulink url="https://developers.yubico.com/PIV/Introduction/Certificate_slots.html">Yubico PIV certificate slots</ulink>.
</para></listitem>
</itemizedlist>
</example>
man/journalctl.xml
+1 -1
View File
@@ -865,7 +865,7 @@
<para><option>--vacuum-time=</option> removes archived journal files older than the specified
timespan. Accepts the usual <literal>s</literal> (default), <literal>m</literal>,
<literal>h</literal>, <literal>days</literal>, <literal>months</literal>, <literal>weeks</literal>
<literal>h</literal>, <literal>days</literal>, <literal>weeks</literal>, <literal>months</literal>,
and <literal>years</literal> suffixes, see
<citerefentry><refentrytitle>systemd.time</refentrytitle><manvolnum>7</manvolnum></citerefentry> for
details.</para>
man/machinectl.xml
+6 -4
View File
@@ -413,10 +413,12 @@
<varlistentry>
<term><command>edit</command> <replaceable>NAME|FILE</replaceable></term>
<listitem><para>Edit the settings file of the specified machines. For the format of the settings file, refer to <citerefentry
project='man-pages'><refentrytitle>systemd.nspawn</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
If an existing settings file of the given machine can't be found, <command>edit</command> automatically
create a new settings file from scratch under <filename>/etc/</filename></para>
<listitem><para>Edit the settings file of the specified machines. For the format of the settings
file, refer to
<citerefentry project='man-pages'><refentrytitle>systemd.nspawn</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
If an existing settings file of the given machine can't be found, <command>edit</command>
automatically create a new settings file from scratch under <filename>/etc/</filename>.
</para>
<xi:include href="version-info.xml" xpointer="v254"/></listitem>
</varlistentry>
man/networkctl.xml
+33 -26
View File
@@ -72,7 +72,7 @@
<varlistentry>
<term>missing</term>
<listitem>
<para>the device is missing</para>
<para>The device is missing.</para>
<xi:include href="version-info.xml" xpointer="v245"/>
</listitem>
@@ -80,7 +80,7 @@
<varlistentry>
<term>off</term>
<listitem>
<para>the device is powered down</para>
<para>The device is powered down.</para>
<xi:include href="version-info.xml" xpointer="v240"/>
</listitem>
@@ -88,7 +88,7 @@
<varlistentry>
<term>no-carrier</term>
<listitem>
<para>the device is powered up, but it does not yet have a carrier</para>
<para>The device is powered up, but does not yet have a carrier.</para>
<xi:include href="version-info.xml" xpointer="v240"/>
</listitem>
@@ -96,7 +96,7 @@
<varlistentry>
<term>dormant</term>
<listitem>
<para>the device has a carrier, but is not yet ready for normal traffic</para>
<para>The device has a carrier, but is not yet ready for normal traffic.</para>
<xi:include href="version-info.xml" xpointer="v240"/>
</listitem>
@@ -104,7 +104,8 @@
<varlistentry>
<term>degraded-carrier</term>
<listitem>
<para>one of the bonding or bridge slave network interfaces is in off, no-carrier, or dormant state, and the master interface has no address.</para>
<para>One of the bonding or bridge slave network interfaces is in off, no-carrier, or
dormant state, and the master interface has no address.</para>
<xi:include href="version-info.xml" xpointer="v242"/>
</listitem>
@@ -112,8 +113,8 @@
<varlistentry>
<term>carrier</term>
<listitem>
<para>the link has a carrier, or for bond or bridge master, all bonding or bridge slave
network interfaces are enslaved to the master</para>
<para>The link has carrier, or for bond or bridge master, all bonding or bridge slave
network interfaces are enslaved to the master.</para>
<xi:include href="version-info.xml" xpointer="v240"/>
</listitem>
@@ -121,7 +122,7 @@
<varlistentry>
<term>degraded</term>
<listitem>
<para>the link has carrier and addresses valid on the local link configured. For bond or
<para>The link has carrier and addresses valid on the local link configured. For bond or
bridge master this means that not all slave network interfaces have carrier but at least
one does.</para>
@@ -131,7 +132,8 @@
<varlistentry>
<term>enslaved</term>
<listitem>
<para>the link has carrier and is enslaved to bond or bridge master network interface</para>
<para>The link has carrier and is enslaved to bond or bridge master network interface.
</para>
<xi:include href="version-info.xml" xpointer="v242"/>
</listitem>
@@ -139,7 +141,7 @@
<varlistentry>
<term>routable</term>
<listitem>
<para>the link has carrier and routable address configured. For bond or bridge master it is
<para>The link has carrier and routable address configured. For bond or bridge master it is
not necessary for all slave network interfaces to have carrier, but at least one must.</para>
<xi:include href="version-info.xml" xpointer="v240"/>
@@ -153,7 +155,8 @@
<varlistentry>
<term>pending</term>
<listitem>
<para>udev is still processing the link, we don't yet know if we will manage it</para>
<para><citerefentry><refentrytitle>systemd-udevd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
is still processing the link, we don't yet know if we will manage it.</para>
<xi:include href="version-info.xml" xpointer="v240"/>
</listitem>
@@ -161,7 +164,8 @@
<varlistentry>
<term>initialized</term>
<listitem>
<para>udev has processed the link, but we don't yet know if we will manage it</para>
<para><citerefentry><refentrytitle>systemd-udevd</refentrytitle><manvolnum>8</manvolnum></citerefentry>
has processed the link, but we don't yet know if we will manage it.</para>
<xi:include href="version-info.xml" xpointer="v251"/>
</listitem>
@@ -169,7 +173,7 @@
<varlistentry>
<term>configuring</term>
<listitem>
<para>in the process of retrieving configuration or configuring the link</para>
<para>Configuration for the link is being retrieved or the link is being configured.</para>
<xi:include href="version-info.xml" xpointer="v240"/>
</listitem>
@@ -177,7 +181,7 @@
<varlistentry>
<term>configured</term>
<listitem>
<para>link configured successfully</para>
<para>Link has been configured successfully.</para>
<xi:include href="version-info.xml" xpointer="v240"/>
</listitem>
@@ -185,7 +189,7 @@
<varlistentry>
<term>unmanaged</term>
<listitem>
<para>networkd is not handling the link</para>
<para><command>systemd-networkd</command> is not handling the link.</para>
<xi:include href="version-info.xml" xpointer="v240"/>
</listitem>
@@ -193,7 +197,7 @@
<varlistentry>
<term>failed</term>
<listitem>
<para>networkd failed to manage the link</para>
<para><command>systemd-networkd</command> failed to configure the link.</para>
<xi:include href="version-info.xml" xpointer="v240"/>
</listitem>
@@ -201,7 +205,7 @@
<varlistentry>
<term>linger</term>
<listitem>
<para>the link is gone, but has not yet been dropped by networkd</para>
<para>The link is gone, but has not yet been dropped by <command>systemd-networkd</command>.</para>
<xi:include href="version-info.xml" xpointer="v240"/>
</listitem>
@@ -246,7 +250,7 @@
<varlistentry>
<term>unknown</term>
<listitem>
<para>all links have unknown online status (i.e. there are no required links)</para>
<para>All links have unknown online status (i.e. there are no required links).</para>
<xi:include href="version-info.xml" xpointer="v249"/>
</listitem>
@@ -254,7 +258,7 @@
<varlistentry>
<term>offline</term>
<listitem>
<para>all required links are offline</para>
<para>All required links are offline.</para>
<xi:include href="version-info.xml" xpointer="v249"/>
</listitem>
@@ -262,7 +266,7 @@
<varlistentry>
<term>partial</term>
<listitem>
<para>some, but not all, required links are online</para>
<para>Some, but not all, required links are online.</para>
<xi:include href="version-info.xml" xpointer="v249"/>
</listitem>
@@ -270,7 +274,7 @@
<varlistentry>
<term>online</term>
<listitem>
<para>all required links are online</para>
<para>All required links are online.</para>
<xi:include href="version-info.xml" xpointer="v249"/>
</listitem>
@@ -436,7 +440,8 @@ s - Service VLAN, m - Two-port MAC Relay (TPMR)
the main configuration file. Unless <option>--no-reload</option> is specified,
<command>systemd-networkd</command> will be reloaded after the edit of the
<filename>.network</filename> or <filename>.netdev</filename> files finishes.
The same applies for <filename>.link</filename> files and <command>systemd-udevd</command>.
The same applies for <filename>.link</filename> files and
<citerefentry><refentrytitle>systemd-udevd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
Note that the changed link settings are not automatically applied after reloading.
To achieve that, trigger uevents for the corresponding interface. Refer to
<citerefentry><refentrytitle>systemd.link</refentrytitle><manvolnum>5</manvolnum></citerefentry>
@@ -514,8 +519,7 @@ s - Service VLAN, m - Two-port MAC Relay (TPMR)
</varlistentry>
<varlistentry>
<term><option>--drop-in=</option></term>
<replaceable>NAME</replaceable>
<term><option>--drop-in=</option><replaceable>NAME</replaceable></term>
<listitem>
<para>When used with <command>edit</command>, edit the drop-in file <replaceable>NAME</replaceable>
@@ -529,8 +533,11 @@ s - Service VLAN, m - Two-port MAC Relay (TPMR)
<term><option>--no-reload</option></term>
<listitem>
<para>When used with <command>edit</command>, <command>systemd-networkd</command>
or <command>systemd-udevd</command> will not be reloaded after the editing finishes.</para>
<para>When used with <command>edit</command>,
<citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
or
<citerefentry><refentrytitle>systemd-udevd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
will not be reloaded after the editing finishes.</para>
<xi:include href="version-info.xml" xpointer="v254"/>
</listitem>
man/os-release.xml
+2 -2
View File
@@ -104,7 +104,7 @@
<para><filename>/usr/lib/extension-release.d/extension-release.<replaceable>IMAGE</replaceable></filename>
plays the same role for extension images as <filename>os-release</filename> for the main system, and
follows the syntax and rules as described in the <ulink
url="https://systemd.io/PORTABLE_SERVICES">Portable Services Documentation</ulink>. The purpose of this
url="https://systemd.io/PORTABLE_SERVICES">Portable Services</ulink> page. The purpose of this
file is to identify the extension and to allow the operating system to verify that the extension image
matches the base OS. This is typically implemented by checking that the <varname>ID=</varname> options
match, and either <varname>SYSEXT_LEVEL=</varname> exists and matches too, or if it is not present,
@@ -534,7 +534,7 @@
<varlistentry>
<term><varname>PORTABLE_PREFIXES=</varname></term>
<listitem><para>Takes a space-separated list of one or more valid prefix match strings for the
<ulink url="https://systemd.io/PORTABLE_SERVICES">Portable Services Documentation</ulink> logic.
<ulink url="https://systemd.io/PORTABLE_SERVICES">Portable Services</ulink> logic.
This field serves two purposes: it is informational, identifying portable service images as such
(and thus allowing them to be distinguished from other OS images, such as bootable system images).
It is also used when a portable service image is attached: the specified or implied portable
man/resolvectl.xml
+11 -11
View File
@@ -77,17 +77,17 @@
[[<replaceable>NAME</replaceable>] <replaceable>TYPE</replaceable>]
<replaceable>DOMAIN</replaceable></term>
<listitem><para>Resolve <ulink url="https://tools.ietf.org/html/rfc6763">DNS-SD</ulink> and <ulink
url="https://tools.ietf.org/html/rfc2782">SRV</ulink> services, depending on the specified list of
parameters. If three parameters are passed the first is assumed to be the DNS-SD service name, the
second the <constant class='dns'>SRV</constant> service type, and the third the domain to search in.
In this case a full DNS-SD style <constant class='dns'>SRV</constant> and <constant
class='dns'>TXT</constant> lookup is executed. If only two parameters are specified, the first is
assumed to be the <constant class='dns'>SRV</constant> service type, and the second the domain to look
in. In this case no <constant class='dns'>TXT</constant> resource record is requested. Finally, if
only one parameter is specified, it is assumed to be a domain name, that is already prefixed with an
<constant class='dns'>SRV</constant> type, and an <constant class='dns'>SRV</constant> lookup is done
(no <constant class='dns'>TXT</constant>).</para>
<listitem><para>Resolve <ulink url="https://tools.ietf.org/html/rfc6763">RFC 6763 DNS-SD</ulink> and
<ulink url="https://tools.ietf.org/html/rfc2782">RFC 2782 SRV</ulink> services, depending on the
specified list of parameters. If three parameters are passed the first is assumed to be the DNS-SD
service name, the second the <constant class='dns'>SRV</constant> service type, and the third the
domain to search in. In this case a full DNS-SD style <constant class='dns'>SRV</constant> and
<constant class='dns'>TXT</constant> lookup is executed. If only two parameters are specified, the
first is assumed to be the <constant class='dns'>SRV</constant> service type, and the second the
domain to look in. In this case no <constant class='dns'>TXT</constant> resource record is requested.
Finally, if only one parameter is specified, it is assumed to be a domain name, that is already
prefixed with an <constant class='dns'>SRV</constant> type, and an <constant
class='dns'>SRV</constant> lookup is done (no <constant class='dns'>TXT</constant>).</para>
<xi:include href="version-info.xml" xpointer="v239"/></listitem>
</varlistentry>
man/resolved.conf.xml
+13 -9
View File
@@ -363,17 +363,21 @@ DNSStubListenerExtra=udp:[2001:db8:0:f102::13]:9953</programlisting>
</varlistentry>
<varlistentry>
<term>StaleRetentionSec=<replaceable>SECONDS</replaceable></term>
<listitem><para>Takes a duration value, which determines the length of time DNS resource records can be retained
in the cache beyond their Time To Live (TTL). This allows these records to be returned as stale records.
By default, this value is set to zero, meaning that DNS resource records are not stored in the cache after their TTL expires.</para>
<listitem><para>Takes a duration value, which determines the length of time DNS resource records can
be retained in the cache beyond their Time To Live (TTL). This allows these records to be returned as
stale records. By default, this value is set to zero, meaning that DNS resource records are not
stored in the cache after their TTL expires.</para>
<para>This is useful when a DNS server failure occurs or becomes unreachable.
In such cases, systemd-resolved continues to use the stale records to answer DNS queries, particularly when no valid response
can be obtained from the upstream DNS servers. However, this doesn't apply to NXDOMAIN responses, as those are still perfectly valid responses.
This feature enhances resilience against DNS infrastructure failures and outages.</para>
<para>This is useful when a DNS server failure occurs or becomes unreachable. In such cases,
<citerefentry><refentrytitle>systemd-resolved</refentrytitle><manvolnum>8</manvolnum></citerefentry>
continues to use the stale records to answer DNS queries, particularly when no valid response can be
obtained from the upstream DNS servers. However, this doesn't apply to NXDOMAIN responses, as those
are still perfectly valid responses. This feature enhances resilience against DNS infrastructure
failures and outages.</para>
<para>systemd-resolved always attempts to reach the upstream DNS servers first, before providing the client application with any stale data.
If this feature is enabled, cache will not be flushed when changing servers.</para>
<para><command>systemd-resolved</command> always attempts to reach the upstream DNS servers first,
before providing the client application with any stale data. If this feature is enabled, cache will
not be flushed when changing servers.</para>
<xi:include href="version-info.xml" xpointer="v254"/>
</listitem>
man/sd-id128.xml
+1 -1
View File
@@ -190,7 +190,7 @@ int main(int argc, char **argv) {
are similar to
<constant>SD_ID128_FORMAT_STR</constant> and <function>SD_ID128_MAKE_STR()</function>,
but include separating hyphens to conform to the
"<ulink url="https://en.wikipedia.org/wiki/Universally_unique_identifier#Format">canonical representation</ulink>".
"<ulink url="https://en.wikipedia.org/wiki/Universally_unique_identifier#Format">UUID canonical representation</ulink>".
They format the string based on <ulink
url="https://tools.ietf.org/html/rfc4122">RFC4122</ulink> Variant 1 rules, i.e. converting from Big
Endian byte order. This matches behaviour of most other Linux userspace infrastructure. It's probably
man/sd_bus_error.xml
+1 -1
View File
@@ -163,7 +163,7 @@
<listitem><para>The <structfield>name</structfield> field contains a short identifier of an error. It
should follow the rules for error names described in the D-Bus specification, subsection <ulink
url="https://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-names">Valid
Names</ulink>. A number of common, standardized error names are described in
D-Bus Names</ulink>. A number of common, standardized error names are described in
<citerefentry><refentrytitle>sd-bus-errors</refentrytitle><manvolnum>3</manvolnum></citerefentry>, but
additional domain-specific errors may be defined by applications.</para></listitem>
man/sd_bus_message_append_array.xml
+1 -1
View File
@@ -80,7 +80,7 @@
<literal>t</literal>, <literal>d</literal> (but not
<literal>b</literal>), as defined by the <ulink
url="https://dbus.freedesktop.org/doc/dbus-specification.html#basic-types">Basic
Types</ulink> section of the D-Bus specification, and listed in
D-Bus Types</ulink> section of the D-Bus specification, and listed in
<citerefentry><refentrytitle>sd_bus_message_append_basic</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
Pointer <parameter>p</parameter> must point to an array of size
<parameter>size</parameter> bytes containing items of the
man/sd_bus_set_description.xml
+1 -1
View File
@@ -121,7 +121,7 @@
i.e. lack of authentication, of the bus peer. This function must be called before the bus is
started. See the
<ulink url="view-source:https://dbus.freedesktop.org/doc/dbus-specification.html#auth-mechanisms">
Authentication Mechanisms</ulink> section of the D-Bus specification for details.</para>
D-Bus Authentication Mechanisms</ulink> section of the D-Bus specification for details.</para>
<para><function>sd_bus_is_anonymous()</function> returns true if the bus connection allows
anonymous authentication (in the sense described in previous paragraph).</para>
man/systemctl.xml
+3 -3
View File
@@ -2740,11 +2740,11 @@ Jan 12 10:46:45 example.com bluetoothd[8900]: gatt-time-server: Input/output err
</varlistentry>
<varlistentry>
<term><option>--drop-in=</option></term>
<term><option>--drop-in=</option><replaceable>NAME</replaceable></term>
<listitem>
<para>When used with <command>edit</command>, use the given drop-in file name instead of
<filename>override.conf</filename>.</para>
<para>When used with <command>edit</command>, use <replaceable>NAME</replaceable> as the drop-in
file name instead of <filename>override.conf</filename>.</para>
<xi:include href="version-info.xml" xpointer="v253"/>
</listitem>
man/systemd-analyze.xml
+1 -1
View File
@@ -863,7 +863,7 @@ stored sock 0:8 4213190 - socket:[4213190] ro
<citerefentry><refentrytitle>systemd.image-policy</refentrytitle><manvolnum>7</manvolnum></citerefentry>. The
policy is normalized and simplified. For each currently defined partition identifier (as per the <ulink
url="https://uapi-group.org/specifications/specs/discoverable_partitions_specification">Discoverable
Partitions Specification</ulink> the effect of the image policy string is shown in tabular form.</para>
Partitions Specification</ulink>) the effect of the image policy string is shown in tabular form.</para>
<example>
<title>Example Output</title>
man/systemd-battery-check.service.xml
+6 -9
View File
@@ -18,7 +18,7 @@
<refnamediv>
<refname>systemd-battery-check.service</refname>
<refname>systemd-battery-check</refname>
<refpurpose>Check battery level whether there's enough charge, and power off if not.</refpurpose>
<refpurpose>Check battery level whether there's enough charge, and power off if not</refpurpose>
</refnamediv>
<refsynopsisdiv>
@@ -32,14 +32,11 @@
<refsect1>
<title>Description</title>
<para>
<filename>systemd-battery-check.service</filename> is used to check the battery level during the early
boot stage to determine whether there's sufficient battery power to carry on with the booting process.
</para>
<para>
<command>systemd-battery-check</command> returns success if the device is connected to an AC power
source or if the battery charge is greater than 5%. It returns failure otherwise.
</para>
<para>This service checks the presence of an external power supply and the battery level during the early
boot stage to determine whether there is sufficient power to carry on with the booting process.</para>
<para><command>systemd-battery-check</command> returns success if the device is connected to an AC power
source or if the battery charge is greater than 5%. It returns failure otherwise.</para>
</refsect1>
<refsect1>
man/systemd-firstboot.xml
+2 -2
View File
@@ -293,8 +293,8 @@
<term><option>--force</option></term>
<listitem><para>Write configuration even if the relevant files already exist. Without this option,
<filename>systemd-firstboot</filename> doesn't modify or replace existing files. Note that when
configuring the root account, even with this option, <filename>systemd-firstboot</filename> only
<command>systemd-firstboot</command> doesn't modify or replace existing files. Note that when
configuring the root account, even with this option, <command>systemd-firstboot</command> only
modifies the entry of the <literal>root</literal> user, leaving other entries in
<filename>/etc/passwd</filename> and <filename>/etc/shadow</filename> intact.</para>
man/systemd-fsck@.service.xml
+4 -4
View File
@@ -55,12 +55,12 @@
last check, number of mounts, unclean unmount, etc.</para>
<para><filename>systemd-fsck-root.service</filename> and <filename>systemd-fsck-usr.service</filename>
will activate <filename>reboot.target</filename> if <filename>fsck</filename> returns the "System
should reboot" condition, or <filename>emergency.target</filename> if <filename>fsck</filename>
will activate <filename>reboot.target</filename> if <command>fsck</command> returns the "System
should reboot" condition, or <filename>emergency.target</filename> if <command>fsck</command>
returns the "Filesystem errors left uncorrected" condition.</para>
<para><filename>systemd-fsck@.service</filename> will fail if
<filename>fsck</filename> returns with either "System should reboot"
<command>fsck</command> returns with either "System should reboot"
or "Filesystem errors left uncorrected" conditions. For filesystems
listed in <filename>/etc/fstab</filename> without <literal>nofail</literal>
or <literal>noauto</literal> options, <literal>local-fs.target</literal>
@@ -70,7 +70,7 @@
<refsect1>
<title>Kernel Command Line</title>
<para><filename>systemd-fsck</filename> understands these kernel
<para><command>systemd-fsck</command> understands these kernel
command line parameters:</para>
<variablelist class='kernel-commandline-options'>
man/systemd-hibernate-resume.service.xml
+1 -1
View File
@@ -31,7 +31,7 @@
<para><filename>systemd-hibernate-resume.service</filename> initiates the resume from hibernation.</para>
<para><filename>systemd-hibernate-resume</filename> only supports the in-kernel hibernation
<para><command>systemd-hibernate-resume</command> only supports the in-kernel hibernation
implementation, see <ulink url="https://docs.kernel.org/power/swsusp.html">Swap suspend</ulink>.
Internally, it works by writing the major:minor of specified device node to
<filename>/sys/power/resume</filename>, along with the offset in memory pages
man/systemd-id128.xml
+2 -2
View File
@@ -137,8 +137,8 @@
<term><option>--uuid</option></term>
<listitem><para>Generate output as a UUID formatted in the "canonical representation", with five
groups of digits separated by hyphens. See the
<ulink url="https://en.wikipedia.org/wiki/Universally_unique_identifier#Format">wikipedia</ulink>
groups of digits separated by hyphens. See the Wikipedia entry for
<ulink url="https://en.wikipedia.org/wiki/Universally_unique_identifier#Format">Universally Unique Identifiers</ulink>
for more discussion.</para>
<xi:include href="version-info.xml" xpointer="v244"/></listitem>
man/systemd-notify.xml
+3 -1
View File
@@ -211,7 +211,9 @@
invoked. This option may be used multiple times to pass multiple file descriptors in a single
notification message.</para>
<para>To use this functionality from a <command>bash</command> shell, use an expression like the following:</para>
<para>To use this functionality from a
<citerefentry project='man-pages'><refentrytitle>bash</refentrytitle><manvolnum>1</manvolnum></citerefentry>
shell, use an expression like the following:</para>
<programlisting>systemd-notify --fd=4 --fd=5 4&lt;/some/file 5&lt;/some/other/file</programlisting>
<xi:include href="version-info.xml" xpointer="v254"/></listitem>
man/systemd-portabled.service.xml
+1 -1
View File
@@ -35,7 +35,7 @@
<para>Most of <command>systemd-portabled</command>'s functionality is accessible through the
<citerefentry><refentrytitle>portablectl</refentrytitle><manvolnum>1</manvolnum></citerefentry> command.</para>
<para>See the <ulink url="https://systemd.io/PORTABLE_SERVICES">Portable Services Documentation</ulink>
<para>See the <ulink url="https://systemd.io/PORTABLE_SERVICES">Portable Services</ulink> page
for details about the concepts this service implements.</para>
</refsect1>
man/systemd-run.xml
+16 -10
View File
@@ -560,7 +560,8 @@ Dec 08 20:44:48 container systemd[1]: Started /bin/touch /tmp/foo.</programlisti
<example>
<title>Allowing access to the tty</title>
<para>The following command invokes <citerefentry project='man-pages'><refentrytitle>bash</refentrytitle><manvolnum>1</manvolnum></citerefentry>
<para>The following command invokes
<citerefentry project='man-pages'><refentrytitle>bash</refentrytitle><manvolnum>1</manvolnum></citerefentry>
as a service passing its standard input, output and error to the calling TTY.</para>
<programlisting># systemd-run -t --send-sighup bash</programlisting>
@@ -618,18 +619,22 @@ There is a screen on:
</programlisting>
<para>The first argument is expanded by the shell (double quotes), but the second one is not expanded
by the shell (single quotes). <command>echo</command> is called with [<literal>/usr/bin/echo</literal>,
by the shell (single quotes).
<citerefentry project='man-pages'><refentrytitle>echo</refentrytitle><manvolnum>1</manvolnum></citerefentry>
is called with [<literal>/usr/bin/echo</literal>,
<literal>[]</literal>, <literal>[${INVOCATION_ID}]</literal>] as the argument array, and then
<command>systemd</command> generates <varname>${INVOCATION_ID}</varname> and substitutes it in the
command-line. This substitution could not be done on the client side, because the target ID that will
be set for the service isn't known before the call is made.</para>
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
generates <varname>${INVOCATION_ID}</varname> and substitutes it in the command-line. This substitution
could not be done on the client side, because the target ID that will be set for the service isn't
known before the call is made.</para>
</example>
<example>
<title>Variable expansion and output redirection using a shell</title>
<para>Variable expansion by <command>systemd</command> can be disabled with
<varname>--expand-environment=no</varname>.</para>
<para>Variable expansion by
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
can be disabled with <varname>--expand-environment=no</varname>.</para>
<para>Disabling variable expansion can be useful if the command to execute contains dollar characters
and escaping them would be inconvenient. For example, when a shell is used:</para>
@@ -639,9 +644,10 @@ There is a screen on:
/bin/bash 12345
</programlisting>
<para>The last argument is passed verbatim to the <command>bash</command> shell which is started by the
service unit. The shell expands <literal>$SHELL</literal> to the path of the shell, and
<literal>$$</literal> to its process number, and then those strings are passed to the
<para>The last argument is passed verbatim to the
<citerefentry project='man-pages'><refentrytitle>bash</refentrytitle><manvolnum>1</manvolnum></citerefentry>
shell which is started by the service unit. The shell expands <literal>$SHELL</literal> to the path of
the shell, and <literal>$$</literal> to its process number, and then those strings are passed to the
<command>echo</command> built-in and printed to standard output (which in this case is connected to the
calling terminal).</para>
</example>
man/systemd-sleep.conf.xml
+5 -5
View File
@@ -153,9 +153,9 @@
be aborted.</para>
<para>The allowed set of values is determined by the kernel and is shown in the file itself (use
<command>cat /sys/power/disk</command> to display). See <ulink
url="https://www.kernel.org/doc/html/latest/admin-guide/pm/sleep-states.html#basic-sysfs-interfaces-for-system-suspend-and-hibernation">the
kernel documentation</ulink> for more details.</para>
<command>cat /sys/power/disk</command> to display). See the kernel documentation page
<ulink url="https://www.kernel.org/doc/html/latest/admin-guide/pm/sleep-states.html#basic-sysfs-interfaces-for-system-suspend-and-hibernation">
Basic sysfs Interfaces for System Suspend and Hibernation</ulink> for more details.</para>
<para>
<citerefentry><refentrytitle>systemd-suspend-then-hibernate.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
@@ -175,8 +175,8 @@
<para>The allowed set of values is determined by the kernel and is shown in the file itself (use
<command>cat /sys/power/state</command> to display). See <ulink
url="https://www.kernel.org/doc/html/latest/admin-guide/pm/sleep-states.html#basic-sysfs-interfaces-for-system-suspend-and-hibernation">the
kernel documentation</ulink> for more details.</para>
url="https://www.kernel.org/doc/html/latest/admin-guide/pm/sleep-states.html#basic-sysfs-interfaces-for-system-suspend-and-hibernation">
Basic sysfs Interfaces for System Suspend and Hibernation</ulink> for more details.</para>
<para>
<citerefentry><refentrytitle>systemd-suspend-then-hibernate.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
man/systemd-soft-reboot.service.xml
+7 -7
View File
@@ -43,18 +43,18 @@
<listitem><para>The second phase of regular shutdown, as implemented by
<citerefentry><refentrytitle>systemd-shutdown</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para></listitem>
<listitem><para>The third phase of regular shutdown, i.e. the return to the initrd
context</para></listitem>
<listitem><para>The third phase of regular shutdown, i.e. the return to the initrd context.
</para></listitem>
<listitem><para>The hardware reboot operation</para></listitem>
<listitem><para>The hardware reboot operation.</para></listitem>
<listitem><para>The firmware initialization</para></listitem>
<listitem><para>The firmware initialization.</para></listitem>
<listitem><para>The boot loader initialization</para></listitem>
<listitem><para>The boot loader initialization.</para></listitem>
<listitem><para>The kernel initialization</para></listitem>
<listitem><para>The kernel initialization.</para></listitem>
<listitem><para>The initrd initialization</para></listitem>
<listitem><para>The initrd initialization.</para></listitem>
</itemizedlist>
<para>However this form of reboot comes with drawbacks as well:</para>
man/systemd-stub.xml
+24 -22
View File
@@ -162,30 +162,32 @@
system extension images is measured into TPM PCR 13 (if a TPM is present).</para></listitem>
<listitem><para>Similarly, files
<filename><replaceable>foo</replaceable>.efi.extra.d/*.addon.efi</filename>
are loaded and verified as PE binaries, and a <literal>.cmdline</literal> section is parsed from them.
In case Secure Boot is enabled, these files will be validated using keys in UEFI DB, Shim's DB or
Shim's MOK, and will be rejected otherwise. Additionally, if the both the addon and the UKI contain a
a <literal>.uname</literal> section, the addon will be rejected if they do not exactly match. It is
<filename><replaceable>foo</replaceable>.efi.extra.d/*.addon.efi</filename> are loaded and verified as
PE binaries, and a <literal>.cmdline</literal> section is parsed from them. Addons are supposed to be
used to pass additional kernel command line parameters or Devicetree blobs, regardless of the kernel
image being booted, for example to allow platform vendors to ship platform-specific
configuration.</para>
<para>In case Secure Boot is enabled, these files will be validated using keys in UEFI DB, Shim's DB or
Shim's MOK, and will be rejected otherwise. Additionally, if the both the addon and the UKI contain a a
<literal>.uname</literal> section, the addon will be rejected if they do not match exactly. It is
recommended to always add a <literal>.sbat</literal> section to all signed addons, so that they may be
revoked with a SBAT policy update, without requiring blocklisting via DBX/MOKX. The
<citerefentry><refentrytitle>ukify</refentrytitle><manvolnum>1</manvolnum></citerefentry> tool will
add a SBAT policy by default if none is passed when building addons. For more information on SBAT see
<ulink url="https://github.com/rhboot/shim/blob/main/SBAT.md">Shim's documentation</ulink>.
Addons are supposed to be used to pass additional kernel command line parameters or Devicetree blobs,
regardless of the kernel image being booted, for example to allow platform vendors to ship
platform-specific configuration. The loaded command line addon files are sorted, loaded, and measured
into TPM PCR 12 (if a TPM is present) and appended to the kernel command line. UKI command line options
are listed first, then options from addons in <filename>/loader/addons/*.addon.efi</filename>, and
finally UKI-specific addons. Device tree blobs are loaded and measured following the same algorithm.
Addons are always loaded in the same order based on the filename, so that, given the same set of
addons, the same set of measurements can be expected in PCR12. However, note that the filename is not
protected by the PE signature, and as such an attacker with write access to the ESP could potentially
rename these files to change the order in which they are loaded, in a way that could alter the
functionality of the kernel, as some options might be order dependent. If you sign such addons, you
should pay attention to the PCR12 values and make use of an attestation service so that improper use
of your signed addons can be detected and dealt with using one of the aforementioned revocation
mechanisms.</para></listitem>
<citerefentry><refentrytitle>ukify</refentrytitle><manvolnum>1</manvolnum></citerefentry> tool will add
a SBAT policy by default if none is passed when building addons. For more information on SBAT see
<ulink url="https://github.com/rhboot/shim/blob/main/SBAT.md">Shim documentation</ulink>.</para>
<para>Addon files are sorted, loaded, and measured into TPM PCR 12 (if a TPM is present) and appended
to the kernel command line. UKI command line options are listed first, then options from addons in
<filename>/loader/addons/*.addon.efi</filename>, and finally UKI-specific addons. Device tree blobs are
loaded and measured following the same algorithm. Addons are always loaded in the same order based on
the filename, so that, given the same set of addons, the same set of measurements can be expected in
PCR12. However, note that the filename is not protected by the PE signature, and as such an attacker
with write access to the ESP could potentially rename these files to change the order in which they are
loaded, in a way that could alter the functionality of the kernel, as some options might be
order-dependent. If you sign such addons, you should pay attention to the PCR12 values and make use of
an attestation service so that improper use of your signed addons can be detected and dealt with using
one of the aforementioned revocation mechanisms.</para></listitem>
<listitem><para>Files <filename>/loader/credentials/*.cred</filename> are packed up in a
<command>cpio</command> archive and placed in the <filename>/.extra/global_credentials/</filename>
man/systemd-sysext.xml
+9 -7
View File
@@ -112,7 +112,7 @@
suitable for shipping resources that are processed by subsystems running in earliest boot. Specifically,
OS extension images are not suitable for shipping system services or
<citerefentry><refentrytitle>systemd-sysusers</refentrytitle><manvolnum>8</manvolnum></citerefentry>
definitions. See the <ulink url="https://systemd.io/PORTABLE_SERVICES">Portable Services Documentation</ulink>
definitions. See the <ulink url="https://systemd.io/PORTABLE_SERVICES">Portable Services</ulink> page
for a simple mechanism for shipping system services in disk images, in a similar fashion to OS
extensions. Note the different isolation on these two mechanisms: while system extension directly extend
the underlying OS image with additional files that appear in a way very similar to as if they were
@@ -129,7 +129,7 @@
an extension with the same name in a system folder with lower precedence.</para>
<para>A simple mechanism for version compatibility is enforced: a system extension image must carry a
<filename>/usr/lib/extension-release.d/extension-release.<replaceable>$name</replaceable></filename>
<filename>/usr/lib/extension-release.d/extension-release.<replaceable>NAME</replaceable></filename>
file, which must match its image name, that is compared with the host <filename>os-release</filename>
file: the contained <varname>ID=</varname> fields have to match unless <literal>_any</literal> is set
for the extension. If the extension <varname>ID=</varname> is not <literal>_any</literal>, the
@@ -168,11 +168,13 @@
<filename>.raw</filename> suffix are considered disk image based confext images.</para>
<para>Again, just like sysext images, the confext images will contain a
<filename>/etc/extension-release.d/extension-release.<replaceable>$name</replaceable></filename>
file, which must match the image name (with the usual escape hatch of xattr), and again with content
being one or more of <varname>ID=</varname>, <varname>VERSION_ID=</varname>, and
<varname>CONFEXT_LEVEL</varname>. Confext images will then be checked and matched against the
base OS layer.</para>
<filename>/etc/extension-release.d/extension-release.<replaceable>NAME</replaceable></filename>
file, which must match the image name (with the usual escape hatch of
the <varname>user.extension-release.strict</varname>
<citerefentry project='man-pages'><refentrytitle>xattr</refentrytitle><manvolnum>7</manvolnum></citerefentry>),
and again with content being one or more of <varname>ID=</varname>, <varname>VERSION_ID=</varname>, and
<varname>CONFEXT_LEVEL</varname>. Confext images will then be checked and matched against the base OS
layer.</para>
</refsect1>
<refsect1>
man/systemd-system.conf.xml
+2 -2
View File
@@ -461,8 +461,8 @@
case of the system manager, this includes variables set by the kernel based on the kernel command line.</para>
<para>Setting environment variables for the manager process may be useful to modify its behaviour.
See <ulink url="https://systemd.io/ENVIRONMENT">ENVIRONMENT</ulink> for a descriptions of some
variables understood by <command>systemd</command>.</para>
See <ulink url="https://systemd.io/ENVIRONMENT">Known Environment Variables</ulink> for a
descriptions of some variables understood by <command>systemd</command>.</para>
<para>Simple <literal>%</literal>-specifier expansion is supported, see below for a list of supported
specifiers.</para>
man/systemd-sysusers.xml
+1 -1
View File
@@ -150,7 +150,7 @@
<title>Credentials</title>
<para><command>systemd-sysusers</command> supports the service credentials logic as implemented by
<varname>ImportCredential=</varname><varname>LoadCredential=</varname>/<varname>SetCredential=</varname>
<varname>ImportCredential=</varname>/<varname>LoadCredential=</varname>/<varname>SetCredential=</varname>
(see <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
details). The following credentials are used when passed in:</para>
man/systemd-vconsole-setup.service.xml
+1 -1
View File
@@ -57,7 +57,7 @@
<title>Credentials</title>
<para><command>systemd-vconsole-setup</command> supports the service credentials logic as implemented by
<varname>ImportCredential=</varname><varname>LoadCredential=</varname>/<varname>SetCredential=</varname>
<varname>ImportCredential=</varname>/<varname>LoadCredential=</varname>/<varname>SetCredential=</varname>
(see <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>1</manvolnum></citerefentry> for
details). The following credentials are used when passed in:</para>
man/systemd.exec.xml
+46 -39
View File
@@ -166,8 +166,9 @@
or loopback file instead of a directory. The device node or file system image file needs to contain a
file system without a partition table, or a file system within an MBR/MS-DOS or GPT partition table
with only a single Linux-compatible partition, or a set of file systems within a GPT partition table
that follows the <ulink url="https://uapi-group.org/specifications/specs/discoverable_partitions_specification">Discoverable Partitions
Specification</ulink>.</para>
that follows the
<ulink url="https://uapi-group.org/specifications/specs/discoverable_partitions_specification">
Discoverable Partitions Specification</ulink>.</para>
<para>When <varname>DevicePolicy=</varname> is set to <literal>closed</literal> or
<literal>strict</literal>, or set to <literal>auto</literal> and <varname>DeviceAllow=</varname> is
@@ -207,8 +208,9 @@
<citerefentry project='man-pages'><refentrytitle>mount</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
</para>
<para>Valid partition names follow the <ulink
url="https://uapi-group.org/specifications/specs/discoverable_partitions_specification">Discoverable Partitions Specification</ulink>:
<para>Valid partition names follow the
<ulink url="https://uapi-group.org/specifications/specs/discoverable_partitions_specification">
Discoverable Partitions Specification</ulink>:
<constant>root</constant>, <constant>usr</constant>, <constant>home</constant>, <constant>srv</constant>,
<constant>esp</constant>, <constant>xbootldr</constant>, <constant>tmp</constant>,
<constant>var</constant>.</para>
@@ -230,10 +232,11 @@
<para>To make sure making ephemeral copies can be made efficiently, the root directory or root image
should be located on the same filesystem as <filename>/var/lib/systemd/ephemeral-trees/</filename>.
When using <varname>RootEphemeral=</varname> with root directories, btrfs should be used as the
filesystem and the root directory should ideally be a subvolume which <command>systemd</command> can
snapshot to make the ephemeral copy. For root images, a filesystem with support for reflinks should
be used to ensure an efficient ephemeral copy.</para>
When using <varname>RootEphemeral=</varname> with root directories,
<citerefentry project='url'><refentrytitle url='https://btrfs.wiki.kernel.org/index.php/Manpage/btrfs(5)'>btrfs</refentrytitle><manvolnum>5</manvolnum></citerefentry>
should be used as the filesystem and the root directory should ideally be a subvolume which
<command>systemd</command> can snapshot to make the ephemeral copy. For root images, a filesystem
with support for reflinks should be used to ensure an efficient ephemeral copy.</para>
<xi:include href="system-only.xml" xpointer="singular"/>
@@ -302,8 +305,9 @@
<para>This option is supported only for disk images that contain a single file system, without an
enveloping partition table. Images that contain a GPT partition table should instead include both
root file system and matching Verity data in the same image, implementing the <ulink
url="https://uapi-group.org/specifications/specs/discoverable_partitions_specification">Discoverable Partitions Specification</ulink>.</para>
root file system and matching Verity data in the same image, implementing the
<ulink url="https://uapi-group.org/specifications/specs/discoverable_partitions_specification">
Discoverable Partitions Specification</ulink>.</para>
<xi:include href="system-only.xml" xpointer="singular"/>
@@ -831,9 +835,10 @@ CapabilityBoundingSet=~CAP_B CAP_C</programlisting>
<varname>SystemCallFilter=</varname>, or <varname>SystemCallLog=</varname> are specified. Note that
even if this setting is overridden by them, <command>systemctl show</command> shows the original
value of this setting. In case the service will be run in a new mount namespace anyway and SELinux is
disabled, all file systems are mounted with <constant>MS_NOSUID</constant> flag. Also see <ulink
url="https://docs.kernel.org/userspace-api/no_new_privs.html">No New Privileges
Flag</ulink>.</para>
disabled, all file systems are mounted with <constant>MS_NOSUID</constant> flag. Also see
the kernel document
<ulink url="https://docs.kernel.org/userspace-api/no_new_privs.html">No New Privileges Flag</ulink>.
</para>
<para>Note that this setting only has an effect on the unit's processes themselves (or any processes
directly or indirectly forked off them). It has no effect on processes potentially invoked on request
@@ -1913,7 +1918,7 @@ BindReadOnlyPaths=/var/lib/systemd</programlisting>
<para>Note that this functionality might not be available, for example if KSM is disabled in the
kernel, or the kernel doesn't support controlling KSM at the process level through
<function>prctl()</function>.</para>
<citerefentry><refentrytitle>prctl</refentrytitle><manvolnum>2</manvolnum></citerefentry>.</para>
<xi:include href="version-info.xml" xpointer="v254"/>
</listitem>
@@ -2787,37 +2792,39 @@ SystemCallErrorNumber=EPERM</programlisting>
<listitem><para>Similar to <varname>Environment=</varname>, but reads the environment variables from
a text file. The text file should contain newline-separated variable assignments. Empty lines, lines
without an <literal>=</literal> separator, or lines starting with <literal>;</literal> or
<literal>#</literal> will be ignored, which may be used for commenting. The file must be UTF-8
encoded. Valid characters are <ulink
url="https://www.unicode.org/glossary/#unicode_scalar_value">unicode scalar values</ulink> other than
<ulink url="https://www.unicode.org/glossary/#noncharacter">noncharacters</ulink>, U+0000 NUL, and
U+FEFF <ulink url="https://www.unicode.org/glossary/#byte_order_mark">byte order mark</ulink>.
Control codes other than NUL are allowed.</para>
<literal>#</literal> will be ignored, which may be used for commenting. The file must be encoded with
UTF-8. Valid characters are
<ulink url="https://www.unicode.org/glossary/#unicode_scalar_value">unicode scalar values</ulink>
other than
<ulink url="https://www.unicode.org/glossary/#noncharacter">unicode noncharacters</ulink>,
<constant>U+0000</constant> <constant>NUL</constant>, and <constant>U+FEFF</constant>
<ulink url="https://www.unicode.org/glossary/#byte_order_mark">unicode byte order mark</ulink>.
Control codes other than <constant>NUL</constant> are allowed.</para>
<para>In the file, an unquoted value after the <literal>=</literal> is parsed with the same backslash-escape
rules as <ulink
url="https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_02_01">unquoted
text</ulink> in a POSIX shell, but unlike in a shell, interior whitespace is preserved and quotes after the
url="https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_02_01">POSIX shell unquoted
text</ulink>, but unlike in a shell, interior whitespace is preserved and quotes after the
first non-whitespace character are preserved. Leading and trailing whitespace (space, tab, carriage return) is
discarded, but interior whitespace within the line is preserved verbatim. A line ending with a backslash will be
continued to the following one, with the newline itself discarded. A backslash
<literal>\</literal> followed by any character other than newline will preserve the following character, so that
<literal>\\</literal> will become the value <literal>\</literal>.</para>
<para>In the file, a <literal>'</literal>-quoted value after the <literal>=</literal> can span multiple lines
and contain any character verbatim other than single quote, like <ulink
url="https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_02_02">single-quoted
text</ulink> in a POSIX shell. No backslash-escape sequences are recognized. Leading and trailing whitespace
outside of the single quotes is discarded.</para>
<para>In the file, a <literal>'</literal>-quoted value after the <literal>=</literal> can span
multiple lines and contain any character verbatim other than single quote, like <ulink
url="https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_02_02">POSIX
shell single-quoted text</ulink>. No backslash-escape sequences are recognized. Leading and trailing
whitespace outside of the single quotes is discarded.</para>
<para>In the file, a <literal>"</literal>-quoted value after the <literal>=</literal> can span multiple lines,
and the same escape sequences are recognized as in <ulink
url="https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_02_03">double-quoted
text</ulink> of a POSIX shell. Backslash (<literal>\</literal>) followed by any of <literal>"\`$</literal> will
preserve that character. A backslash followed by newline is a line continuation, and the newline itself is
discarded. A backslash followed by any other character is ignored; both the backslash and the following
character are preserved verbatim. Leading and trailing whitespace outside of the double quotes is
discarded.</para>
<para>In the file, a <literal>"</literal>-quoted value after the <literal>=</literal> can span
multiple lines, and the same escape sequences are recognized as in <ulink
url="https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_02_03">POSIX
shell double-quoted text</ulink>. Backslash (<literal>\</literal>) followed by any of
<literal>"\`$</literal> will preserve that character. A backslash followed by newline is a line
continuation, and the newline itself is discarded. A backslash followed by any other character is
ignored; both the backslash and the following character are preserved verbatim. Leading and trailing
whitespace outside of the double quotes is discarded.</para>
<para>The argument passed should be an absolute filename or wildcard expression, optionally prefixed with
<literal>-</literal>, which indicates that if the file does not exist, it will not be read and no error or
@@ -3174,7 +3181,7 @@ StandardInputData=V2XigLJyZSBubyBzdHJhbmdlcnMgdG8gbG92ZQpZb3Uga25vdyB0aGUgcnVsZX
<varname>RateLimitBurst=</varname> configured in
<citerefentry><refentrytitle>journald.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
Note that this only applies to log messages that are processed by the logging subsystem, i.e. by
<citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
<citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
This means that if you connect a service's stderr directly to a file via
<varname>StandardOutput=file:…</varname> or a similar setting, the rate limiting will not be applied
to messages written that way (but it will be enforced for messages generated via
@@ -4141,9 +4148,9 @@ StandardInputData=V2XigLJyZSBubyBzdHJhbmdlcnMgdG8gbG92ZQpZb3Uga25vdyB0aGUgcnVsZX
<varname>FileDescriptorStoreMax=</varname> is set to a non-zero value (see
<citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>
for details). Applications may check this environment variable before sending file descriptors to
the service manager via <function>sd_pid_notify_with_fds()</function> (see
<citerefentry><refentrytitle>sd_notify</refentrytitle><manvolnum>3</manvolnum></citerefentry> for
details).</para>
the service manager via
<citerefentry><refentrytitle>sd_pid_notify_with_fds</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
</para>
<xi:include href="version-info.xml" xpointer="v254"/></listitem>
</varlistentry>
man/systemd.image-policy.xml
+7 -7
View File
@@ -51,10 +51,10 @@
<listitem><para><option>verity</option> for partitions that shall exist and be used, with Verity
authentication. (Note: if a DDI image carries a data partition, along with a Verity partition and a
signature partition for it, and only the <option>verity</option> flag is set – and
<option>signed</option> is not –, then the image will be set up with Verity, but the signature data will
not be used. Or in other words: any DDI with a set of partitions that qualify for
<option>signature</option> also implicitly qualifies for <option>verity</option>, and in fact
signature partition for it, and only the <option>verity</option> flag is set (<option>signed</option>
is not), then the image will be set up with Verity, but the signature data will not be used. Or in
other words: any DDI with a set of partitions that qualify for <option>signature</option> also
implicitly qualifies for <option>verity</option>, and in fact also
<option>unprotected</option>).</para></listitem>
<listitem><para><option>signed</option> for partitions that shall exist and be used, with Verity
@@ -130,9 +130,9 @@
<para>Most systemd components that support operating with disk images support a
<option>--image-policy=</option> command line option to specify the image policy to use, and default to
relatively open policies by default (typically the <literal>*</literal> policy, as described above),
under the assumption that trust in disk images is established before the images are passed to the program
in question.</para>
relatively open policies (typically the <literal>*</literal> policy, as described above), under the
assumption that trust in disk images is established before the images are passed to the program in
question.</para>
<para>For the host image itself
<citerefentry><refentrytitle>systemd-gpt-auto-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>
man/systemd.link.xml
+3 -3
View File
@@ -1306,9 +1306,9 @@ $ sudo ip link set eth0 down
$ sudo udevadm trigger --verbose --settle --action add /sys/class/net/eth0</programlisting>
<para>You may also need to stop the service that manages the network interface, e.g.
<filename>systemd-networkd.service</filename> or <filename>NetworkManager.service</filename> before
the above operation, and then restart the service after that. For more details about
<command>udevadm</command> command, see
<citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
or <filename>NetworkManager.service</filename> before the above operation, and then restart the service
after that. For more details about <command>udevadm</command> command, see
<citerefentry><refentrytitle>udevadm</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
</example>
man/systemd.net-naming-scheme.xml
+1 -1
View File
@@ -448,7 +448,7 @@
property or none at all.</para>
<para>Some firmware and hypervisor implementations report unreasonably high numbers for the
on-board index. To prevent the generation of bogus onbard interface names, index numbers greater
on-board index. To prevent the generation of bogus on-board interface names, index numbers greater
than 16381 (2¹⁴-1) were ignored. For s390 PCI devices index values up to 65535 (2¹⁶-1) are valid.
To account for that, the limit was increased to 65535.</para>
man/systemd.netdev.xml
+4 -4
View File
@@ -712,11 +712,11 @@
<varlistentry>
<term><varname>ReduceARPProxy=</varname></term>
<listitem>
<para>Takes a boolean. When true, bridge-connected VXLAN tunnel
endpoint answers ARP requests from the local bridge on behalf
of remote Distributed Overlay Virtual Ethernet
<para>Takes a boolean. When true, bridge-connected VXLAN tunnel endpoint answers ARP requests from
the local bridge on behalf of remote
<ulink url="https://en.wikipedia.org/wiki/Distributed_Overlay_Virtual_Ethernet">
(DOVE)</ulink> clients. Defaults to false.</para>
Distributed Overlay Virtual Ethernet (DOVE)</ulink>
clients. Defaults to false.</para>
<xi:include href="version-info.xml" xpointer="v233"/>
</listitem>
man/systemd.network.xml
+14 -6
View File
@@ -2430,7 +2430,9 @@ NFTSet=prefix:netdev:filter:eth_ipv4_prefix</programlisting>
<term><varname>UseCaptivePortal=</varname></term>
<listitem>
<para>When true (the default), the captive portal advertised by the DHCP server will be recorded
and made available to client programs and displayed in the networkctl status output per-link.</para>
and made available to client programs and displayed in the
<citerefentry><refentrytitle>networkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
status output per-link.</para>
<xi:include href="version-info.xml" xpointer="v254"/>
</listitem>
@@ -2881,7 +2883,9 @@ NFTSet=prefix:netdev:filter:eth_ipv4_prefix</programlisting>
<term><varname>UseCaptivePortal=</varname></term>
<listitem>
<para>When true (the default), the captive portal advertised by the DHCPv6 server will be recorded
and made available to client programs and displayed in the networkctl status output per-link.</para>
and made available to client programs and displayed in the
<citerefentry><refentrytitle>networkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
status output per-link.</para>
<xi:include href="version-info.xml" xpointer="v254"/>
</listitem>
@@ -3297,7 +3301,9 @@ Token=prefixstable:2002:da8:1::</programlisting></para>
<term><varname>UseCaptivePortal=</varname></term>
<listitem>
<para>When true (the default), the captive portal received in the Router Advertisement will be recorded
and made available to client programs and displayed in the networkctl status output per-link.</para>
and made available to client programs and displayed in the
<citerefentry><refentrytitle>networkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
status output per-link.</para>
<xi:include href="version-info.xml" xpointer="v254"/>
</listitem>
@@ -3306,9 +3312,11 @@ Token=prefixstable:2002:da8:1::</programlisting></para>
<varlistentry>
<term><varname>UsePREF64=</varname></term>
<listitem>
<para>When true, the IPv6 PREF64 (or NAT64) prefixes received in the Router Advertisement will be recorded
and made available to client programs and displayed in the <command>networkctl</command> status output per-link.
See <ulink url="https://tools.ietf.org/html/rfc8781">RFC 8781</ulink>. Defaults to false.</para>
<para>When true, the IPv6 PREF64 (or NAT64) prefixes received in the Router Advertisement will be
recorded and made available to client programs and displayed in the
<citerefentry><refentrytitle>networkctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
status output per-link. See <ulink url="https://tools.ietf.org/html/rfc8781">RFC 8781</ulink>.
Defaults to false.</para>
<xi:include href="version-info.xml" xpointer="v255"/>
</listitem>
man/systemd.resource-control.xml
+23 -9
View File
@@ -1143,7 +1143,7 @@ NFTSet=cgroup:inet:filter:my_service user:inet:filter:serviceuser
<listitem>
<para><varname>BPFProgram=</varname> allows attaching custom BPF programs to the cgroup of a
unit. (This generalizes the functionality exposed via <varname>IPEgressFilterPath=</varname> and
and <varname>IPIngressFilterPath=</varname> for other hooks.) Cgroup-bpf hooks in the form of BPF
<varname>IPIngressFilterPath=</varname> for other hooks.) Cgroup-bpf hooks in the form of BPF
programs loaded to the BPF filesystem are attached with cgroup-bpf attach flags determined by the
unit. For details about attachment types and flags see <ulink
url="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/plain/include/uapi/linux/bpf.h"><filename>bpf.h</filename></ulink>. Also
@@ -1154,13 +1154,27 @@ NFTSet=cgroup:inet:filter:my_service user:inet:filter:serviceuser
<replaceable>type</replaceable>:<replaceable>program-path</replaceable>.</para>
<para>The BPF program type is equivalent to the BPF attach type used in
<command>bpftool</command>. It may be one of <constant>egress</constant>,
<constant>ingress</constant>, <constant>sock_create</constant>, <constant>sock_ops</constant>,
<constant>device</constant>, <constant>bind4</constant>, <constant>bind6</constant>,
<constant>connect4</constant>, <constant>connect6</constant>, <constant>post_bind4</constant>,
<constant>post_bind6</constant>, <constant>sendmsg4</constant>, <constant>sendmsg6</constant>,
<constant>sysctl</constant>, <constant>recvmsg4</constant>, <constant>recvmsg6</constant>,
<constant>getsockopt</constant>, <constant>setsockopt</constant>.</para>
<citerefentry project='mankier'><refentrytitle>bpftool</refentrytitle><manvolnum>8</manvolnum></citerefentry>
It may be one of
<constant>egress</constant>,
<constant>ingress</constant>,
<constant>sock_create</constant>,
<constant>sock_ops</constant>,
<constant>device</constant>,
<constant>bind4</constant>,
<constant>bind6</constant>,
<constant>connect4</constant>,
<constant>connect6</constant>,
<constant>post_bind4</constant>,
<constant>post_bind6</constant>,
<constant>sendmsg4</constant>,
<constant>sendmsg6</constant>,
<constant>sysctl</constant>,
<constant>recvmsg4</constant>,
<constant>recvmsg6</constant>,
<constant>getsockopt</constant>,
or <constant>setsockopt</constant>.
</para>
<para>The specified program path must be an absolute path referencing a BPF program inode in the
bpffs file system (which generally means it must begin with <filename>/sys/fs/bpf/</filename>). If
@@ -1545,7 +1559,7 @@ DeviceAllow=/dev/loop-control
<varname>$MEMORY_PRESSURE_WATCH</varname> environment variable to the literal string
<filename>/dev/null</filename>. If <literal>on</literal> tells the service to watch for memory
pressure events. This enables memory accounting for the service, and ensures the
<filename>memory.pressure</filename> cgroup attribute files is accessible for read and write to the
<filename>memory.pressure</filename> cgroup attribute file is accessible for reading and writing by the
service's user. It then sets the <varname>$MEMORY_PRESSURE_WATCH</varname> environment variable for
processes invoked by the unit to the file system path to this file. The threshold information
configured with <varname>MemoryPressureThresholdSec=</varname> is encoded in the
man/systemd.service.xml
+5 -4
View File
@@ -167,7 +167,7 @@
been forked off (i.e. immediately after <function>fork()</function>, and before various process
attributes have been configured and in particular before the new process has called
<function>execve()</function> to invoke the actual service binary). Typically,
<varname>Type=</varname><option>exec</option> (see below) is the better choice, see below.</para>
<varname>Type=</varname><option>exec</option> is the better choice, see below.</para>
<para>It is expected that the process configured with <varname>ExecStart=</varname> is the main
process of the service. In this mode, if the process offers functionality to other processes on
@@ -239,7 +239,7 @@
socket provided by systemd. If <varname>NotifyAccess=</varname> is missing or set to
<option>none</option>, it will be forcibly set to <option>main</option>.</para>
<para>If the service supports reloading, and uses the a signal to start the reload, using
<para>If the service supports reloading, and uses a signal to start the reload, using
<option>notify-reload</option> instead is recommended.</para></listitem>
<listitem><para>Behavior of <option>notify-reload</option> is similar to <option>notify</option>,
@@ -1239,8 +1239,9 @@
<constant>stop</constant> the event is logged but the unit is terminated cleanly by the service
manager. If set to <constant>kill</constant> and one of the unit's processes is killed by the OOM
killer the kernel is instructed to kill all remaining processes of the unit too, by setting the
<filename>memory.oom.group</filename> attribute to <constant>1</constant>; also see <ulink
url="https://docs.kernel.org/admin-guide/cgroup-v2.html">kernel documentation</ulink>.</para>
<filename>memory.oom.group</filename> attribute to <constant>1</constant>; also see kernel
page <ulink url="https://docs.kernel.org/admin-guide/cgroup-v2.html">Control Group v2</ulink>.
</para>
<para>Defaults to the setting <varname>DefaultOOMPolicy=</varname> in
<citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>
man/systemd.socket.xml
+3 -3
View File
@@ -349,9 +349,9 @@
queue that have not been accepted yet. This setting matters only for stream and sequential packet
sockets. See
<citerefentry><refentrytitle>listen</refentrytitle><manvolnum>2</manvolnum></citerefentry> for
details. Note that this value is silently capped by the <literal>net.core.somaxconn</literal> sysctl,
which typically defaults to 4096. By default this is set to 4294967295, so that the sysctl takes full
effect.</para></listitem>
details. Defaults to 4294967295. Note that this value is silently capped by the
<literal>net.core.somaxconn</literal> sysctl, which typically defaults to 4096, so typically
the sysctl is the setting that actually matters.</para></listitem>
</varlistentry>
<varlistentry>
man/systemd.unit.xml
+6 -6
View File
@@ -884,12 +884,12 @@
<term><varname>JoinsNamespaceOf=</varname></term>
<listitem><para>For units that start processes (such as service units), lists one or more other units
whose network and/or temporary file namespace to join. If this is specified on a unit (say, a.service
has <varname>JoinsNamespaceOf=b.service</varname>), then this the inverse dependency
(<varname>JoinsNamespaceOf=a.service</varname> for b.service) is implied. This only applies to unit
types which support the <varname>PrivateNetwork=</varname>, <varname>NetworkNamespacePath=</varname>,
<varname>PrivateIPC=</varname>, <varname>IPCNamespacePath=</varname>, and
<varname>PrivateTmp=</varname> directives (see
whose network and/or temporary file namespace to join. If this is specified on a unit (say,
<filename>a.service</filename> has <varname>JoinsNamespaceOf=b.service</varname>), then the inverse
dependency (<varname>JoinsNamespaceOf=a.service</varname> for b.service) is implied. This only
applies to unit types which support the <varname>PrivateNetwork=</varname>,
<varname>NetworkNamespacePath=</varname>, <varname>PrivateIPC=</varname>,
<varname>IPCNamespacePath=</varname>, and <varname>PrivateTmp=</varname> directives (see
<citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
details). If a unit that has this setting set is started, its processes will see the same
<filename>/tmp/</filename>, <filename>/var/tmp/</filename>, IPC namespace and network namespace as
man/tmpfiles.d.xml
+4 -4
View File
@@ -872,10 +872,10 @@ e! /var/cache/krb5rcache - - - 0
<programlisting>-smbios type=11,value=io.systemd.credential.binary:tmpfiles.extra=$(echo "f~ /root/.ssh/authorized_keys 700 root root - $(ssh-add -L | base64 -w 0)" | base64 -w 0)
</programlisting>
<para>By passing this line to QEMU, the public key of the current user will be encoded in
base64, added to a tmpfiles.d line that tells systemd-tmpfiles to decode it into
<filename>/root/.ssh/authorized_keys</filename>, encode that line itself in base64 and
pass it as a Credential that will be picked up by systemd from SMBIOS on boot.
<para>By passing this line to QEMU, the public key of the current user will be encoded in base64, added
to a tmpfiles.d line that tells <command>systemd-tmpfiles</command> to decode it into
<filename>/root/.ssh/authorized_keys</filename>, encode that line itself in base64 and pass it as a
Credential that will be picked up by systemd from SMBIOS on boot.
</para>
</example>
</refsect1>
man/udev.xml
+2 -1
View File
@@ -136,7 +136,8 @@
backslash, lowercase t, backslash, lowercase n.</para>
<para>The string can be prefixed with a lowercase e (e"string\n") to mark the string as
<ulink url="https://en.wikipedia.org/wiki/Escape_sequences_in_C#Table_of_escape_sequences">C-style escaped</ulink>.
C-style escaped, see
<ulink url="https://en.wikipedia.org/wiki/Escape_sequences_in_C#Table_of_escape_sequences">Escape sequences in C</ulink>.
For example, e"string\n" is parsed as 7 characters: 6 lowercase letters and a newline.
This can be useful for writing special characters when a kernel driver requires them.</para>
man/ukify.xml
+7 -7
View File
@@ -111,7 +111,7 @@
<para>If the stub and/or the kernel contain <literal>.sbat</literal> sections they will be merged in
the UKI so that revocation updates affecting either are considered when the UKI is loaded by Shim. For
more information on SBAT see
<ulink url="https://github.com/rhboot/shim/blob/main/SBAT.md">Shim's documentation.</ulink>
<ulink url="https://github.com/rhboot/shim/blob/main/SBAT.md">Shim documentation</ulink>.
</para>
</refsect2>
@@ -243,7 +243,7 @@
<term><option>--summary</option></term>
<listitem><para>Print a summary of loaded config and exit. This is useful to check how the options
form the configuration file and the command line are combined.</para>
from the configuration file and the command line are combined.</para>
<xi:include href="version-info.xml" xpointer="v254"/></listitem>
</varlistentry>
@@ -478,7 +478,7 @@
DBX/MOKX. If not specified manually, a default metadata entry consisting of
<literal>uki,1,UKI,uki,1,https://www.freedesktop.org/software/systemd/man/systemd-stub.html</literal>
will be used, to ensure it is always possible to revoke UKIs and addons. For more information on
SBAT see <ulink url="https://github.com/rhboot/shim/blob/main/SBAT.md">Shim's documentation.</ulink>
SBAT see <ulink url="https://github.com/rhboot/shim/blob/main/SBAT.md">Shim documentation</ulink>.
</para>
<xi:include href="version-info.xml" xpointer="v254"/></listitem>
@@ -512,8 +512,8 @@
<para>On the command line, this option may be specified more than once, similarly to the
<option>--pcr-private-key=</option> option. If not present, the public keys will be extracted from
the private keys. On the command line, if present, the this option must be specified the same number
of times as the <option>--pcr-private-key=</option> option.</para>
the private keys. On the command line, if present, this option must be specified the same number of
times as the <option>--pcr-private-key=</option> option.</para>
<xi:include href="version-info.xml" xpointer="v253"/></listitem>
</varlistentry>
@@ -662,13 +662,13 @@ Writing public key for PCR signing to /etc/kernel/pcr-system.pub.pem
<para>(Both operations need to be done as root to allow write access
to <filename>/etc/kernel/</filename>.)</para>
<para>Subsequent invocations of using the config file
<para>Subsequent invocations using the config file
(<command>ukify build --config=/etc/kernel/uki.conf</command>)
will use this certificate and key files. Note that the
<citerefentry><refentrytitle>kernel-install</refentrytitle><manvolnum>8</manvolnum></citerefentry>
plugin <filename>60-ukify.install</filename> uses <filename>/etc/kernel/uki.conf</filename>
by default, so after this file has been created, installations of kernels that create a UKI on the
local machine using <command>kernel-install</command> would perform signing using this config.</para>
local machine using <command>kernel-install</command> will perform signing using this config.</para>
</example>
</refsect1>
src/shared/varlink-idl.c
+1 -1
View File
@@ -379,7 +379,7 @@ VarlinkInterface* varlink_interface_free(VarlinkInterface *interface) {
return NULL;
/* So here's the thing: in most cases we want that users of this define their interface descriptions
* in C code, and hence the definitions are constant and immutable during the life-cycle of the
* in C code, and hence the definitions are constant and immutable during the lifecycle of the
* system. Because of that we define all structs with const* pointers. It makes it very nice and
* straight-forward to populate these structs with literal C strings. However, in some not so common
* cases we also want to allocate these structures dynamically on the heap, when parsing interface