diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index ddf603a6c1..2a8ffd8a47 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -1085,6 +1085,10 @@ CapabilityBoundingSet=~CAP_B CAP_C 5) is typically a better choice than LimitNPROC=. + These settings, including the defaults described below, do not affect commands prefixed with + +. Such commands inherit the resource limits of the service manager itself, which may be + different. + Resource limits not configured explicitly for a unit default to the value configured in the various DefaultLimitCPU=, DefaultLimitFSIZE=, … options available in systemd-system.conf5, and – diff --git a/man/systemd.service.xml b/man/systemd.service.xml index 57bb224c24..975b41d65a 100644 --- a/man/systemd.service.xml +++ b/man/systemd.service.xml @@ -1576,7 +1576,7 @@ RestartMaxDelaySec=160s + - If the executable path is prefixed with + then the process is executed with full privileges. In this mode privilege restrictions configured with User=, Group=, CapabilityBoundingSet= or the various file system namespacing options (such as PrivateDevices=, PrivateTmp=) are not applied to the invoked command line (but still affect any other ExecStart=, ExecStop=, … lines). However, note that this will not bypass options that apply to the whole control group, such as DevicePolicy=, see systemd.resource-control5 for the full list. + If the executable path is prefixed with + then the process is executed with full privileges. In this mode privilege restrictions configured with User=, Group=, CapabilityBoundingSet= or the various file system namespacing options (such as PrivateDevices=, PrivateTmp=) are not applied to the invoked command line (but still affect any other ExecStart=, ExecStop=, … lines). Resource limits configured with LimitCPU=, LimitCORE=, LimitNOFILE= and the other resource limit settings described in systemd.exec5 (including the defaults set with DefaultLimitCPU=, DefaultLimitCORE=, … in systemd-system.conf5) are not applied either, and the invoked command inherits the resource limits of the service manager itself. However, note that this will not bypass options that apply to the whole control group, such as DevicePolicy=, see systemd.resource-control5 for the full list.