249 lines
11 KiB
XML
249 lines
11 KiB
XML
<?xml version="1.0"?>
|
|
<!--*-nxml-*-->
|
|
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
|
|
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
|
|
<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
|
|
<refentry id="systemd-sysctl.service"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude">
|
|
|
|
<refentryinfo>
|
|
<title>systemd-sysctl.service</title>
|
|
<productname>systemd</productname>
|
|
</refentryinfo>
|
|
|
|
<refmeta>
|
|
<refentrytitle>systemd-sysctl.service</refentrytitle>
|
|
<manvolnum>8</manvolnum>
|
|
</refmeta>
|
|
|
|
<refnamediv>
|
|
<refname>systemd-sysctl.service</refname>
|
|
<refname>systemd-sysctl</refname>
|
|
<refpurpose>Configure kernel parameters at boot</refpurpose>
|
|
</refnamediv>
|
|
|
|
<refsynopsisdiv>
|
|
<cmdsynopsis>
|
|
<command>/usr/lib/systemd/systemd-sysctl</command>
|
|
<arg choice="opt" rep="repeat">OPTIONS</arg>
|
|
<arg choice="opt" rep="repeat"><replaceable>CONFIGFILE</replaceable></arg>
|
|
</cmdsynopsis>
|
|
<para><filename>systemd-sysctl.service</filename></para>
|
|
</refsynopsisdiv>
|
|
|
|
<refsect1>
|
|
<title>Description</title>
|
|
|
|
<para><filename>systemd-sysctl.service</filename> is an early boot
|
|
service that configures
|
|
<citerefentry project='man-pages'><refentrytitle>sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>
|
|
kernel parameters by invoking <command>/usr/lib/systemd/systemd-sysctl</command>.</para>
|
|
|
|
<para>When invoked with no arguments, <command>/usr/lib/systemd/systemd-sysctl</command> applies
|
|
all directives from configuration files listed in
|
|
<citerefentry><refentrytitle>sysctl.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
|
|
When invoked with positional arguments, the configuration specified by the command line arguments is
|
|
executed. If the string <literal>-</literal> is specified instead of a filename, the configuration is
|
|
read from standard input. If the argument is a file name (without any slashes), all configuration
|
|
directories are searched for a matching file and the file found that has the highest priority is
|
|
executed. If the argument is a path, that file is used directly without searching the configuration
|
|
directories for any other matching file.</para>
|
|
|
|
<para>In addition, <option>--prefix=</option> option may be used to limit which sysctl
|
|
settings are applied.</para>
|
|
|
|
<para>See
|
|
<citerefentry><refentrytitle>sysctl.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>
|
|
for information about the configuration of sysctl settings. After sysctl configuration is
|
|
changed on disk, it must be written to the files in <filename>/proc/sys/</filename> before it
|
|
takes effect. It is possible to update specific settings, or simply to reload all configuration,
|
|
see Examples below.</para>
|
|
</refsect1>
|
|
|
|
<refsect1><title>Options</title>
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><option>--prefix=</option></term>
|
|
<listitem>
|
|
<para>Only apply rules with the specified prefix.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v230"/>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term><option>--strict</option></term>
|
|
<listitem>
|
|
<para>Always return non-zero exit code on failure (including invalid sysctl variable
|
|
name and insufficient permissions), unless the sysctl variable name is prefixed with a "-"
|
|
character.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v252"/>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--verify</option></term>
|
|
<listitem>
|
|
<para>After <command>systemd-sysctl</command> successfully writes a value to a sysctl variable, the
|
|
variable is read back and verified to match the value that was written. If the variable cannot be
|
|
read back, or if the returned value differs from the written value, the write operation is
|
|
considered to have failed. To detect such failures reliably, it is recommended to also specify
|
|
<option>--strict</option>, and to ensure that the settings being applied are not prefixed with
|
|
<literal>-</literal> (see
|
|
<citerefentry><refentrytitle>sysctl.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>
|
|
for details). This mode is disabled by default, since the format accepted by the kernel may differ
|
|
from the format returned when the variable is read back, or the kernel may normalize the input. As
|
|
a result, verification may not work reliably in all cases. Therefore, this option is best used
|
|
together with explicitly specified configuration files or settings provided through
|
|
<option>--inline</option>, or with <option>--prefix=</option> to restrict the set of sysctl
|
|
variables being written.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v262"/>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--inline</option></term>
|
|
<listitem><para>Treat each positional argument as a separate configuration line instead of a file
|
|
name. When specified, at least one positional argument must be specified.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v259"/></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--save=<replaceable>FILENAME</replaceable></option></term>
|
|
<listitem>
|
|
<para>Before applying the loaded sysctl settings, write them to <filename>/run/sysctl.d/</filename>
|
|
using the specified filename. If the filename does not end with <filename>.conf</filename>, the
|
|
suffix is appended. This option requires one or more positional arguments. May be combined with
|
|
<option>--inline</option>. This may be useful for creating runtime sysctl configuration files or
|
|
overriding existing sysctl configuration files.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v262"/>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--revert=<replaceable>FILENAME</replaceable></option></term>
|
|
<listitem>
|
|
<para>Before loading and applying the sysctl settings, removes the specified sysctl configuration
|
|
file under <filename>/run/sysctl.d/</filename>. If the filename does not end with
|
|
<filename>.conf</filename>, the suffix is appended. This may be useful for removing configuration
|
|
files created by <option>--save=</option>.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v262"/>
|
|
</listitem>
|
|
</varlistentry>
|
|
|
|
<xi:include href="standard-options.xml" xpointer="cat-config" />
|
|
<xi:include href="standard-options.xml" xpointer="tldr" />
|
|
<xi:include href="standard-options.xml" xpointer="no-pager" />
|
|
<xi:include href="standard-options.xml" xpointer="help" />
|
|
<xi:include href="standard-options.xml" xpointer="version" />
|
|
|
|
</variablelist>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>Credentials</title>
|
|
|
|
<para><command>systemd-sysctl</command> supports the service credentials logic as implemented by
|
|
<varname>ImportCredential=</varname>/<varname>LoadCredential=</varname>/<varname>SetCredential=</varname>
|
|
(see <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
|
|
details). The following credentials are used when passed in:</para>
|
|
|
|
<variablelist class='system-credentials'>
|
|
<varlistentry>
|
|
<term><varname>sysctl.extra</varname></term>
|
|
|
|
<listitem><para>The contents of this credential may contain additional lines to operate on. The
|
|
credential contents should follow the same format as any other <filename>sysctl.d/</filename> drop-in
|
|
configuration file. If this credential is passed it is processed after all of the drop-in files read
|
|
from the file system. The settings configured in the credential hence take precedence over those in
|
|
the file system.</para>
|
|
|
|
<xi:include href="version-info.xml" xpointer="v252"/></listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
|
|
<para>Note that by default the <filename>systemd-sysctl.service</filename> unit file is set up to inherit
|
|
the <literal>sysctl.extra</literal> credential from the service manager.</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>Examples</title>
|
|
|
|
<example>
|
|
<title>Reset all sysctl settings</title>
|
|
|
|
<programlisting>systemctl restart systemd-sysctl</programlisting>
|
|
</example>
|
|
|
|
<example>
|
|
<title>View coredump handler configuration</title>
|
|
|
|
<programlisting># sysctl kernel.core_pattern
|
|
kernel.core_pattern = |/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t %P %I
|
|
</programlisting>
|
|
</example>
|
|
|
|
<example>
|
|
<title>Update and verify coredump handler configuration</title>
|
|
|
|
<programlisting># /usr/lib/systemd/systemd-sysctl --prefix kernel.core_pattern --strict --verify</programlisting>
|
|
|
|
<para>This searches all the directories listed in
|
|
<citerefentry><refentrytitle>sysctl.d</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
|
|
configuration files and writes <filename>/proc/sys/kernel/core_pattern</filename>. The sysctl variable
|
|
is read back and verified. If writing or verification fails, the command exits with a non-zero status,
|
|
unless the corresponding setting is prefixed with <literal>-</literal>.</para>
|
|
</example>
|
|
|
|
<example>
|
|
<title>Update coredump handler configuration according to a specific file</title>
|
|
|
|
<programlisting># /usr/lib/systemd/systemd-sysctl 50-coredump.conf</programlisting>
|
|
|
|
<para>This applies all the settings found in <filename>50-coredump.conf</filename>.
|
|
Either <filename>/etc/sysctl.d/50-coredump.conf</filename>, or
|
|
<filename>/run/sysctl.d/50-coredump.conf</filename>, or
|
|
<filename>/usr/lib/sysctl.d/50-coredump.conf</filename> will be used, in the order
|
|
of preference.</para>
|
|
</example>
|
|
|
|
<example>
|
|
<title>Disable IPv6 on an interface and save the specified setting</title>
|
|
|
|
<programlisting># /usr/lib/systemd/systemd-sysctl --save=99-disable-ipv6-foo - <<EOF
|
|
net.ipv6.conf.foo.disable_ipv6=1
|
|
EOF</programlisting>
|
|
|
|
<para>This disables IPv6 on the network interface <filename>foo</filename>, and creates
|
|
<filename>/run/sysctl.d/99-disable-ipv6-foo.conf</filename>.</para>
|
|
</example>
|
|
|
|
<example>
|
|
<title>Remove a runtime sysctl configuration file</title>
|
|
|
|
<programlisting># /usr/lib/systemd/systemd-sysctl --revert=99-disable-ipv6-foo --prefix=/net/ipv6/conf/foo</programlisting>
|
|
|
|
<para>This removes <filename>/run/sysctl.d/99-disable-ipv6-foo.conf</filename>, and applies the
|
|
remaining sysctl settings for the network interface <filename>foo</filename>.</para>
|
|
</example>
|
|
|
|
<para>See
|
|
<citerefentry project='man-pages'><refentrytitle>sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>
|
|
for various ways to directly apply sysctl settings.</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>See Also</title>
|
|
<para><simplelist type="inline">
|
|
<member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
|
|
<member><citerefentry><refentrytitle>sysctl.d</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
|
|
<member><citerefentry project='man-pages'><refentrytitle>sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry></member>
|
|
</simplelist></para>
|
|
</refsect1>
|
|
|
|
</refentry>
|