dilim/systemd
1
0 Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-11-06 05:17:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

man: document that '+' prefixed commands ignore limit settings

Browse Source 
(cherry picked from commit e8e4a385b9)
(cherry picked from commit d4da50bbc9)
(cherry picked from commit d76cfd4b5e)
(cherry picked from commit b24ed67b0b)
(cherry picked from commit 1c7422a12c)
This commit is contained in:
Daniel Sedlak authored and Luca Boccassi committed 2026-10-17 19:08:41 +01:00
1 parent ffd45b2979
commit e18fa9ed89
2 files changed
+5 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

man/systemd.exec.xml
+4
View File
@@ -1044,6 +1044,10 @@ CapabilityBoundingSet=~CAP_B CAP_C</programlisting>
<manvolnum>5</manvolnum></citerefentry>) is typically a better choice than <varname>LimitNPROC=</varname>.
</para>
<para>These settings, including the defaults described below, do not affect commands prefixed with
<literal>+</literal>. Such commands inherit the resource limits of the service manager itself, which may be
different.</para>
<para>Resource limits not configured explicitly for a unit default to the value configured in the various
<varname>DefaultLimitCPU=</varname>, <varname>DefaultLimitFSIZE=</varname>, … options available in
<citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>, and –
man/systemd.service.xml
+1 -1
View File
@@ -1448,7 +1448,7 @@ RestartMaxDelaySec=160s</programlisting>
<row>
<entry><literal>+</literal></entry>
<entry>If the executable path is prefixed with <literal>+</literal> then the process is executed with full privileges. In this mode privilege restrictions configured with <varname>User=</varname>, <varname>Group=</varname>, <varname>CapabilityBoundingSet=</varname> or the various file system namespacing options (such as <varname>PrivateDevices=</varname>, <varname>PrivateTmp=</varname>) are not applied to the invoked command line (but still affect any other <varname>ExecStart=</varname>, <varname>ExecStop=</varname>, … lines). However, note that this will not bypass options that apply to the whole control group, such as <varname>DevicePolicy=</varname>, see <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry> for the full list.</entry>
<entry>If the executable path is prefixed with <literal>+</literal> then the process is executed with full privileges. In this mode privilege restrictions configured with <varname>User=</varname>, <varname>Group=</varname>, <varname>CapabilityBoundingSet=</varname> or the various file system namespacing options (such as <varname>PrivateDevices=</varname>, <varname>PrivateTmp=</varname>) are not applied to the invoked command line (but still affect any other <varname>ExecStart=</varname>, <varname>ExecStop=</varname>, … lines). Resource limits configured with <varname>LimitCPU=</varname>, <varname>LimitCORE=</varname>, <varname>LimitNOFILE=</varname> and the other resource limit settings described in <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> (including the defaults set with <varname>DefaultLimitCPU=</varname>, <varname>DefaultLimitCORE=</varname>, … in <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>) are not applied either, and the invoked command inherits the resource limits of the service manager itself. However, note that this will not bypass options that apply to the whole control group, such as <varname>DevicePolicy=</varname>, see <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry> for the full list.</entry>
</row>
<row>