From e18fa9ed89d159667a2fa350d5d649718771faa1 Mon Sep 17 00:00:00 2001 From: Daniel Sedlak Date: Thu, 8 Oct 2026 08:34:51 +0200 Subject: [PATCH] man: document that '+' prefixed commands ignore limit settings (cherry picked from commit e8e4a385b9bf3a556e60131bef418ca89371bac1) (cherry picked from commit d4da50bbc9d653cf1a40c5d8df6532a699dd5de2) (cherry picked from commit d76cfd4b5ea423ef67c50bce2510621cc1e6de86) (cherry picked from commit b24ed67b0be6e0354b975ff155f91513b3faba45) (cherry picked from commit 1c7422a12c388c8c1872c5047dd25c0ba5d7245a) --- man/systemd.exec.xml | 4 ++++ man/systemd.service.xml | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index a656a8c7c31..87180281ddd 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -1044,6 +1044,10 @@ CapabilityBoundingSet=~CAP_B CAP_C 5) is typically a better choice than LimitNPROC=. + These settings, including the defaults described below, do not affect commands prefixed with + +. Such commands inherit the resource limits of the service manager itself, which may be + different. + Resource limits not configured explicitly for a unit default to the value configured in the various DefaultLimitCPU=, DefaultLimitFSIZE=, … options available in systemd-system.conf5, and – diff --git a/man/systemd.service.xml b/man/systemd.service.xml index 021a4fe4d43..1ca5e361057 100644 --- a/man/systemd.service.xml +++ b/man/systemd.service.xml @@ -1448,7 +1448,7 @@ RestartMaxDelaySec=160s + - If the executable path is prefixed with + then the process is executed with full privileges. In this mode privilege restrictions configured with User=, Group=, CapabilityBoundingSet= or the various file system namespacing options (such as PrivateDevices=, PrivateTmp=) are not applied to the invoked command line (but still affect any other ExecStart=, ExecStop=, … lines). However, note that this will not bypass options that apply to the whole control group, such as DevicePolicy=, see systemd.resource-control5 for the full list. + If the executable path is prefixed with + then the process is executed with full privileges. In this mode privilege restrictions configured with User=, Group=, CapabilityBoundingSet= or the various file system namespacing options (such as PrivateDevices=, PrivateTmp=) are not applied to the invoked command line (but still affect any other ExecStart=, ExecStop=, … lines). Resource limits configured with LimitCPU=, LimitCORE=, LimitNOFILE= and the other resource limit settings described in systemd.exec5 (including the defaults set with DefaultLimitCPU=, DefaultLimitCORE=, … in systemd-system.conf5) are not applied either, and the invoked command inherits the resource limits of the service manager itself. However, note that this will not bypass options that apply to the whole control group, such as DevicePolicy=, see systemd.resource-control5 for the full list.