SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

man: document that '+' prefixed commands ignore limit settings

Browse Source 
(cherry picked from commit e8e4a385b9bf3a556e60131bef418ca89371bac1)
This commit is contained in:
Daniel Sedlak
2026-10-16 17:24:51 +01:00
committed by Luca Boccassi
parent c918ac7401
commit d4da50bbc9
2 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd.exec.xml
+4
View File
@@ -1085,6 +1085,10 @@ CapabilityBoundingSet=~CAP_B CAP_C</programlisting>
<manvolnum>5</manvolnum></citerefentry>) is typically a better choice than <varname>LimitNPROC=</varname>.
</para>
<para>These settings, including the defaults described below, do not affect commands prefixed with
<literal>+</literal>. Such commands inherit the resource limits of the service manager itself, which may be
different.</para>
<para>Resource limits not configured explicitly for a unit default to the value configured in the various
<varname>DefaultLimitCPU=</varname>, <varname>DefaultLimitFSIZE=</varname>, … options available in
<citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>, and –
man/systemd.service.xml
+1 -1
View File
@@ -1576,7 +1576,7 @@ RestartMaxDelaySec=160s</programlisting>
<row>
<entry><literal>+</literal></entry>
<entry>If the executable path is prefixed with <literal>+</literal> then the process is executed with full privileges. In this mode privilege restrictions configured with <varname>User=</varname>, <varname>Group=</varname>, <varname>CapabilityBoundingSet=</varname> or the various file system namespacing options (such as <varname>PrivateDevices=</varname>, <varname>PrivateTmp=</varname>) are not applied to the invoked command line (but still affect any other <varname>ExecStart=</varname>, <varname>ExecStop=</varname>, … lines). However, note that this will not bypass options that apply to the whole control group, such as <varname>DevicePolicy=</varname>, see <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry> for the full list.</entry>
<entry>If the executable path is prefixed with <literal>+</literal> then the process is executed with full privileges. In this mode privilege restrictions configured with <varname>User=</varname>, <varname>Group=</varname>, <varname>CapabilityBoundingSet=</varname> or the various file system namespacing options (such as <varname>PrivateDevices=</varname>, <varname>PrivateTmp=</varname>) are not applied to the invoked command line (but still affect any other <varname>ExecStart=</varname>, <varname>ExecStop=</varname>, … lines). Resource limits configured with <varname>LimitCPU=</varname>, <varname>LimitCORE=</varname>, <varname>LimitNOFILE=</varname> and the other resource limit settings described in <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> (including the defaults set with <varname>DefaultLimitCPU=</varname>, <varname>DefaultLimitCORE=</varname>, … in <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>) are not applied either, and the invoked command inherits the resource limits of the service manager itself. However, note that this will not bypass options that apply to the whole control group, such as <varname>DevicePolicy=</varname>, see <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry> for the full list.</entry>
</row>
<row>