From d4da50bbc9d653cf1a40c5d8df6532a699dd5de2 Mon Sep 17 00:00:00 2001 From: Daniel Sedlak Date: Thu, 8 Oct 2026 08:34:51 +0200 Subject: [PATCH] man: document that '+' prefixed commands ignore limit settings (cherry picked from commit e8e4a385b9bf3a556e60131bef418ca89371bac1) --- man/systemd.exec.xml | 4 ++++ man/systemd.service.xml | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index ddf603a6c1..2a8ffd8a47 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -1085,6 +1085,10 @@ CapabilityBoundingSet=~CAP_B CAP_C 5) is typically a better choice than LimitNPROC=. + These settings, including the defaults described below, do not affect commands prefixed with + +. Such commands inherit the resource limits of the service manager itself, which may be + different. + Resource limits not configured explicitly for a unit default to the value configured in the various DefaultLimitCPU=, DefaultLimitFSIZE=, … options available in systemd-system.conf5, and – diff --git a/man/systemd.service.xml b/man/systemd.service.xml index 57bb224c24..975b41d65a 100644 --- a/man/systemd.service.xml +++ b/man/systemd.service.xml @@ -1576,7 +1576,7 @@ RestartMaxDelaySec=160s + - If the executable path is prefixed with + then the process is executed with full privileges. In this mode privilege restrictions configured with User=, Group=, CapabilityBoundingSet= or the various file system namespacing options (such as PrivateDevices=, PrivateTmp=) are not applied to the invoked command line (but still affect any other ExecStart=, ExecStop=, … lines). However, note that this will not bypass options that apply to the whole control group, such as DevicePolicy=, see systemd.resource-control5 for the full list. + If the executable path is prefixed with + then the process is executed with full privileges. In this mode privilege restrictions configured with User=, Group=, CapabilityBoundingSet= or the various file system namespacing options (such as PrivateDevices=, PrivateTmp=) are not applied to the invoked command line (but still affect any other ExecStart=, ExecStop=, … lines). Resource limits configured with LimitCPU=, LimitCORE=, LimitNOFILE= and the other resource limit settings described in systemd.exec5 (including the defaults set with DefaultLimitCPU=, DefaultLimitCORE=, … in systemd-system.conf5) are not applied either, and the invoked command inherits the resource limits of the service manager itself. However, note that this will not bypass options that apply to the whole control group, such as DevicePolicy=, see systemd.resource-control5 for the full list.