12b42c76672a66c2d4ea7212c14f8f1b5a62b78dTom Gundersen<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN" "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
c91faef3b3facfdf13282aee957af25dd555890bLennart Poettering This file is part of systemd.
c91faef3b3facfdf13282aee957af25dd555890bLennart Poettering Copyright 2011 Lennart Poettering
c91faef3b3facfdf13282aee957af25dd555890bLennart Poettering systemd is free software; you can redistribute it and/or modify it
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering under the terms of the GNU Lesser General Public License as published by
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering the Free Software Foundation; either version 2.1 of the License, or
c91faef3b3facfdf13282aee957af25dd555890bLennart Poettering (at your option) any later version.
c91faef3b3facfdf13282aee957af25dd555890bLennart Poettering systemd is distributed in the hope that it will be useful, but
c91faef3b3facfdf13282aee957af25dd555890bLennart Poettering WITHOUT ANY WARRANTY; without even the implied warranty of
c91faef3b3facfdf13282aee957af25dd555890bLennart Poettering MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering Lesser General Public License for more details.
5430f7f2bc7330f3088b894166bf3524a067e3d8Lennart Poettering You should have received a copy of the GNU Lesser General Public License
c91faef3b3facfdf13282aee957af25dd555890bLennart Poettering along with systemd; If not, see <http://www.gnu.org/licenses/>.
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek xmlns:xi="http://www.w3.org/2001/XInclude">
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <productname>systemd</productname>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <email>lennart@poettering.net</email>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <refentrytitle>sysctl.d</refentrytitle>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <refpurpose>Configure kernel parameters at boot</refpurpose>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <refsynopsisdiv>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <para><filename>/etc/sysctl.d/*.conf</filename></para>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <para><filename>/run/sysctl.d/*.conf</filename></para>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <para><filename>/usr/lib/sysctl.d/*.conf</filename></para>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek </refsynopsisdiv>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>systemd-sysctl.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek reads configuration files from the above directories to configure
3ba3a79df4ae094d1008c04a9af8d1ff970124c4Zbigniew Jędrzejewski-Szmek <citerefentry project='man-pages'><refentrytitle>sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek kernel parameters.</para>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <title>Configuration Format</title>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <para>The configuration files contain a list of variable
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek assignments, separated by newlines. Empty lines and lines whose
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek first non-whitespace character is <literal>#</literal> or
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <literal>;</literal> are ignored.</para>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <para>Note that either <literal>/</literal> or
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <literal>.</literal> may be used as separators within sysctl
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek variable names. If the first separator is a slash, remaining
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek slashes and dots are left intact. If the first separator is a dot,
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek dots and slashes are interchanged.
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <literal>kernel.domainname=foo</literal> and
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <literal>kernel/domainname=foo</literal> are equivalent and will
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek cause <literal>foo</literal> to be written to
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <filename>/proc/sys/kernel/domainname</filename>. Either
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <literal>net.ipv4.conf.enp3s0/200.forwarding</literal> or
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <literal>net/ipv4/conf/enp3s0.200/forwarding</literal> may be used
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <filename>/proc/sys/net/ipv4/conf/enp3s0.200/forwarding</filename>.
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <para>The settings configured with <filename>sysctl.d</filename>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek files will be applied early on boot. The network
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek interface-specific options will also be applied individually for
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek each network interface as it shows up in the system. (More
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek specifically, <filename>net.ipv4.conf.*</filename>,
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <filename>net.ipv6.conf.*</filename>,
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <filename>net.ipv4.neigh.*</filename> and
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <filename>net.ipv6.neigh.*</filename>).</para>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <para>Many sysctl parameters only become available when certain
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek kernel modules are loaded. Modules are usually loaded on demand,
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek e.g. when certain hardware is plugged in or network brought up.
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>systemd-sysctl.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek which runs during early boot will not configure such parameters if
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek they become available after it has run. To set such parameters, it
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek is recommended to add an
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>udev</refentrytitle><manvolnum>7</manvolnum></citerefentry>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek rule to set those parameters when they become available.
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek Alternatively, a slightly simpler and less efficient option is to
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek add the module to
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>modules-load.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek causing it to be loaded statically before sysctl settings are
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek applied (see example below).</para>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <xi:include href="standard-conf.xml" xpointer="confd" />
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <title>Set kernel YP domain name</title>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <para><filename>/etc/sysctl.d/domain-name.conf</filename>:
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <programlisting>kernel.domainname=example.com</programlisting>
9407bc2d03b6405754807b6f38c8ca95b4fc1f40Zbigniew Jędrzejewski-Szmek <title>Apply settings available only when a certain module is loaded (method one)</title>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <para><filename>/etc/udev/rules.d/99-bridge.rules</filename>:
9407bc2d03b6405754807b6f38c8ca95b4fc1f40Zbigniew Jędrzejewski-Szmek <programlisting>ACTION=="add", SUBSYSTEM=="module", KERNEL=="br_netfilter", \
9407bc2d03b6405754807b6f38c8ca95b4fc1f40Zbigniew Jędrzejewski-Szmek RUN+="/usr/lib/systemd/systemd-sysctl --prefix=/net/bridge"
71418295125c542d3edd1e7251bb0701ef1af89bZbigniew Jędrzejewski-Szmek</programlisting>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <para><filename>/etc/sysctl.d/bridge.conf</filename>:
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <programlisting>net.bridge.bridge-nf-call-ip6tables = 0
71418295125c542d3edd1e7251bb0701ef1af89bZbigniew Jędrzejewski-Szmeknet.bridge.bridge-nf-call-iptables = 0
71418295125c542d3edd1e7251bb0701ef1af89bZbigniew Jędrzejewski-Szmeknet.bridge.bridge-nf-call-arptables = 0
71418295125c542d3edd1e7251bb0701ef1af89bZbigniew Jędrzejewski-Szmek</programlisting>
9407bc2d03b6405754807b6f38c8ca95b4fc1f40Zbigniew Jędrzejewski-Szmek <para>This method applies settings when the module is
b938cb902c3b5bca807a94b277672c64d6767886Jan Engelhardt loaded. Please note that, unless the <filename>br_netfilter</filename>
9407bc2d03b6405754807b6f38c8ca95b4fc1f40Zbigniew Jędrzejewski-Szmek module is loaded, bridged packets will not be filtered by
a8eaaee72a2f06e0fb64fb71de3b71ecba31dafbJan Engelhardt Netfilter (starting with kernel 3.18), so simply not loading the
a8eaaee72a2f06e0fb64fb71de3b71ecba31dafbJan Engelhardt module is sufficient to avoid filtering.</para>
9407bc2d03b6405754807b6f38c8ca95b4fc1f40Zbigniew Jędrzejewski-Szmek <title>Apply settings available only when a certain module is loaded (method two)</title>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <para><filename>/etc/modules-load.d/bridge.conf</filename>:
9407bc2d03b6405754807b6f38c8ca95b4fc1f40Zbigniew Jędrzejewski-Szmek <programlisting>br_netfilter</programlisting>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <para><filename>/etc/sysctl.d/bridge.conf</filename>:
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <programlisting>net.bridge.bridge-nf-call-ip6tables = 0
7284335adbb8cb2bc9c11f9e102906da1bf71145Zbigniew Jędrzejewski-Szmeknet.bridge.bridge-nf-call-iptables = 0
7284335adbb8cb2bc9c11f9e102906da1bf71145Zbigniew Jędrzejewski-Szmeknet.bridge.bridge-nf-call-arptables = 0
7284335adbb8cb2bc9c11f9e102906da1bf71145Zbigniew Jędrzejewski-Szmek</programlisting>
9407bc2d03b6405754807b6f38c8ca95b4fc1f40Zbigniew Jędrzejewski-Szmek <para>This method forces the module to be always loaded. Please
b938cb902c3b5bca807a94b277672c64d6767886Jan Engelhardt note that, unless the <filename>br_netfilter</filename> module is
a8eaaee72a2f06e0fb64fb71de3b71ecba31dafbJan Engelhardt loaded, bridged packets will not be filtered with Netfilter
9407bc2d03b6405754807b6f38c8ca95b4fc1f40Zbigniew Jędrzejewski-Szmek (starting with kernel 3.18), so simply not loading the module is
a8eaaee72a2f06e0fb64fb71de3b71ecba31dafbJan Engelhardt sufficient to avoid filtering.</para>
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>systemd-sysctl.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
798d3a524ea57aaf40cb53858aaa45ec702f012dZbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>systemd-delta</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
3ba3a79df4ae094d1008c04a9af8d1ff970124c4Zbigniew Jędrzejewski-Szmek <citerefentry project='man-pages'><refentrytitle>sysctl</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
3ba3a79df4ae094d1008c04a9af8d1ff970124c4Zbigniew Jędrzejewski-Szmek <citerefentry project='man-pages'><refentrytitle>sysctl.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
3ba3a79df4ae094d1008c04a9af8d1ff970124c4Zbigniew Jędrzejewski-Szmek <citerefentry project='man-pages'><refentrytitle>modprobe</refentrytitle><manvolnum>8</manvolnum></citerefentry>