systemd.resource-control.xml revision e41969e3d1a8bda8b0b2f7eb012cef1c8835509a
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering<?xml-stylesheet type="text/xsl" href="http://docbook.sourceforge.net/release/xsl/current/xhtml/docbook.xsl"?>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
2f6a59070559786428d9eaf199ae3d61772b2225Kay SieversThis file is part of systemd.
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart PoetteringCopyright 2013 Zbigniew Jędrzejewski-Szmek
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poetteringsystemd is free software; you can redistribute it and/or modify it
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poetteringunder the terms of the GNU Lesser General Public License as published by
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poetteringthe Free Software Foundation; either version 2.1 of the License, or
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering(at your option) any later version.
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poetteringsystemd is distributed in the hope that it will be useful, but
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart PoetteringWITHOUT ANY WARRANTY; without even the implied warranty of
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart PoetteringMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart PoetteringLesser General Public License for more details.
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart PoetteringYou should have received a copy of the GNU Lesser General Public License
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poetteringalong with systemd; If not, see <http://www.gnu.org/licenses/>.
3f6fd1ba65f962702753c4ad284b588e59689a23Lennart Poettering <refentryinfo>
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen <productname>systemd</productname>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering </authorgroup>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering </refentryinfo>
7085053a437456ab87d726f3697002dd811fdf7aDaniel Wallace <refentrytitle>systemd.resource-control</refentrytitle>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <refname>systemd.resource-control</refname>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <refpurpose>Resource control unit settings</refpurpose>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <refsynopsisdiv>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <filename><replaceable>slice</replaceable>.slice</filename>,
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <filename><replaceable>scope</replaceable>.scope</filename>,
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <filename><replaceable>service</replaceable>.service</filename>,
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <filename><replaceable>socket</replaceable>.socket</filename>,
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <filename><replaceable>mount</replaceable>.mount</filename>,
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <filename><replaceable>swap</replaceable>.swap</filename>
46e65dcc3a522b5e992e165b5e61d14254026859Lennart Poettering </refsynopsisdiv>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <para>Unit configuration files for services, slices, scopes,
2f6a59070559786428d9eaf199ae3d61772b2225Kay Sievers sockets, mount points, and swap devices share a subset of
ffc06c3513d9a0693c7f810d03b20705127ba55aKay Sievers configuration options for resource control of spawned
2f6a59070559786428d9eaf199ae3d61772b2225Kay Sievers processes. Internally, this relies on the Control Groups
2f6a59070559786428d9eaf199ae3d61772b2225Kay Sievers kernel concept for organizing processes in a hierarchial tree of
2f6a59070559786428d9eaf199ae3d61772b2225Kay Sievers named groups for the purpose of resource management.</para>
2f6a59070559786428d9eaf199ae3d61772b2225Kay Sievers <para>This man page lists the configuration options shared by
2f6a59070559786428d9eaf199ae3d61772b2225Kay Sievers those six unit types. See
2f6a59070559786428d9eaf199ae3d61772b2225Kay Sievers <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering for the common options of all unit configuration files, and
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
e7e55dbdc38f929805ab2407fbd50886043a9e7cDavid Herrmann <citerefentry><refentrytitle>systemd.scope</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
e7e55dbdc38f929805ab2407fbd50886043a9e7cDavid Herrmann <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
e7e55dbdc38f929805ab2407fbd50886043a9e7cDavid Herrmann <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
e7e55dbdc38f929805ab2407fbd50886043a9e7cDavid Herrmann <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
e7e55dbdc38f929805ab2407fbd50886043a9e7cDavid Herrmann <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>
e7e55dbdc38f929805ab2407fbd50886043a9e7cDavid Herrmann for more information on the specific unit configuration files. The
ffc06c3513d9a0693c7f810d03b20705127ba55aKay Sievers resource control configuration options are configured in the
f18ca9dcdeda247e208f7143e834fd2fb2070d80Kay Sievers [Slice], [Scope], [Service], [Socket], [Mount], or [Swap]
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering sections, depending on the unit type.</para>
d95a74ed1191bb09f5be57b0619d3d77708e019dLennart Poettering url="http://www.freedesktop.org/wiki/Software/systemd/ControlGroupInterface/">New
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering Control Group Interfaces</ulink> for an introduction on how to make
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering use of resource control APIs from programs.</para>
d95a74ed1191bb09f5be57b0619d3d77708e019dLennart Poettering <para>Units of the types listed above can have settings
2311eb2ff0c3ff80ec3645b02c97170c9a565454Kay Sievers for resource control configuration:</para>
d95a74ed1191bb09f5be57b0619d3d77708e019dLennart Poettering <varlistentry>
d95a74ed1191bb09f5be57b0619d3d77708e019dLennart Poettering <term><varname>CPUAccounting=</varname></term>
9ff09bcb86fb125768667aca9bc0b10b1745370aShawn Landden <para>Turn on CPU usage accounting for this unit. Takes a
9ff09bcb86fb125768667aca9bc0b10b1745370aShawn Landden boolean argument. Note that turning on CPU accounting for
d95a74ed1191bb09f5be57b0619d3d77708e019dLennart Poettering one unit might also implicitly turn it on for all units
9ff09bcb86fb125768667aca9bc0b10b1745370aShawn Landden contained in the same slice and for all its parent slices
9ff09bcb86fb125768667aca9bc0b10b1745370aShawn Landden and the units contained therein. The system default for this
9ff09bcb86fb125768667aca9bc0b10b1745370aShawn Landden setting maybe controlled with
d95a74ed1191bb09f5be57b0619d3d77708e019dLennart Poettering <varname>DefaultCPUAccounting=</varname> in
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
5ffa8c818120e35c89becd938d160235c069dd12Zbigniew Jędrzejewski-Szmek <term><varname>CPUShares=<replaceable>weight</replaceable></varname></term>
9ff09bcb86fb125768667aca9bc0b10b1745370aShawn Landden <para>Assign the specified overall CPU time share weight to
9ff09bcb86fb125768667aca9bc0b10b1745370aShawn Landden the processes executed. Takes an integer value. This
9ff09bcb86fb125768667aca9bc0b10b1745370aShawn Landden controls the <literal>cpu.shares</literal> control group
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering attribute, which defaults to 1024. For details about this
2f6a59070559786428d9eaf199ae3d61772b2225Kay Sievers control group attribute, see <ulink
2f6a59070559786428d9eaf199ae3d61772b2225Kay Sievers url="https://www.kernel.org/doc/Documentation/scheduler/sched-design-CFS.txt">sched-design-CFS.txt</ulink>.</para>
d95a74ed1191bb09f5be57b0619d3d77708e019dLennart Poettering <para>Implies <literal>CPUAccounting=true</literal>.</para>
9ff09bcb86fb125768667aca9bc0b10b1745370aShawn Landden <varlistentry>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <term><varname>MemoryAccounting=</varname></term>
2667cc25896a15f82f9f1583e80d416beb1316e1Thomas Hindoe Paaboel Andersen <para>Turn on process and kernel memory accounting for this
d95a74ed1191bb09f5be57b0619d3d77708e019dLennart Poettering unit. Takes a boolean argument. Note that turning on memory
d95a74ed1191bb09f5be57b0619d3d77708e019dLennart Poettering accounting for one unit might also implicitly turn it on for
d95a74ed1191bb09f5be57b0619d3d77708e019dLennart Poettering all its parent slices. The system default for this setting
d95a74ed1191bb09f5be57b0619d3d77708e019dLennart Poettering maybe controlled with
d95a74ed1191bb09f5be57b0619d3d77708e019dLennart Poettering <varname>DefaultMemoryAccounting=</varname> in
d95a74ed1191bb09f5be57b0619d3d77708e019dLennart Poettering <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
d95a74ed1191bb09f5be57b0619d3d77708e019dLennart Poettering </varlistentry>
d95a74ed1191bb09f5be57b0619d3d77708e019dLennart Poettering <varlistentry>
5ffa8c818120e35c89becd938d160235c069dd12Zbigniew Jędrzejewski-Szmek <term><varname>MemoryLimit=<replaceable>bytes</replaceable></varname></term>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <para>Specify the limit on maximum memory usage of the
5ffa8c818120e35c89becd938d160235c069dd12Zbigniew Jędrzejewski-Szmek executed processes. The limit specifies how much process and
2f6a59070559786428d9eaf199ae3d61772b2225Kay Sievers kernel memory can be used by tasks in this unit. Takes a
2f6a59070559786428d9eaf199ae3d61772b2225Kay Sievers memory size in bytes. If the value is suffixed with K, M, G
2f6a59070559786428d9eaf199ae3d61772b2225Kay Sievers or T, the specified memory size is parsed as Kilobytes,
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering Megabytes, Gigabytes, or Terabytes (with the base 1024),
2f6a59070559786428d9eaf199ae3d61772b2225Kay Sievers respectively. This controls the
1fc464f6fbecfc5d8ba9f7b98d19e21fb324bfb9Lennart Poettering <literal>memory.limit_in_bytes</literal> control group
ab59f4123a6f9c32953e522cc9afc5fc610d59caVedran Miletić attribute. For details about this control group attribute,
ab59f4123a6f9c32953e522cc9afc5fc610d59caVedran Miletić url="https://www.kernel.org/doc/Documentation/cgroups/memory.txt">memory.txt</ulink>.</para>
ab59f4123a6f9c32953e522cc9afc5fc610d59caVedran Miletić <para>Implies <literal>MemoryAccounting=true</literal>.</para>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering </varlistentry>
e7e55dbdc38f929805ab2407fbd50886043a9e7cDavid Herrmann <term><varname>BlockIOAccounting=</varname></term>
9f6eb1cd58f2ddf2eb6ba0e4de056e13d938af75Kay Sievers <para>Turn on Block IO accounting for this unit. Takes a
9f6eb1cd58f2ddf2eb6ba0e4de056e13d938af75Kay Sievers boolean argument. Note that turning on block IO accounting
9f6eb1cd58f2ddf2eb6ba0e4de056e13d938af75Kay Sievers for one unit might also implicitly turn it on for all units
9f6eb1cd58f2ddf2eb6ba0e4de056e13d938af75Kay Sievers contained in the same slice and all for its parent slices
9f6eb1cd58f2ddf2eb6ba0e4de056e13d938af75Kay Sievers and the units contained therein. The system default for this
9f6eb1cd58f2ddf2eb6ba0e4de056e13d938af75Kay Sievers setting maybe controlled with
ffc06c3513d9a0693c7f810d03b20705127ba55aKay Sievers <citerefentry><refentrytitle>systemd-system.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.</para>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering </varlistentry>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <varlistentry>
ffc06c3513d9a0693c7f810d03b20705127ba55aKay Sievers <term><varname>BlockIOWeight=<replaceable>weight</replaceable></varname></term>
9f6eb1cd58f2ddf2eb6ba0e4de056e13d938af75Kay Sievers overall block IO weight for the
9f6eb1cd58f2ddf2eb6ba0e4de056e13d938af75Kay Sievers executed processes. Takes a single
e7e55dbdc38f929805ab2407fbd50886043a9e7cDavid Herrmann weight value (between 10 and 1000) to
e7e55dbdc38f929805ab2407fbd50886043a9e7cDavid Herrmann set the default block IO weight. This
ffc06c3513d9a0693c7f810d03b20705127ba55aKay Sievers control group attribute, which
ffc06c3513d9a0693c7f810d03b20705127ba55aKay Sievers defaults to 1000. For details about
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering this control group attribute, see
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen url="https://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt">blkio-controller.txt</ulink>.</para>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <literal>BlockIOAccounting=true</literal>.</para>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering </varlistentry>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <varlistentry>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <term><varname>BlockIODeviceWeight=<replaceable>device</replaceable> <replaceable>weight</replaceable></varname></term>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <para>Set the per-device overall block IO weight for the
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering executed processes. Takes a space-separated pair of a file
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering path and a weight value to specify the device specific
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering weight value, between 10 and 1000. (Example: "/dev/sda
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering 500"). The file path may be specified as path to a block
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering device node or as any other file, in which case the backing
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen block device of the file system of the file is
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen determined. This controls the
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen <literal>blkio.weight_device</literal> control group
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen attribute, which defaults to 1000. Use this option multiple
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen times to set weights for multiple devices. For details about
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen this control group attribute, see <ulink
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen url="https://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt">blkio-controller.txt</ulink>.</para>
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen <literal>BlockIOAccounting=true</literal>.</para>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <varlistentry>
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen <term><varname>BlockIOReadBandwidth=<replaceable>device</replaceable> <replaceable>bytes</replaceable></varname></term>
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen <term><varname>BlockIOWriteBandwidth=<replaceable>device</replaceable> <replaceable>bytes</replaceable></varname></term>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <para>Set the per-device overall block IO bandwidth limit
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering for the executed processes. Takes a space-separated pair of
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering a file path and a bandwidth value (in bytes per second) to
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering specify the device specific bandwidth. The file path may be
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering a path to a block device node, or as any other file in which
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen case the backing block device of the file system of the file
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen is used. If the bandwidth is suffixed with K, M, G, or T,
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen the specified bandwidth is parsed as Kilobytes, Megabytes,
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen Gigabytes, or Terabytes, respectively, to the base of
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen "/dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 5M"). This
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen controls the <literal>blkio.read_bps_device</literal> and
e5609878d8802e2469c433be418bcbcf55fbe63bLennart Poettering <literal>blkio.write_bps_device</literal> control group
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen attributes. Use this option multiple times to set bandwidth
07a062a79374406e8f6b5a1e2f80c80baf031567Jason St. John limits for multiple devices. For details about these control
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen group attributes, see <ulink
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen url="https://www.kernel.org/doc/Documentation/cgroups/blkio-controller.txt">blkio-controller.txt</ulink>.
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen <literal>BlockIOAccounting=true</literal>.</para>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering </varlistentry>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <varlistentry>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <term><varname>DeviceAllow=</varname></term>
e5609878d8802e2469c433be418bcbcf55fbe63bLennart Poettering <para>Control access to specific device nodes by the
e5609878d8802e2469c433be418bcbcf55fbe63bLennart Poettering executed processes. Takes two space-separated strings: a
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering device node specifier followed by a combination of
e5609878d8802e2469c433be418bcbcf55fbe63bLennart Poettering <constant>r</constant>, <constant>w</constant>,
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <emphasis>r</emphasis>eading, <emphasis>w</emphasis>riting,
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen or creation of the specific device node(s) by the unit
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen (<emphasis>m</emphasis>knod), respectively. This controls
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen the <literal>devices.allow</literal> and
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen <literal>devices.deny</literal> control group
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen attributes. For details about these control group
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen attributes, see <ulink
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen url="https://www.kernel.org/doc/Documentation/cgroups/devices.txt">devices.txt</ulink>.</para>
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen <para>The device node specifier is either a path to a device
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen node in the file system, starting with
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen <filename>/dev/</filename>, or a string starting with either
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen <literal>char-</literal> or <literal>block-</literal>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering followed by a device group name, as listed in
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <filename>/proc/devices</filename>. The latter is useful to
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen whitelist all current and future devices belonging to a
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen specific device group at once. The device group is matched
e5609878d8802e2469c433be418bcbcf55fbe63bLennart Poettering according to file name globbing rules, you may hence use the
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <literal>*</literal> and <literal>?</literal>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering wildcards. Examples: <filename>/dev/sda5</filename> is a
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering path to a device node, referring to an ATA or SCSI block
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <literal>char-alsa</literal> are specifiers for all pseudo
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering TTYs and all ALSA sound devices,
e5609878d8802e2469c433be418bcbcf55fbe63bLennart Poettering respectively. <literal>char-cpu/*</literal> is a specifier
e5609878d8802e2469c433be418bcbcf55fbe63bLennart Poettering matching all CPU related device groups.</para>
e5609878d8802e2469c433be418bcbcf55fbe63bLennart Poettering </varlistentry>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <varlistentry>
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen <term><varname>DevicePolicy=auto|closed|strict</varname></term>
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen Control the policy for allowing device access:
e5609878d8802e2469c433be418bcbcf55fbe63bLennart Poettering <varlistentry>
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen <term><option>strict</option></term>
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen <para>means to only allow types of access that are
a281d9c7851b16c4c9195d042901540ee9ced799Thomas Hindoe Paaboel Andersen explicitly specified.</para>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering </varlistentry>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <varlistentry>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <para>in addition, allows access to standard pseudo
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering devices including
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering </varlistentry>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <varlistentry>
7591abd48079edc1f2adbd922e4b83eb73abeabeLennart Poettering in addition, allows access to all devices if no
07a062a79374406e8f6b5a1e2f80c80baf031567Jason St. John explicit <varname>DeviceAllow=</varname> is present.
4f8f66cb4236783cd3cbee97fefc9aaa8469ac08Zbigniew Jędrzejewski-Szmek This is the default.
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering </varlistentry>
3906ab4adf0aa7b952e39100262a11acd55cd79bRonny Chevalier <para>The name of the slice unit to place the unit
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering in. Defaults to <filename>system.slice</filename> for all
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering non-instantiated units of all unit types (except for slice
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering units themselves see below). Instance units are by default
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering placed in a subslice of <filename>system.slice</filename>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering that is named after the template name.</para>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <para>This option may be used to arrange systemd units in a
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering hierarchy of slices each of which might have resource
c978343015c787713651dff571acb5207367f5f2Lennart Poettering settings applied.</para>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <para>For units of type slice, the only accepted value for
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering this setting is the parent slice. Since the name of a slice
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering unit implies the parent slice, it is hence redundant to ever
c978343015c787713651dff571acb5207367f5f2Lennart Poettering set this parameter directly for slice units.</para>
c978343015c787713651dff571acb5207367f5f2Lennart Poettering </varlistentry>
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <citerefentry><refentrytitle>systemd.service</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <citerefentry><refentrytitle>systemd.slice</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <citerefentry><refentrytitle>systemd.scope</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
601185b43da638b1c74153deae01dbd518680889Zbigniew Jędrzejewski-Szmek <citerefentry><refentrytitle>systemd.socket</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <citerefentry><refentrytitle>systemd.swap</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <citerefentry><refentrytitle>systemd.directives</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <citerefentry><refentrytitle>systemd.special</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
601185b43da638b1c74153deae01dbd518680889Zbigniew Jędrzejewski-Szmek The documentation for control groups and specific controllers in the Linux kernel:
601185b43da638b1c74153deae01dbd518680889Zbigniew Jędrzejewski-Szmek <ulink url="https://www.kernel.org/doc/Documentation/cgroups/cgroups.txt">cgroups.txt</ulink>,
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <ulink url="https://www.kernel.org/doc/Documentation/cgroups/cpuacct.txt">cpuacct.txt</ulink>,
6d0274f11547a0f11200bb82bf598a5a253e12cfLennart Poettering <ulink url="https://www.kernel.org/doc/Documentation/cgroups/memory.txt">memory.txt</ulink>,