summaryrefslogtreecommitdiffstats
path: root/docs/ENVIRONMENT.md (follow)
Commit message (Collapse)AuthorAgeFilesLines
* ask-password: Add $SYSTEMD_ASK_PASSWORD_KEYRING_TYPEDaan De Meyer2024-11-021-0/+5
| | | | | | | | | Currently ask_password_auto() will always try to store the password into the user keyring. Let's make this configurable so that we can configure ask_password_auto() into the session keyring. This is required when working with user namespaces, as the user keyring is namespaced by user namespaces which makes it impossible to share cached keys across user namespaces by using the user namespace while this is possible with the session keyring.
* ask-password: Drop "default" for SYSTEMD_ASK_PASSWORD_KEYRING_TIMEOUT_SECDaan De Meyer2024-11-021-6/+5
| | | | Users can simply unset the environment variable to achieve the same effect.
* ask-password: Allow configuring the keyring timeout via an environment variableDaan De Meyer2024-10-301-0/+9
| | | | | | | | | | | | | | | | In mkosi, we want an easy way to set the keyring timeout for every tool we invoke that might use systemd-ask-password to query for a password which is then stored in the kernel keyring. Let's make this possible via a new $SYSTEMD_ASK_PASSWORD_KEYRING_TIMEOUT_SEC environment variable. Using an environment variable means we don't have to modify every separate tool to add a CLI option allowing to specify the timeout. In mkosi specifically, we'll set up a new session keyring for the mkosi process linked to the user keyring so that any pins in the user keyring are used if available, and otherwise we'll query for and store password in mkosi's session keyring with a zero timeout so that they stay in the keyring until the mkosi process exits at which point they're removed from the keyring.
* pid1: add env var to override default mount rate limit intervalxujing2024-10-161-0/+7
| | | | | | | | Similar to 24a4542c. 24a4542c can only be set 1 in 1s at most, sometimes we may need to set to something else(such as 1 in 2s). So it's best to let the user decide. This also allows users to solve #34690.
* docs: add a missing : characterGaël PORTAY2024-10-141-1/+1
| | | | This adds the missing colon character to the section systemd-sysusers.
* Add $SYSTEMD_IN_CHROOT to override chroot detectionDaan De Meyer2024-08-161-7/+7
| | | | | | | When running unprivileged, checking /proc/1/root doesn't work because it requires privileges. Instead, let's add an environment variable so the process that chroot's can tell (systemd) subprocesses whether they're running in a chroot or not.
* repart: Allow overriding fstype per partition designatorDaan De Meyer2024-07-031-0/+4
| | | | | | $SYSTEMD_REPART_OVERRIDE_FSTYPE is too invasive. Often you want to override the fstype only for a specific designator, so let's support that as well.
* Merge pull request #33370 from grawity/run-titleZbigniew Jędrzejewski-Szmek2024-06-281-0/+4
|\ | | | | run: add option to prevent the setting of terminal title
| * run: add environment variable to prevent the setting of terminal titleMantas Mikulėnas2024-06-251-0/+4
| | | | | | | | | | | | This goes together with the existing SYSTEMD_TINT_BACKGROUND. Closes https://github.com/systemd/systemd/issues/33301
* | varlink: if $SYSTEMD_VARLINK_LISTEN is set to "-", listen on stdioLennart Poettering2024-06-271-1/+2
|/
* bus-util: add env var for disabling exit-on-idleLennart Poettering2024-06-121-0/+6
|
* docs,man: Avoid some ambiguous uses of "may not"Colin Watson2024-05-081-1/+1
| | | | | | | | | | | | Like much English text, the systemd documentation uses "may not" in the sense of both "will possibly not" and "is forbidden to". In many cases this is OK because the context makes it clear, but in others I felt it was possible to read the "is forbidden to" sense by mistake: in particular, I tripped over "the target file may not exist" in systemd.unit(5) before realizing the correct interpretation. Use "might not" or "may choose not to" in these cases to make it clear which sense we mean.
* nspawn, vmspawn, run0: add env var for turning off background tintingLennart Poettering2024-05-021-0/+8
| | | | | | | Some people are just sad, sad lost souls who don't like even the tiniest ray of color in their life. Let's add an env var knob for allowing them to turn the background tinting off, to drive the last bit of color from their life so that they can stay in their grey grey life.
* vmspawn: add env var that can extend the qemu cmdlineLennart Poettering2024-04-201-0/+3
| | | | | This is a bit hackish, but really useful sometimes to play around with some qemu switches.
* vmspawn: generate predicatable TAP device names and MAC addressesSam Leonard2024-04-151-0/+8
|
* mountfsd: add new systemd-mountfsd componentLennart Poettering2024-04-061-0/+18
|
* docs: Document SYSTEMD_SYSEXT_MUTABLE_MODE env varKrzesimir Nowak2024-03-251-0/+7
|
* Merge pull request #31778 from yuwata/kbd-utilLuca Boccassi2024-03-181-1/+6
|\ | | | | kbd-util: allow to override the default keymap directories
| * kbd-util: allow to override the default keymap directoriesYu Watanabe2024-03-141-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This introduces $SYSTEMD_KEYMAP_DIRECTORIES environment variable to override the hardcoded keymap directories. I think it is not necessary to provide the first class configuration option for controlling the keymap directories, but it is not good to hardcode the paths. So, let's introduce an environment variable to override that. Prompted by #31759. Closes #31759.
* | network: pin file descriptor of persistent storageYu Watanabe2024-03-151-0/+7
|/ | | | | | This also drop the support of /run/systemd/netif/persistent-storage-ready, as the file is anyway removed when networkd is stopped. Let's use $SYSTEMD_NETWORK_PERSISTENT_STORAGE_READY=1 instead on testing.
* Merge pull request #30612 from AdrianVovk/sleep-freeze-user-seesionsLennart Poettering2024-03-061-0/+16
|\ | | | | Freeze user sessions for all types of sleep
| * homework: Lock/Unlock: Freeze/Thaw user sessionAdrian Vovk2024-03-051-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Whenever a home directory is in a locked state, accessing the files of the home directory is extremely likely to cause the thread to hang. This will put the session in a strange state, where some threads are hanging due to file access and others are not hanging because they are not trying to access any of the user's files. This can lead to a whole slew of consequences. For example, imagine a likely situation where the Wayland compositor is not hanging, but the user's open apps are. Eventually, the compositor will detect that none of the apps are responding to its pings, assume that they're frozen (which they are), and kill them. The systemd user instance can end up in a similarly confused state and start killing user services. In the worst case, killing an app at an unexpected moment can lead to data loss. The solution is to suspend execution of the whole user session by freezing the user's slice.
| * sleep: Always freeze user.sliceAdrian Vovk2024-03-051-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, we'd only freeze user.slice in the case of s2h, because we didn't want the user session to resume while systemd was transitioning from suspend to hibernate. This commit extends this freezing behavior to all sleep modes. We also have an environment variable to disable the freezing behavior outright. This is a necessary workaround for someone that has hooks in /usr/lib/systemd/system-sleep/ which communicate with some process running under user.slice, or if someone is using the proprietary NVIDIA driver which breaks when user.slice is frozen (issue #27559) Fixes #27559
* | resolved: make resolved authoritative in resolveing our local host nameLennart Poettering2024-03-051-1/+2
|/ | | | | | | | | | | | This is a kinda a follow-up for ce266330fc3bd6767451ac3400336cd9acebe9c1: it makes resolved authoritative on our local hostname, and never contacts DNS anymore for it. We effectively already were authoritative for it, except if the user queried for other RR types than just A/AAAA. This closes the gap and refuses routing other RR type queries to DNS. Fixes: #23662
* repart: add --private-key-source and drop --private-key-uriLuca Boccassi2024-03-011-8/+0
| | | | | | | | | | | | It turns out it's mostly PKCS11 that supports the URI format, and other engines just take files. For example the tpm2-tss-openssl engine just takes a sealed private key file path as the key input, and the engine needs to be specified separately. Add --private-key-source=file|engine:foo|provider:bar to manually specify how to use the private key parameter. Follow-up for 0a8264080a5d4b5e13e65eed80ac98a476f7fe43
* Merge pull request #31531 from poettering/verity-userspace-optionalLennart Poettering2024-02-281-0/+6
|\ | | | | dissect: make use of userspace verity keyring optional
| * dissect: condition usespace verity keyring via kernel cmdline option + env varLennart Poettering2024-02-281-0/+6
| |
* | tree-wide: use "_" rather than "-" as separator in kernel cmdline optionsLennart Poettering2024-02-281-1/+1
|/ | | | | | | | | | | Most of our kernel cmdline options use underscores as word separators in kernel cmdline options, but there were some exceptions. Let's fix those, and also use underscores. Since our /proc/cmdline parsers don't distinguish between the two characters anyway this should not break anything, but makes sure our own codebase (and in particular docs and log messages) are internally consistent.
* Revert "docs: use collections to structure the data"Zbigniew Jędrzejewski-Szmek2024-02-231-0/+644
| | | | | | | | | This reverts commit 5e8ff010a1436d33bbf3c108335af6e0b4ff7a2a. This broke all the URLs, we can't have that. (And actually, we probably don't _want_ to make the change either. It's nicer to have all the pages in one directory, so one doesn't have to figure out to which collection the page belongs.)
* docs: use collections to structure the datahulkoba2024-02-221-644/+0
|
* pcrlock: document the env vars we honour to find measurement logsLennart Poettering2024-02-211-0/+10
| | | | | This env vars have been supported for a while, let's document them where we usually document them.
* openssl: add helper to load key from provider/engineLuca Boccassi2024-02-091-0/+8
| | | | | It's not the literal private key, but EVP_PKEY becomes a reference to the engine/provider that OpenSSL knows how to use later
* core: add SYSTEMD_VERITY_SHARING env var for local developmentLuca Boccassi2024-01-261-0/+3
| | | | | | When running an image that cannot be mounted (e.g.: key missing intentionally for development purposes), there's a retry loop that takes some time and slows development down. Add an env var to disable it.
* varlink: also honour new env var $SYSTEMD_VARLINK_LISTEN in ↵Lennart Poettering2024-01-161-0/+5
| | | | | | | | | | | | | varlink_server_listen_auto() varlink_server_listen_auto() is supposed to be the one-stop solution for turning simple command line tools into IPC services. They aren't easy to test/debug however, since you have to invoke them through a service manager. Let's make this easier: if the SYSTEMD_VARLINK_LISTEN env var is set, let's listen on the socket specified therein. This makes things easier to gdb: just run the service from the cmdline.
* sd-bus: also intrepret $SYSTEMD_SSH env varLennart Poettering2024-01-081-1/+2
| | | | | | To make things symmetric to the $SYSTEMD_SSH logic that the varlink transport supports, let's also honour such a variable in sd-bus when picking ssh transport.
* varlink: add "ssh:" transportLennart Poettering2024-01-081-0/+5
| | | | | | | | | | | | | | | | | | This uses openssh 9.4's -W support for AF_UNIX. Unfortunately older versions don't work with this, and I couldn#t figure a way that would work for older versions too, would not be racy and where we'd still could keep track of the forked off ssh process. Unfortunately, on older versions -W will just hang (because it tries to resolve the AF_UNIX path as regular host name), which sucks, but hopefully this issue will go away sooner or later on its own, as distributions update. Fedora is still stuck at 9.3 at the time of posting this (even on Fedora), even though 9.4, 9.5, 9.6 have all already been released by now. Example: varlinkctl call -j ssh:root@somehost:/run/systemd/io.systemd.Credentials io.systemd.Credentials.Encrypt '{"text":"foobar"}'
* udev: add upper bound of 5 hours to SYSTEMD_UDEV_EXTRA_TIMEOUT_SEC=Luca Boccassi2024-01-041-1/+2
| | | | | | Follow-up for b16c6076cb334c9da9602d4bafbf60381d6d630e CID#1533111
* udev: wait for an extra time before the manager kills workersYu Watanabe2024-01-021-0/+6
| | | | | | | | | | Otherwise, udev workers cannot detect slow programs invoked by IMPORT{program}=, PROGRAM=, or RUN=, and whole worker process may be killed. Fixes #30436. Co-authored-by: sushmbha <sushmita.bhattacharya@oracle.com>
* Add $SYSTEMD_HWDB_UPDATE_BYPASS (#30463)Daan De Meyer2023-12-141-0/+8
| | | | | | Same as $KERNEL_INSTALL_BYPASS, but for hwdb. This will speed up cross architecture image builds in mkosi as I can disable package managers from running the costly hwdb update stuff in qemu user mode and run it myself with a native systemd-hwdb with --root=.
* shared/cryptsetup-util: build problematic code only in developer modeZbigniew Jędrzejewski-Szmek2023-11-281-1/+2
| | | | | | | | | | | | | | This code doesn't link when gcc+lld is used: $ LDFLAGS=-fuse-ld=lld meson setup build-lld && ninja -C build-lld udevadm ... ld.lld: error: src/shared/libsystemd-shared-255.a(libsystemd-shared-255.a.p/cryptsetup-util.c.o): symbol crypt_token_external_path@@ has undefined version collect2: error: ld returned 1 exit status As a work-around, restrict it to developer mode. Closes https://github.com/systemd/systemd/issues/30218.
* storagetm: expose more useful metadata for nvme block devicesLennart Poettering2023-11-131-0/+11
| | | | | | don't let the devices to be announced just as model "Linux". Let's instead propagate the underlying block device's model. Also do something reasonably smart for the serial and firmware version fields.
* nspawn: allow disabling os-release checkFrantisek Sumsal2023-11-031-0/+4
| | | | | | | | Introduce a new env variable $SYSTEMD_NSPAWN_CHECK_OS_RELEASE, that can be used to disable the os-release check for bootable OS trees. Useful when trying to boot a container with empty /etc/ and bind-mounted /usr/. Resolves: #29185
* firewall: allow selecting firewall backend via env varLennart Poettering2023-11-031-0/+6
|
* crytsetup: allow overriding the token .so library path via an env varLennart Poettering2023-11-021-0/+5
| | | | | | | | | | | | I tried to get something similar upstream: https://gitlab.com/cryptsetup/cryptsetup/-/issues/846 But no luck, it was suggested I use ELF interposition instead. Hence, let's do so (but not via ugly LD_PRELOAD, but simply by overriding the relevant symbol natively in our own code). This makes debugging tokens a ton easier.
* nspawn: allow user-specified MAC address on container sideRaul Cheleguini2023-10-251-0/+6
| | | | | Introduce the environment variable SYSTEMD_NSPAWN_NETWORK_MAC to allow user-specified MAC address on container side.
* man,docs: suffix directories with /Mike Yuan2023-10-211-1/+1
|
* systemctl: automatically softreboot/kexec if set up on rebootLuca Boccassi2023-10-201-0/+7
| | | | | | | | | Automatically softreboot if the nextroot has been set up with an OS tree, or automatically kexec if a kernel has been loaded with kexec --load. Add SYSTEMCTL_SKIP_AUTO_KEXEC and SYSTEMCTL_SKIP_AUTO_SOFT_REBOOT to skip the automated switchover.
* repart: add simple mechanism to override fstype choicesLennart Poettering2023-10-051-0/+3
| | | | | This is very useful for quickly testing things when building DDIs, in particular in the CI, and trivial to add.
* sd-netlink: make the default timeout configurable by environment variableYu Watanabe2023-10-011-1/+4
| | | | | | | | | | | On normal systems, triggering a timeout should be a bug in code or configuration error, so I do not think we should extend the default timeout. Also, we should not introduce a 'first class' configuration option about that. But, making it configurable may be useful for cases such that "an extremely highly utilized system (lots of OOM kills, very high CPU utilization, etc)". Closes #25441.
* pcrphase: rename binary to pcrextendLennart Poettering2023-09-251-1/+1
| | | | | | | | | | | | | | | | | | | The tool initially just measured the boot phase, but was subsequently extended to measure file system and machine IDs, too. At AllSystemsGo there were request to add more, and make the tool generically accessible. Hence, let's rename the binary (but not the pcrphase services), to make clear the tool is not just measureing the boot phase, but a lot of other things too. The tool is located in /usr/lib/ and still relatively new, hence let's just rename the binary and be done with it, while keeping the unit names stable. While we are at it, also move the tool out of src/boot/ and into its own src/pcrextend/ dir, since it's not really doing boot related stuff anymore.
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-30 08:58:49 +0100