view release on metacpan or  search on metacpan

lib/Config/Model/models/Systemd/Common/Exec.pl  view on Meta::CPAN

C<ProtectHome=read-only> are implied, thus prohibiting the service to write to
arbitrary file system locations. In order to allow the service to write to certain directories, they
have to be allow-listed using C<ReadWritePaths>, but care must be taken so that
UID/GID recycling does not create security issues involving files created by the service. Use
C<RuntimeDirectory> (see below) in order to assign a writable runtime directory to a
service, owned by the dynamic user/group and removed automatically when the unit is terminated. Use
C<StateDirectory>, C<CacheDirectory> and
C<LogsDirectory> in order to assign a set of writable directories for specific
purposes to the service in a way that they are protected from vulnerabilities due to UID reuse (see
below). If this option is enabled, care should be taken that the unit's processes do not get access
to directories outside of these explicitly configured and managed ones. Specifically, do not use
C<BindPaths> and be careful with C<AF_UNIX> file descriptor
passing for directory file descriptors, as this would permit processes to create files or directories
owned by the dynamic user/group that are not subject to the lifecycle and access guarantees of the
service. Note that this option is currently incompatible with D-Bus policies, thus a service using
this option may currently not allocate a D-Bus service name (note that this does not affect calling
into other D-Bus services). Defaults to off.",
      'Environment' => "Sets environment variables for executed processes. Each line is unquoted using the
rules described in \"Quoting\" section in
L<systemd.syntax(7)>
and becomes a list of variable assignments. If you need to assign a value containing spaces or the
equals sign to a variable, put quotes around the whole assignment. Variable expansion is not
performed inside the strings and the C<\$> character has no special meaning. Specifier
expansion is performed, see the \"Specifiers\" section in
L<systemd.unit(5)>.

This option may be specified more than once, in which case all listed variables will be set. If
the same variable is listed twice, the later setting will override the earlier setting. If the empty
string is assigned to this option, the list of environment variables is reset, all prior assignments
have no effect.

The names of the variables can contain ASCII letters, digits, and the underscore character.
Variable names cannot be empty or start with a digit. In variable values, most characters are
allowed, but non-printable characters are currently rejected.

Example:

    Environment=\"VAR1=word1 word2\" VAR2=word3 \"VAR3=\$word 5 6\"

gives three variables C<VAR1>,
C<VAR2>, C<VAR3>
with the values C<word1 word2>,
C<word3>, C<\$word 5 6>.

See L<environ(7)> for
details about environment variables.

Note that environment variables are not suitable for passing secrets (such as passwords, key
material, \x{2026})  to service processes. Environment variables set for a unit are exposed to unprivileged
clients via D-Bus IPC, and generally not understood as being data that requires protection. Moreover,
environment variables are propagated down the process tree, including across security boundaries
(such as setuid/setgid executables), and hence might leak to processes that should not have access to
the secret data. Use C<LoadCredential>, C<LoadCredentialEncrypted>
or C<SetCredentialEncrypted> (see below) to pass data to unit processes
securely.",
      'EnvironmentFile' => 'Similar to C<Environment>, but reads the environment variables from
a text file. The text file should contain newline-separated variable assignments. Empty lines, lines
without an C<=> separator, or lines starting with C<;> or
C<#> will be ignored, which may be used for commenting. The file must be encoded with
UTF-8. Valid characters are
L<unicode scalar values|https://www.unicode.org/glossary/#unicode_scalar_value>
other than
L<unicode noncharacters|https://www.unicode.org/glossary/#noncharacter>,
C<U+0000> C<NUL>, and C<U+FEFF>L<unicode byte order mark|https://www.unicode.org/glossary/#byte_order_mark>.
Control codes other than C<NUL> are allowed.

In the file, an unquoted value after the C<=> is parsed with the same backslash-escape
rules as L<POSIX shell unquoted
text|https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_02_01>, but unlike in a shell,
interior whitespace is preserved and quotes after the
first non-whitespace character are preserved. Leading and trailing whitespace (space, tab, carriage return) is
discarded, but interior whitespace within the line is preserved verbatim. A line ending with a backslash will be
continued to the following one, with the newline itself discarded. A backslash
C<\\> followed by any character other than newline will preserve the following character, so that
C<\\\\> will become the value C<\\>.

In the file, a C<\'>-quoted value after the C<=> can span
multiple lines and contain any character verbatim other than single quote, like L<POSIX
shell single-quoted text|https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_02_02>. No
backslash-escape sequences are recognized. Leading and trailing
whitespace outside of the single quotes is discarded.

In the file, a C<">-quoted value after the C<=> can span
multiple lines, and the same escape sequences are recognized as in L<POSIX
shell double-quoted text|https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_02_03>.
Backslash (C<\\>) followed by any of
C<"\\`$> will preserve that character. A backslash followed by newline is a line
continuation, and the newline itself is discarded. A backslash followed by any other character is
ignored; both the backslash and the following character are preserved verbatim. Leading and trailing
whitespace outside of the double quotes is discarded.

The argument passed should be an absolute filename or wildcard expression. If the file does not
exist, cannot be read, or contains invalid content, the service will fail to start. To make the file
optional, prefix the path with C<->, which causes all errors related to the file to be
silently ignored. This option may be specified more than once in which case all specified files are read.
If the empty string is assigned to this option, the list of files to read is reset, all prior assignments
have no effect.

Note that shell variables such as C<$HOME> are not expanded in this path.
Use C<%>-specifiers instead; for example, C<%h> expands to the
user\'s home directory.

The files listed with this directive will be read shortly before the process is executed (more
specifically, after all processes from a previous unit state terminated. This means you can generate these
files in one unit state, and read it with this option in the next. The files are read from the file
system of the service manager, before any file system changes like bind mounts take place).

Settings from these files override settings made with C<Environment>. If the same
variable is set twice from these files, the files will be read in the order they are specified and the later
setting will override the earlier setting.',
      'ExecPaths' => 'Sets up a new file system namespace for executed processes. These options may be used
to limit access a process has to the file system. Each setting takes a space-separated list of paths
relative to the host\'s root directory (i.e. the system running the service manager). Note that if
paths contain symlinks, they are resolved relative to the root directory set with
C<RootDirectory>/C<RootImage>.

Paths listed in C<ReadWritePaths> are accessible from within the namespace
with the same access modes as from outside of it. Paths listed in C<ReadOnlyPaths>
are accessible for reading only, writing will be refused even if the usual file access controls would
permit this. Nest C<ReadWritePaths> inside of C<ReadOnlyPaths> in
order to provide writable subdirectories within read-only directories. Use
C<ReadWritePaths> in order to allow-list specific paths for write access if
C<ProtectSystem=strict> is used. Note that C<ReadWritePaths> cannot
be used to gain write access to a file system whose superblock is mounted read-only. On Linux, for