man/sysctl.d.5

   1 '\" t
   2 .TH "SYSCTL\&.D" "5" "" "systemd 219" "sysctl.d"
   3 .\" -----------------------------------------------------------------
   4 .\" * Define some portability stuff
   5 .\" -----------------------------------------------------------------
   6 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   7 .\" http://bugs.debian.org/507673
   8 .\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
   9 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  10 .ie \n(.g .ds Aq \(aq
  11 .el       .ds Aq '
  12 .\" -----------------------------------------------------------------
  13 .\" * set default formatting
  14 .\" -----------------------------------------------------------------
  15 .\" disable hyphenation
  16 .nh
  17 .\" disable justification (adjust text to left margin only)
  18 .ad l
  19 .\" -----------------------------------------------------------------
  20 .\" * MAIN CONTENT STARTS HERE *
  21 .\" -----------------------------------------------------------------
  22 .SH "NAME"
  23 sysctl.d \- Configure kernel parameters at boot
  24 .SH "SYNOPSIS"
  25 .PP
  26 /etc/sysctl\&.d/*\&.conf
  27 .PP
  28 /run/sysctl\&.d/*\&.conf
  29 .PP
  30 /usr/lib/sysctl\&.d/*\&.conf
  31 .SH "DESCRIPTION"
  32 .PP
  33 At boot,
  34 \fBsystemd-sysctl.service\fR(8)
  35 reads configuration files from the above directories to configure
  36 \fBsysctl\fR(8)
  37 kernel parameters\&.
  38 .SH "CONFIGURATION FORMAT"
  39 .PP
  40 The configuration files contain a list of variable assignments, separated by newlines\&. Empty lines and lines whose first non\-whitespace character is
  41 "#"
  42 or
  43 ";"
  44 are ignored\&.
  45 .PP
  46 Note that either
  47 "/"
  48 or
  49 "\&."
  50 may be used as separators within sysctl variable names\&. If the first separator is a slash, remaining slashes and dots are left intact\&. If the first separator is a dot, dots and slashes are interchanged\&.
  51 "kernel\&.domainname=foo"
  52 and
  53 "kernel/domainname=foo"
  54 are equivalent and will cause
  55 "foo"
  56 to be written to
  57 /proc/sys/kernel/domainname\&. Either
  58 "net\&.ipv4\&.conf\&.enp3s0/200\&.forwarding"
  59 or
  60 "net/ipv4/conf/enp3s0\&.200/forwarding"
  61 may be used to refer to
  62 /proc/sys/net/ipv4/conf/enp3s0\&.200/forwarding\&.
  63 .PP
  64 The settings configured with
  65 sysctl\&.d
  66 files will be applied early on boot\&. The network interface\-specific options will also be applied individually for each network interface as it shows up in the system\&. (More specifically,
  67 net\&.ipv4\&.conf\&.*,
  68 net\&.ipv6\&.conf\&.*,
  69 net\&.ipv4\&.neigh\&.*
  70 and
  71 net\&.ipv6\&.neigh\&.*)\&.
  72 .PP
  73 Many sysctl parameters only become available when certain kernel modules are loaded\&. Modules are usually loaded on demand, e\&.g\&. when certain hardware is plugged in or network brought up\&. This means that
  74 \fBsystemd-sysctl.service\fR(8)
  75 which runs during early boot will not configure such parameters if they become available after it has run\&. To set such parameters, it is recommended to add an
  76 \fBudev\fR(7)
  77 rule to set those parameters when they become available\&. Alternatively, a slightly simpler and less efficient option is to add the module to
  78 \fBmodules-load.d\fR(5), causing it to be loaded statically before sysctl settings are applied (see example below)\&.
  79 .SH "CONFIGURATION DIRECTORIES AND PRECEDENCE"
  80 .PP
  81 Configuration files are read from directories in
  82 /etc/,
  83 /run/, and
  84 /usr/lib/, in order of precedence\&. Each configuration file in these configuration directories shall be named in the style of
  85 \fIfilename\fR\&.conf\&. Files in
  86 /etc/
  87 override files with the same name in
  88 /run/
  89 and
  90 /usr/lib/\&. Files in
  91 /run/
  92 override files with the same name in
  93 /usr/lib/\&.
  94 .PP
  95 Packages should install their configuration files in
  96 /usr/lib/\&. Files in
  97 /etc/
  98 are reserved for the local administrator, who may use this logic to override the configuration files installed by vendor packages\&. All configuration files are sorted by their filename in lexicographic order, regardless of which of the directories they reside in\&. If multiple files specify the same option, the entry in the file with the lexicographically latest name will take precedence\&. It is recommended to prefix all filenames with a two\-digit number and a dash, to simplify the ordering of the files\&.
  99 .PP
 100 If the administrator wants to disable a configuration file supplied by the vendor, the recommended way is to place a symlink to
 101 /dev/null
 102 in the configuration directory in
 103 /etc/, with the same filename as the vendor configuration file\&.
 104 .SH "EXAMPLES"
 105 .PP
 106 \fBExample\ \&1.\ \&Set kernel YP domain name\fR
 107 .PP
 108 /etc/sysctl\&.d/domain\-name\&.conf:
 109 .sp
 110 .if n \{\
 111 .RS 4
 112 .\}
 113 .nf
 114 kernel\&.domainname=example\&.com
 115 .fi
 116 .if n \{\
 117 .RE
 118 .\}
 119 .PP
 120 \fBExample\ \&2.\ \&Disable packet filter on bridged packets (method one)\fR
 121 .PP
 122 /etc/udev/rules\&.d/99\-bridge\&.rules:
 123 .sp
 124 .if n \{\
 125 .RS 4
 126 .\}
 127 .nf
 128 ACTION=="add", SUBSYSTEM=="module", KERNEL=="bridge", RUN+="/usr/lib/systemd/systemd\-sysctl \-\-prefix=/net/bridge"
 129 .fi
 130 .if n \{\
 131 .RE
 132 .\}
 133 .PP
 134 /etc/sysctl\&.d/bridge\&.conf:
 135 .sp
 136 .if n \{\
 137 .RS 4
 138 .\}
 139 .nf
 140 net\&.bridge\&.bridge\-nf\-call\-ip6tables = 0
 141 net\&.bridge\&.bridge\-nf\-call\-iptables = 0
 142 net\&.bridge\&.bridge\-nf\-call\-arptables = 0
 143 .fi
 144 .if n \{\
 145 .RE
 146 .\}
 147 .PP
 148 \fBExample\ \&3.\ \&Disable packet filter on bridged packets (method two)\fR
 149 .PP
 150 /etc/modules\-load\&.d/bridge\&.conf:
 151 .sp
 152 .if n \{\
 153 .RS 4
 154 .\}
 155 .nf
 156 bridge
 157 .fi
 158 .if n \{\
 159 .RE
 160 .\}
 161 .PP
 162 /etc/sysctl\&.d/bridge\&.conf:
 163 .sp
 164 .if n \{\
 165 .RS 4
 166 .\}
 167 .nf
 168 net\&.bridge\&.bridge\-nf\-call\-ip6tables = 0
 169 net\&.bridge\&.bridge\-nf\-call\-iptables = 0
 170 net\&.bridge\&.bridge\-nf\-call\-arptables = 0
 171 .fi
 172 .if n \{\
 173 .RE
 174 .\}
 175 .SH "SEE ALSO"
 176 .PP
 177 \fBsystemd\fR(1),
 178 \fBsystemd-sysctl.service\fR(8),
 179 \fBsystemd-delta\fR(1),
 180 \fBsysctl\fR(8),
 181 \fBsysctl.conf\fR(5),
 182 \fBmodprobe\fR(8)