man/sysctl.d.html

   1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>sysctl.d</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><style>
   2     a.headerlink {
   3       color: #c60f0f;
   4       font-size: 0.8em;
   5       padding: 0 4px 0 4px;
   6       text-decoration: none;
   7       visibility: hidden;
   8     }
   9
  10     a.headerlink:hover {
  11       background-color: #c60f0f;
  12       color: white;
  13     }
  14
  15     h1:hover > a.headerlink, h2:hover > a.headerlink, h3:hover > a.headerlink, dt:hover > a.headerlink {
  16       visibility: visible;
  17     }
  18   </style><a href="index.html">Index </a>·
  19   <a href="systemd.directives.html">Directives </a>·
  20   <a href="../python-systemd/index.html">Python </a>·
  21
  22   <span style="float:right">systemd 221</span><hr><div class="refentry"><a name="sysctl.d"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>sysctl.d — Configure kernel parameters at boot</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><p><code class="filename">/etc/sysctl.d/*.conf</code></p><p><code class="filename">/run/sysctl.d/*.conf</code></p><p><code class="filename">/usr/lib/sysctl.d/*.conf</code></p></div><div class="refsect1"><a name="idm47042537340832"></a><h2 id="Description">Description<a class="headerlink" title="Permalink to this headline" href="#Description">¶</a></h2><p>At boot,
  23     <a href="systemd-sysctl.service.html"><span class="citerefentry"><span class="refentrytitle">systemd-sysctl.service</span>(8)</span></a>
  24     reads configuration files from the above directories to configure
  25     <a href="http://man7.org/linux/man-pages/man8/sysctl.8.html"><span class="citerefentry"><span class="refentrytitle">sysctl</span>(8)</span></a>
  26     kernel parameters.</p></div><div class="refsect1"><a name="idm47042535924096"></a><h2 id="Configuration Format">Configuration Format<a class="headerlink" title="Permalink to this headline" href="#Configuration%20Format">¶</a></h2><p>The configuration files contain a list of variable
  27     assignments, separated by newlines. Empty lines and lines whose
  28     first non-whitespace character is "<code class="literal">#</code>" or
  29     "<code class="literal">;</code>" are ignored.</p><p>Note that either "<code class="literal">/</code>" or
  30     "<code class="literal">.</code>" may be used as separators within sysctl
  31     variable names. If the first separator is a slash, remaining
  32     slashes and dots are left intact. If the first separator is a dot,
  33     dots and slashes are interchanged.
  34     "<code class="literal">kernel.domainname=foo</code>" and
  35     "<code class="literal">kernel/domainname=foo</code>" are equivalent and will
  36     cause "<code class="literal">foo</code>" to be written to
  37     <code class="filename">/proc/sys/kernel/domainname</code>. Either
  38     "<code class="literal">net.ipv4.conf.enp3s0/200.forwarding</code>" or
  39     "<code class="literal">net/ipv4/conf/enp3s0.200/forwarding</code>" may be used
  40     to refer to
  41     <code class="filename">/proc/sys/net/ipv4/conf/enp3s0.200/forwarding</code>.
  42     </p><p>The settings configured with <code class="filename">sysctl.d</code>
  43     files will be applied early on boot. The network
  44     interface-specific options will also be applied individually for
  45     each network interface as it shows up in the system. (More
  46     specifically, <code class="filename">net.ipv4.conf.*</code>,
  47     <code class="filename">net.ipv6.conf.*</code>,
  48     <code class="filename">net.ipv4.neigh.*</code> and
  49     <code class="filename">net.ipv6.neigh.*</code>).</p><p>Many sysctl parameters only become available when certain
  50     kernel modules are loaded. Modules are usually loaded on demand,
  51     e.g. when certain hardware is plugged in or network brought up.
  52     This means that
  53     <a href="systemd-sysctl.service.html"><span class="citerefentry"><span class="refentrytitle">systemd-sysctl.service</span>(8)</span></a>
  54     which runs during early boot will not configure such parameters if
  55     they become available after it has run. To set such parameters, it
  56     is recommended to add an
  57     <a href="udev.html"><span class="citerefentry"><span class="refentrytitle">udev</span>(7)</span></a>
  58     rule to set those parameters when they become available.
  59     Alternatively, a slightly simpler and less efficient option is to
  60     add the module to
  61     <a href="modules-load.d.html"><span class="citerefentry"><span class="refentrytitle">modules-load.d</span>(5)</span></a>,
  62     causing it to be loaded statically before sysctl settings are
  63     applied (see example below).</p></div><div class="refsection"><a name="confd"></a><h2>Configuration Directories and Precedence</h2><p>Configuration files are read from directories in
  64     <code class="filename">/etc/</code>, <code class="filename">/run/</code>, and
  65     <code class="filename">/usr/lib/</code>, in order of precedence.
  66     Each configuration file in these configuration directories shall be named in
  67     the style of <code class="filename"><em class="replaceable"><code>filename</code></em>.conf</code>.
  68     Files in <code class="filename">/etc/</code> override files with the same name in
  69     <code class="filename">/run/</code> and <code class="filename">/usr/lib/</code>. Files in
  70     <code class="filename">/run/</code> override files with the same name in
  71     <code class="filename">/usr/lib/</code>.</p><p>Packages should install their configuration files in
  72     <code class="filename">/usr/lib/</code>. Files in <code class="filename">/etc/</code> are
  73     reserved for the local administrator, who may use this logic to override the
  74     configuration files installed by vendor packages. All configuration files
  75     are sorted by their filename in lexicographic order, regardless of which of
  76     the directories they reside in. If multiple files specify the same option,
  77     the entry in the file with the lexicographically latest name will take
  78     precedence. It is recommended to prefix all filenames with a two-digit number
  79     and a dash, to simplify the ordering of the files.</p><p>If the administrator wants to disable a configuration file supplied by
  80     the vendor, the recommended way is to place a symlink to
  81     <code class="filename">/dev/null</code> in the configuration directory in
  82     <code class="filename">/etc/</code>, with the same filename as the vendor
  83     configuration file.</p></div><div class="refsect1"><a name="idm47042535120592"></a><h2 id="Examples">Examples<a class="headerlink" title="Permalink to this headline" href="#Examples">¶</a></h2><div class="example"><a name="idm47042535119952"></a><p class="title"><b>Example 1. Set kernel YP domain name</b></p><div class="example-contents"><p><code class="filename">/etc/sysctl.d/domain-name.conf</code>:
  84       </p><pre class="programlisting">kernel.domainname=example.com</pre></div></div><br class="example-break"><div class="example"><a name="idm47042535117680"></a><p class="title"><b>Example 2. Disable packet filter on bridged packets (method one)</b></p><div class="example-contents"><p><code class="filename">/etc/udev/rules.d/99-bridge.rules</code>:
  85       </p><pre class="programlisting">ACTION=="add", SUBSYSTEM=="module", KERNEL=="bridge", RUN+="/usr/lib/systemd/systemd-sysctl --prefix=/net/bridge"
  86 </pre><p><code class="filename">/etc/sysctl.d/bridge.conf</code>:
  87       </p><pre class="programlisting">net.bridge.bridge-nf-call-ip6tables = 0
  88 net.bridge.bridge-nf-call-iptables = 0
  89 net.bridge.bridge-nf-call-arptables = 0
  90 </pre></div></div><br class="example-break"><div class="example"><a name="idm47042535113648"></a><p class="title"><b>Example 3. Disable packet filter on bridged packets (method two)</b></p><div class="example-contents"><p><code class="filename">/etc/modules-load.d/bridge.conf</code>:
  91       </p><pre class="programlisting">bridge</pre><p><code class="filename">/etc/sysctl.d/bridge.conf</code>:
  92       </p><pre class="programlisting">net.bridge.bridge-nf-call-ip6tables = 0
  93 net.bridge.bridge-nf-call-iptables = 0
  94 net.bridge.bridge-nf-call-arptables = 0
  95 </pre></div></div><br class="example-break"></div><div class="refsect1"><a name="idm47042535109616"></a><h2 id="See Also">See Also<a class="headerlink" title="Permalink to this headline" href="#See%20Also">¶</a></h2><p>
  96       <a href="systemd.html"><span class="citerefentry"><span class="refentrytitle">systemd</span>(1)</span></a>,
  97       <a href="systemd-sysctl.service.html"><span class="citerefentry"><span class="refentrytitle">systemd-sysctl.service</span>(8)</span></a>,
  98       <a href="systemd-delta.html"><span class="citerefentry"><span class="refentrytitle">systemd-delta</span>(1)</span></a>,
  99       <a href="http://man7.org/linux/man-pages/man8/sysctl.8.html"><span class="citerefentry"><span class="refentrytitle">sysctl</span>(8)</span></a>,
 100       <a href="http://man7.org/linux/man-pages/man5/sysctl.conf.5.html"><span class="citerefentry"><span class="refentrytitle">sysctl.conf</span>(5)</span></a>,
 101       <a href="http://man7.org/linux/man-pages/man8/modprobe.8.html"><span class="citerefentry"><span class="refentrytitle">modprobe</span>(8)</span></a>
 102     </p></div></div></body></html>