man/systemd.socket.html

   1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>systemd.socket</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><style>
   2     a.headerlink {
   3       color: #c60f0f;
   4       font-size: 0.8em;
   5       padding: 0 4px 0 4px;
   6       text-decoration: none;
   7       visibility: hidden;
   8     }
   9
  10     a.headerlink:hover {
  11       background-color: #c60f0f;
  12       color: white;
  13     }
  14
  15     h1:hover > a.headerlink, h2:hover > a.headerlink, h3:hover > a.headerlink, dt:hover > a.headerlink {
  16       visibility: visible;
  17     }
  18   </style><a href="index.html">Index </a>·
  19   <a href="systemd.directives.html">Directives </a>·
  20   <a href="../python-systemd/index.html">Python </a>·
  21   <a href="../libudev/index.html">libudev </a>·
  22   <a href="../libudev/index.html">gudev </a><span style="float:right">systemd 220</span><hr><div class="refentry"><a name="systemd.socket"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>systemd.socket — Socket unit configuration</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><p><code class="filename"><em class="replaceable"><code>socket</code></em>.socket</code></p></div><div class="refsect1"><a name="idm139681112171616"></a><h2 id="Description">Description<a class="headerlink" title="Permalink to this headline" href="#Description">¶</a></h2><p>A unit configuration file whose name ends in
  23     "<code class="literal">.socket</code>" encodes information about an IPC or
  24     network socket or a file system FIFO controlled and supervised by
  25     systemd, for socket-based activation.</p><p>This man page lists the configuration options specific to
  26     this unit type. See
  27     <a href="systemd.unit.html"><span class="citerefentry"><span class="refentrytitle">systemd.unit</span>(5)</span></a>
  28     for the common options of all unit configuration files. The common
  29     configuration items are configured in the generic [Unit] and
  30     [Install] sections. The socket specific configuration options are
  31     configured in the [Socket] section.</p><p>Additional options are listed in
  32     <a href="systemd.exec.html"><span class="citerefentry"><span class="refentrytitle">systemd.exec</span>(5)</span></a>,
  33     which define the execution environment the
  34     <code class="option">ExecStartPre=</code>, <code class="option">ExecStartPost=</code>,
  35     <code class="option">ExecStopPre=</code> and <code class="option">ExecStopPost=</code>
  36     commands are executed in, and in
  37     <a href="systemd.kill.html"><span class="citerefentry"><span class="refentrytitle">systemd.kill</span>(5)</span></a>,
  38     which define the way the processes are terminated, and in
  39     <a href="systemd.resource-control.html"><span class="citerefentry"><span class="refentrytitle">systemd.resource-control</span>(5)</span></a>,
  40     which configure resource control settings for the processes of the
  41     socket.</p><p>For each socket file, a matching service file must exist,
  42     describing the service to start on incoming traffic on the socket
  43     (see
  44     <a href="systemd.service.html"><span class="citerefentry"><span class="refentrytitle">systemd.service</span>(5)</span></a>
  45     for more information about .service files). The name of the
  46     .service unit is by default the same as the name of the .socket
  47     unit, but can be altered with the <code class="option">Service=</code> option
  48     described below. Depending on the setting of the
  49     <code class="option">Accept=</code> option described below, this .service
  50     unit must either be named like the .socket unit, but with the
  51     suffix replaced, unless overridden with <code class="option">Service=</code>;
  52     or it must be a template unit named the same way. Example: a
  53     socket file <code class="filename">foo.socket</code> needs a matching
  54     service <code class="filename">foo.service</code> if
  55     <code class="option">Accept=false</code> is set. If
  56     <code class="option">Accept=true</code> is set, a service template file
  57     <code class="filename">foo@.service</code> must exist from which services
  58     are instantiated for each incoming connection.</p><p>Unless <code class="varname">DefaultDependencies=</code> is set to
  59     <code class="option">false</code>, socket units will implicitly have
  60     dependencies of type <code class="varname">Requires=</code> and
  61     <code class="varname">After=</code> on <code class="filename">sysinit.target</code>
  62     as well as dependencies of type <code class="varname">Conflicts=</code> and
  63     <code class="varname">Before=</code> on
  64     <code class="filename">shutdown.target</code>. These ensure that socket
  65     units pull in basic system initialization, and are terminated
  66     cleanly prior to system shutdown. Only sockets involved with early
  67     boot or late system shutdown should disable this option.</p><p>Socket units will have a <code class="varname">Before=</code>
  68     dependency on the service which they trigger added implicitly. No
  69     implicit <code class="varname">WantedBy=</code> or
  70     <code class="varname">RequiredBy=</code> dependency from the socket to the
  71     service is added. This means that the service may be started
  72     without the socket, in which case it must be able to open sockets
  73     by itself. To prevent this, an explicit
  74     <code class="varname">Requires=</code> dependency may be added.</p><p>Socket units may be used to implement on-demand starting of
  75     services, as well as parallelized starting of services. See the
  76     blog stories linked at the end for an introduction.</p><p>Note that the daemon software configured for socket
  77     activation with socket units needs to be able to accept sockets
  78     from systemd, either via systemd's native socket passing interface
  79     (see
  80     <a href="sd_listen_fds.html"><span class="citerefentry"><span class="refentrytitle">sd_listen_fds</span>(3)</span></a>
  81     for details) or via the traditional
  82     <a href="https://www.freebsd.org/cgi/man.cgi?inetd(8)"><span class="citerefentry"><span class="refentrytitle">inetd</span>(8)</span></a>-style
  83     socket passing (i.e. sockets passed in via standard input and
  84     output, using <code class="varname">StandardInput=socket</code> in the
  85     service file).</p></div><div class="refsect1"><a name="idm139681107248864"></a><h2 id="Options">Options<a class="headerlink" title="Permalink to this headline" href="#Options">¶</a></h2><p>Socket files must include a [Socket] section, which carries
  86     information about the socket or FIFO it supervises. A number of
  87     options that may be used in this section are shared with other
  88     unit types. These options are documented in
  89     <a href="systemd.exec.html"><span class="citerefentry"><span class="refentrytitle">systemd.exec</span>(5)</span></a>
  90     and
  91     <a href="systemd.kill.html"><span class="citerefentry"><span class="refentrytitle">systemd.kill</span>(5)</span></a>.
  92     The options specific to the [Socket] section of socket units are
  93     the following:</p><div class="variablelist"><dl class="variablelist"><dt id="ListenStream="><span class="term"><code class="varname">ListenStream=</code>, </span><span class="term"><code class="varname">ListenDatagram=</code>, </span><span class="term"><code class="varname">ListenSequentialPacket=</code></span><a class="headerlink" title="Permalink to this term" href="#ListenStream=">¶</a></dt><dd><p>Specifies an address to listen on for a stream
  94         (<code class="constant">SOCK_STREAM</code>), datagram
  95         (<code class="constant">SOCK_DGRAM</code>), or sequential packet
  96         (<code class="constant">SOCK_SEQPACKET</code>) socket, respectively.
  97         The address can be written in various formats:</p><p>If the address starts with a slash
  98         ("<code class="literal">/</code>"), it is read as file system socket in
  99         the <code class="constant">AF_UNIX</code> socket family.</p><p>If the address starts with an at symbol
 100         ("<code class="literal">@</code>"), it is read as abstract namespace
 101         socket in the <code class="constant">AF_UNIX</code> family. The
 102         "<code class="literal">@</code>" is replaced with a
 103         <code class="constant">NUL</code> character before binding. For
 104         details, see
 105         <a href="http://man7.org/linux/man-pages/man7/unix.7.html"><span class="citerefentry"><span class="refentrytitle">unix</span>(7)</span></a>.</p><p>If the address string is a single number, it is read as
 106         port number to listen on via IPv6. Depending on the value of
 107         <code class="varname">BindIPv6Only=</code> (see below) this might result
 108         in the service being available via both IPv6 and IPv4
 109         (default) or just via IPv6.
 110         </p><p>If the address string is a string in the format
 111         v.w.x.y:z, it is read as IPv4 specifier for listening on an
 112         address v.w.x.y on a port z.</p><p>If the address string is a string in the format [x]:y,
 113         it is read as IPv6 address x on a port y. Note that this might
 114         make the service available via IPv4, too, depending on the
 115         <code class="varname">BindIPv6Only=</code> setting (see below).
 116         </p><p>Note that <code class="constant">SOCK_SEQPACKET</code> (i.e.
 117         <code class="varname">ListenSequentialPacket=</code>) is only available
 118         for <code class="constant">AF_UNIX</code> sockets.
 119         <code class="constant">SOCK_STREAM</code> (i.e.
 120         <code class="varname">ListenStream=</code>) when used for IP sockets
 121         refers to TCP sockets, <code class="constant">SOCK_DGRAM</code> (i.e.
 122         <code class="varname">ListenDatagram=</code>) to UDP.</p><p>These options may be specified more than once in which
 123         case incoming traffic on any of the sockets will trigger
 124         service activation, and all listed sockets will be passed to
 125         the service, regardless of whether there is incoming traffic
 126         on them or not. If the empty string is assigned to any of
 127         these options, the list of addresses to listen on is reset,
 128         all prior uses of any of these options will have no
 129         effect.</p><p>It is also possible to have more than one socket unit
 130         for the same service when using <code class="varname">Service=</code>,
 131         and the service will receive all the sockets configured in all
 132         the socket units. Sockets configured in one unit are passed in
 133         the order of configuration, but no ordering between socket
 134         units is specified.</p><p>If an IP address is used here, it is often desirable to
 135         listen on it before the interface it is configured on is up
 136         and running, and even regardless of whether it will be up and
 137         running at any point. To deal with this, it is recommended to
 138         set the <code class="varname">FreeBind=</code> option described
 139         below.</p></dd><dt id="ListenFIFO="><span class="term"><code class="varname">ListenFIFO=</code></span><a class="headerlink" title="Permalink to this term" href="#ListenFIFO=">¶</a></dt><dd><p>Specifies a file system FIFO to listen on.
 140         This expects an absolute file system path as argument.
 141         Behavior otherwise is very similar to the
 142         <code class="varname">ListenDatagram=</code> directive
 143         above.</p></dd><dt id="ListenSpecial="><span class="term"><code class="varname">ListenSpecial=</code></span><a class="headerlink" title="Permalink to this term" href="#ListenSpecial=">¶</a></dt><dd><p>Specifies a special file in the file system to
 144         listen on. This expects an absolute file system path as
 145         argument. Behavior otherwise is very similar to the
 146         <code class="varname">ListenFIFO=</code> directive above. Use this to
 147         open character device nodes as well as special files in
 148         <code class="filename">/proc</code> and
 149         <code class="filename">/sys</code>.</p></dd><dt id="ListenNetlink="><span class="term"><code class="varname">ListenNetlink=</code></span><a class="headerlink" title="Permalink to this term" href="#ListenNetlink=">¶</a></dt><dd><p>Specifies a Netlink family to create a socket
 150         for to listen on. This expects a short string referring to the
 151         <code class="constant">AF_NETLINK</code> family name (such as
 152         <code class="varname">audit</code> or <code class="varname">kobject-uevent</code>)
 153         as argument, optionally suffixed by a whitespace followed by a
 154         multicast group integer. Behavior otherwise is very similar to
 155         the <code class="varname">ListenDatagram=</code> directive
 156         above.</p></dd><dt id="ListenMessageQueue="><span class="term"><code class="varname">ListenMessageQueue=</code></span><a class="headerlink" title="Permalink to this term" href="#ListenMessageQueue=">¶</a></dt><dd><p>Specifies a POSIX message queue name to listen
 157         on. This expects a valid message queue name (i.e. beginning
 158         with /). Behavior otherwise is very similar to the
 159         <code class="varname">ListenFIFO=</code> directive above. On Linux
 160         message queue descriptors are actually file descriptors and
 161         can be inherited between processes.</p></dd><dt id="BindIPv6Only="><span class="term"><code class="varname">BindIPv6Only=</code></span><a class="headerlink" title="Permalink to this term" href="#BindIPv6Only=">¶</a></dt><dd><p>Takes a one of <code class="option">default</code>,
 162         <code class="option">both</code> or <code class="option">ipv6-only</code>. Controls
 163         the IPV6_V6ONLY socket option (see
 164         <a href="http://linux.die.net/man/7/ipv6"><span class="citerefentry"><span class="refentrytitle">ipv6</span>(7)</span></a>
 165         for details). If <code class="option">both</code>, IPv6 sockets bound
 166         will be accessible via both IPv4 and IPv6. If
 167         <code class="option">ipv6-only</code>, they will be accessible via IPv6
 168         only. If <code class="option">default</code> (which is the default,
 169         surprise!), the system wide default setting is used, as
 170         controlled by
 171         <code class="filename">/proc/sys/net/ipv6/bindv6only</code>, which in
 172         turn defaults to the equivalent of
 173         <code class="option">both</code>.</p></dd><dt id="Backlog="><span class="term"><code class="varname">Backlog=</code></span><a class="headerlink" title="Permalink to this term" href="#Backlog=">¶</a></dt><dd><p>Takes an unsigned integer argument. Specifies
 174         the number of connections to queue that have not been accepted
 175         yet. This setting matters only for stream and sequential
 176         packet sockets. See
 177         <a href="http://man7.org/linux/man-pages/man2/listen.2.html"><span class="citerefentry"><span class="refentrytitle">listen</span>(2)</span></a>
 178         for details. Defaults to SOMAXCONN (128).</p></dd><dt id="BindToDevice="><span class="term"><code class="varname">BindToDevice=</code></span><a class="headerlink" title="Permalink to this term" href="#BindToDevice=">¶</a></dt><dd><p>Specifies a network interface name to bind
 179         this socket to. If set, traffic will only be accepted from the
 180         specified network interfaces. This controls the
 181         SO_BINDTODEVICE socket option (see
 182         <a href="http://man7.org/linux/man-pages/man7/socket.7.html"><span class="citerefentry"><span class="refentrytitle">socket</span>(7)</span></a>
 183         for details). If this option is used, an automatic dependency
 184         from this socket unit on the network interface device unit
 185         (<a href="systemd.device.html"><span class="citerefentry"><span class="refentrytitle">systemd.device</span>(5)</span></a>
 186         is created.</p></dd><dt id="SocketUser="><span class="term"><code class="varname">SocketUser=</code>, </span><span class="term"><code class="varname">SocketGroup=</code></span><a class="headerlink" title="Permalink to this term" href="#SocketUser=">¶</a></dt><dd><p>Takes a UNIX user/group name. When specified,
 187         all AF_UNIX sockets and FIFO nodes in the file system are
 188         owned by the specified user and group. If unset (the default),
 189         the nodes are owned by the root user/group (if run in system
 190         context) or the invoking user/group (if run in user context).
 191         If only a user is specified but no group, then the group is
 192         derived from the user's default group.</p></dd><dt id="SocketMode="><span class="term"><code class="varname">SocketMode=</code></span><a class="headerlink" title="Permalink to this term" href="#SocketMode=">¶</a></dt><dd><p>If listening on a file system socket or FIFO,
 193         this option specifies the file system access mode used when
 194         creating the file node. Takes an access mode in octal
 195         notation. Defaults to 0666.</p></dd><dt id="DirectoryMode="><span class="term"><code class="varname">DirectoryMode=</code></span><a class="headerlink" title="Permalink to this term" href="#DirectoryMode=">¶</a></dt><dd><p>If listening on a file system socket or FIFO,
 196         the parent directories are automatically created if needed.
 197         This option specifies the file system access mode used when
 198         creating these directories. Takes an access mode in octal
 199         notation. Defaults to 0755.</p></dd><dt id="Accept="><span class="term"><code class="varname">Accept=</code></span><a class="headerlink" title="Permalink to this term" href="#Accept=">¶</a></dt><dd><p>Takes a boolean argument. If true, a service
 200         instance is spawned for each incoming connection and only the
 201         connection socket is passed to it. If false, all listening
 202         sockets themselves are passed to the started service unit, and
 203         only one service unit is spawned for all connections (also see
 204         above). This value is ignored for datagram sockets and FIFOs
 205         where a single service unit unconditionally handles all
 206         incoming traffic. Defaults to <code class="option">false</code>. For
 207         performance reasons, it is recommended to write new daemons
 208         only in a way that is suitable for
 209         <code class="option">Accept=false</code>. A daemon listening on an
 210         <code class="constant">AF_UNIX</code> socket may, but does not need to,
 211         call
 212         <a href="http://man7.org/linux/man-pages/man2/close.2.html"><span class="citerefentry"><span class="refentrytitle">close</span>(2)</span></a>
 213         on the received socket before exiting. However, it must not
 214         unlink the socket from a file system. It should not invoke
 215         <a href="http://man7.org/linux/man-pages/man2/shutdown.2.html"><span class="citerefentry"><span class="refentrytitle">shutdown</span>(2)</span></a>
 216         on sockets it got with <code class="varname">Accept=false</code>, but it
 217         may do so for sockets it got with
 218         <code class="varname">Accept=true</code> set. Setting
 219         <code class="varname">Accept=true</code> is mostly useful to allow
 220         daemons designed for usage with
 221         <a href="https://www.freebsd.org/cgi/man.cgi?inetd(8)"><span class="citerefentry"><span class="refentrytitle">inetd</span>(8)</span></a>
 222         to work unmodified with systemd socket
 223         activation.</p><p>For IPv4 and IPv6 connections the <code class="varname">REMOTE_ADDR</code>
 224         environment variable will contain the remote IP, and <code class="varname">REMOTE_PORT</code>
 225         will contain the remote port. This is the same as the format used by CGI.
 226         For SOCK_RAW the port is the IP protocol.</p></dd><dt id="MaxConnections="><span class="term"><code class="varname">MaxConnections=</code></span><a class="headerlink" title="Permalink to this term" href="#MaxConnections=">¶</a></dt><dd><p>The maximum number of connections to
 227         simultaneously run services instances for, when
 228         <code class="option">Accept=true</code> is set. If more concurrent
 229         connections are coming in, they will be refused until at least
 230         one existing connection is terminated. This setting has no
 231         effect on sockets configured with
 232         <code class="option">Accept=false</code> or datagram sockets. Defaults to
 233         64.</p></dd><dt id="KeepAlive="><span class="term"><code class="varname">KeepAlive=</code></span><a class="headerlink" title="Permalink to this term" href="#KeepAlive=">¶</a></dt><dd><p>Takes a boolean argument. If true, the TCP/IP
 234         stack will send a keep alive message after 2h (depending on
 235         the configuration of
 236         <code class="filename">/proc/sys/net/ipv4/tcp_keepalive_time</code>)
 237         for all TCP streams accepted on this socket. This controls the
 238         SO_KEEPALIVE socket option (see
 239         <a href="http://man7.org/linux/man-pages/man7/socket.7.html"><span class="citerefentry"><span class="refentrytitle">socket</span>(7)</span></a>
 240         and the <a class="ulink" href="http://www.tldp.org/HOWTO/html_single/TCP-Keepalive-HOWTO/" target="_top">TCP
 241         Keepalive HOWTO</a> for details.) Defaults to
 242         <code class="option">false</code>.</p></dd><dt id="KeepAliveTimeSec="><span class="term"><code class="varname">KeepAliveTimeSec=</code></span><a class="headerlink" title="Permalink to this term" href="#KeepAliveTimeSec=">¶</a></dt><dd><p>Takes time (in seconds) as argument . The connection needs to remain
 243         idle before TCP starts sending keepalive probes. This controls the TCP_KEEPIDLE
 244         socket option (see
 245         <a href="http://man7.org/linux/man-pages/man7/socket.7.html"><span class="citerefentry"><span class="refentrytitle">socket</span>(7)</span></a>
 246         and the <a class="ulink" href="http://www.tldp.org/HOWTO/html_single/TCP-Keepalive-HOWTO/" target="_top">TCP
 247         Keepalive HOWTO</a> for details.)
 248         Defaults value is 7200 seconds (2 hours).</p></dd><dt id="KeepAliveIntervalSec="><span class="term"><code class="varname">KeepAliveIntervalSec=</code></span><a class="headerlink" title="Permalink to this term" href="#KeepAliveIntervalSec=">¶</a></dt><dd><p>Takes time (in seconds) as argument between
 249         individual keepalive probes, if the socket option SO_KEEPALIVE
 250         has been set on this socket seconds as argument. This controls
 251         the TCP_KEEPINTVL socket option (see
 252         <a href="http://man7.org/linux/man-pages/man7/socket.7.html"><span class="citerefentry"><span class="refentrytitle">socket</span>(7)</span></a>
 253         and the <a class="ulink" href="http://www.tldp.org/HOWTO/html_single/TCP-Keepalive-HOWTO/" target="_top">TCP
 254         Keepalive HOWTO</a> for details.) Defaults value is 75
 255         seconds.</p></dd><dt id="KeepAliveProbes="><span class="term"><code class="varname">KeepAliveProbes=</code></span><a class="headerlink" title="Permalink to this term" href="#KeepAliveProbes=">¶</a></dt><dd><p>Takes integer as argument. It's the number of
 256         unacknowledged probes to send before considering the
 257         connection dead and notifying the application layer. This
 258         controls the TCP_KEEPCNT socket option (see
 259         <a href="http://man7.org/linux/man-pages/man7/socket.7.html"><span class="citerefentry"><span class="refentrytitle">socket</span>(7)</span></a>
 260         and the <a class="ulink" href="http://www.tldp.org/HOWTO/html_single/TCP-Keepalive-HOWTO/" target="_top">TCP
 261         Keepalive HOWTO</a> for details.) Defaults value is
 262         9.</p></dd><dt id="NoDelay="><span class="term"><code class="varname">NoDelay=</code></span><a class="headerlink" title="Permalink to this term" href="#NoDelay=">¶</a></dt><dd><p>Takes a boolean argument. TCP Nagle's
 263         algorithm works by combining a number of small outgoing
 264         messages, and sending them all at once. This controls the
 265         TCP_NODELAY socket option (see
 266         <a href="http://linux.die.net/man/7/tcp"><span class="citerefentry"><span class="refentrytitle">tcp</span>(7)</span></a>
 267         Defaults to <code class="option">false</code>.</p></dd><dt id="Priority="><span class="term"><code class="varname">Priority=</code></span><a class="headerlink" title="Permalink to this term" href="#Priority=">¶</a></dt><dd><p>Takes an integer argument controlling the
 268         priority for all traffic sent from this socket. This controls
 269         the SO_PRIORITY socket option (see
 270         <a href="http://man7.org/linux/man-pages/man7/socket.7.html"><span class="citerefentry"><span class="refentrytitle">socket</span>(7)</span></a>
 271         for details.).</p></dd><dt id="DeferAcceptSec="><span class="term"><code class="varname">DeferAcceptSec=</code></span><a class="headerlink" title="Permalink to this term" href="#DeferAcceptSec=">¶</a></dt><dd><p>Takes time (in seconds) as argument. If set,
 272         the listening process will be awakened only when data arrives
 273         on the socket, and not immediately when connection is
 274         established. When this option is set, the
 275         <code class="constant">TCP_DEFER_ACCEPT</code> socket option will be
 276         used (see
 277         <a href="http://linux.die.net/man/7/tcp"><span class="citerefentry"><span class="refentrytitle">tcp</span>(7)</span></a>),
 278         and the kernel will ignore initial ACK packets without any
 279         data. The argument specifies the approximate amount of time
 280         the kernel should wait for incoming data before falling back
 281         to the normal behaviour of honouring empty ACK packets. This
 282         option is beneficial for protocols where the client sends the
 283         data first (e.g. HTTP, in contrast to SMTP), because the
 284         server process will not be woken up unnecessarily before it
 285         can take any action.
 286         </p><p>If the client also uses the
 287         <code class="constant">TCP_DEFER_ACCEPT</code> option, the latency of
 288         the initial connection may be reduced, because the kernel will
 289         send data in the final packet establishing the connection (the
 290         third packet in the "three-way handshake").</p><p>Disabled by default.</p></dd><dt id="ReceiveBuffer="><span class="term"><code class="varname">ReceiveBuffer=</code>, </span><span class="term"><code class="varname">SendBuffer=</code></span><a class="headerlink" title="Permalink to this term" href="#ReceiveBuffer=">¶</a></dt><dd><p>Takes an integer argument controlling the
 291         receive or send buffer sizes of this socket, respectively.
 292         This controls the SO_RCVBUF and SO_SNDBUF socket options (see
 293         <a href="http://man7.org/linux/man-pages/man7/socket.7.html"><span class="citerefentry"><span class="refentrytitle">socket</span>(7)</span></a>
 294         for details.). The usual suffixes K, M, G are supported and
 295         are understood to the base of 1024.</p></dd><dt id="IPTOS="><span class="term"><code class="varname">IPTOS=</code></span><a class="headerlink" title="Permalink to this term" href="#IPTOS=">¶</a></dt><dd><p>Takes an integer argument controlling the IP
 296         Type-Of-Service field for packets generated from this socket.
 297         This controls the IP_TOS socket option (see
 298         <a href="http://linux.die.net/man/7/ip"><span class="citerefentry"><span class="refentrytitle">ip</span>(7)</span></a>
 299         for details.). Either a numeric string or one of
 300         <code class="option">low-delay</code>, <code class="option">throughput</code>,
 301         <code class="option">reliability</code> or <code class="option">low-cost</code> may
 302         be specified.</p></dd><dt id="IPTTL="><span class="term"><code class="varname">IPTTL=</code></span><a class="headerlink" title="Permalink to this term" href="#IPTTL=">¶</a></dt><dd><p>Takes an integer argument controlling the IPv4
 303         Time-To-Live/IPv6 Hop-Count field for packets generated from
 304         this socket. This sets the IP_TTL/IPV6_UNICAST_HOPS socket
 305         options (see
 306         <a href="http://linux.die.net/man/7/ip"><span class="citerefentry"><span class="refentrytitle">ip</span>(7)</span></a>
 307         and
 308         <a href="http://linux.die.net/man/7/ipv6"><span class="citerefentry"><span class="refentrytitle">ipv6</span>(7)</span></a>
 309         for details.)</p></dd><dt id="Mark="><span class="term"><code class="varname">Mark=</code></span><a class="headerlink" title="Permalink to this term" href="#Mark=">¶</a></dt><dd><p>Takes an integer value. Controls the firewall
 310         mark of packets generated by this socket. This can be used in
 311         the firewall logic to filter packets from this socket. This
 312         sets the SO_MARK socket option. See
 313         <a href="http://linux.die.net/man/8/iptables"><span class="citerefentry"><span class="refentrytitle">iptables</span>(8)</span></a>
 314         for details.</p></dd><dt id="ReusePort="><span class="term"><code class="varname">ReusePort=</code></span><a class="headerlink" title="Permalink to this term" href="#ReusePort=">¶</a></dt><dd><p>Takes a boolean value. If true, allows
 315         multiple
 316         <a href="http://man7.org/linux/man-pages/man2/bind.2.html"><span class="citerefentry"><span class="refentrytitle">bind</span>(2)</span></a>s
 317         to this TCP or UDP port. This controls the SO_REUSEPORT socket
 318         option. See
 319         <a href="http://man7.org/linux/man-pages/man7/socket.7.html"><span class="citerefentry"><span class="refentrytitle">socket</span>(7)</span></a>
 320         for details.</p></dd><dt id="SmackLabel="><span class="term"><code class="varname">SmackLabel=</code>, </span><span class="term"><code class="varname">SmackLabelIPIn=</code>, </span><span class="term"><code class="varname">SmackLabelIPOut=</code></span><a class="headerlink" title="Permalink to this term" href="#SmackLabel=">¶</a></dt><dd><p>Takes a string value. Controls the extended
 321         attributes "<code class="literal">security.SMACK64</code>",
 322         "<code class="literal">security.SMACK64IPIN</code>" and
 323         "<code class="literal">security.SMACK64IPOUT</code>", respectively, i.e.
 324         the security label of the FIFO, or the security label for the
 325         incoming or outgoing connections of the socket, respectively.
 326         See <a class="ulink" href="https://www.kernel.org/doc/Documentation/security/Smack.txt" target="_top">Smack.txt</a>
 327         for details.</p></dd><dt id="SELinuxContextFromNet="><span class="term"><code class="varname">SELinuxContextFromNet=</code></span><a class="headerlink" title="Permalink to this term" href="#SELinuxContextFromNet=">¶</a></dt><dd><p>Takes a boolean argument. When true, systemd
 328          will attempt to figure out the SELinux label used for the
 329          instantiated service from the information handed by the peer
 330          over the network. Note that only the security level is used
 331          from the information provided by the peer. Other parts of the
 332          resulting SELinux context originate from either the target
 333          binary that is effectively triggered by socket unit or from
 334          the value of the <code class="varname">SELinuxContext=</code> option.
 335          This configuration option only affects sockets with
 336          <code class="varname">Accept=</code> mode set to
 337          "<code class="literal">true</code>". Also note that this option is useful
 338          only when MLS/MCS SELinux policy is deployed. Defaults to
 339          "<code class="literal">false</code>". </p></dd><dt id="PipeSize="><span class="term"><code class="varname">PipeSize=</code></span><a class="headerlink" title="Permalink to this term" href="#PipeSize=">¶</a></dt><dd><p>Takes a size in bytes. Controls the pipe
 340         buffer size of FIFOs configured in this socket unit. See
 341         <a href="http://man7.org/linux/man-pages/man2/fcntl.2.html"><span class="citerefentry"><span class="refentrytitle">fcntl</span>(2)</span></a>
 342         for details. The usual suffixes K, M, G are supported and are
 343         understood to the base of 1024.</p></dd><dt id="MessageQueueMaxMessages=,
 344         MessageQueueMessageSize="><span class="term"><code class="varname">MessageQueueMaxMessages=</code>,
 345         <code class="varname">MessageQueueMessageSize=</code></span><a class="headerlink" title="Permalink to this term" href="#MessageQueueMaxMessages=,%0A%20%20%20%20%20%20%20%20MessageQueueMessageSize=">¶</a></dt><dd><p>These two settings take integer values and
 346         control the mq_maxmsg field or the mq_msgsize field,
 347         respectively, when creating the message queue. Note that
 348         either none or both of these variables need to be set. See
 349         <a href="http://linux.die.net/man/3/mq_setattr"><span class="citerefentry"><span class="refentrytitle">mq_setattr</span>(3)</span></a>
 350         for details.</p></dd><dt id="FreeBind="><span class="term"><code class="varname">FreeBind=</code></span><a class="headerlink" title="Permalink to this term" href="#FreeBind=">¶</a></dt><dd><p>Takes a boolean value. Controls whether the
 351         socket can be bound to non-local IP addresses. This is useful
 352         to configure sockets listening on specific IP addresses before
 353         those IP addresses are successfully configured on a network
 354         interface. This sets the IP_FREEBIND socket option. For
 355         robustness reasons it is recommended to use this option
 356         whenever you bind a socket to a specific IP address. Defaults
 357         to <code class="option">false</code>.</p></dd><dt id="Transparent="><span class="term"><code class="varname">Transparent=</code></span><a class="headerlink" title="Permalink to this term" href="#Transparent=">¶</a></dt><dd><p>Takes a boolean value. Controls the
 358         IP_TRANSPARENT socket option. Defaults to
 359         <code class="option">false</code>.</p></dd><dt id="Broadcast="><span class="term"><code class="varname">Broadcast=</code></span><a class="headerlink" title="Permalink to this term" href="#Broadcast=">¶</a></dt><dd><p>Takes a boolean value. This controls the
 360         SO_BROADCAST socket option, which allows broadcast datagrams
 361         to be sent from this socket. Defaults to
 362         <code class="option">false</code>.</p></dd><dt id="PassCredentials="><span class="term"><code class="varname">PassCredentials=</code></span><a class="headerlink" title="Permalink to this term" href="#PassCredentials=">¶</a></dt><dd><p>Takes a boolean value. This controls the
 363         SO_PASSCRED socket option, which allows
 364         <code class="constant">AF_UNIX</code> sockets to receive the
 365         credentials of the sending process in an ancillary message.
 366         Defaults to <code class="option">false</code>.</p></dd><dt id="PassSecurity="><span class="term"><code class="varname">PassSecurity=</code></span><a class="headerlink" title="Permalink to this term" href="#PassSecurity=">¶</a></dt><dd><p>Takes a boolean value. This controls the
 367         SO_PASSSEC socket option, which allows
 368         <code class="constant">AF_UNIX</code> sockets to receive the security
 369         context of the sending process in an ancillary message.
 370         Defaults to <code class="option">false</code>.</p></dd><dt id="TCPCongestion="><span class="term"><code class="varname">TCPCongestion=</code></span><a class="headerlink" title="Permalink to this term" href="#TCPCongestion=">¶</a></dt><dd><p>Takes a string value. Controls the TCP
 371         congestion algorithm used by this socket. Should be one of
 372         "westwood", "veno", "cubic", "lp" or any other available
 373         algorithm supported by the IP stack. This setting applies only
 374         to stream sockets.</p></dd><dt id="ExecStartPre="><span class="term"><code class="varname">ExecStartPre=</code>, </span><span class="term"><code class="varname">ExecStartPost=</code></span><a class="headerlink" title="Permalink to this term" href="#ExecStartPre=">¶</a></dt><dd><p>Takes one or more command lines, which are
 375         executed before or after the listening sockets/FIFOs are
 376         created and bound, respectively. The first token of the
 377         command line must be an absolute filename, then followed by
 378         arguments for the process. Multiple command lines may be
 379         specified following the same scheme as used for
 380         <code class="varname">ExecStartPre=</code> of service unit
 381         files.</p></dd><dt id="ExecStopPre="><span class="term"><code class="varname">ExecStopPre=</code>, </span><span class="term"><code class="varname">ExecStopPost=</code></span><a class="headerlink" title="Permalink to this term" href="#ExecStopPre=">¶</a></dt><dd><p>Additional commands that are executed before
 382         or after the listening sockets/FIFOs are closed and removed,
 383         respectively. Multiple command lines may be specified
 384         following the same scheme as used for
 385         <code class="varname">ExecStartPre=</code> of service unit
 386         files.</p></dd><dt id="TimeoutSec="><span class="term"><code class="varname">TimeoutSec=</code></span><a class="headerlink" title="Permalink to this term" href="#TimeoutSec=">¶</a></dt><dd><p>Configures the time to wait for the commands
 387         specified in <code class="varname">ExecStartPre=</code>,
 388         <code class="varname">ExecStartPost=</code>,
 389         <code class="varname">ExecStopPre=</code> and
 390         <code class="varname">ExecStopPost=</code> to finish. If a command does
 391         not exit within the configured time, the socket will be
 392         considered failed and be shut down again. All commands still
 393         running will be terminated forcibly via
 394         <code class="constant">SIGTERM</code>, and after another delay of this
 395         time with <code class="constant">SIGKILL</code>. (See
 396         <code class="option">KillMode=</code> in
 397         <a href="systemd.kill.html"><span class="citerefentry"><span class="refentrytitle">systemd.kill</span>(5)</span></a>.)
 398         Takes a unit-less value in seconds, or a time span value such
 399         as "5min 20s". Pass "<code class="literal">0</code>" to disable the
 400         timeout logic. Defaults to
 401         <code class="varname">DefaultTimeoutStartSec=</code> from the manager
 402         configuration file (see
 403         <a href="systemd-system.conf.html"><span class="citerefentry"><span class="refentrytitle">systemd-system.conf</span>(5)</span></a>).
 404         </p></dd><dt id="Service="><span class="term"><code class="varname">Service=</code></span><a class="headerlink" title="Permalink to this term" href="#Service=">¶</a></dt><dd><p>Specifies the service unit name to activate on
 405         incoming traffic. This setting is only allowed for sockets
 406         with <code class="varname">Accept=no</code>. It defaults to the service
 407         that bears the same name as the socket (with the suffix
 408         replaced). In most cases, it should not be necessary to use
 409         this option.</p></dd><dt id="RemoveOnStop="><span class="term"><code class="varname">RemoveOnStop=</code></span><a class="headerlink" title="Permalink to this term" href="#RemoveOnStop=">¶</a></dt><dd><p>Takes a boolean argument. If enabled, any file
 410         nodes created by this socket unit are removed when it is
 411         stopped. This applies to AF_UNIX sockets in the file system,
 412         POSIX message queues, FIFOs, as well as any symlinks to them
 413         configured with <code class="varname">Symlinks=</code>. Normally, it
 414         should not be necessary to use this option, and is not
 415         recommended as services might continue to run after the socket
 416         unit has been terminated and it should still be possible to
 417         communicate with them via their file system node. Defaults to
 418         off.</p></dd><dt id="Symlinks="><span class="term"><code class="varname">Symlinks=</code></span><a class="headerlink" title="Permalink to this term" href="#Symlinks=">¶</a></dt><dd><p>Takes a list of file system paths. The
 419         specified paths will be created as symlinks to the AF_UNIX
 420         socket path or FIFO path of this socket unit. If this setting
 421         is used, only one AF_UNIX socket in the file system or one
 422         FIFO may be configured for the socket unit. Use this option to
 423         manage one or more symlinked alias names for a socket, binding
 424         their lifecycle together. Defaults to the empty
 425         list.</p></dd></dl></div><p>Check
 426     <a href="systemd.exec.html"><span class="citerefentry"><span class="refentrytitle">systemd.exec</span>(5)</span></a>
 427     and
 428     <a href="systemd.kill.html"><span class="citerefentry"><span class="refentrytitle">systemd.kill</span>(5)</span></a>
 429     for more settings.</p></div><div class="refsect1"><a name="idm139681107088816"></a><h2 id="See Also">See Also<a class="headerlink" title="Permalink to this headline" href="#See%20Also">¶</a></h2><p>
 430         <a href="systemd.html"><span class="citerefentry"><span class="refentrytitle">systemd</span>(1)</span></a>,
 431         <a href="systemctl.html"><span class="citerefentry"><span class="refentrytitle">systemctl</span>(1)</span></a>,
 432         <a href="systemd.unit.html"><span class="citerefentry"><span class="refentrytitle">systemd.unit</span>(5)</span></a>,
 433         <a href="systemd.exec.html"><span class="citerefentry"><span class="refentrytitle">systemd.exec</span>(5)</span></a>,
 434         <a href="systemd.kill.html"><span class="citerefentry"><span class="refentrytitle">systemd.kill</span>(5)</span></a>,
 435         <a href="systemd.resource-control.html"><span class="citerefentry"><span class="refentrytitle">systemd.resource-control</span>(5)</span></a>,
 436         <a href="systemd.service.html"><span class="citerefentry"><span class="refentrytitle">systemd.service</span>(5)</span></a>,
 437         <a href="systemd.directives.html"><span class="citerefentry"><span class="refentrytitle">systemd.directives</span>(7)</span></a>
 438       </p><p>
 439         For more extensive descriptions see the "systemd for Developers" series:
 440         <a class="ulink" href="http://0pointer.de/blog/projects/socket-activation.html" target="_top">Socket Activation</a>,
 441         <a class="ulink" href="http://0pointer.de/blog/projects/socket-activation2.html" target="_top">Socket Activation, part II</a>,
 442         <a class="ulink" href="http://0pointer.de/blog/projects/inetd.html" target="_top">Converting inetd Services</a>,
 443         <a class="ulink" href="http://0pointer.de/blog/projects/socket-activated-containers.html" target="_top">Socket Activated Internet Services and OS Containers</a>.
 444       </p></div></div></body></html>