Layer: system

Module: systemd

Tunables Interfaces Templates

Description:

Systemd components (not PID 1)


Tunables:

systemd_logind_get_bootloader
Default value

false

Description

Allow systemd-logind to interact with the bootloader (read which one is installed on fixed disks, enumerate entries for dbus property BootLoaderEntries, etc.)

systemd_networkd_dhcp_server
Default value

false

Description

Allow systemd-networkd to run its DHCPd server component

systemd_nspawn_labeled_namespace
Default value

false

Description

Allow systemd-nspawn to create a labelled namespace with the same types as parent environment

systemd_socket_proxyd_bind_any
Default value

false

Description

Allow systemd-socket-proxyd to bind any port instead of one labelled with systemd_socket_proxyd_port_t.

systemd_socket_proxyd_connect_any
Default value

false

Description

Allow systemd-socket-proxyd to connect to any port instead of labelled ones.

systemd_tmpfiles_manage_all
Default value

false

Description

Enable support for systemd-tmpfiles to manage all non-security files.

Return

Interfaces:

systemd_PrivateDevices( domain )
Summary

Allow domain to be used as a systemd service with a unit that uses PrivateDevices=yes in section [Service].

Parameters
Parameter:Description:
domain

Domain allowed access

systemd_connect_machined( domain )
Summary

Allow connecting to /run/systemd/userdb/io.systemd.Machine socket

Parameters
Parameter:Description:
domain

Domain that can access the socket

systemd_create_all_user_keys( domain )
Summary

Create keys for the all systemd --user domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_create_logind_linger_dir( domain )
Summary

Allow the specified domain to create the systemd-logind linger directory with the correct context.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_dbus_chat_hostnamed( domain )
Summary

Send and receive messages from systemd hostnamed over dbus.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_dbus_chat_locale( domain )
Summary

Send and receive messages from systemd localed over dbus.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_dbus_chat_logind( domain )
Summary

Send and receive messages from systemd logind over dbus.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_dbus_chat_machined( domain )
Summary

Send and receive messages from systemd machined over dbus.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_dbus_chat_networkd( domain )
Summary

Send and receive messages from systemd networkd over dbus.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_dbus_chat_resolved( domain )
Summary

Send and receive messages from systemd resolved over dbus.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_dgram_nspawn( domain )
Summary

send datagrams to systemd_nspawn_t

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_domtrans_sysusers( domain )
Summary

Execute systemd-sysusers in the systemd sysusers domain.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_dontaudit_connect_machined( domain )
Summary

dontaudit connecting to /run/systemd/userdb/io.systemd.Machine socket

Parameters
Parameter:Description:
domain

Domain that can access the socket

systemd_enabledisable_networkd( domain )
Summary

Allow specified domain to enable systemd-networkd units

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_exec_systemctl( domain )
Summary

Execute the systemctl program.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_filetrans_passwd_runtime_dirs( domain )
Summary

Transition to systemd_passwd_runtime_t when creating dirs

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_filetrans_userdb_runtime_dirs( domain )
Summary

Transition to systemd_userdbd_runtime_t when creating the userdb directory inside an init runtime directory.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_get_user_manager_units_status( domain )
Summary

Get the status of systemd user manager units (systemd --user).

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_get_user_runtime_units_status( domain )
Summary

Allow the specified domain to get the status of systemd user runtime units.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_get_user_transient_units_status( domain )
Summary

Allow the specified domain to get the status of systemd user transient units.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_getattr_updated_runtime( domain )
Summary

Allow domain to getattr on .updated file (generated by systemd-update-done

Parameters
Parameter:Description:
domain

domain allowed access

systemd_list_journal_dirs( domain )
Summary

Allow domain to list the contents of systemd_journal_t dirs

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_list_networkd_runtime( domain )
Summary

Allow domain to list dirs under /run/systemd/netif

Parameters
Parameter:Description:
domain

domain permitted the access

systemd_list_tmpfiles_conf( domain )
Summary

Allow domain to list systemd tmpfiles config directory

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_list_user_runtime_unit_dirs( domain )
Summary

Allow the specified domain to list the contents of systemd user runtime unit directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_list_user_transient_unit_dirs( domain )
Summary

Allow the specified domain to list the contents of systemd user transient unit directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_list_userdb_runtime_dirs( domain )
Summary

List the contents of systemd userdb runtime directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_log_parse_environment( domain )
Summary

Make the specified type usable as an log parse environment type.

Parameters
Parameter:Description:
domain

Type to be used as a log parse environment type.

systemd_manage_conf_home_content( domain )
Summary

Allow the specified domain to manage systemd config home content.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_manage_data_home_content( domain )
Summary

Allow the specified domain to manage systemd data home content.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_manage_journal_files( domain )
Summary

Allow domain to create/manage systemd_journal_t files

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_manage_logind_runtime_pipes( domain )
Summary

Manage systemd-logind runtime pipes.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_manage_networkd_units( domain )
Summary

Allow domain to create/manage systemd_networkd_t unit files

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_manage_passwd_runtime_symlinks( domain )
Summary

Allow to domain to create systemd-passwd symlink

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_manage_userdb_runtime_dirs( domain )
Summary

Manage systemd userdb runtime directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_manage_userdb_runtime_sock_files( domain )
Summary

Manage socket files under /run/systemd/userdb .

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_map_hwdb( domain )
Summary

Allow domain to map udev hwdb file

Parameters
Parameter:Description:
domain

domain allowed access

systemd_read_hwdb( domain )
Summary

Allow domain to read udev hwdb file

Parameters
Parameter:Description:
domain

domain allowed access

systemd_read_journal_files( domain )
Summary

Allow domain to read systemd_journal_t files

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_read_logind_runtime_files( domain )
Summary

Read systemd-logind runtime files.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_read_logind_sessions_files( domain )
Summary

Read logind sessions files.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_read_logind_state( domain )
Summary

Allow systemd_logind_t to read process state for cgroup file

Parameters
Parameter:Description:
domain

Domain systemd_logind_t may access.

systemd_read_machines( domain )
Summary

Allow reading /run/systemd/machines

Parameters
Parameter:Description:
domain

Domain that can access the machines files

systemd_read_networkd_runtime( domain )
Summary

Allow domain to read files generated by systemd_networkd

Parameters
Parameter:Description:
domain

domain allowed access

systemd_read_networkd_units( domain )
Summary

Allow domain to read systemd_networkd_t unit files

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_read_resolved_runtime( domain )
Summary

Allow domain to read resolv.conf file generated by systemd_resolved

Parameters
Parameter:Description:
domain

domain allowed access

systemd_read_user_runtime_files( domain )
Summary

Allow the specified domain to read systemd user runtime files.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_read_user_runtime_lnk_files( domain )
Summary

Allow the specified domain to read systemd user runtime lnk files.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_read_user_runtime_units( domain )
Summary

Allow the specified domain to read systemd user runtime unit files. (Deprecated)

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_read_user_runtime_units_files( domain )
Summary

Allow the specified domain to read systemd user runtime unit files.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_read_user_transient_units_files( domain )
Summary

Allow the specified domain to read systemd user transient unit files.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_read_user_unit_files( domain )
Summary

Allow the specified domain to read system-wide systemd user unit files. (Deprecated)

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_read_user_units_files( domain )
Summary

Allow the specified domain to read system-wide systemd user unit files.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_read_userdb_runtime_files( domain )
Summary

Read systemd userdb runtime files.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_relabel_conf_home_content( domain )
Summary

Allow the specified domain to relabel systemd config home content.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_relabel_data_home_content( domain )
Summary

Allow the specified domain to relabel systemd data home content.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_relabelfrom_journal_files( domain )
Summary

Relabel from systemd-journald file type.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_relabelfrom_networkd_tun_sockets( domain )
Summary

Relabel systemd_networkd tun socket.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_relabelto_journal_dirs( domain )
Summary

Relabel to systemd-journald directory type.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_relabelto_journal_files( domain )
Summary

Relabel to systemd-journald file type.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_relabelto_tmpfiles_conf_dirs( domain )
Summary

Allow domain to relabel to systemd tmpfiles config directory

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_relabelto_tmpfiles_conf_files( domain )
Summary

Allow domain to relabel to systemd tmpfiles config files

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_reload_user_manager_units( domain )
Summary

Allow the specified domain to reload systemd user manager units (systemd --user).

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_reload_user_runtime_units( domain )
Summary

Allow the specified domain to reload systemd user runtime units.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_reload_user_transient_units( domain )
Summary

Allow the specified domain to reload systemd user transient units.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_run_nspawn( domain , role )
Summary

run systemd-nspawn in systemd_nspawn_t domain

Parameters
Parameter:Description:
domain

Domain allowed access.

role

The role of the object to create.

systemd_run_passwd_agent( domain , role )
Summary

allow systemd_passwd_agent to be run by admin

Parameters
Parameter:Description:
domain

Domain that runs it

role

role that it runs in

systemd_run_sysusers( domain , role )
Summary

Run systemd-sysusers with a domain transition.

Parameters
Parameter:Description:
domain

Domain allowed access.

role

Role allowed access.

systemd_rw_homework_semaphores( domain )
Summary

Read and write systemd-homework semaphores.

Parameters
Parameter:Description:
domain

Domain allowed access

systemd_rw_networkd_netlink_route_sockets( domain )
Summary

Read/Write from systemd_networkd netlink route socket.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_search_all_user_keys( domain )
Summary

Search keys for the all systemd --user domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_search_conf_home_content( domain )
Summary

Allow the specified domain to search systemd config home content.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_search_data_home_content( domain )
Summary

Allow the specified domain to search systemd data home content.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_search_user_runtime( domain )
Summary

Allow the specified domain to search systemd user runtime content.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_search_user_runtime_unit_dirs( domain )
Summary

Allow the specified domain to search systemd user runtime unit directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_search_user_transient_unit_dirs( domain )
Summary

Allow the specified domain to search systemd user transient unit directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_signull_logind( domain )
Summary

Send systemd_login a null signal.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_start_power_units( domain )
Summary

Allow specified domain to start power units

Parameters
Parameter:Description:
domain

Domain to not audit.

systemd_start_user_manager_units( domain )
Summary

Allow the specified domain to start systemd user manager units (systemd --user).

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_start_user_runtime_units( domain )
Summary

Allow the specified domain to start systemd user runtime units.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_start_user_transient_units( domain )
Summary

Allow the specified domain to start systemd user transient units.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_startstop_networkd( domain )
Summary

Allow specified domain to start systemd-networkd units

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_status_logind( domain )
Summary

Get the system status information from systemd_login

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_status_networkd( domain )
Summary

Allow specified domain to get status of systemd-networkd

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_status_power_units( domain )
Summary

Get the system status information about power units

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_status_user_runtime_units( domain )
Summary

Allow the specified domain to get the status of systemd user runtime units. (Deprecated)

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_stop_user_manager_units( domain )
Summary

Allow the specified domain to stop systemd user manager units (systemd --user).

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_stop_user_runtime_units( domain )
Summary

Allow the specified domain to stop systemd user runtime units.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_stop_user_transient_units( domain )
Summary

Allow the specified domain to stop systemd user transient units.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_stream_connect_resolved( domain )
Summary

Connect to systemd resolved over /run/systemd/resolve/io.systemd.Resolve .

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_stream_connect_socket_proxyd( domain )
Summary

Allows connections to the systemd-socket-proxyd's socket.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_stream_connect_userdb( domain )
Summary

Connect to /run/systemd/userdb/io.systemd.DynamicUser .

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_tmpfiles_conf_file( type )
Summary

Make the specified type usable for systemd tmpfiles config files.

Parameters
Parameter:Description:
type

Type to be used for systemd tmpfiles config files.

systemd_tmpfiles_conf_filetrans( domain , private type , object , name )
Summary

Create an object in the systemd tmpfiles config directory, with a private type using a type transition.

Parameters
Parameter:Description:
domain

Domain allowed access.

private type

The type of the object to be created.

object

The object class of the object being created.

name

The name of the object being created.

systemd_tmpfiles_creator( domain )
Summary

Allow the specified domain to create the tmpfiles config directory with the correct context.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_tmpfilesd_managed( type )
Summary

Allow systemd_tmpfiles_t to manage filesystem objects

Parameters
Parameter:Description:
type

Type of object to manage

systemd_use_inherited_machined_ptys( domain )
Summary

receive and use a systemd_machined_devpts_t file handle

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_use_logind_fds( domain )
Summary

Use inherited systemd logind file descriptors.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_use_nss( domain )
Summary

Allow domain to use systemd's Name Service Switch (NSS) module. This module provides UNIX user and group name resolution for dynamic users and groups allocated through the DynamicUser= option in systemd unit files

Parameters
Parameter:Description:
domain

Domain allowed access

systemd_use_passwd_agent( domain )
Summary

Allow a systemd_passwd_agent_t process to interact with a daemon that needs a password from the sysadmin.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_use_passwd_agent_fds( domain )
Summary

allow systemd_passwd_agent to inherit fds

Parameters
Parameter:Description:
domain

Domain that owns the fds

systemd_user_activated_sock_file( file_type )
Summary

Associate the specified file type to be a type whose sock files can be managed by systemd user instances for socket activation.

Parameters
Parameter:Description:
file_type

File type to be associated.

systemd_user_unix_stream_activated_socket( domain , sock_file_type )
Summary

Associate the specified domain to be a domain whose unix stream sockets and sock files can be managed by systemd user instances for socket activation.

Parameters
Parameter:Description:
domain

Domain to be associated.

sock_file_type

File type of the domain's sock files to be associated.

systemd_watch_journal_dirs( domain )
Summary

Allow domain to add a watch on systemd_journal_t directories

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_watch_logind_runtime_dirs( domain )
Summary

Watch systemd-logind runtime dirs.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_watch_logind_sessions_dirs( domain )
Summary

Watch logind sessions dirs.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_watch_machines_dirs( domain )
Summary

Allow watching /run/systemd/machines

Parameters
Parameter:Description:
domain

Domain that can watch the machines files

systemd_watch_networkd_runtime_dirs( domain )
Summary

Watch directories under /run/systemd/netif

Parameters
Parameter:Description:
domain

Domain permitted the access

systemd_watch_passwd_runtime_dirs( domain )
Summary

Allow a domain to watch systemd-passwd runtime dirs.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_write_all_user_keys( domain )
Summary

Write keys for the all systemd --user domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_write_inherited_logind_inhibit_pipes( domain )
Summary

Write inherited logind inhibit pipes.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_write_inherited_logind_sessions_pipes( domain )
Summary

Write inherited logind sessions pipes.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_write_logind_runtime_pipes( domain )
Summary

Write systemd-logind runtime named pipe.

Parameters
Parameter:Description:
domain

Domain allowed access.

systemd_write_user_runtime_socket( domain )
Summary

Allow the specified domain to write to the systemd user runtime named socket.

Parameters
Parameter:Description:
domain

Domain allowed access.

Return

Templates:

systemd_read_user_manager_state( prefix , domain )
Summary

Read the process state (/proc/pid) of the specified systemd user instance.

Parameters
Parameter:Description:
prefix

Prefix for the user domain.

domain

Domain allowed access.

systemd_role_template( prefix , role , userdomain )
Summary

Template for systemd --user per-role domains.

Parameters
Parameter:Description:
prefix

Prefix for generated types

role

The user role.

userdomain

The user domain for the role.

systemd_user_app_status( prefix , domain )
Summary

Allow the target domain to be monitored and have its output captured by the specified systemd user instance domain.

Parameters
Parameter:Description:
prefix

Prefix for the user domain.

domain

Domain to allow the systemd user instance to monitor.

systemd_user_daemon_domain( prefix , entry_point , domain )
Summary

Allow the specified domain to be started as a daemon by the specified systemd user instance.

Parameters
Parameter:Description:
prefix

Prefix for the user domain.

entry_point

Entry point file type for the domain.

domain

Domain to allow the systemd user domain to run.

systemd_user_manager_dbus_chat( prefix , domain )
Summary

Send and receive messages from the specified systemd user instance over dbus.

Parameters
Parameter:Description:
prefix

Prefix for the user domain.

domain

Domain allowed access.

systemd_user_manager_system_start( prefix , domain )
Summary

Send a start request to the specified systemd user instance system object.

Parameters
Parameter:Description:
prefix

Prefix for the user domain.

domain

Domain allowed access.

systemd_user_manager_system_status( prefix , domain )
Summary

Get the status of the specified systemd user instance system object.

Parameters
Parameter:Description:
prefix

Prefix for the user domain.

domain

Domain allowed access.

systemd_user_manager_system_stop( prefix , domain )
Summary

Send a stop request to the specified systemd user instance system object.

Parameters
Parameter:Description:
prefix

Prefix for the user domain.

domain

Domain allowed access.

systemd_user_send_systemd_notify( prefix , domain )
Summary

Allow the target domain the permissions necessary to use systemd notify when started by the specified systemd user instance.

Parameters
Parameter:Description:
prefix

Prefix for the user domain.

domain

Domain to be allowed systemd notify permissions.

Return