启动#

as above

systemctl mask dev-hugepages.mount
<component type="addon">
	<id>com.example.Devel</id>
	<extends>com.example.OS</extends>
	<name>Development Tools</name>
	<summary>Tools essential to develop Example OS</summary>
	<provides>
		<binary>gcc</binary>
		<binary>g++</binary>
		<binary>make</binary>
		<binary>autoconf</binary>
		<binary>cmake</binary>
		<binary>meson</binary>
		<binary>ninja</binary>
	</provides>
	<developer_name>Example, inc.</developer_name>
	<releases>
		<release version="45" date="2024-01-15" />
		<release version="44" date="2023-12-08" />
		<release version="43" date="2023-11-10" />
	</releases>
	<bundle type="systemd" class="extension">devel</bundle>
</component>
<component merge="append">
	<id>com.example.OS</id>
	<releases>
		<release version="45" date="2024-01-15" urgency="high">
			<description>
				<p>This release includes various bug fixes and performance improvements</p>
			</description>
		</release>
	</releases>
	<bundle type="systemd" class="sysupdate" />
</component>
<component type="service">
	<id>com.example.Foobar</id>
	<name>Foobar Service</name>
	<summary>Service that does foo to bar</summary>
	<icon type="remote">https://example.com/products/foobar/logo.svg</icon>
	<url type="homepage">https://example.com/products/foobar</url>
	<provides>
		<dbus type="system">com.example.Foobar</dbus>
	</provides>
	<developer_name>Example, inc.</developer_name>
	<releases>
		<release version="1.0.1" date="2024-02-16" urgency="critical">
			<description>
				<p>This release fixes a major security vulnerability. Please update ASAP.</p>
			</description>
			<issues>
				<issue type="cve">CVE-2024-28153</issue>
			</issues>
		</release>
		<release version="1.1-beta" date="2024-01-08" type="development" />
		<release version="1.0" date="2023-11-23">
			<description>
				<p>Initial release!</p>
			</description>
		</release>
	</releases>
	<bundle type="systemd" class="portable">foobar</bundle>
</component>
void some_function(
                int foo,
                bool bar,
                char baz) {

        int a, b, c;
void foo() {
}
void foo()
{
}
const char* foo(const char *input);
const char *foo(const char *input);
(const char*) s;
(const char *)s;
if (foobar)
        waldo();
if (foobar) {
        waldo();
}
if (foobar)
        waldo();
else {
        foo();
        bar();
}
if (foobar) {
        waldo();
} else {
        foo();
        bar();
}
if (foobar) {
        find();
        waldo();
} else
        dont_find_waldo();
typedef enum FoobarFlags {
        FOOBAR_QUUX  = 1 << 0,
        FOOBAR_WALDO = 1 << 1,
        FOOBAR_XOXO  = 1 << 2,
        …
} FoobarFlags;
typedef enum FoobarMode {
        FOOBAR_AAA,
        FOOBAR_BBB,
        FOOBAR_CCC,
        …
        _FOOBAR_MAX,
        _FOOBAR_INVALID = -EINVAL,
} FoobarMode;
/* → empty line here is good */
r = some_function(…);
/* → empty line here would be bad */
if (r < 0)
        return log_error_errno(r, "Some function failed: %m");
/* → empty line here is good */
static int foobar_frobnicate(
                Foobar *object,            /* the associated mutable object */
                const char *input,         /* immutable input parameter */
                char **ret_frobnicated,    /* return parameter on success */
                unsigned *reterr_line,     /* return parameter on failure */
                unsigned *reterr_column) { /* ditto */
        …
        return 0;
}
static int do_something(
                const char *input,
                const char *ret_on_success,
                const char *reterr_on_failure);
static int do_something(
                const char *reterr_on_failure,
                const char *ret_on_success,
                const char *input);
myfunction(NULL, NULL, NULL);
myfunction(/* a= */ NULL, /* b= */ NULL, /* c= */ NULL);
// manager.h

typedef struct Manager Manager;

#include "unit.h"

struct Manager {
        Unit *unit;
};

// unit.h

typedef struct Unit Unit;

#include "manager.h"

struct Unit {
        Manager *manager;
};
// manager.h

typedef struct Unit Unit;

typedef struct Manager {
        Unit *unit;
} Manager;

// manager.c

#include "unit.h"

// unit.h

typedef struct Manager Manager;

typedef struct Unit {
        Manager *manager;
} Unit;

// unit.c

#include "manager.h"
// source.h

#include <stddef.h>

#include "log.h"

static inline void my_function_that_logs(size_t sz) {
        log_error("oops: %zu", sz);
}
// source.h

#include "forward.h"

void my_function_that_logs(size_t sz);

// source.c

#include "source.h"
#include "log.h"

void my_function_that_logs(size_t sz) {
        log_error("oops: %zu", sz);
}
{
        uint64_t a;
        int r;

        r = frobnicate(&a);
        if (r < 0)
                …

        uint64_t b = a + 1, c;

        r = foobarify(a, b, &c);
        if (r < 0)
                …

        const char *pretty = prettify(a, b, c);
        …
}
{
        uint64_t x = 7;
        int a;

        a = foobar();
}
{
        int a = foobar();
        uint64_t x = 7;
}
struct foobar t = {
        .foo = 7,
        .bar = "bazz",
};
struct foobar t;
zero(t);
t.foo = 7;
t.bar = "bazz";
p = foobar_unref(p);
…
r = RET_NERRNO(unlink(t));
…
…
r = RET_NERRNO(open("/some/file", O_RDONLY|O_CLOEXEC));
…
(void) unlink("/foo/bar/baz");
unlink("/foo/bar/baz");
if (condition_not_met)
        return (void) log_tests_skipped("Cannot run ...");
r = operation(...);
if (r < 0)
        return log_(error|warning|notice|...)_errno(r, "Failed to ...: %m");
n = read(..., s, sizeof s);
if (n != sizeof s)
        return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to read ...");
        // FIXME: This compatibility code path shall be removed once kernel X.Y
        //        becomes the new minimal baseline

mv /home/foobar /home/foobar.saved
getent passwd foobar
getent shadow foobar
getent group 1000
homectl create foobar --uid=$UID --real-name=$GECOS
homectl with foobar -- rsync -aHANUXv --remove-source-files /home/foobar.saved/ .
rmdir /home/foobar.saved
…
[Service]
ExecStart=/usr/bin/myservice.sh
LoadCredential=foobar:/etc/myfoobarcredential.txt
Environment=FOOBARPATH=%d/foobar
…
#!/bin/sh

sha256sum $CREDENTIALS_DIRECTORY/foobar
sha256sum $FOOBARPATH
systemd-run -P --wait -p LoadCredential=abc:/etc/hosts systemd-creds cat abc
systemd-creds encrypt --name=foobar plaintext.txt ciphertext.cred
shred -u plaintext.txt
systemd-run -P --wait -p LoadCredentialEncrypted=foobar:$(pwd)/ciphertext.cred systemd-creds cat foobar
systemd-creds encrypt -p --name=foobar plaintext.txt -
…
[Service]
ExecStart=/usr/bin/systemd-creds cat foobar
SetCredentialEncrypted=foobar: \
        k6iUCUh0RJCQyvL8k8q1UyAAAAABAAAADAAAABAAAAC1lFmbWAqWZ8dCCQkAAAAAgAAAA \
        AAAAAALACMA0AAAACAAAAAAfgAg9uNpGmj8LL2nHE0ixcycvM3XkpOCaf+9rwGscwmqRJ \
        cAEO24kB08FMtd/hfkZBX8PqoHd/yPTzRxJQBoBsvo9VqolKdy9Wkvih0HQnQ6NkTKEdP \
        HQ08+x8sv5sr+Mkv4ubp3YT1Jvv7CIPCbNhFtag1n5y9J7bTOKt2SQwBOAAgACwAAABIA \
        ID8H3RbsT7rIBH02CIgm/Gv1ukSXO3DMHmVQkDG0wEciABAAII6LvrmL60uEZcp5qnEkx \
        SuhUjsDoXrJs0rfSWX4QAx5PwfdFuxPusgEfTYIiCb8a/W6RJc7cMweZVCQMbTARyIAAA \
        AAJt7Q9F/Gz0pBv1Lc4Dpn1WpebyBBm+vQ5N/lSKW2XSm8cONwCopxpDc7wJjXg7OTR6r \
        xGCpIvGXLt3ibwJl81woLya2RRjIvc/R2zNm/yWzZAjiOLPih4SuHthqiX98ey8PUmZJB \
        VGXglCZFjBx+d7eCqTIdghtp5pkDGwMJT6pjw4FfyFK2nJPawFKPAqzw9DK2iYttFeXi5 \
        19xCfLBH9NKS/idlYXrhp+XIEtsr26s4lx5y10Goyc3qDOR3RD2cuZj0gHwV35hhhhcCz \
        JaYytef1X/YL+7fYH5kuE4rxSksoUuA/LhtjszBeGbcbIT+O8SuvBJHLKTSHxPL8FTyk3 \
        L4FSkEHs0rYwUIkKmnGohDdsYrMJ2fjH3yDNBP16aD1+f/Nuh75cjhUnGsDLt9K4hGg== \
…
systemd-nspawn --set-credential=mycred:supersecret -i test.raw -b
qemu-system-x86_64 \
        -machine type=q35,accel=kvm,smm=on \
        -smp 2 \
        -m 1G \
        -cpu host \
        -nographic \
        -nodefaults \
        -serial mon:stdio \
        -drive if=none,id=hd,file=test.raw,format=raw \
        -device virtio-scsi-pci,id=scsi \
        -device scsi-hd,drive=hd,bootindex=1 \
        -smbios type=11,value=io.systemd.credential:mycred=supersecret
systemd-creds --system cat mycred
systemd-run -p ImportCredential=mycred -P --wait systemd-creds cat mycred
{
        "systemd.credentials": [
                {
                        "name": "mycred",
                        "text": "supersecret"
                },
                {
                        "name": "mybinarycred",
                        "data": "YmFyCg=="
                }
        ]
}
systemd-nspawn -i test.raw  \
        --set-credential=passwd.hashed-password.root:$(mkpasswd mysecret) \
        --set-credential=firstboot.locale:C.UTF-8 \
        -b
qemu-system-x86_64 \
        -machine type=q35,accel=kvm,smm=on \
        -smp 2 \
        -m 1G \
        -cpu host \
        -nographic \
        -nodefaults \
        -serial mon:stdio \
        -drive if=none,id=hd,file=test.raw,format=raw \
        -device virtio-scsi-pci,id=scsi \
        -device scsi-hd,drive=hd,bootindex=1 \
        -smbios type=11,value=io.systemd.credential:passwd.hashed-password.root=$(mkpasswd mysecret) \
        -smbios type=11,value=io.systemd.credential:firstboot.locale=C.UTF-8
qemu-system-x86_64 \
        -machine type=q35,accel=kvm,smm=on \
        -smp 2 \
        -m 1G \
        -cpu host \
        -nographic \
        -nodefaults \
        -serial mon:stdio \
        -drive if=none,id=hd,file=test.raw,format=raw \
        -device virtio-scsi-pci,id=scsi \
        -device scsi-hd,drive=hd,bootindex=1 \
        -device vhost-vsock-pci,id=vhost-vsock-pci0,guest-cid=42 \
        -smbios type=11,value=io.systemd.credential:vmm.notify_socket=vsock:2:1234 \
        -smbios type=11,value=io.systemd.credential.binary:tmpfiles.extra=$(echo -e "d /root/.ssh 0750 root root -\nf~ /root/.ssh/authorized_keys 0600 root root - $(ssh-add -L | base64 -w 0)" | base64 -w 0)
$ socat - VSOCK-LISTEN:1234,socktype=5
READY=1
systemd.log_level=debug systemd.log_target=console console=ttyS0,38400 console=tty1
systemd.journald.forward_to_console=1 console=ttyS0,38400 console=tty1
mount -o remount,rw /
systemctl enable debug-shell.service
systemd.debug_shell=1
systemctl --root=/ enable debug-shell.service
systemd.log_level=debug systemd.log_target=kmsg log_buf_len=1M printk.devkmsg=on
journalctl -b
systemctl list-jobs
reboot -f
poweroff -f
systemd.log_level=debug systemd.log_target=kmsg log_buf_len=1M printk.devkmsg=on enforcing=0
#!/bin/sh
mount -o remount,rw /
dmesg > /shutdown-log.txt
mount -o remount,ro /
# systemctl start foo.service
Job failed. See system journal and 'systemctl status' for details.
# systemctl status foo.service
foo.service - mmm service
Loaded: loaded (/etc/systemd/system/foo.service; static)
Active: failed (Result: exit-code) since Fri, 11 May 2012 20:26:23 +0200; 4s ago
Process: 1329 ExecStart=/usr/local/bin/foo (code=exited, status=1/FAILURE)
CGroup: name=systemd:/system/foo.service

May 11 20:26:23 scratch foo[1329]: Failed to parse config
# systemctl isolate graphical.target
# ln -sf /usr/lib/systemd/system/multi-user.target /etc/systemd/system/default.target
# ln -sf /usr/lib/systemd/system/graphical.target /etc/systemd/system/default.target
$ systemctl list-units --type=target
# ln -sf /usr/lib/systemd/system/foobar.service /etc/systemd/system/multi-user.target.wants/foobar.service
# systemctl daemon-reload
# systemctl enable serial-getty@ttyS2.service
# systemctl start serial-getty@ttyS2.service
$ alias psc='ps xawf -eo pid,user,cgroup,args'
$ psc
...
# journalctl --full
$ mkosi -f genkey                                            # Generate signing keys once.
$ mkosi -f box -- meson setup -Dbpf-framework=disabled build # bpftool detection inside mkosi box is broken on Ubuntu Noble and older
$ mkosi -f box -- meson compile -C build
$ mkosi -f box -- build/systemctl --version
$ mkosi -f box -- meson test -C build --print-errorlogs -q   # Run the unit tests
$ mkosi -f box -- meson compile -C build mkosi # (re-)build the OS image
$ mkosi boot                                       # Boot the image with systemd-nspawn.
$ mkosi vm                                         # Boot the image with qemu.
$ git clone https://github.com/systemd/mkosi.git
$ ln -s $PWD/mkosi/bin/mkosi ~/.local/bin/mkosi # Make sure ~/.local/bin is in $PATH.
$ git clone https://github.com/systemd/systemd.git
$ cd systemd
$ git checkout -b <BRANCH>                         # where BRANCH is the name of the branch
$ $EDITOR src/core/main.c                          # or wherever you'd like to make your changes
$ mkosi -f genkey                                  # Generate signing keys once.
$ mkosi -f box -- meson setup build            # Set up meson
$ mkosi -f box -- meson compile -C build mkosi # (re-)build the test image
$ mkosi vm                                         # Boot the image in qemu
$ git add -p                                       # interactively put together your patch
$ git commit                                       # commit it
$ git push -u <REMOTE>                             # where REMOTE is your "fork" on GitHub
[Build]
ToolsTree=
mkosi -R && mkosi ssh -- dnf upgrade --disablerepo="*" --assumeyes "/work/build/*.rpm"             # CentOS/Fedora
mkosi -R && mkosi ssh -- apt-get install "/work/build/*.deb"                                       # Debian/Ubuntu
mkosi -R && mkosi ssh -- pacman --upgrade --needed --noconfirm "/work/build/*.pkg.tar"             # Arch Linux
mkosi -R && mkosi ssh -- zypper --non-interactive install --allow-unsigned-rpm "/work/build/*.rpm" # OpenSUSE
mkosi -d <distribution> -r <release> -t none -f
mkosi -d <distribution> -r <release> -E WITH_DEBUG=1 -t none -f
run0 dnf upgrade build/mkosi.builddir/<distribution>~<release>~<architecture>/*.rpm                                           # Fedora/CentOS
run0 apt-get install build/mkosi.builddir/<distribution>~<release>~<architecture>/*.deb                                       # Debian/Ubuntu
run0 pacman --upgrade --needed --noconfirm build/mkosi.builddir/<distribution>~<release>~<architecture>/*.pkg.tar             # Arch Linux
run0 zypper --non-interactive install --allow-unsigned-rpm build/mkosi.builddir/<distribution>~<release>~<architecture>/*.rpm # OpenSUSE
run0 dnf downgrade "systemd*" # Fedora/CentOS
# TODO: Other distributions
$ wget https://build.opensuse.org/projects/system:systemd/signing_keys/download?kind=ssl -O- | openssl x509 -inform pem -outform der -out obs.der
$ run0 mokutil --import obs.der
#!/bin/sh
exec pkexec gdb "$@"
"C_Cpp.formatting": "Disabled",
"C_Cpp.intelliSenseEngine": "Disabled",
"C_Cpp.enhancedColorization": "Disabled",
"C_Cpp.suggestSnippets": false,
{
    "version": "0.2.0",
    "configurations": [
        {
            "type": "cppdbg",
            "program": "/usr/lib/systemd/systemd",
            "processId": "${command:pickRemoteProcess}",
            "request": "attach",
            "name": "systemd",
            "pipeTransport": {
                "pipeProgram": "mkosi",
                "pipeArgs": ["-C", "${workspaceFolder}", "ssh"],
                "debuggerPath": "/usr/bin/gdb"
            },
            "MIMode": "gdb",
            "sourceFileMap": {
                "/work/src": {
                    "editorPath": "${workspaceFolder}",
                    "useForBreakpoints": false
                },
            }
        }
    ]
}
{
    "name": "systemd-boot",
    "type": "cppdbg",
    "request": "launch",
    "program": "${workspaceFolder}/build/src/boot/efi/systemd-bootx64.efi",
    "cwd": "${workspaceFolder}",
    "MIMode": "gdb",
    "miDebuggerServerAddress": ":1234",
    "setupCommands": [
        { "text": "shell mkfifo /tmp/sdboot.{in,out}" },
        { "text": "shell qemu-system-x86_64 [...] -s -serial pipe:/tmp/sdboot" },
        { "text": "shell ${workspaceFolder}/tools/debug-sd-boot.sh ${workspaceFolder}/build/src/boot/efi/systemd-bootx64.efi /tmp/sdboot.out systemd-boot.gdb" },
        { "text": "source /tmp/systemd-boot.gdb" },
    ]
}
{
    "clangd.path": "<path-to-systemd-repository>/mkosi/mkosi.clangd",
}
$ mkosi box -- env CC=clang CXX=clang++ meson setup build
$ mkosi box -- ninja -C build gensources
$ gdbus introspect --system --dest org.freedesktop.login1 --object-path /org/freedesktop/login1
node /org/freedesktop/login1 {
  interface org.freedesktop.login1.Manager {
    methods:
      Inhibit(in  s what,
              in  s who,
              in  s why,
              in  s mode,
              out h fd);
      ListInhibitors(out a(ssssuu) inhibitors);
      ...
    signals:
      PrepareForShutdown(b active);
      PrepareForSleep(b active);
      ...
    properties:
      readonly s BlockInhibited = '';
      readonly s DelayInhibited = '';
      readonly t InhibitDelayMaxUSec = 5000000;
      readonly b PreparingForShutdown = false;
      readonly b PreparingForSleep = false;
      ...
  };
  ...
};
fd = Inhibit("shutdown:idle", "Package Manager", "Upgrade in progress...", "block");
/* ...
      do your work
                 ... */
close(fd);
int fd = -1;

takeLock() {
        if (fd >= 0)
                return;

        fd = Inhibit("sleep", "Word Processor", "Save any unsaved data in time...", "delay");
}

onDocumentOpen(void) {
        takeLock();
}

onPrepareForSleep(bool b) {
        if (b) {
                saveData();
                if (fd >= 0) {
                        close(fd);
                        fd = -1;
                }
         } else
                takeLock();

}
__CURSOR=s=739ad463348b4ceca5a9e69c95a3c93f;i=4ece7;b=6c7c6013a26343b29e964691ff25d04c;m=4fc72436e;t=4c508a72423d9;x=d3e5610681098c10;p=system.journal
__REALTIME_TIMESTAMP=1342540861416409
__MONOTONIC_TIMESTAMP=21415215982
_BOOT_ID=6c7c6013a26343b29e964691ff25d04c
_TRANSPORT=syslog
PRIORITY=4
SYSLOG_FACILITY=3
SYSLOG_IDENTIFIER=gdm-password]
SYSLOG_PID=587
MESSAGE=AccountsService-DEBUG(+): ActUserManager: ignoring unspecified session '8' since it's not graphical: Success
_PID=587
_UID=0
_GID=500
_COMM=gdm-session-wor
_EXE=/usr/libexec/gdm-session-worker
_CMDLINE=gdm-session-worker [pam/gdm-password]
_AUDIT_SESSION=2
_AUDIT_LOGINUID=500
_SYSTEMD_CGROUP=/user/lennart/2
_SYSTEMD_SESSION=2
_SELINUX_CONTEXT=system_u:system_r:xdm_t:s0-s0:c0.c1023
_SOURCE_REALTIME_TIMESTAMP=1342540861413961
_MACHINE_ID=a91663387a90b89f185d4e860000001a
_HOSTNAME=epsilon

__CURSOR=s=739ad463348b4ceca5a9e69c95a3c93f;i=4ece8;b=6c7c6013a26343b29e964691ff25d04c;m=4fc72572f;t=4c508a7243799;x=68597058a89b7246;p=system.journal
__REALTIME_TIMESTAMP=1342540861421465
__MONOTONIC_TIMESTAMP=21415221039
_BOOT_ID=6c7c6013a26343b29e964691ff25d04c
_TRANSPORT=syslog
PRIORITY=6
SYSLOG_FACILITY=9
SYSLOG_IDENTIFIER=/USR/SBIN/CROND
SYSLOG_PID=8278
MESSAGE=(root) CMD (run-parts /etc/cron.hourly)
_PID=8278
_UID=0
_GID=0
_COMM=run-parts
_EXE=/usr/bin/bash
_CMDLINE=/bin/bash /bin/run-parts /etc/cron.hourly
_AUDIT_SESSION=8
_AUDIT_LOGINUID=0
_SYSTEMD_CGROUP=/user/root/8
_SYSTEMD_SESSION=8
_SELINUX_CONTEXT=system_u:system_r:crond_t:s0-s0:c0.c1023
_SOURCE_REALTIME_TIMESTAMP=1342540861416351
_MACHINE_ID=a91663387a90b89f185d4e860000001a
_HOSTNAME=epsilon
python3 -c 'from systemd import journal; journal.send("foo\nbar")'
journalctl -n1 -o export
__CURSOR=s=bcce4fb8ffcb40e9a6e05eee8b7831bf;i=5ef603;b=ec25d6795f0645619ddac9afdef453ee;m=545242e7049;t=50f1202
__REALTIME_TIMESTAMP=1423944916375353
__MONOTONIC_TIMESTAMP=5794517905481
_BOOT_ID=ec25d6795f0645619ddac9afdef453ee
_TRANSPORT=journal
_UID=1001
_GID=1001
_CAP_EFFECTIVE=0
_SYSTEMD_OWNER_UID=1001
_SYSTEMD_SLICE=user-1001.slice
_MACHINE_ID=5833158886a8445e801d437313d25eff
_HOSTNAME=bupkis
_AUDIT_LOGINUID=1001
_SELINUX_CONTEXT=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
CODE_LINE=1
CODE_FUNC=<module>
SYSLOG_IDENTIFIER=python3
_COMM=python3
_EXE=/usr/bin/python3.4
_AUDIT_SESSION=35898
_SYSTEMD_CGROUP=/user.slice/user-1001.slice/session-35898.scope
_SYSTEMD_SESSION=35898
_SYSTEMD_UNIT=session-35898.scope
MESSAGE
^G^@^@^@^@^@^@^@foo
bar
CODE_FILE=<string>
_PID=16853
_CMDLINE=python3 -c from systemd import journal; journal.send("foo\nbar")
_SOURCE_REALTIME_TIMESTAMP=1423944916372858
MESSAGE=Hello World
_UDEV_DEVNODE=/dev/waldo
_UDEV_DEVLINK=/dev/alias1
_UDEV_DEVLINK=/dev/alias2
BINARY=this is a binary value \a
LARGE=this is a super large value (let's pretend at least, for the sake of this example)
{
  "MESSAGE" : "Hello World",
  "_UDEV_DEVNODE" : "/dev/waldo",
  "_UDEV_DEVLINK" : [ "/dev/alias1", "/dev/alias2" ],
  "BINARY" : [ 116, 104, 105, 115, 32, 105, 115, 32, 97, 32, 98, 105, 110, 97, 114, 121, 32, 118, 97, 108, 117, 101, 32, 7 ],
  "LARGE" : null
}
enum {
        OBJECT_UNUSED,
        OBJECT_DATA,
        OBJECT_FIELD,
        OBJECT_ENTRY,
        OBJECT_DATA_HASH_TABLE,
        OBJECT_FIELD_HASH_TABLE,
        OBJECT_ENTRY_ARRAY,
        OBJECT_TAG,
        _OBJECT_TYPE_MAX
};
_packed_ struct Header {
        uint8_t signature[8]; /* "LPKSHHRH" */
        le32_t compatible_flags;
        le32_t incompatible_flags;
        uint8_t state;
        uint8_t reserved[7];
        sd_id128_t file_id;
        sd_id128_t machine_id;
        sd_id128_t tail_entry_boot_id;
        sd_id128_t seqnum_id;
        le64_t header_size;
        le64_t arena_size;
        le64_t data_hash_table_offset;
        le64_t data_hash_table_size;
        le64_t field_hash_table_offset;
        le64_t field_hash_table_size;
        le64_t tail_object_offset;
        le64_t n_objects;
        le64_t n_entries;
        le64_t tail_entry_seqnum;
        le64_t head_entry_seqnum;
        le64_t entry_array_offset;
        le64_t head_entry_realtime;
        le64_t tail_entry_realtime;
        le64_t tail_entry_monotonic;
        /* Added in 187 */
        le64_t n_data;
        le64_t n_fields;
        /* Added in 189 */
        le64_t n_tags;
        le64_t n_entry_arrays;
        /* Added in 246 */
        le64_t data_hash_chain_depth;
        le64_t field_hash_chain_depth;
        /* Added in 252 */
        le32_t tail_entry_array_offset;
        le32_t tail_entry_array_n_entries;
        /* Added in 254 */
        le64_t tail_entry_offset;
};
enum {
        HEADER_INCOMPATIBLE_COMPRESSED_XZ   = 1 << 0,
        HEADER_INCOMPATIBLE_COMPRESSED_LZ4  = 1 << 1,
        HEADER_INCOMPATIBLE_KEYED_HASH      = 1 << 2,
        HEADER_INCOMPATIBLE_COMPRESSED_ZSTD = 1 << 3,
        HEADER_INCOMPATIBLE_COMPACT         = 1 << 4,
};

enum {
        HEADER_COMPATIBLE_SEALED             = 1 << 0,
        HEADER_COMPATIBLE_TAIL_ENTRY_BOOT_ID = 1 << 1,
};
enum {
        STATE_OFFLINE = 0,
        STATE_ONLINE = 1,
        STATE_ARCHIVED = 2,
        _STATE_MAX
};
enum {
        OBJECT_COMPRESSED_XZ   = 1 << 0,
        OBJECT_COMPRESSED_LZ4  = 1 << 1,
        OBJECT_COMPRESSED_ZSTD = 1 << 2,
};

_packed_ struct ObjectHeader {
        uint8_t type;
        uint8_t flags;
        uint8_t reserved[6];
        le64_t size;
        uint8_t payload[];
};
_packed_ struct DataObject {
        ObjectHeader object;
        le64_t hash;
        le64_t next_hash_offset;
        le64_t next_field_offset;
        le64_t entry_offset; /* the first array entry we store inline */
        le64_t entry_array_offset;
        le64_t n_entries;
        union {                                                         \
                struct {                                                \
                        uint8_t payload[] ;                             \
                } regular;                                              \
                struct {                                                \
                        le32_t tail_entry_array_offset;                 \
                        le32_t tail_entry_array_n_entries;              \
                        uint8_t payload[];                              \
                } compact;                                              \
        };                                                              \
};
_packed_ struct FieldObject {
        ObjectHeader object;
        le64_t hash;
        le64_t next_hash_offset;
        le64_t head_data_offset;
        uint8_t payload[];
};
_packed_ struct EntryObject {
        ObjectHeader object;
        le64_t seqnum;
        le64_t realtime;
        le64_t monotonic;
        sd_id128_t boot_id;
        le64_t xor_hash;
        union {                                 \
                struct {                        \
                        le64_t object_offset;   \
                        le64_t hash;            \
                } regular[];                    \
                struct {                        \
                        le32_t object_offset;   \
                } compact[];                    \
        } items;                                \
};
_packed_ struct HashItem {
        le64_t head_hash_offset;
        le64_t tail_hash_offset;
};

_packed_ struct HashTableObject {
        ObjectHeader object;
        HashItem items[];
};
_packed_ struct EntryArrayObject {
        ObjectHeader object;
        le64_t next_entry_array_offset;
        union {
                le64_t regular[];
                le32_t compact[];
        } items;
};
#define TAG_LENGTH (256/8)

_packed_ struct TagObject {
        ObjectHeader object;
        le64_t seqnum;
        le64_t epoch;
        uint8_t tag[TAG_LENGTH]; /* SHA-256 HMAC */
};
-- fc2e22bc6ee647b6b90729ab34a250b1
Subject: Process @COREDUMP_PID@ (@COREDUMP_COMM@) dumped core
Defined-By: systemd
Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
Documentation: man:core(5)

Process @COREDUMP_PID@ (@COREDUMP_COMM@) crashed and dumped core.

This usually indicates a programming error in the crashing program and
should be reported to its vendor as a bug.
{
	"groupName" : "systemd-resolve",
	"gid" : 193,
	"status" : {
		"6b18704270e94aa896b003b4340978f1" : {
			"service" : "io.systemd.NameServiceSwitch"
		}
	}
}
{
	"groupName" : "grobie",
	"binding" : {
		"6b18704270e94aa896b003b4340978f1" : {
			"gid" : 60232
		}
	},
	"disposition" : "regular",
	"status" : {
		"6b18704270e94aa896b003b4340978f1" : {
			"service" : "io.systemd.Home"
		}
	}
}
{
"userName" : "u"
}
{
        "userName" : "httpd",
        "uid" : 473,
        "gid" : 473,
        "disposition" : "system",
        "locked" : true
}
{
        "autoLogin" : true,
        "binding" : {
                "15e19cf24e004b949ddaac60c74aa165" : {
                        "fileSystemType" : "ext4",
                        "fileSystemUuid" : "758e88c8-5851-4a2a-b88f-e7474279c111",
                        "gid" : 60232,
                        "homeDirectory" : "/home/grobie",
                        "blobDirectory" : "/var/cache/systemd/homed/grobie/",
                        "imagePath" : "/home/grobie.home",
                        "luksCipher" : "aes",
                        "luksCipherMode" : "xts-plain64",
                        "luksUuid" : "e63581ba-79fb-4226-b9de-1888393f7573",
                        "luksVolumeKeySize" : 32,
                        "partitionUuid" : "41f9ce04-c827-4b74-a981-c669f93eb4dc",
                        "storage" : "luks",
                        "uid" : 60232
                }
        },
        "blobManifest" : {
                "avatar" : "c0636851d25a62d817ff7da4e081d1e646e42c74d0ecb53425f75fcf1ba43b52",
                "login-background" : "da7ad0222a6edbc6cd095149c72d38d92fd3114f606e4b57469857ef47fade18"
        },
        "disposition" : "regular",
        "enforcePasswordPolicy" : false,
        "lastChangeUSec" : 1565950024279735,
        "memberOf" : [
                "wheel"
        ],
        "privileged" : {
                "hashedPassword" : [
                        "$6$WHBKvAFFT9jKPA4k$OPY4D4TczKN/jOnJzy54DDuOOagCcvxxybrwMbe1SVdm.Bbr.zOmBdATp.QrwZmvqyr8/SafbbQu.QZ2rRvDs/"
                ]
        },
        "signature" : [
                {
                        "data" : "LU/HeVrPZSzi3MJ0PVHwD5m/xf51XDYCrSpbDRNBdtF4fDVhrN0t2I2OqH/1yXiBidXlV0ptMuQVq8KVICdEDw==",
                        "key" : "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA/QT6kQWOAMhDJf56jBmszEQQpJHqDsGDMZOdiptBgRk=\n-----END PUBLIC KEY-----\n"
                }
        ],
        "userName" : "grobie",
        "status" : {
                "15e19cf24e004b949ddaac60c74aa165" : {
                        "goodAuthenticationCounter" : 16,
                        "lastGoodAuthenticationUSec" : 1566309343044322,
                        "rateLimitBeginUSec" : 1566309342340723,
                        "rateLimitCount" : 1,
                        "state" : "inactive",
                        "service" : "io.systemd.Home",
                        "diskSize" : 161118667776,
                        "diskCeiling" : 190371729408,
                        "diskFloor" : 5242880,
                        "signedLocally" : true
                }
        }
}
{
        "autoLogin" : true,
        "disposition" : "regular",
        "enforcePasswordPolicy" : false,
        "lastChangeUSec" : 1565950024279735,
        "memberOf" : [
                "wheel"
        ],
        "privileged" : {
                "hashedPassword" : [
                        "$6$WHBKvAFFT9jKPA4k$OPY4D4TczKN/jOnJzy54DDuOOagCcvxxybrwMbe1SVdm.Bbr.zOmBdATp.QrwZmvqyr8/SafbbQu.QZ2rRvDs/"
                ]
        },
        "signature" : [
                {
                        "data" : "LU/HeVrPZSzi3MJ0PVHwD5m/xf51XDYCrSpbDRNBdtF4fDVhrN0t2I2OqH/1yXiBidXlV0ptMuQVq8KVICdEDw==",
                        "key" : "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA/QT6kQWOAMhDJf56jBmszEQQpJHqDsGDMZOdiptBgRk=\n-----END PUBLIC KEY-----\n"
                }
        ],
        "userName" : "grobie"
}
SYSTEMD_HOME_DEBUG_SUFFIX=foo \
      SYSTEMD_HOMEWORK_PATH=/home/lennart/projects/systemd/build/systemd-homework \
      SYSTEMD_HOME_ROOT=/home.foo/ \
      SYSTEMD_HOME_RECORD_DIR=/var/lib/systemd/home.foo/ \
      /home/lennart/projects/systemd/build/systemd-homed
$ gcc -o take_BSD_lock -lsystemd take_BSD_lock.c

$ ./take_BSD_lock /dev/sda1
Successfully took a BSD lock: /dev/sda

$ flock -x /dev/sda ./take_BSD_lock /dev/sda1
Failed to take a BSD lock on /dev/sda: Resource temporarily unavailable
/* SPDX-License-Identifier: MIT-0 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/file.h>
#include <systemd/sd-device.h>
#include <unistd.h>

static inline void closep(int *fd) {
    if (*fd >= 0)
        close(*fd);
}

/**
 * lock_whole_disk_from_devname
 * @devname: devname of a block device, e.g., /dev/sda or /dev/sda1
 * @open_flags: the flags to open the device, e.g., O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY
 * @flock_operation: the operation to call flock, e.g., LOCK_EX|LOCK_NB
 *
 * given the devname of a block device, take a BSD lock of the whole disk
 *
 * Returns: negative errno value on error, or non-negative fd if the lock was taken successfully.
 **/
int lock_whole_disk_from_devname(const char *devname, int open_flags, int flock_operation) {
    __attribute__((cleanup(sd_device_unrefp))) sd_device *dev = NULL;
    sd_device *whole_dev;
    const char *whole_disk_devname, *subsystem, *devtype;
    int r;

    // create a sd_device instance from devname
    r = sd_device_new_from_devname(&dev, devname);
    if (r < 0) {
        errno = -r;
        fprintf(stderr, "Failed to create sd_device: %m\n");
        return r;
    }

    // if the subsystem of dev is block, but its devtype is not disk, find its parent
    r = sd_device_get_subsystem(dev, &subsystem);
    if (r < 0) {
        errno = -r;
        fprintf(stderr, "Failed to get the subsystem: %m\n");
        return r;
    }
    if (strcmp(subsystem, "block") != 0) {
        fprintf(stderr, "%s is not a block device, refusing.\n", devname);
        return -EINVAL;
    }

    r = sd_device_get_devtype(dev, &devtype);
    if (r < 0) {
        errno = -r;
        fprintf(stderr, "Failed to get the devtype: %m\n");
        return r;
    }
    if (strcmp(devtype, "disk") == 0)
        whole_dev = dev;
    else {
        r = sd_device_get_parent_with_subsystem_devtype(dev, "block", "disk", &whole_dev);
        if (r < 0) {
            errno = -r;
            fprintf(stderr, "Failed to get the parent device: %m\n");
            return r;
        }
    }

    // open the whole disk device node
    __attribute__((cleanup(closep))) int fd = sd_device_open(whole_dev, open_flags);
    if (fd < 0) {
        errno = -fd;
        fprintf(stderr, "Failed to open the device: %m\n");
        return fd;
    }

    // get the whole disk devname
    r = sd_device_get_devname(whole_dev, &whole_disk_devname);
    if (r < 0) {
        errno = -r;
        fprintf(stderr, "Failed to get the whole disk name: %m\n");
        return r;
    }

    // take a BSD lock of the whole disk device node
    if (flock(fd, flock_operation) < 0) {
        r = -errno;
        fprintf(stderr, "Failed to take a BSD lock on %s: %m\n", whole_disk_devname);
        return r;
    }

    printf("Successfully took a BSD lock: %s\n", whole_disk_devname);

    // take the fd to avoid automatic cleanup
    int ret_fd = fd;
    fd = -EBADF;
    return ret_fd;
}

int main(int argc, char **argv) {
    if (argc != 2) {
        fprintf(stderr, "Invalid number of parameters.\n");
        return EXIT_FAILURE;
    }

    // try to take an exclusive and nonblocking BSD lock (use O_WRONLY mode to ensure udev
    // rescans the device once the lock is closed)
    __attribute__((cleanup(closep))) int fd =
        lock_whole_disk_from_devname(
            argv[1],
            O_WRONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY,
            LOCK_EX|LOCK_NB);

    if (fd < 0)
        return EXIT_FAILURE;

    /**
     * The device is now locked until the return below.
     * Now you can safely manipulate the block device.
     **/

    return EXIT_SUCCESS;
}
PRIORITY=3\n
SYSLOG_FACILITY=3\n
CODE_FILE=src/foobar.c\n
CODE_LINE=77\n
BINARY_BLOB\n
\004\000\000\000\000\000\000\000xx\nx\n
CODE_FUNC=some_func\n
SYSLOG_IDENTIFIER=footool\n
MESSAGE=Something happened.\n
├─user.slice
│ └─user-1000.slice
│   ├─session-18.scope
│   │ ├─703 login -- lennart
│   │ └─773 -bash
│   ├─session-1.scope
│   │ ├─  518 gdm-session-worker [pam/gdm-autologin]
│   │ ├─  540 gnome-session
│   │ ├─  552 dbus-launch --sh-syntax --exit-with-session
│   │ ├─  553 /bin/dbus-daemon --fork --print-pid 4 --print-address 6 --session
│   │ ├─  589 /usr/libexec/gvfsd
│   │ ├─  593 /usr/libexec//gvfsd-fuse -f /run/user/1000/gvfs
│   │ ├─  598 /usr/libexec/gnome-settings-daemon
│   │ ├─  617 /usr/bin/gnome-keyring-daemon --start --components=gpg
│   │ ├─  630 /usr/bin/pulseaudio --start
│   │ ├─  726 /usr/bin/gnome-shell
│   │ ├─  728 syndaemon -i 1.0 -t -K -R
│   │ ├─  736 /usr/libexec/gsd-printer
│   │ ├─  742 /usr/libexec/dconf-service
│   │ ├─  798 /usr/libexec/mission-control-5
│   │ ├─  802 /usr/libexec/goa-daemon
│   │ ├─  823 /usr/libexec/gvfsd-metadata
│   │ ├─  866 /usr/libexec/gvfs-udisks2-volume-monitor
│   │ ├─  880 /usr/libexec/gvfs-gphoto2-volume-monitor
│   │ ├─  886 /usr/libexec/gvfs-afc-volume-monitor
│   │ ├─  891 /usr/libexec/gvfs-mtp-volume-monitor
│   │ ├─  895 /usr/libexec/gvfs-goa-volume-monitor
│   │ ├─  999 /usr/libexec/telepathy-logger
│   │ ├─ 1076 /usr/libexec/gnome-terminal-server
│   │ ├─ 1079 gnome-pty-helper
│   │ ├─ 1080 bash
│   │ ├─ 1134 ssh-agent
│   │ ├─ 1137 gedit l
│   │ ├─ 1160 gpg-agent --daemon --write-env-file
│   │ ├─ 1371 /usr/lib64/firefox/firefox
│   │ ├─ 1729 systemd-cgls
│   │ ├─ 1929 bash
│   │ ├─ 2057 emacs src/login/org.freedesktop.login1.policy.in
│   │ ├─ 2060 /usr/libexec/gconfd-2
│   │ ├─29634 /usr/libexec/gvfsd-http --spawner :1.5 /org/gtk/gvfs/exec_spaw/0
│   │ └─31416 bash
│   └─user@1000.service
│     ├─532 /usr/lib/systemd/systemd --user
│     └─541 (sd-pam)
└─system.slice
  ├─1 /usr/lib/systemd/systemd --system --deserialize 22
  ├─sshd.service
  │ └─29701 /usr/sbin/sshd -D
  ├─udisks2.service
  │ └─743 /usr/lib/udisks2/udisksd --no-debug
  ├─colord.service
  │ └─727 /usr/libexec/colord
  ├─upower.service
  │ └─633 /usr/libexec/upowerd
  ├─wpa_supplicant.service
  │ └─488 /usr/sbin/wpa_supplicant -u -f /var/log/wpa_supplicant.log -c /etc/wpa_supplicant/wpa_supplicant.conf -u -f /var/log/wpa_supplicant.log -P /var/run/wpa_supplicant.pid
  ├─bluetooth.service
  │ └─463 /usr/sbin/bluetoothd -n
  ├─polkit.service
  │ └─443 /usr/lib/polkit-1/polkitd --no-debug
  ├─alsa-state.service
  │ └─408 /usr/sbin/alsactl -s -n 19 -c -E ALSA_CONFIG_PATH=/etc/alsa/alsactl.conf --initfile=/lib/alsa/init/00main rdaemon
  ├─systemd-udevd.service
  │ └─253 /usr/lib/systemd/systemd-udevd
  ├─systemd-journald.service
  │ └─240 /usr/lib/systemd/systemd-journald
  ├─rtkit-daemon.service
  │ └─419 /usr/libexec/rtkit-daemon
  ├─rpcbind.service
  │ └─475 /sbin/rpcbind -w
  ├─cups.service
  │ └─731 /usr/sbin/cupsd -f
  ├─avahi-daemon.service
  │ ├─417 avahi-daemon: running [delta.local]
  │ └─424 avahi-daemon: chroot helper
  ├─dbus.service
  │ ├─418 /bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation
  │ └─462 /usr/sbin/modem-manager
  ├─accounts-daemon.service
  │ └─416 /usr/libexec/accounts-daemon
  ├─systemd-ask-password-wall.service
  │ └─434 /usr/bin/systemd-tty-ask-password-agent --wall
  ├─systemd-logind.service
  │ └─415 /usr/lib/systemd/systemd-logind
  ├─ntpd.service
  │ └─429 /usr/sbin/ntpd -u ntp:ntp -g
  ├─rngd.service
  │ └─412 /sbin/rngd -f
  ├─libvirtd.service
  │ └─467 /usr/sbin/libvirtd
  ├─irqbalance.service
  │ └─411 /usr/sbin/irqbalance --foreground
  ├─crond.service
  │ └─421 /usr/sbin/crond -n
  ├─NetworkManager.service
  │ ├─ 410 /usr/sbin/NetworkManager --no-daemon
  │ ├─1066 /sbin/dhclient -d -sf /usr/libexec/nm-dhcp-client.action -pf /var/run/dhclient-enp0s20u2.pid -lf /var/lib/NetworkManager/dhclient-35c8218b-9e45-4b1f-b79e-22334f687340-enp0s20u2.lease -cf /var/lib/NetworkManager/dhclient-enp0s20u2.conf enp0s20u2
  │ └─1070 /sbin/dhclient -d -sf /usr/libexec/nm-dhcp-client.action -pf /var/run/dhclient-enp0s26u1u4i2.pid -lf /var/lib/NetworkManager/dhclient-f404f1ca-ccfe-4957-aead-dec19c126dea-enp0s26u1u4i2.lease -cf /var/lib/NetworkManager/dhclient-enp0s26u1u4i2.conf enp0s26u1u4i2
  └─gdm.service
    ├─420 /usr/sbin/gdm
    ├─449 /usr/libexec/gdm-simple-slave --display-id /org/gnome/DisplayManager/Displays/_0
    └─476 /usr/bin/Xorg :0 -background none -verbose -auth /run/gdm/auth-for-gdm-pJjwsi/database -seat seat0 -nolisten tcp vt1
# systemctl set-property httpd.service CPUShares=500 MemoryLimit=500M
$ ninja -C build/ systemd-pot
$ cp po/systemd.pot po/${lang_code}.po
$ ninja -C build/ systemd-update-po
$ ninja -C build/ systemd-gmo
# portablectl attach foobar_0.7.23.raw
[Service]
RootImage=/path/to/foobar.raw
Environment=PORTABLE=foobar
LogExtraFields=PORTABLE=foobar
/usr/bin/minimald                            # a statically compiled binary
/usr/lib/systemd/system/minimal-test.service # the unit file for the service, with ExecStart=/usr/bin/minimald
/usr/lib/os-release                          # an os-release file explaining what this is
/etc/resolv.conf                             # empty file to mount over with host's version
/etc/machine-id                              # ditto
/proc/                                       # empty directory to use as mount point for host's API fs
/sys/                                        # ditto
/dev/                                        # ditto
/run/                                        # ditto
/tmp/                                        # ditto
/var/tmp/                                    # ditto
# portablectl attach --extension foobar_0.7.23.raw debian-runtime_11.1.raw foobar
# portablectl attach --extension barbaz_7.0.23/ debian-runtime_11.1.raw barbaz
# portablectl attach foobar_0.7.23.raw
# systemctl enable --now foobar@instancea.service
# systemctl enable --now foobar@instanceb.service
…
PORTABLE=app0.raw
PORTABLE_ROOT=base.raw
PORTABLE_ROOT_NAME_AND_VERSION=debian_10
PORTABLE_EXTENSION=app0.raw
PORTABLE_EXTENSION_NAME_AND_VERSION=app_0
PORTABLE_EXTENSION=app1.raw
PORTABLE_EXTENSION_NAME_AND_VERSION=app_1
struct linux_efi_random_seed {
    u32     size; // of the 'seed' array in bytes
    u8      seed[];
};
(void) sd_event_add_memory_pressure(event, NULL, NULL, NULL);
(void) sd_event_add_cpu_pressure(event, NULL, my_cpu_pressure_handler, userdata);
(void) sd_event_add_io_pressure(event, NULL, my_io_pressure_handler, userdata);
After=network-online.target
Wants=network-online.target
$ systemctl is-enabled NetworkManager-wait-online.service systemd-networkd-wait-online.service
disabled
enabled

[Unit]
DefaultDependencies=no
After=nss-lookup.target
Before=network-online.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=sh -c 'until ping -c 1 example.com; do sleep 1; done'

[Install]
WantedBy=network-online.target
http {
  server {
    listen [::]:80 ipv6only=on;
    listen 80;
  }
}
[Service]
User=nginx
Group=nginx
Environment=NGINX=3:4;
ExecStart=/usr/sbin/nginx -c/etc/nginx/my-nginx.conf
PrivateNetwork=true
[Socket]
ListenStream=80
ListenStream=0.0.0.0:80
BindIPv6Only=ipv6-only

[Install]
WantedBy=sockets.target
[global]
pid = /run/my-php-fpm-pool.pid ; Not really used by anything with daemonize = no, but needs to be writable.
error_log = syslog             ; Will aggregate to the service's systemd journal.
daemonize = no                 ; systemd handles the forking.

[www]
listen = /var/run/my-php-fpm-pool.socket  ; Must match systemd socket unit.
user = nginx ; Ignored but required.
group = nginx ; Ignored but required.
pm = static
pm.max_children = 10
slowlog = syslog
[Service]
User=nginx
Group=nginx
Environment="FPM_SOCKETS=/var/run/my-php-fpm-pool.socket=3"
ExecStart=/usr/sbin/php-fpm --fpm-config=/etc/php-fpm.d/my-php-fpm-pool.conf
KillMode=process
[Socket]
ListenStream=/var/run/my-php-fpm-pool.socket

[Install]
WantedBy=sockets.target
sudo systemctl --system daemon-reload
sudo systemctl start my-php-fpm-pool.socket
sudo systemctl enable my-php-fpm-pool.socket
sudo systemctl status my-php-fpm-pool.service
sudo systemctl stop my-php-fpm-pool.socket my-php-fpm-pool.service
sudo systemctl start my-php-fpm-pool.socket
...
argv[0][0] = '@';
...
#include <unistd.h>

int main(int argc, char *argv[]) {
        ...
        if (access("/etc/initrd-release", F_OK) >= 0)
                argv[0][0] = '@';
        ...
    }
[Unit]
…
DefaultDependencies=no
IgnoreOnIsolate=yes
RefuseManualStop=yes
SurviveFinalKillSignal=yes
…
$ mkdir -p /etc/sysctl.d
$ cat >/etc/sysctl.d/50-coredump.conf <<EOF
# Party like it's 1995!
kernel.core_pattern=core
EOF

$ mkdir -p /etc/systemd/system.conf.d
$ cat >/etc/systemd/system.conf.d/50-coredump.conf <<EOF
[Manager]
DefaultLimitCORE=0:infinity
EOF

 ┌──────┐posix_spawn() ┌───────────┐execve() ┌────────┐
 │ PID1 ├─────────────►│sd-executor├────────►│program │
 └──────┘  (memfd)     └───────────┘         └────────┘
/boot/loader/loader.conf
timeout 3
default 6a9857a393724b7a981ebb5b8495b9ea-*

/boot/loader/entries/6a9857a393724b7a981ebb5b8495b9ea-3.8.0-2.fc19.x86_64.conf
title      Fedora 19 (Rawhide)
version    3.8.0-2.fc19.x86_64
machine-id 6a9857a393724b7a981ebb5b8495b9ea
linux      /6a9857a393724b7a981ebb5b8495b9ea/3.8.0-2.fc19.x86_64/linux
initrd     /6a9857a393724b7a981ebb5b8495b9ea/3.8.0-2.fc19.x86_64/initrd
options    root=UUID=f8f83f73-df71-445c-87f7-31f70263b83b quiet

/boot/loader/entries/custom-kernel.conf
title      My kernel
efi        /bzImage
options    root=PARTUUID=084917b7-8be2-4e86-838d-f771a9902e08

/boot/loader/entries/custom-kernel-initrd.conf
title      My kernel with initrd
linux      /bzImage
initrd     /initrd.img
options    root=PARTUUID=084917b7-8be2-4e86-838d-f771a9902e08 quiet
 resolvectl domain corporate0 '~corp-company.example' '~2.0.192.in-addr.arpa'
 resolvectl default-route corporate0 false
 resolvectl dns corporate0 192.0.2.1

 resolvectl domain privacy0 '~.'
 resolvectl default-route privacy0 true
 resolvectl dns privacy0 8.8.8.8

[Build]
Environment=SANITIZERS=address,undefined
ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1
UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1
CFLAGS=-shared-libasan
CXXFLAGS=-shared-libasan
ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1
UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1
# Optionally locate the respective runtime DSO
$ ldd build/systemd | grep libclang_rt.asan
        libclang_rt.asan-x86_64.so => not found
        libclang_rt.asan-x86_64.so => not found
$ find /usr/lib* /usr/local/lib* -type f -name libclang_rt.asan-x86_64.so 2>/dev/null
/usr/lib64/clang/7.0.1/lib/libclang_rt.asan-x86_64.so

# Set the LD_LIBRARY_PATH accordingly
export LD_LIBRARY_PATH=/usr/lib64/clang/7.0.1/lib/

# If the path is correct, the "not found" message should change to an actual path
$ ldd build/systemd | grep libclang_rt.asan
        libclang_rt.asan-x86_64.so => /usr/lib64/clang/7.0.1/lib/libclang_rt.asan-x86_64.so (0x00007fa9752fc000)
/bin → /usr/bin
/sbin → /usr/sbin
/lib → /usr/lib
/lib64 → /usr/lib64
$ systemctl
UNIT                       LOAD   ACTIVE SUB     JOB DESCRIPTION
accounts-daemon.service    loaded active running     Accounts Service
atd.service                loaded active running     Job spooling tools
avahi-daemon.service       loaded active running     Avahi mDNS/DNS-SD Stack
bluetooth.service          loaded active running     Bluetooth Manager
colord-sane.service        loaded active running     Daemon for monitoring attached scanners and registering them with colord
colord.service             loaded active running     Manage, Install and Generate Color Profiles
crond.service              loaded active running     Command Scheduler
cups.service               loaded active running     CUPS Printing Service
dbus.service               loaded active running     D-Bus System Message Bus
...
$ systemctl status udisks2.service
udisks2.service - Storage Daemon
            Loaded: loaded (/usr/lib/systemd/system/udisks2.service; static)
            Active: active (running) since Wed, 27 Jun 2012 20:49:25 +0200; 1 day and 1h ago
        Main PID: 615 (udisksd)
            CGroup: name=systemd:/system/udisks2.service
                    └ 615 /usr/lib/udisks2/udisksd --no-debug

Jun 27 20:49:25 epsilon udisksd[615]: udisks daemon version 1.94.0 starting
Jun 27 20:49:25 epsilon udisksd[615]: Acquired the name org.freedesktop.UDisks2 on the system message bus
$ systemd-cgls
└ system
├ 1 /usr/lib/systemd/systemd --system --deserialize 18
├ ntpd.service
│ └ 8471 /usr/sbin/ntpd -u ntp:ntp -g
├ upower.service
│ └ 798 /usr/libexec/upowerd
├ wpa_supplicant.service
│ └ 751 /usr/sbin/wpa_supplicant -u -f /var/log/wpa_supplicant.log -c /etc/wpa_supplicant/wpa_supplicant.conf -u -f /var/log/wpa_supplicant.log -P /var/run/wpa_supplicant.pid
├ nfs-idmap.service
│ └ 731 /usr/sbin/rpc.idmapd
├ nfs-rquotad.service
│ └ 753 /usr/sbin/rpc.rquotad
├ nfs-mountd.service
│ └ 732 /usr/sbin/rpc.mountd
├ nfs-lock.service
│ └ 704 /sbin/rpc.statd
├ rpcbind.service
│ └ 680 /sbin/rpcbind -w
├ postfix.service
│ ├   859 /usr/libexec/postfix/master
│ ├   877 qmgr -l -t fifo -u
│ └ 32271 pickup -l -t fifo -u
├ colord-sane.service
│ └ 647 /usr/libexec/colord-sane
├ udisks2.service
│ └ 615 /usr/lib/udisks2/udisksd --no-debug
├ colord.service
│ └ 607 /usr/libexec/colord
├ prefdm.service
│ ├ 567 /usr/sbin/gdm-binary -nodaemon
│ ├ 602 /usr/libexec/gdm-simple-slave --display-id /org/gnome/DisplayManager/Display1
│ ├ 612 /usr/bin/Xorg :0 -br -verbose -auth /var/run/gdm/auth-for-gdm-O00GPA/database -seat seat0 -nolisten tcp
│ └ 905 gdm-session-worker [pam/gdm-password]
├ systemd-ask-password-wall.service
│ └ 645 /usr/bin/systemd-tty-ask-password-agent --wall
├ atd.service
│ └ 544 /usr/sbin/atd -f
├ ksmtuned.service
│ ├  548 /bin/bash /usr/sbin/ksmtuned
│ └ 1092 sleep 60
├ dbus.service
│ ├ 586 /bin/dbus-daemon --system --address=systemd: --nofork --systemd-activation
│ ├ 601 /usr/libexec/polkit-1/polkitd --no-debug
│ └ 657 /usr/sbin/modem-manager
├ cups.service
│ └ 508 /usr/sbin/cupsd -f
├ avahi-daemon.service
│ ├ 506 avahi-daemon: running [epsilon.local]
│ └ 516 avahi-daemon: chroot helper
├ system-setup-keyboard.service
│ └ 504 /usr/bin/system-setup-keyboard
├ accounts-daemon.service
│ └ 502 /usr/libexec/accounts-daemon
├ systemd-logind.service
│ └ 498 /usr/lib/systemd/systemd-logind
├ crond.service
│ └ 486 /usr/sbin/crond -n
├ NetworkManager.service
│ ├  484 /usr/sbin/NetworkManager --no-daemon
│ └ 8437 /sbin/dhclient -d -4 -sf /usr/libexec/nm-dhcp-client.action -pf /var/run/dhclient-wlan0.pid -lf /var/lib/dhclient/dhclient-903b6f6aa7a1-46c8-82a9-7f637dfbb3e4-wlan0.lease -cf /var/run/nm-d...
├ libvirtd.service
│ ├ 480 /usr/sbin/libvirtd
│ └ 571 /sbin/dnsmasq --strict-order --bind-interfaces --pid-file=/var/run/libvirt/network/default.pid --conf-file= --except-interface lo --listenaddress 192.168.122.1 --dhcp-range 192.168.122.2,1...
├ bluetooth.service
│ └ 479 /usr/sbin/bluetoothd -n
├ systemd-udev.service
│ └ 287 /usr/lib/systemd/systemd-udevd
└ systemd-journald.service
└ 280 /usr/lib/systemd/systemd-journald
$ alias psc='ps xawf -eo pid,user,cgroup,args'
$ psc
    PID USER     CGROUP                              COMMAND
...
    1 root     name=systemd:/systemd-1             /bin/systemd systemd.log_target=kmsg systemd.log_level=debug selinux=0
    415 root     name=systemd:/systemd-1/sysinit.service /sbin/udevd -d
    928 root     name=systemd:/systemd-1/atd.service /usr/sbin/atd -f
    930 root     name=systemd:/systemd-1/ntpd.service /usr/sbin/ntpd -n
    932 root     name=systemd:/systemd-1/crond.service /usr/sbin/crond -n
    935 root     name=systemd:/systemd-1/auditd.service /sbin/auditd -n
    943 root     name=systemd:/systemd-1/auditd.service  \_ /sbin/audispd
    964 root     name=systemd:/systemd-1/auditd.service      \_ /usr/sbin/sedispatch
    937 root     name=systemd:/systemd-1/acpid.service /usr/sbin/acpid -f
    941 rpc      name=systemd:/systemd-1/rpcbind.service /sbin/rpcbind -f
    944 root     name=systemd:/systemd-1/rsyslog.service /sbin/rsyslogd -n -c 4
    947 root     name=systemd:/systemd-1/systemd-logger.service /lib/systemd/systemd-logger
    950 root     name=systemd:/systemd-1/cups.service /usr/sbin/cupsd -f
    955 dbus     name=systemd:/systemd-1/messagebus.service /bin/dbus-daemon --system --address=systemd: --nofork --systemd-activation
    969 root     name=systemd:/systemd-1/getty@.service/tty6 /sbin/mingetty tty6
    970 root     name=systemd:/systemd-1/getty@.service/tty5 /sbin/mingetty tty5
    971 root     name=systemd:/systemd-1/getty@.service/tty1 /sbin/mingetty tty1
    973 root     name=systemd:/systemd-1/getty@.service/tty4 /sbin/mingetty tty4
    974 root     name=systemd:/user/lennart/2        login -- lennart
    1824 lennart  name=systemd:/user/lennart/2         \_ -bash
    975 root     name=systemd:/systemd-1/getty@.service/tty3 /sbin/mingetty tty3
    988 root     name=systemd:/systemd-1/polkitd.service /usr/libexec/polkit-1/polkitd
    994 rtkit    name=systemd:/systemd-1/rtkit-daemon.service /usr/libexec/rtkit-daemon
...
$ ln -sf /usr/lib/systemd/system/multi-user.target /etc/systemd/system/default.target
$ ln -sf /usr/lib/systemd/system/graphical.target /etc/systemd/system/default.target
$ systemctl show -p "Wants" multi-user.target
Wants=rc-local.service avahi-daemon.service rpcbind.service NetworkManager.service acpid.service dbus.service atd.service crond.service auditd.service ntpd.service udisks.service bluetooth.service cups.service wpa_supplicant.service getty.target modem-manager.service portreserve.service abrtd.service yum-updatesd.service upowerd.service test-first.service pcscd.service rsyslog.service haldaemon.service remote-fs.target plymouth-quit.service systemd-update-utmp-runlevel.service sendmail.service lvm2-monitor.service cpuspeed.service udev-post.service mdmonitor.service iscsid.service livesys.service livesys-late.service irqbalance.service iscsi.service netfs.service
$ systemd --test --system --unit=foobar.target
{
        "userName": "grobie",
        "disposition": "regular",
        "homeDirectory": "/home/grobie",
        "blobDirectory": "/etc/userdb/grobie.blob/",
}
interface io.systemd.UserDatabase

method GetUserRecord(
        uid : ?int,
        userName : ?string,
        fuzzyNames: ?[]string,
        dispositionMask: ?[]string,
        uidMin: ?int,
        uidMax: ?int,
        uuid: ?string,
        service : string
) -> (
        record : object,
        incomplete : bool
)

method GetGroupRecord(
        gid : ?int,
        groupName : ?string,
        fuzzyNames: ?[]string,
        dispositionMask: ?[]string,
        gidMin: ?int,
        gidMax: ?int,
        uuid: ?string,
        service : string
) -> (
        record : object,
        incomplete : bool
)

method GetMemberships(
        userName : ?string,
        groupName : ?string,
        service : string
) -> (
        userName : string,
        groupName : string
)

error NoRecordFound()
error BadService()
error ServiceNotAvailable()
error ConflictingRecordFound()
error NonMatchingRecordFound()
error EnumerationNotSupported()
varlinkctl introspect /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase
varlinkctl call /run/systemd/userdb/io.systemd.Multiplexer io.systemd.UserDatabase.GetUserRecord '{"userName": "alice", "service": "io.systemd.Multiplexer"}'
$ pkg-config --variable=system_uid_max systemd
999
$ pkg-config --variable=greeter_uid_min systemd
60578
$ pkg-config --variable=greeter_uid_max systemd
60705
$ pkg-config --variable=dynamic_uid_min systemd
61184
$ pkg-config --variable=dynamic_uid_max systemd
65519
$ pkg-config --variable=container_uid_base_min systemd
524288
$ pkg-config --variable=container_uid_base_max systemd
1878982656
$ pkg-config --variable=foreign_uid_base systemd
2147352576
INTERNAL_UID = EXTERNAL_UID & 0x0000FFFF
CONTAINER_BASE_UID = EXTERNAL_UID & 0xFFFF0000
EXTERNAL_UID = INTERNAL_UID | CONTAINER_BASE_UID
✓ Description=
✓ SourcePath=
✓ OnFailureJobMode=
✓ JobTimeoutAction=
✓ JobTimeoutRebootArgument=
✓ StartLimitAction=
✓ FailureAction=
✓ SuccessAction=
✓ RebootArgument=
✓ CollectMode=
✓ StopWhenUnneeded=
✓ RefuseManualStart=
✓ RefuseManualStop=
✓ AllowIsolate=
✓ IgnoreOnIsolate=
✓ SurviveFinalKillSignal=
✓ DefaultDependencies=
✓ JobTimeoutSec=
✓ JobRunningTimeoutSec=
✓ StartLimitIntervalSec=
✓ StartLimitBurst=
✓ SuccessActionExitStatus=
✓ FailureActionExitStatus=
✓ Documentation=
✓ RequiresMountsFor=
✓ WantsMountsFor=
✓ Markers=
✓ Requires=
✓ Requisite=
✓ Wants=
✓ BindsTo=
✓ PartOf=
✓ Upholds=
✓ RequiredBy=
✓ RequisiteOf=
✓ WantedBy=
✓ BoundBy=
✓ UpheldBy=
✓ ConsistsOf=
✓ Conflicts=
✓ ConflictedBy=
✓ Before=
✓ After=
✓ OnSuccess=
✓ OnSuccessOf=
✓ OnFailure=
✓ OnFailureOf=
✓ Triggers=
✓ TriggeredBy=
✓ PropagatesReloadTo=
✓ ReloadPropagatedFrom=
✓ PropagatesStopTo=
✓ StopPropagatedFrom=
✓ JoinsNamespaceOf=
✓ References=
✓ ReferencedBy=
✓ InSlice=
✓ SliceOf=
✓ ConditionArchitecture=
✓ ConditionFirmware=
✓ ConditionVirtualization=
✓ ConditionHost=
✓ ConditionKernelCommandLine=
✓ ConditionVersion=
✓ ConditionCredential=
✓ ConditionSecurity=
✓ ConditionCapability=
✓ ConditionACPower=
✓ ConditionNeedsUpdate=
✓ ConditionFirstBoot=
✓ ConditionPathExists=
✓ ConditionPathExistsGlob=
✓ ConditionPathIsDirectory=
✓ ConditionPathIsSymbolicLink=
✓ ConditionPathIsMountPoint=
✓ ConditionPathIsReadWrite=
✓ ConditionPathIsEncrypted=
✓ ConditionDirectoryNotEmpty=
✓ ConditionFileNotEmpty=
✓ ConditionFileIsExecutable=
✓ ConditionUser=
✓ ConditionGroup=
✓ ConditionControlGroupController=
✓ ConditionCPUs=
✓ ConditionMemory=
✓ ConditionEnvironment=
✓ ConditionCPUFeature=
✓ ConditionOSRelease=
✓ ConditionMemoryPressure=
✓ ConditionCPUPressure=
✓ ConditionIOPressure=
✓ ConditionKernelModuleLoaded=
✓ AssertArchitecture=
✓ AssertFirmware=
✓ AssertVirtualization=
✓ AssertHost=
✓ AssertKernelCommandLine=
✓ AssertVersion=
✓ AssertCredential=
✓ AssertSecurity=
✓ AssertCapability=
✓ AssertACPower=
✓ AssertNeedsUpdate=
✓ AssertFirstBoot=
✓ AssertPathExists=
✓ AssertPathExistsGlob=
✓ AssertPathIsDirectory=
✓ AssertPathIsSymbolicLink=
✓ AssertPathIsMountPoint=
✓ AssertPathIsReadWrite=
✓ AssertPathIsEncrypted=
✓ AssertDirectoryNotEmpty=
✓ AssertFileNotEmpty=
✓ AssertFileIsExecutable=
✓ AssertUser=
✓ AssertGroup=
✓ AssertControlGroupController=
✓ AssertCPUs=
✓ AssertMemory=
✓ AssertEnvironment=
✓ AssertCPUFeature=
✓ AssertOSRelease=
✓ AssertMemoryPressure=
✓ AssertCPUPressure=
✓ AssertIOPressure=
✓ AssertKernelModuleLoaded=
✓ WorkingDirectory=
✓ RootDirectory=
✓ RootImage=
✓ User=
✓ Group=
✓ SupplementaryGroups=
✓ Nice=
✓ OOMScoreAdjust=
✓ CoredumpFilter=
✓ IOSchedulingClass=
✓ IOSchedulingPriority=
✓ CPUSchedulingPolicy=
✓ CPUSchedulingPriority=
✓ CPUSchedulingResetOnFork=
✓ CPUAffinity=
✓ UMask=
✓ Environment=
✓ EnvironmentFile=
✓ PassEnvironment=
✓ UnsetEnvironment=
✓ DynamicUser=
✓ RemoveIPC=
✓ StandardInput=
✓ StandardOutput=
✓ StandardError=
✓ StandardInputText=
✓ StandardInputData=
✓ TTYPath=
✓ TTYReset=
✓ TTYVHangup=
✓ TTYVTDisallocate=
✓ TTYRows=
✓ TTYColumns=
✓ SyslogIdentifier=
✓ SyslogFacility=
✓ SyslogLevel=
✓ SyslogLevelPrefix=
✓ LogLevelMax=
✓ LogExtraFields=
✓ LogFilterPatterns=
✓ LogRateLimitIntervalSec=
✓ LogRateLimitBurst=
✓ SecureBits=
✓ CapabilityBoundingSet=
✓ AmbientCapabilities=
✓ TimerSlackNSec=
✓ NoNewPrivileges=
✓ KeyringMode=
✓ ProtectProc=
✓ ProcSubset=
✓ SystemCallFilter=
✓ SystemCallArchitectures=
✓ SystemCallErrorNumber=
✓ SystemCallLog=
✓ MemoryDenyWriteExecute=
✓ RestrictNamespaces=
✓ RestrictRealtime=
✓ RestrictSUIDSGID=
✓ RestrictAddressFamilies=
✓ RootHash=
✓ RootHashSignature=
✓ RootVerity=
✓ LockPersonality=
✓ LimitCPU=
✓ LimitFSIZE=
✓ LimitDATA=
✓ LimitSTACK=
✓ LimitCORE=
✓ LimitRSS=
✓ LimitNOFILE=
✓ LimitAS=
✓ LimitNPROC=
✓ LimitMEMLOCK=
✓ LimitLOCKS=
✓ LimitSIGPENDING=
✓ LimitMSGQUEUE=
✓ LimitNICE=
✓ LimitRTPRIO=
✓ LimitRTTIME=
✓ ReadWritePaths=
✓ ReadOnlyPaths=
✓ InaccessiblePaths=
✓ BindPaths=
✓ BindReadOnlyPaths=
✓ TemporaryFileSystem=
✓ PrivateTmp=
✓ PrivateDevices=
✓ PrivateMounts=
✓ ProtectKernelTunables=
✓ ProtectKernelModules=
✓ ProtectKernelLogs=
✓ ProtectControlGroups=
✓ PrivateNetwork=
✓ PrivateUsers=
✓ ProtectSystem=
✓ ProtectHome=
✓ ProtectClock=
✓ MountFlags=
✓ MountAPIVFS=
✓ Personality=
✓ RuntimeDirectoryPreserve=
✓ RuntimeDirectoryMode=
✓ RuntimeDirectory=
✓ StateDirectoryMode=
✓ StateDirectoryAccounting=
✓ StateDirectoryQuota=
✓ StateDirectory=
✓ CacheDirectoryMode=
✓ CacheDirectoryAccounting=
✓ CacheDirectoryQuota=
✓ CacheDirectory=
✓ LogsDirectoryMode=
✓ LogsDirectoryAccounting=
✓ LogsDirectoryQuota=
✓ LogsDirectory=
✓ ConfigurationDirectoryMode=
✓ ConfigurationDirectory=
✓ PAMName=
✓ IgnoreSIGPIPE=
✓ UtmpIdentifier=
✓ UtmpMode=
✓ SELinuxContext=
✓ SmackProcessLabel=
✓ AppArmorProfile=
✓ Slice=
✓ DevicePolicy=
✓ Slice=
✓ ManagedOOMSwap=
✓ ManagedOOMMemoryPressure=
✓ ManagedOOMPreference=
✓ MemoryPressureWatch=
✓ DelegateSubgroup=
✓ ManagedOOMMemoryPressureLimit=
✓ MemoryAccounting=
✓ MemoryZSwapWriteback=
✓ IOAccounting=
✓ TasksAccounting=
✓ IPAccounting=
✓ CoredumpReceive=
✓ CPUWeight=
✓ StartupCPUWeight=
✓ IOWeight=
✓ StartupIOWeight=
✓ AllowedCPUs=
✓ StartupAllowedCPUs=
✓ AllowedMemoryNodes=
✓ StartupAllowedMemoryNodes=
✓ CPUSetPartition=
✓ DisableControllers=
✓ Delegate=
✓ MemoryMin=
✓ DefaultMemoryLow=
✓ DefaultMemoryMin=
✓ MemoryLow=
✓ MemoryHigh=
✓ MemoryMax=
✓ MemorySwapMax=
✓ MemoryZSwapMax=
✓ TasksMax=
✓ CPUQuota=
✓ CPUQuotaPeriodSec=
✓ DeviceAllow=
✓ IODeviceWeight=
✓ IODeviceLatencyTargetSec=
✓ IPAddressAllow=
✓ IPAddressDeny=
✓ IPIngressFilterPath=
✓ IPEgressFilterPath=
✓ BPFProgram=
✓ SocketBindAllow=
✓ SocketBindDeny=
✓ MemoryPressureThresholdSec=
✓ NFTSet=
✓ ManagedOOMMemoryPressureDurationSec=
✓ IOReadBandwidthMax=
✓ IOWriteBandwidthMax=
✓ IOReadIOPSMax=
✓ IOWriteIOPSMax=
✓ KillMode=
✓ SendSIGHUP=
✓ SendSIGKILL=
✓ KillSignal=
✓ RestartKillSignal=
✓ FinalKillSignal=
✓ WatchdogSignal=
✓ ReloadSignal=
✓ PIDFile=
✓ Type=
✓ ExitType=
✓ Restart=
✓ RestartMode=
✓ BusName=
✓ NotifyAccess=
✓ USBFunctionDescriptors=
✓ USBFunctionStrings=
✓ OOMPolicy=
✓ TimeoutStartFailureMode=
✓ TimeoutStopFailureMode=
✓ FileDescriptorStorePreserve=
✓ PermissionsStartOnly=
✓ RootDirectoryStartOnly=
✓ RemainAfterExit=
✓ GuessMainPID=
✓ RestartSec=
✓ RestartMaxDelaySec=
✓ TimeoutStartSec=
✓ TimeoutStopSec=
✓ TimeoutAbortSec=
✓ RuntimeMaxSec=
✓ RuntimeRandomizedExtraSec=
✓ WatchdogSec=
✓ TimeoutSec=
✓ FileDescriptorStoreMax=
✓ RestartSteps=
✓ ExecCondition=
✓ ExecStartPre=
✓ ExecStart=
✓ ExecStartPost=
✓ ExecConditionEx=
✓ ExecStartPreEx=
✓ ExecStartEx=
✓ ExecStartPostEx=
✓ ExecReload=
✓ ExecStop=
✓ ExecStopPost=
✓ ExecReloadEx=
✓ ExecStopEx=
✓ ExecStopPostEx=
✓ RestartPreventExitStatus=
✓ RestartForceExitStatus=
✓ SuccessExitStatus=
✓ OpenFile=
  Socket=
✓ What=
✓ Where=
✓ Options=
✓ Type=
✓ TimeoutSec=
✓ DirectoryMode=
✓ SloppyOptions=
✓ LazyUnmount=
✓ ForceUnmount=
✓ ReadwriteOnly=
✓ Where=
✓ ExtraOptions=
✓ DirectoryMode=
✓ TimeoutIdleSec=
✓ WakeSystem=
✓ RemainAfterElapse=
✓ Persistent=
✓ OnTimezoneChange=
✓ OnClockChange=
✓ FixedRandomDelay=
✓ DeferReactivation=
✓ AccuracySec=
✓ RandomizedDelaySec=
✓ OnActiveSec=
✓ OnBootSec=
✓ OnStartupSec=
✓ OnUnitActiveSec=
✓ OnUnitInactiveSec=
✓ OnCalendar=
  Unit=
✓ RuntimeMaxSec=
✓ RuntimeRandomizedExtraSec=
✓ TimeoutStopSec=
✓ User=
✓ Group=
✓ OOMPolicy=
✓ Accept=
✓ FlushPending=
✓ Writable=
✓ KeepAlive=
✓ NoDelay=
✓ FreeBind=
✓ Transparent=
✓ Broadcast=
✓ PassCredentials=
✓ PassFileDescriptorsToExec=
✓ PassSecurity=
✓ PassPacketInfo=
✓ ReusePort=
✓ RemoveOnStop=
✓ SELinuxContextFromNet=
✓ Priority=
✓ IPTTL=
✓ Mark=
✓ IPTOS=
✓ Backlog=
✓ MaxConnections=
✓ MaxConnectionsPerSource=
✓ KeepAliveProbes=
✓ TriggerLimitBurst=
✓ PollLimitBurst=
✓ SocketMode=
✓ DirectoryMode=
✓ MessageQueueMaxMessages=
✓ MessageQueueMessageSize=
✓ TimeoutSec=
✓ KeepAliveTimeSec=
✓ KeepAliveIntervalSec=
✓ DeferAcceptSec=
✓ DeferTrigger=
✓ DeferTriggerMaxSec=
✓ TriggerLimitIntervalSec=
✓ PollLimitIntervalSec=
✓ ReceiveBuffer=
✓ SendBuffer=
✓ PipeSize=
✓ ExecStartPre=
✓ ExecStartPost=
✓ ExecReload=
✓ ExecStopPost=
✓ SmackLabel=
✓ SmackLabelIPIn=
✓ SmackLabelIPOut=
✓ TCPCongestion=
✓ BindToDevice=
✓ BindIPv6Only=
✓ FileDescriptorName=
✓ SocketUser=
✓ SocketGroup=
✓ Timestamping=
✓ Symlinks=
✓ SocketProtocol=
✓ ListenStream=
✓ ListenDatagram=
✓ ListenSequentialPacket=
✓ ListenNetlink=
✓ ListenSpecial=
✓ ListenMessageQueue=
✓ ListenFIFO=
✓ ListenUSBFunction=
  Service=
  What=
  Priority=
  Options=
  TimeoutSec=
✓ MakeDirectory=
✓ DirectoryMode=
✓ PathExists=
✓ PathExistsGlob=
✓ PathChanged=
✓ PathModified=
✓ DirectoryNotEmpty=
✓ TriggerLimitBurst=
✓ PollLimitBurst=
✓ TriggerLimitIntervalSec=
✓ PollLimitIntervalSec=
  Unit=
  Alias=
  WantedBy=
  RequiredBy=
  Also=
  DefaultInstance=
#include <arpa/inet.h>
#include <netinet/in.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <systemd/sd-bus.h>

int main(int argc, char*argv[]) {
        sd_bus_error error = SD_BUS_ERROR_NULL;
        sd_bus_message *reply = NULL;
        const char *canonical;
        sd_bus *bus = NULL;
        uint64_t flags;
        int r;

        r = sd_bus_open_system(&bus);
        if (r < 0) {
                fprintf(stderr, "Failed to open system bus: %s\n", strerror(-r));
                goto finish;
        }

        r = sd_bus_call_method(bus,
                               "org.freedesktop.resolve1",
                               "/org/freedesktop/resolve1",
                               "org.freedesktop.resolve1.Manager",
                               "ResolveHostname",
                               &error,
                               &reply,
                               "isit",
                               0,                                        /* Network interface index where to look (0 means any) */
                               argc >= 2 ? argv[1] : "www.github.com",   /* Hostname */
                               AF_UNSPEC,                                /* Which address family to look for */
                               UINT64_C(0));                             /* Input flags parameter */
        if (r < 0) {
               fprintf(stderr, "Failed to resolve hostnme: %s\n", error.message);
                sd_bus_error_free(&error);
                goto finish;
        }

        r = sd_bus_message_enter_container(reply, 'a', "(iiay)");
        if (r < 0)
                goto parse_failure;

        for (;;) {
                char buf[INET6_ADDRSTRLEN];
                int ifindex, family;
                const void *data;
                size_t length;

                r = sd_bus_message_enter_container(reply, 'r', "iiay");
                if (r < 0)
                        goto parse_failure;
                if (r == 0)  /* Reached end of array */
                        break;
                r = sd_bus_message_read(reply, "ii", &ifindex, &family);
                if (r < 0)
                        goto parse_failure;
                r = sd_bus_message_read_array(reply, 'y', &data, &length);
                if (r < 0)
                        goto parse_failure;
                r = sd_bus_message_exit_container(reply);
                if (r < 0)
                        goto parse_failure;

                printf("Found IP address %s on interface %i.\n", inet_ntop(family, data, buf, sizeof(buf)), ifindex);
        }

        r = sd_bus_message_exit_container(reply);
        if (r < 0)
                goto parse_failure;
        r = sd_bus_message_read(reply, "st", &canonical, &flags);
        if (r < 0)
                goto parse_failure;

        printf("Canonical name is %s\n", canonical);
        goto finish;

parse_failure:
        fprintf(stderr, "Parse failure: %s\n", strerror(-r));

finish:
        sd_bus_message_unref(reply);
        sd_bus_flush_close_unref(bus);
        return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
}
gcc addrtest.c -o addrtest -Wall `pkg-config --cflags --libs libsystemd`
#include <assert.h>
#include <endian.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <systemd/sd-bus.h>

#define DNS_CLASS_IN 1U
#define DNS_TYPE_MX 15U

#define SD_RESOLVED_AUTHENTICATED (UINT64_C(1) << 9)

static const uint8_t* print_name(const uint8_t* p) {
        bool dot = false;
        for (;;) {
                if (*p == 0)
                        return p + 1;
                if (dot)
                        putchar('.');
                else
                        dot = true;
                printf("%.*s", (int) *p, (const char*) p + 1);
                p += *p + 1;
        }
}

static void process_mx(const void *rr, size_t sz) {
        uint16_t class, type, rdlength, preference;
        const uint8_t *p = rr;
        uint32_t ttl;

        fputs("Found MX: ", stdout);
        p = print_name(p);

        memcpy(&type, p, sizeof(uint16_t));
        p += sizeof(uint16_t);
        memcpy(&class, p, sizeof(uint16_t));
        p += sizeof(uint16_t);
        memcpy(&ttl, p, sizeof(uint32_t));
        p += sizeof(uint32_t);
        memcpy(&rdlength, p, sizeof(uint16_t));
        p += sizeof(uint16_t);
        memcpy(&preference, p, sizeof(uint16_t));
        p += sizeof(uint16_t);

        assert(be16toh(type) == DNS_TYPE_MX);
        assert(be16toh(class) == DNS_CLASS_IN);
        printf(" preference=%u ", be16toh(preference));

        p = print_name(p);
        putchar('\n');

        assert(p == (const uint8_t*) rr + sz);
}

int main(int argc, char*argv[]) {
        sd_bus_error error = SD_BUS_ERROR_NULL;
        sd_bus_message *reply = NULL;
        sd_bus *bus = NULL;
        uint64_t flags;
        int r;

        r = sd_bus_open_system(&bus);
        if (r < 0) {
                fprintf(stderr, "Failed to open system bus: %s\n", strerror(-r));
                goto finish;
        }

        r = sd_bus_call_method(bus,
                               "org.freedesktop.resolve1",
                               "/org/freedesktop/resolve1",
                               "org.freedesktop.resolve1.Manager",
                               "ResolveRecord",
                               &error,
                               &reply,
                               "isqqt",
                               0,                                  /* Network interface index where to look (0 means any) */
                               argc >= 2 ? argv[1] : "gmail.com",  /* Domain name */
                               DNS_CLASS_IN,                       /* DNS RR class */
                               DNS_TYPE_MX,                        /* DNS RR type */
                               UINT64_C(0));                       /* Input flags parameter */
        if (r < 0) {
                fprintf(stderr, "Failed to resolve record: %s\n", error.message);
                sd_bus_error_free(&error);
                goto finish;
        }

        r = sd_bus_message_enter_container(reply, 'a', "(iqqay)");
        if (r < 0)
                goto parse_failure;

        for (;;) {
                uint16_t class, type;
                const void *data;
                size_t length;
                int ifindex;

                r = sd_bus_message_enter_container(reply, 'r', "iqqay");
                if (r < 0)
                        goto parse_failure;
                if (r == 0)  /* Reached end of array */
                        break;
                r = sd_bus_message_read(reply, "iqq", &ifindex, &class, &type);
                if (r < 0)
                        goto parse_failure;
                r = sd_bus_message_read_array(reply, 'y', &data, &length);
                if (r < 0)
                        goto parse_failure;
                r = sd_bus_message_exit_container(reply);
                if (r < 0)
                        goto parse_failure;

                process_mx(data, length);
        }

        r = sd_bus_message_exit_container(reply);
        if (r < 0)
                goto parse_failure;
        r = sd_bus_message_read(reply, "t", &flags);
        if (r < 0)
                goto parse_failure;

        printf("Response is authenticated: %s\n", flags & SD_RESOLVED_AUTHENTICATED ? "yes" : "no");
        goto finish;

parse_failure:
        fprintf(stderr, "Parse failure: %s\n", strerror(-r));

finish:
        sd_bus_message_unref(reply);
        sd_bus_flush_close_unref(bus);
        return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
   }
gcc rrtest.c -o rrtest -Wall `pkg-config --cflags --libs libsystemd`
[Unit]
Description=System Logging Service
Requires=syslog.socket

[Service]
ExecStart=/usr/sbin/syslog-ng -n
StandardOutput=null

[Install]
Alias=syslog.service
WantedBy=multi-user.target

Component	Environment
Boot Loader: `systemd-boot`	UEFI APIs, simple VFAT file system access
UKI initially: `systemd-stub`	UEFI APIs, simple VFAT file system access
UKI finally: `initrd`	Linux APIs, complex storage and file systems
Root File System: `rootfs`	Linux APIs, full OS functionality

Mount	Category
`/` (root fs)	1/initrd
`/usr/`	1/initrd
`/etc/`	1/initrd
`/var/`	2/early
`/var/tmp/`	2/early
`/tmp/`	2/early
`/home/`	3/regular
`/srv/`	3/regular
XBOOTLDR	3/regular
ESP	3/regular

Mode	A null-key credential is accepted when…
`strict`	never
`tofu`	this is the first boot, or no TPM2 is available
`relaxed`	SecureBoot is off, or no TPM2 is available
`off`	always

Structure	Field	Section	Field	Condition
`struct group`	`gr_name`	`regular`	`groupName`
`struct group`	`gr_passwd`	`privileged`	`password`	(See notes below)
`struct group`	`gr_gid`	`regular`	`gid`
`struct group`	`gr_mem`	`regular`	`members`
`struct sgrp`	`sg_namp`	`regular`	`groupName`
`struct sgrp`	`sg_passwd`	`privileged`	`password`	(See notes below)
`struct sgrp`	`sg_adm`	`regular`	`administrators`
`struct sgrp`	`sg_mem`	`regular`	`members`

Structure	Field	Section	Field	Condition
`struct passwd`	`pw_name`	`regular`	`userName`
`struct passwd`	`pw_passwd`	`privileged`	`password`	(See notes below)
`struct passwd`	`pw_uid`	`regular`	`uid`
`struct passwd`	`pw_gid`	`regular`	`gid`
`struct passwd`	`pw_gecos`	`regular`	`realName`
`struct passwd`	`pw_dir`	`regular`	`homeDirectory`
`struct passwd`	`pw_shell`	`regular`	`shell`
`struct spwd`	`sp_namp`	`regular`	`userName`
`struct spwd`	`sp_pwdp`	`privileged`	`password`	(See notes below)
`struct spwd`	`sp_lstchg`	`regular`	`lastPasswordChangeUSec`	(if `sp_lstchg` > 0)
`struct spwd`	`sp_lstchg`	`regular`	`passwordChangeNow`	(if `sp_lstchg` == 0)
`struct spwd`	`sp_min`	`regular`	`passwordChangeMinUSec`
`struct spwd`	`sp_max`	`regular`	`passwordChangeMaxUSec`
`struct spwd`	`sp_warn`	`regular`	`passwordChangeWarnUSec`
`struct spwd`	`sp_inact`	`regular`	`passwordChangeInactiveUSec`
`struct spwd`	`sp_expire`	`regular`	`locked`	(if `sp_expire` in [0, 1])
`struct spwd`	`sp_expire`	`regular`	`notAfterUSec`	(if `sp_expire` > 1)

Section	Included in Signature	Persistent	Security Sensitive	Contains Host-Specific Data
regular	yes	yes	no	no
privileged	yes	yes	yes	no
perMachine	yes	yes	no	yes
binding	no	yes	no	yes
status	no	no	no	yes
signature	no	yes	no	no
secret	no	no	yes	no

Config
default	pattern to select the default entry in the list of entries
timeout	timeout in seconds for how long to show the menu

Entry
title	text to show in the menu
version	version string to append to the title when the title is not unique
machine-id	machine identifier to append to the title when the title is not unique
efi	executable EFI image
options	options to pass to the EFI image / kernel command line
linux	linux kernel image (systemd-boot still requires the kernel to have an EFI stub)
initrd	initramfs image (systemd-boot just adds this as option initrd=)

Keys
Up/Down	Select menu entry
Enter	boot the selected entry
d	select the default entry to boot (stored in a non-volatile EFI variable)
t/T	adjust the timeout (stored in a non-volatile EFI variable)
e	edit the option line (kernel command line) for this bootup to pass to the EFI image
Q	quit
v	show the systemd-boot and UEFI version
P	print the current configuration to the console
h	show key mapping

EFI Variables
LoaderEntryDefault	entry identifier to select as default at bootup, ignoring boot assessment	non-volatile
LoaderEntryPreferred	entry identifier to select as default at bootup, respecting boot assessment	non-volatile
LoaderEntrySysFail	sysfail entry identifier	non-volatile
LoaderSysFailReason	system failure reason	volatile
LoaderConfigTimeout	timeout in seconds to show the menu	non-volatile
LoaderEntryOneShot	entry identifier to select at the next and only the next bootup	non-volatile
LoaderDeviceIdentifier	list of identifiers of the volume the loader was started from	volatile
LoaderDevicePartUUID	partition GPT UUID of the ESP systemd-boot was executed from	volatile

UID/GID	Same in Hexadecimal	How Many	Purpose	Defined By	Listed in
0	0x00000000	1	`root` user	Linux	`/etc/passwd` + `nss-systemd`
1…4	0x00000001…0x00000004	4	System users	Distributions	`/etc/passwd`
5	0x00000005	1	`tty` group	`systemd`	`/etc/passwd`
6…999	0x00000006…0x000003E7	994	System users	Distributions	`/etc/passwd`
1000…60000	0x000003E8…0x0000EA60	59001	Regular users	Distributions	`/etc/passwd` + LDAP/NIS/…
60001…60513	0x0000EA61…0x0000EC61	513	Human users (homed)	`systemd`	`nss-systemd`
60514…60577	0x0000EC62…0x0000ECA1	64	Host users mapped into containers	`systemd`	`systemd-nspawn`
60578…60705	0x0000ECA2…0x0000ED21	128	Dynamic greeter users	`systemd`	`nss-systemd`
60706…61183	0x0000ED22…0x0000EEFF	478	unused
61184…65519	0x0000EF00…0x0000FFEF	4336	Dynamic service users	`systemd`	`nss-systemd`
65520…65533	0x0000FFF0…0x0000FFFD	14	unused
65534	0x0000FFFE	1	`nobody` user	Linux	`/etc/passwd` + `nss-systemd`
65535	0x0000FFFF	1	16-bit `(uid_t) -1`	Linux
65536…524287	0x00010000…0x0007FFFF	458752	unused
524288…1879048191	0x00080000…0x6FFFFFFF	1878523904	Container UID ranges	`systemd`	`nss-systemd`
1879048192…2147352575	0x70000000…0x7FFDFFFF	268304384	unused
2147352576…2147418111	0x7FFE0000…0x7FFEFFFF	65536	Foreign UID range	`systemd`	`nss-systemd`
2147418112…2147483647	0x7FFF0000…0x7FFFFFFF	65536	unused
2147483648…4294967294	0x80000000…0xFFFFFFFE	2147483647	HIC SVNT LEONES
4294967295	0xFFFFFFFF	1	32-bit `(uid_t) -1`	Linux

启动#

自动启动评估#

Details#

Walkthrough#

How to adapt this scheme to other setups#

FAQ#

启动组件和根文件系统探测#

Execution Environments#

Structure & Auxiliary Resources#

Automatic Discovery on Disks#

Network Boot#

Trust & Security#

Shim#

Automatic Enrollment of Secure Boot Certificates#

Measured Boot and TPMs#

Security of Network Boot#

Building#

引导加载程序接口#

Boot Loader Entry Identifiers#

Links#

恢复出厂设置#

Exposure in the UI#

Support for non-UEFI Systems#

Support for Resetting other Resources than Partitions + TPM#

Factory Reset via Boot Menu#

挂载点可用性要求#

TPM2 PCR测量#

Measurements Added in Future#

NvPCR Measurements#

PCR Measurements Made by systemd-boot (UEFI)#

PCR 1, EV_EVENT_TAG, SMBIOS information#

PCR 5, EV_EVENT_TAG, loader.conf#

PCR 12, EV_IPL, kernel command line#

PCR Measurements Made by systemd-stub (UEFI)#

PCR 1, EV_EVENT_TAG, SMBIOS information#

PCR 11, EV_IPL, PE section name#

PCR 11, EV_IPL, PE section data#

PCR 12, EV_IPL, kernel command line#

PCR 12, EV_EVENT_TAG, DeviceTrees#

PCR 12, EV_EVENT_TAG, initrd addons#

PCR 12, EV_EVENT_TAG, ucode addons#

PCR 12, EV_IPL, per-uki credentials initrd#

PCR 12, EV_IPL, global credentials initrd#

PCR 13, EV_IPL, sysext initrd#

PCR Measurements Made by systemd-tpm2-setup (Userspace)#

PCR 9, NvPCR Initializations#

PCR/NvPCR Measurements Made by systemd-pcrextend (Userspace)#

PCR 11, boot phases#

PCR 15, machine ID#

NvPCR hardware (base+0), product UUID#

PCR 15, file system#

NvPCR login (base+3), user logins#

PCR 9, NvPCR initialization separator#

PCR/NvPCR Measurements Made by systemd-cryptsetup (Userspace)#

PCR 15, volume key#

NvPCR cryptsetup (base+1), LUKS unlock mechanism/key slot#

PCR/NvPCR Measurements Made by systemd-veritysetup + image dissection logic (Userspace)#

NvPCR verity (base+2), Verity root hash + signature info of activated Verity images#

API File Systems#

Why are you telling me all this? I just want to get rid of the tmpfs backed /tmp!#

Appstream Bundle#

Examples#

Backports#

Stable Branch Repository for older releases#

Policy for backports into stable branches#

Booting Without /usr is Broken#

The Status Quo#

Going Forward#

Code Quality Tools#

Coding Style#

Formatting#

Code Organization and Semantics#

Using C Constructs#

Destructors#

Common Function Naming#

Error Handling#

Logging#

Memory Allocation#

Runtime Behaviour#

Types#

PCR Measurements Made by `systemd-boot` (UEFI)#

PCR 1, `EV_EVENT_TAG`, SMBIOS information#

PCR 5, `EV_EVENT_TAG`, `loader.conf`#

PCR 12, `EV_IPL`, kernel command line#

PCR Measurements Made by `systemd-stub` (UEFI)#

PCR 1, `EV_EVENT_TAG`, SMBIOS information#

PCR 11, `EV_IPL`, PE section name#

PCR 11, `EV_IPL`, PE section data#

PCR 12, `EV_IPL`, kernel command line#

PCR 12, `EV_EVENT_TAG`, DeviceTrees#

PCR 12, `EV_EVENT_TAG`, initrd addons#

PCR 12, `EV_EVENT_TAG`, ucode addons#

PCR 12, `EV_IPL`, per-uki credentials initrd#

PCR 12, `EV_IPL`, global credentials initrd#

PCR 13, `EV_IPL`, sysext initrd#

PCR Measurements Made by `systemd-tpm2-setup` (Userspace)#

PCR/NvPCR Measurements Made by `systemd-pcrextend` (Userspace)#

NvPCR `hardware` (base+0), product UUID#

NvPCR `login` (base+3), user logins#

PCR/NvPCR Measurements Made by `systemd-cryptsetup` (Userspace)#

NvPCR `cryptsetup` (base+1), LUKS unlock mechanism/key slot#

PCR/NvPCR Measurements Made by `systemd-veritysetup` + image dissection logic (Userspace)#

NvPCR `verity` (base+2), Verity root hash + signature info of activated Verity images#

The `/run/host/` Hierarchy#

`libsystemd.so`#

`libudev.so`#