So how do you modify systemd units?
Well, to start with, it makes sense to know where they are.
The default system provided systemd unit files
are in userlib systemd system.
You should never change them.
If you want to have custom units,
custom units are in etc systemd system.
So this is where you should keep your own stuff.
This is a generic approach that we see in many cases in Linux.
So the system provided stuff is in userlib,
and the custom stuff is in etc.
Apart from these, there are also runtime automatically generated
unit files in run systemd.
So while modifying unit file, do not
edit the file in userlib systemd system,
but create a custom file in etc systemd system
that is used as an overlay file.
When systemd was just introduced,
the common way to provide customization
would be to copy the main file from userlib systemd system
into etc systemd system.
And as etc systemd system has a higher priority,
the configuration in there would always win.
Even better is when you use systemctl edit on your unit.
Because if you use systemctl edit, a drop-in file is used.
And this drop-in file will be merged
with the main configuration in userlib systemd system.
Sounds magical?
Well, I'll show you in a bit.
And you will figure that it's not that difficult.
But before doing that, you should know a little bit
about the available parameters.
Systemctl show will show you available parameters
for your specific unit.
Let me demonstrate how this works.
All right, let's use dnf install httpd minus y
so that I don't have to print to prompt yes
to indicate that I'm OK.
That will install the Apache web server.
And systemctl cat on httpd.service
is showing what is currently behind it.
So we have the unit configuration right here,
which contains some dependency information as well.
We have the service configuration.
So in the service configuration, we
can see a lot of security-related settings
as well.
All of these are security-related settings.
And then we have the install section,
which is indicating that this unit is wanted
by the multi-user target.
Now, you should know that the multi-user target
is the default state in which your system will start.
And wanted by is multi-user target.
That means that if I use systemctl enable,
it will be added to this multi-user target.
Now, before getting back to the demo,
as you can find it on the slide,
I want to tell you a little bit about all of these parameters,
like device policy.
What is device policy?
Well, let me show you how you can figure out.
Use man on systemd.directives.
These parameters in systemd terminology
are called directives.
And I want to know more about device policy.
Then I start with systemd directives.
And I look for device policy.
And there you can see that device policy
is further documented in systemd resource control.
So really, this systemd directive man page
is like an index of all the directives
that you can find with further information on where
you can find additional information about it.
So let's look at systemd.resource-control.
Man, systemd.resource-control.
And there I'm going to look for device policy.
And there we can see the device policy.
So that's controlling the policy for allowing device access.
And here we can see the different options,
which can be strict, which can be closed,
and which can be auto.
Now, this is a generic approach that works
for all of these parameters.
So what about these parameters?
Well, if you want an overview of everything that you can use,
you can always use systemctl show.
Do it on your current service.
Then you get an intelligent overview
of parameters that might matter for your service configuration.
And as you can see, there's a lot.
And here also goes, if you want to know more information,
have a look at the man page for systemd.directives
to find the real man page to get all of this information.
Now, I'm going to work with a couple of parameters
that I like a lot, which are restart and restart stack.
And in order to do that, I am using systemctl edit
on vsftpd.service.
Now, maybe for you, nano is OK.
For me, it's not.
So please forgive me.
I'm using Control-X, and I'm using echo editor
is user bin vim.
I need to make that export, by the way.
And I'm going to add that to the end of etc-rc.
That should be a system-wide setting, in my opinion.
And then I'm going to use source etc-rc
to reinitialize the configuration.
And I'm trying again.
Systemctl edit.
And now, fortunately, we're in vim.
I don't like nano very much, but feel
free to do it with nano if you're OK with using nano.
It's a free world.
Choose whatever you want.
Now, what am I going to do?
Well, I am going to do, oops, why am I in vsftpd?
I don't want to be in vsftpd.
I want to be in httpd.
So let's get to systemctl edit httpd.service.
And this is where I want to be.
And here, I'm going to add my modifications.
Well, you always need the header of the location
where you want to add your modifications.
So that will be service.
And in service, I'm going to use a restart is always
and restart sec is 10 seconds, 10s.
And then I'm saving my changes.
Notice that I'm not doing anything else.
I'm just saving the changes.
Because I'm using the systemd approved method,
systemd is automatically updated.
And that means that when I'm using kill all,
httpd followed by, oh, it was never started.
OK, that doesn't make sense.
Let me use systemctl start.
All the httpd.
So now that it has started, I'm using kill all httpd
and systemctl status httpd.
And what do we see?
Well, we see in the status that it is using a drop-in.
This is the drop-in that my edit has just created.
And in active, we can see that this
is activating restart, auto restart.
That's the option that I've just added.
So if I wait long enough, and this should be long enough,
systemctl starting should now show me the,
oh, activating restart 21 seconds ago.
Well, just give it some time, and it will get back.
We can see that the status is reading configuration.
So actually, it is still busy.
And we can also see in the logging part
that apparently it is a reference,
but unset environment variable evaluates to an empty string.
Aha, so it has a hard time with this empty string options.
Apparently, that's a bug in the package.
But if you wait long enough, then you
can see that it's active and running again.
And that is how you can make changes to systemd unit files.