summaryrefslogtreecommitdiff
path: root/man
diff options
context:
space:
mode:
Diffstat (limited to 'man')
-rw-r--r--man/busctl.xml2
-rw-r--r--man/dnssec-trust-anchors.d.xml200
-rw-r--r--man/journal-remote.conf.xml9
-rw-r--r--man/machinectl.xml2
-rw-r--r--man/resolved.conf.xml93
-rw-r--r--man/sd-event.xml2
-rw-r--r--man/sd_bus_creds_get_pid.xml2
-rw-r--r--man/sd_event_add_child.xml2
-rw-r--r--man/sd_event_add_defer.xml2
-rw-r--r--man/sd_event_add_io.xml6
-rw-r--r--man/sd_event_add_signal.xml2
-rw-r--r--man/sd_event_add_time.xml4
-rw-r--r--man/sd_event_exit.xml2
-rw-r--r--man/sd_event_now.xml2
-rw-r--r--man/sd_event_source_set_enabled.xml2
-rw-r--r--man/sd_event_source_set_prepare.xml2
-rw-r--r--man/sd_event_source_set_priority.xml2
-rw-r--r--man/sd_event_wait.xml4
-rw-r--r--man/sd_notify.xml2
-rw-r--r--man/sd_seat_get_active.xml2
-rw-r--r--man/systemctl.xml4
-rw-r--r--man/systemd-resolved.service.xml4
-rw-r--r--man/systemd.network.xml75
-rw-r--r--man/systemd.special.xml2
-rw-r--r--man/systemd.timer.xml2
-rw-r--r--man/systemd.unit.xml2
-rw-r--r--man/tmpfiles.d.xml2
27 files changed, 395 insertions, 40 deletions
diff --git a/man/busctl.xml b/man/busctl.xml
index d8c1085021..26d778d4dd 100644
--- a/man/busctl.xml
+++ b/man/busctl.xml
@@ -448,7 +448,7 @@ ARRAY "s" {
<example>
<title>Invoking a Method</title>
- <para>The following command invokes a the
+ <para>The following command invokes the
<literal>StartUnit</literal> method on the
<literal>org.freedesktop.systemd1.Manager</literal>
interface of the
diff --git a/man/dnssec-trust-anchors.d.xml b/man/dnssec-trust-anchors.d.xml
new file mode 100644
index 0000000000..51271abc16
--- /dev/null
+++ b/man/dnssec-trust-anchors.d.xml
@@ -0,0 +1,200 @@
+<?xml version='1.0'?> <!--*- Mode: nxml; nxml-child-indent: 2; indent-tabs-mode: nil -*-->
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+
+<!--
+ This file is part of systemd.
+
+ Copyright 2016 Lennart Poettering
+
+ systemd is free software; you can redistribute it and/or modify it
+ under the terms of the GNU Lesser General Public License as published by
+ the Free Software Foundation; either version 2.1 of the License, or
+ (at your option) any later version.
+
+ systemd is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public License
+ along with systemd; If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<refentry id="dnssec-trust-anchors.d" conditional='ENABLE_RESOLVED'
+ xmlns:xi="http://www.w3.org/2001/XInclude">
+ <refentryinfo>
+ <title>dnssec-trust-anchors.d</title>
+ <productname>systemd</productname>
+
+ <authorgroup>
+ <author>
+ <contrib>Developer</contrib>
+ <firstname>Lennart</firstname>
+ <surname>Poettering</surname>
+ <email>lennart@poettering.net</email>
+ </author>
+ </authorgroup>
+ </refentryinfo>
+
+ <refmeta>
+ <refentrytitle>dnssec-trust-anchors.d</refentrytitle>
+ <manvolnum>5</manvolnum>
+ </refmeta>
+
+ <refnamediv>
+ <refname>dnssec-trust-anchors.d</refname>
+ <refname>systemd.positive</refname>
+ <refname>systemd.negative</refname>
+ <refpurpose>DNSSEC trust anchor configuration files</refpurpose>
+ </refnamediv>
+
+ <refsynopsisdiv>
+ <para><filename>/etc/dnssec-trust-anchors.d/*.positive</filename></para>
+ <para><filename>/run/dnssec-trust-anchors.d/*.positive</filename></para>
+ <para><filename>/usr/lib/dnssec-trust-anchors.d/*.positive</filename></para>
+ <para><filename>/etc/dnssec-trust-anchors.d/*.negative</filename></para>
+ <para><filename>/run/dnssec-trust-anchors.d/*.negative</filename></para>
+ <para><filename>/usr/lib/dnssec-trust-anchors.d/*.negative</filename></para>
+ </refsynopsisdiv>
+
+ <refsect1>
+ <title>Description</title>
+
+ <para>The DNSSEC trust anchor configuration files define positive
+ and negative trust anchors
+ <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+ bases DNSSEC integrity proofs on.</para>
+ </refsect1>
+
+ <refsect1>
+ <title>Positive Trust Anchors</title>
+
+ <para>Positive trust anchor configuration files contain DNSKEY and
+ DS resource record definitions to use as base for DNSSEC integrity
+ proofs. See <ulink
+ url="https://tools.ietf.org/html/rfc4035#section-4.4">RFC 4035,
+ Section 4.4</ulink> for more information about DNSSEC trust
+ anchors.</para>
+
+ <para>Positive trust anchors are read from files with the suffix
+ <filename>.positive</filename> located in
+ <filename>/etc/dnssec-trust-anchors.d/</filename>,
+ <filename>/run/dnssec-trust-anchors.d/</filename> and
+ <filename>/usr/lib/dnssec-trust-anchors.d/</filename>. These
+ directories are searched in the specified order, and a trust
+ anchor file of the same name in an earlier path overrides a trust
+ anchor files in a later path. To disable a trust anchor file
+ shipped in <filename>/usr/lib/dnssec-trust-anchors.d/</filename>
+ it is sufficient to provide an identically-named file in
+ <filename>/etc/dnssec-trust-anchors.d/</filename> or
+ <filename>/run/dnssec-trust-anchors.d/</filename> that is either
+ empty or a symlink to <filename>/dev/null</filename> ("masked").</para>
+
+ <para>Positive trust anchor files are simple text files resembling
+ DNS zone files, as documented in <ulink
+ url="https://tools.ietf.org/html/rfc1035#section-5">RFC 1035, Section
+ 5</ulink>. One DS or DNSKEY resource record may be listed per
+ line. Empty lines and lines starting with a semicolon
+ (<literal>;</literal>) are ignored and considered comments. A DS
+ resource record is specified like in the following example:</para>
+
+ <programlisting>. IN DS 19036 8 2 49aac11d7b6f6446702e54a1607371607a1a41855200fd2ce1cdde32f24e8fb5</programlisting>
+
+ <para>The first word specifies the domain, use
+ <literal>.</literal> for the root domain. The domain may be
+ specified with or without trailing dot, which is considered
+ equivalent. The second word must be <literal>IN</literal> the
+ third word <literal>DS</literal>. The following words specify the
+ key tag, signature algorithm, digest algorithm, followed by the
+ hex-encoded key fingerprint. See <ulink
+ url="https://tools.ietf.org/html/rfc4034#section-5">RFC 4034,
+ Section 5</ulink> for details about the precise syntax and meaning
+ of these fields.</para>
+
+ <para>Alternatively, DNSKEY resource records may be used to define
+ trust anchors, like in the following example:</para>
+
+ <programlisting>. IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0=</programlisting>
+
+ <para>The first word specifies the domain again, the second word
+ must be <literal>IN</literal>, followed by
+ <literal>DNSKEY</literal>. The subsequent words encode the DNSKEY
+ flags, protocol and algorithm fields, followed by the key data
+ encoded in Base64. See See <ulink
+ url="https://tools.ietf.org/html/rfc4034#section-2">RFC 4034,
+ Section 2</ulink> for details about the precise syntax and meaning
+ of these fields.</para>
+
+ <para>If multiple DS or DNSKEY records are defined for the same
+ domain (possibly even in different trust anchor files), all keys
+ are used and are considered equivalent as base for DNSSEC
+ proofs.</para>
+
+ <para>Note that <filename>systemd-resolved</filename> will
+ automatically use a built-in trust anchor key for the Internet
+ root domain if no positive trust anchors are defined for the root
+ domain. In most cases it is hence unnecessary to define an
+ explicit key with trust anchor files. The built-in key is disabled
+ as soon as at least one trust anchor key for the root domain is
+ defined in trust anchor files.</para>
+
+ <para>It is generally recommended to encode trust anchors in DS
+ resource records, rather than DNSKEY resource records.</para>
+
+ <para>If a trust anchor specified via a DS record is found revoked
+ it is automatically removed from the trust anchor database for the
+ runtime. See <ulink url="https://tools.ietf.org/html/rfc5011">RFC
+ 5011</ulink> for details about revoked trust anchors. Note that
+ <filename>systemd-resolved</filename> will not update its trust
+ anchor database from DNS servers automatically. Instead, it is
+ recommended to update the resolver software or update the new
+ trust anchor via adding in new trust anchor files.</para>
+
+ <para>The current DNSSEC trust anchor for the Internet's root
+ domain is available a the <ulink
+ url="https://data.iana.org/root-anchors/root-anchors.xml">IANA
+ Trust Anchor and Keys</ulink> page.</para>
+ </refsect1>
+
+ <refsect1>
+ <title>Negative Trust Anchors</title>
+
+ <para>Negative trust anchors define domains where DNSSEC
+ validation shall be turned off. Negative trust anchor files are
+ found at the same location as positive trust anchor files, and
+ follow the same overriding rules. They are text files with the
+ <filename>.negative</filename> suffix. Empty lines and lines whose
+ first character is <literal>;</literal> are ignored. Each line
+ specifies one domain name where DNSSEC validation shall be
+ disabled on.</para>
+
+ <para>Negative trust anchors are useful to support private DNS
+ subtrees that are not referenced from the Internet DNS hierarchy,
+ and not signed.</para>
+
+ <para><ulink url="https://tools.ietf.org/html/rfc7646">RFC
+ 7646</ulink> for details on negative trust anchors.</para>
+
+ <para>If no negative trust anchor files are configured a built-in
+ set of well-known private DNS zone domains is used as negative
+ trust anchors.</para>
+
+ <para>It is also possibly to define per-interface negative trust
+ anchors using the <varname>DNSSECNegativeTrustAnchors=</varname>
+ setting in
+ <citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+ files.</para>
+ </refsect1>
+
+ <refsect1>
+ <title>See Also</title>
+ <para>
+ <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+ <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+ <citerefentry><refentrytitle>resolved.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+ <citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+ </para>
+ </refsect1>
+
+</refentry>
diff --git a/man/journal-remote.conf.xml b/man/journal-remote.conf.xml
index fc60258d0b..2d345963d9 100644
--- a/man/journal-remote.conf.xml
+++ b/man/journal-remote.conf.xml
@@ -72,6 +72,13 @@
<literal>[Remote]</literal> section:</para>
<variablelist>
+ <varlistentry>
+ <term><varname>Seal=</varname></term>
+
+ <listitem><para>Periodically sign the data in the journal using Forward Secure Sealing.
+ </para></listitem>
+ </varlistentry>
+
<varlistentry>
<term><varname>SplitMode=</varname></term>
@@ -105,7 +112,7 @@
<refsect1>
<title>See Also</title>
<para>
- <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+ <citerefentry><refentrytitle>systemd-journal-remote</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
<citerefentry><refentrytitle>systemd-journald.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
</para>
diff --git a/man/machinectl.xml b/man/machinectl.xml
index a7288c249b..f9395f3d72 100644
--- a/man/machinectl.xml
+++ b/man/machinectl.xml
@@ -247,7 +247,7 @@
<literal>checksum</literal> is specified, the download is
checked for integrity after the transfer is complete, but no
signatures are verified. If <literal>signature</literal> is
- specified, the checksum is verified and the images's signature
+ specified, the checksum is verified and the image's signature
is checked against a local keyring of trustable vendors. It is
strongly recommended to set this option to
<literal>signature</literal> if the server and protocol
diff --git a/man/resolved.conf.xml b/man/resolved.conf.xml
index 4680b6a4e5..5da2d5488e 100644
--- a/man/resolved.conf.xml
+++ b/man/resolved.conf.xml
@@ -124,6 +124,98 @@
global setting is on.</para></listitem>
</varlistentry>
+ <varlistentry>
+ <term><varname>MulticastDNS=</varname></term>
+ <listitem><para>Takes a boolean argument or
+ <literal>resolve</literal>. Controls Multicast DNS support
+ (<ulink url="https://tools.ietf.org/html/rfc6762">RFC
+ 6762</ulink>) on the local host. If true, enables full
+ Multicast DNS responder and resolver support. If false,
+ disables both. If set to <literal>resolve</literal>, only
+ resolution support is enabled, but responding is
+ disabled. Note that
+ <citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+ also maintains per-interface Multicast DNS settings. Multicast
+ DNS will be enabled on an interface only if the per-interface
+ and the global setting is on.</para></listitem>
+ </varlistentry>
+
+ <varlistentry>
+ <term><varname>DNSSEC=</varname></term>
+ <listitem><para>Takes a boolean argument or
+ <literal>allow-downgrade</literal>. If true all DNS lookups are
+ DNSSEC-validated locally (excluding LLMNR and Multicast
+ DNS). If a response for a lookup request is detected invalid
+ this is returned as lookup failure to applications. Note that
+ this mode requires a DNS server that supports DNSSEC. If the
+ DNS server does not properly support DNSSEC all validations
+ will fail. If set to <literal>allow-downgrade</literal> DNSSEC
+ validation is attempted, but if the server does not support
+ DNSSEC properly, DNSSEC mode is automatically disabled. Note
+ that this mode makes DNSSEC validation vulnerable to
+ "downgrade" attacks, where an attacker might be able to
+ trigger a downgrade to non-DNSSEC mode by synthesizing a DNS
+ response that suggests DNSSEC was not supported. If set to
+ false, DNS lookups are not DNSSEC validated.</para>
+
+ <para>Note that DNSSEC validation requires retrieval of
+ additional DNS data, and thus results in a small DNS look-up
+ time penalty.</para>
+
+ <para>DNSSEC requires knowledge of "trust anchors" to prove
+ data integrity. The trust anchor for the Internet root domain
+ is built into the resolver, additional trust anchors may be
+ defined with
+ <citerefentry><refentrytitle>dnssec-trust-anchors.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+ Trust anchors may change in regular intervals, and old trust
+ anchors may be revoked. In such a case DNSSEC validation is
+ not possible until new trust anchors are configured locally or
+ the resolver software package is updated with the new root
+ trust anchor. In effect, when the built-in trust anchor is
+ revoked and <varname>DNSSEC=</varname> is true, all further
+ lookups will fail, as it cannot be proved anymore whether
+ lookups are correctly signed, or validly unsigned. If
+ <varname>DNSSEC=</varname> is set to
+ <literal>allow-downgrade</literal> the resolver will
+ automatically turn off DNSSEC validation in such a case.</para>
+
+ <para>Client programs looking up DNS data will be informed
+ whether lookups could be verified using DNSSEC, or whether the
+ returned data could not be verified (either because the data
+ was found unsigned in the DNS, or the DNS server did not
+ support DNSSEC or no appropriate trust anchors were known). In
+ the latter case it is assumed that client programs employ a
+ secondary scheme to validate the returned DNS data, should
+ this be required.</para>
+
+ <para>It is recommended to set <varname>DNSSEC=</varname> to
+ true on systems where it is known that the DNS server supports
+ DNSSEC correctly, and where software or trust anchor updates
+ happen regularly. On other systems it is recommended to set
+ <varname>DNSSEC=</varname> to
+ <literal>allow-downgrade</literal>.</para>
+
+ <para>In addition to this global DNSSEC setting
+ <citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+ also maintains per-interface DNSSEC settings. For system DNS
+ servers (see above), only the global DNSSEC setting is in
+ effect. For per-interface DNS servers the per-interface
+ setting is in effect, unless it is unset in which case the
+ global setting is used instead.</para>
+
+ <para>Site-private DNS zones generally conflict with DNSSEC
+ operation, unless a negative (if the private zone is not
+ signed) or positive (if the private zone is signed) trust
+ anchor is configured for them. If
+ <literal>allow-downgrade</literal> mode is selected, it is
+ attempted to detect site-private DNS zones using top-level
+ domains (TLDs) that are not known by the DNS root server. This
+ logic does not work in all private zone setups.</para>
+
+ <para>Defaults to off.</para>
+ </listitem>
+ </varlistentry>
+
</variablelist>
</refsect1>
@@ -133,6 +225,7 @@
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
<citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
<citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+ <citerefentry><refentrytitle>dnssec-trust-anchors.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
<citerefentry><refentrytitle>resolv.conf</refentrytitle><manvolnum>4</manvolnum></citerefentry>
</para>
</refsect1>
diff --git a/man/sd-event.xml b/man/sd-event.xml
index 47989f4421..fc615f0906 100644
--- a/man/sd-event.xml
+++ b/man/sd-event.xml
@@ -136,7 +136,7 @@
<listitem><para>Event sources may be assigned a 64bit priority
value, that controls the order in which event sources are
- dispatched if multiple are pending simultanously. See
+ dispatched if multiple are pending simultaneously. See
<citerefentry><refentrytitle>sd_event_source_set_priority</refentrytitle><manvolnum>3</manvolnum></citerefentry>.</para></listitem>
<listitem><para>The event loop may automatically send watchdog
diff --git a/man/sd_bus_creds_get_pid.xml b/man/sd_bus_creds_get_pid.xml
index aec12bda16..3bcda46656 100644
--- a/man/sd_bus_creds_get_pid.xml
+++ b/man/sd_bus_creds_get_pid.xml
@@ -470,7 +470,7 @@
modified by the caller.</para>
<para>All functions that take a <parameter>char***</parameter>
- parameter will store the answer there as an address of a an array
+ parameter will store the answer there as an address of an array
of strings. Each individual string is NUL-terminated, and the
array is NULL-terminated as a whole. It will be valid as long as
<parameter>c</parameter> remains valid, and should not be freed or
diff --git a/man/sd_event_add_child.xml b/man/sd_event_add_child.xml
index d4b180cf03..bc732db7fa 100644
--- a/man/sd_event_add_child.xml
+++ b/man/sd_event_add_child.xml
@@ -127,7 +127,7 @@
<constant>SD_EVENT_OFF</constant> with
<citerefentry><refentrytitle>sd_event_source_set_enabled</refentrytitle><manvolnum>3</manvolnum></citerefentry>.</para>
- <para>If the the second parameter of
+ <para>If the second parameter of
<function>sd_event_add_child()</function> is passed as NULL no
reference to the event source object is returned. In this case the
event source is considered "floating", and will be destroyed
diff --git a/man/sd_event_add_defer.xml b/man/sd_event_add_defer.xml
index 6a13ede76e..d9ebd3b179 100644
--- a/man/sd_event_add_defer.xml
+++ b/man/sd_event_add_defer.xml
@@ -108,7 +108,7 @@
handler will be called once
(<constant>SD_EVENT_ONESHOT</constant>). Note that if the event
source is set to <constant>SD_EVENT_ON</constant> the event loop
- will never go to sleep again, but continously call the handler,
+ will never go to sleep again, but continuously call the handler,
possibly interleaved with other event sources.</para>
<para><function>sd_event_add_post()</function> adds a new event
diff --git a/man/sd_event_add_io.xml b/man/sd_event_add_io.xml
index 4cc0428e29..eeb406ba5b 100644
--- a/man/sd_event_add_io.xml
+++ b/man/sd_event_add_io.xml
@@ -141,14 +141,14 @@
<constant>EPOLLHUP</constant> set.</para>
<para>By default, the I/O event source will stay enabled
- continously (<constant>SD_EVENT_ON</constant>), but this may be
+ continuously (<constant>SD_EVENT_ON</constant>), but this may be
changed with
<citerefentry><refentrytitle>sd_event_source_set_enabled</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
If the handler function returns a negative error code, it will be
disabled after the invocation, even if the
<constant>SD_EVENT_ON</constant> mode was requested before. Note
that an I/O event source set to <constant>SD_EVENT_ON</constant> will
- fire continously unless data is read or written to the file
+ fire continuously unless data is read or written to the file
descriptor in order to reset the mask of events seen.
</para>
@@ -169,7 +169,7 @@
<constant>SD_EVENT_OFF</constant> with
<citerefentry><refentrytitle>sd_event_source_set_enabled</refentrytitle><manvolnum>3</manvolnum></citerefentry>.</para>
- <para>If the the second parameter of
+ <para>If the second parameter of
<function>sd_event_add_io()</function> is passed as NULL no
reference to the event source object is returned. In this case the
event source is considered "floating", and will be destroyed
diff --git a/man/sd_event_add_signal.xml b/man/sd_event_add_signal.xml
index b5312735d2..a2aabd3c1a 100644
--- a/man/sd_event_add_signal.xml
+++ b/man/sd_event_add_signal.xml
@@ -128,7 +128,7 @@
<constant>SD_EVENT_OFF</constant> with
<citerefentry><refentrytitle>sd_event_source_set_enabled</refentrytitle><manvolnum>3</manvolnum></citerefentry>.</para>
- <para>If the the second parameter of
+ <para>If the second parameter of
<function>sd_event_add_signal()</function> is passed as NULL no
reference to the event source object is returned. In this case the
event source is considered "floating", and will be destroyed
diff --git a/man/sd_event_add_time.xml b/man/sd_event_add_time.xml
index df38f52fc9..b58d740bd8 100644
--- a/man/sd_event_add_time.xml
+++ b/man/sd_event_add_time.xml
@@ -159,7 +159,7 @@
disabled after the invocation, even if the
<constant>SD_EVENT_ON</constant> mode was requested before. Note
that a timer event set to <constant>SD_EVENT_ON</constant> will
- fire continously unless its configured time is updated using
+ fire continuously unless its configured time is updated using
<function>sd_event_source_set_time()</function>.
</para>
@@ -172,7 +172,7 @@
<constant>SD_EVENT_OFF</constant> with
<citerefentry><refentrytitle>sd_event_source_set_enabled</refentrytitle><manvolnum>3</manvolnum></citerefentry>.</para>
- <para>If the the second parameter of
+ <para>If the second parameter of
<function>sd_event_add_time()</function> is passed as NULL no
reference to the event source object is returned. In this case the
event source is considered "floating", and will be destroyed
diff --git a/man/sd_event_exit.xml b/man/sd_event_exit.xml
index 4f34f3b122..9846a3eaf4 100644
--- a/man/sd_event_exit.xml
+++ b/man/sd_event_exit.xml
@@ -76,7 +76,7 @@
exit. The <parameter>code</parameter> parameter may be any integer
value and is returned as-is by
<citerefentry><refentrytitle>sd_event_loop</refentrytitle><manvolnum>3</manvolnum></citerefentry>
- after the last event loop iteration. It may also be be queried
+ after the last event loop iteration. It may also be queried
using <function>sd_event_get_exit_code()</function>, see
below. </para>
diff --git a/man/sd_event_now.xml b/man/sd_event_now.xml
index f577e44c0e..58d7375eac 100644
--- a/man/sd_event_now.xml
+++ b/man/sd_event_now.xml
@@ -67,7 +67,7 @@
<para><function>sd_event_now()</function> returns the timestamp
the most recent event loop iteration began. This timestamp is
- taken right after after returning from the event sleep, and before
+ taken right after returning from the event sleep, and before
dispatching any event sources. The <parameter>event</parameter>
parameter takes the even loop object to retrieve the timestamp
from. The <parameter>clock</parameter> parameter specifies the clock to
diff --git a/man/sd_event_source_set_enabled.xml b/man/sd_event_source_set_enabled.xml
index 74c02e87bb..6844f29a49 100644
--- a/man/sd_event_source_set_enabled.xml
+++ b/man/sd_event_source_set_enabled.xml
@@ -105,7 +105,7 @@
with calls such as
<citerefentry><refentrytitle>sd_event_add_io</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
<citerefentry><refentrytitle>sd_event_add_time</refentrytitle><manvolnum>3</manvolnum></citerefentry>. However,
- depending on the event source type they are enabled continously
+ depending on the event source type they are enabled continuously
(<constant>SD_EVENT_ON</constant>) or only for a single invocation
of the event source handler
(<constant>SD_EVENT_ONESHOT</constant>). For details see the
diff --git a/man/sd_event_source_set_prepare.xml b/man/sd_event_source_set_prepare.xml
index 7066a55306..24861d01d9 100644
--- a/man/sd_event_source_set_prepare.xml
+++ b/man/sd_event_source_set_prepare.xml
@@ -71,7 +71,7 @@
<title>Description</title>
<para><function>sd_event_source_set_prepare()</function> may be
- used to set a prepartion callback for the event source object
+ used to set a preparation callback for the event source object
specified as <parameter>source</parameter>. The callback function
specified as <parameter>callback</parameter> will be invoked
immediately before the event loop goes to sleep to wait for
diff --git a/man/sd_event_source_set_priority.xml b/man/sd_event_source_set_priority.xml
index cc0f5a0103..9234f4233e 100644
--- a/man/sd_event_source_set_priority.xml
+++ b/man/sd_event_source_set_priority.xml
@@ -111,7 +111,7 @@
dispatched is undefined, but the event loop generally tries to
dispatch them in the order it learnt about events on them. As the
backing kernel primitives do not provide accurate information
- about the order in which events occured this is not necessarily
+ about the order in which events occurred this is not necessarily
reliable. However, it is guaranteed that if events are seen on
multiple same-priority event sources at the same time, each one is
not dispatched again until all others have been dispatched
diff --git a/man/sd_event_wait.xml b/man/sd_event_wait.xml
index 1eefa80700..f2aea00e98 100644
--- a/man/sd_event_wait.xml
+++ b/man/sd_event_wait.xml
@@ -107,7 +107,7 @@
and
<citerefentry><refentrytitle>sd_event_loop</refentrytitle><manvolnum>3</manvolnum></citerefentry>
for higher-level functions that execute individual but complete
- iterations of an event loop or run it continously.</para>
+ iterations of an event loop or run it continuously.</para>
<para><function>sd_event_prepare()</function> checks for pending
events and arms necessary timers. If any events are ready to be
@@ -169,7 +169,7 @@
<term><constant>SD_EVENT_PREPARING</constant></term>
<listitem><para>An event source is currently being prepared,
- i.e. the preparation handler is currently being excuted, as
+ i.e. the preparation handler is currently being executed, as
set with
<citerefentry><refentrytitle>sd_event_set_prepare</refentrytitle><manvolnum>3</manvolnum></citerefentry>. This
state is only seen in the event source preparation handler
diff --git a/man/sd_notify.xml b/man/sd_notify.xml
index dbf6330453..bd6cfdcd29 100644
--- a/man/sd_notify.xml
+++ b/man/sd_notify.xml
@@ -242,7 +242,7 @@
multiple file descriptors are submitted at once, the specified
name will be assigned to all of them. In order to assign
different names to submitted file descriptors, submit them in
- seperate invocations of
+ separate invocations of
<function>sd_pid_notify_with_fds()</function>. The name may
consist of any ASCII character, but must not contain control
characters or <literal>:</literal>. It may not be longer than
diff --git a/man/sd_seat_get_active.xml b/man/sd_seat_get_active.xml
index 6e1d505dce..c5e6ddab02 100644
--- a/man/sd_seat_get_active.xml
+++ b/man/sd_seat_get_active.xml
@@ -192,7 +192,7 @@
<function>sd_seat_get_sessions()</function>,
<function>sd_seat_can_multi_session()</function>,
<function>sd_seat_can_tty()</function> and
- <function>sd_seat_can_grapical()</function> interfaces are
+ <function>sd_seat_can_graphical()</function> interfaces are
available as a shared library, which can be compiled and linked to
with the
<constant>libsystemd</constant> <citerefentry project='die-net'><refentrytitle>pkg-config</refentrytitle><manvolnum>1</manvolnum></citerefentry>
diff --git a/man/systemctl.xml b/man/systemctl.xml
index 1fb056874c..a55e06059a 100644
--- a/man/systemctl.xml
+++ b/man/systemctl.xml
@@ -832,7 +832,7 @@ kobject-uevent 1 systemd-udevd-kernel.socket systemd-udevd.service
output. If you are looking for computer-parsable output,
use <command>show</command> instead. By default, this
function only shows 10 lines of output and ellipsizes
- lines to fit in the terminal window. This can be changes
+ lines to fit in the terminal window. This can be changed
with <option>--lines</option> and <option>--full</option>,
see above. In addition, <command>journalctl
--unit=<replaceable>NAME</replaceable></command> or
@@ -1176,7 +1176,7 @@ kobject-uevent 1 systemd-udevd-kernel.socket systemd-udevd.service
</row>
<row>
<entry><literal>bad</literal></entry>
- <entry>Unit file is invalid or another error occured. Note that <command>is-enabled</command> will not actually return this state, but print an error message instead. However the unit file listing printed by <command>list-unit-files</command> might show it.</entry>
+ <entry>Unit file is invalid or another error occurred. Note that <command>is-enabled</command> will not actually return this state, but print an error message instead. However the unit file listing printed by <command>list-unit-files</command> might show it.</entry>
<entry>&gt; 0</entry>
</row>
</tbody>
diff --git a/man/systemd-resolved.service.xml b/man/systemd-resolved.service.xml
index 43d568c6f7..8e1ca1c092 100644
--- a/man/systemd-resolved.service.xml
+++ b/man/systemd-resolved.service.xml
@@ -117,7 +117,7 @@
<listitem><para>Multi-label names are routed to all local
interfaces that have a DNS sever configured, plus the globally
configured DNS server if there is one. Address lookups from the
- link-local addres range are never routed to
+ link-local address range are never routed to
DNS.</para></listitem>
</itemizedlist>
@@ -144,7 +144,9 @@
<para>
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
<citerefentry><refentrytitle>resolved.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+ <citerefentry><refentrytitle>dnssec-trust-anchors.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
<citerefentry><refentrytitle>nss-resolve</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+ <citerefentry><refentrytitle>resolv.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
<citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
<citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
</para>
diff --git a/man/systemd.network.xml b/man/systemd.network.xml
index e6dedb027d..5a6383cfc2 100644
--- a/man/systemd.network.xml
+++ b/man/systemd.network.xml
@@ -228,7 +228,7 @@
<literal>ipv4</literal>, or <literal>ipv6</literal>.</para>
<para>Note that DHCPv6 will by default be triggered by Router
- Advertisment, if that is enabled, regardless of this parameter.
+ Advertisement, if that is enabled, regardless of this parameter.
By enabling DHCPv6 support explicitly, the DHCPv6 client will
be started regardless of the presence of routers on the link,
or what flags the routers pass. See
@@ -277,10 +277,59 @@
<varlistentry>
<term><varname>LLMNR=</varname></term>
<listitem>
- <para>A boolean or <literal>resolve</literal>. When true, enables
- Link-Local Multicast Name Resolution on the link. When set to
- <literal>resolve</literal>, only resolution is enabled, but not
- announcement. Defaults to true.</para>
+ <para>A boolean or <literal>resolve</literal>. When true,
+ enables <ulink
+ url="https://tools.ietf.org/html/rfc4795">Link-Local
+ Multicast Name Resolution</ulink> on the link. When set to
+ <literal>resolve</literal>, only resolution is enabled,
+ but not host registration and announcement. Defaults to
+ true. This setting is read by
+ <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><varname>MulticastDNS=</varname></term>
+ <listitem>
+ <para>A boolean or <literal>resolve</literal>. When true,
+ enables <ulink
+ url="https://tools.ietf.org/html/rfc6762">Multicast
+ DNS</ulink> support on the link. When set to
+ <literal>resolve</literal>, only resolution is enabled,
+ but not host or service registration and
+ announcement. Defaults to false. This setting is read by
+ <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><varname>DNSSEC=</varname></term>
+ <listitem>
+ <para>A boolean or
+ <literal>allow-downgrade</literal>. When true, enables
+ <ulink
+ url="https://tools.ietf.org/html/rfc4033">DNSSEC</ulink>
+ DNS validation support on the link. When set to
+ <literal>allow-downgrade</literal>, compatibility with
+ non-DNSSEC capable networks is increased, by automatically
+ turning off DNSEC in this case. This option defines a
+ per-interface setting for
+ <citerefentry><refentrytitle>resolved.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>'s
+ global <varname>DNSSEC=</varname> option. Defaults to
+ false. This setting is read by
+ <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><varname>DNSSECNegativeTrustAnchors=</varname></term>
+ <listitem><para>A space-separated list of DNSSEC negative
+ trust anchor domains. If specified and DNSSEC is enabled,
+ look-ups done via the interface's DNS server will be subject
+ to the list of negative trust anchors, and not require
+ authentication for the specified domains, or anything below
+ it. Use this to disable DNSSEC authentication for specific
+ private domains, that cannot be proven valid using the
+ Internet DNS hierarchy. Defaults to the empty list. This
+ setting is read by
+ <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
</listitem>
</varlistentry>
<varlistentry>
@@ -346,19 +395,22 @@
<para>A DNS server address, which must be in the format
described in
<citerefentry project='man-pages'><refentrytitle>inet_pton</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
- This option may be specified more than once.</para>
+ This option may be specified more than once. This setting is read by
+ <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>Domains=</varname></term>
<listitem>
- <para>The domains used for DNS resolution over this link.</para>
+ <para>The domains used for DNS resolution over this link. This setting is read by
+ <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></para>
</listitem>
</varlistentry>
<varlistentry>
<term><varname>NTP=</varname></term>
<listitem>
- <para>An NTP server address. This option may be specified more than once.</para>
+ <para>An NTP server address. This option may be specified more than once. This setting is read by
+ <citerefentry><refentrytitle>systemd-timesyncd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></para>
</listitem>
</varlistentry>
<varlistentry>
@@ -673,7 +725,7 @@
<term><varname>UseTimezone=</varname></term>
<listitem><para>When true, the timezone received from the
- DHCP server will be set as as timezone of the local
+ DHCP server will be set as timezone of the local
system. Defaults to <literal>no</literal>.</para></listitem>
</varlistentry>
@@ -1011,9 +1063,10 @@ DHCP=yes
<title>See Also</title>
<para>
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
- <citerefentry><refentrytitle>systemd-networkd</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+ <citerefentry><refentrytitle>systemd-networkd.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
<citerefentry><refentrytitle>systemd.link</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
- <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+ <citerefentry><refentrytitle>systemd.netdev</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+ <citerefentry><refentrytitle>systemd-resolved.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
</para>
</refsect1>
diff --git a/man/systemd.special.xml b/man/systemd.special.xml
index 54e7c49a9e..d28f3d5f90 100644
--- a/man/systemd.special.xml
+++ b/man/systemd.special.xml
@@ -587,7 +587,7 @@
<varlistentry>
<term><filename>umount.target</filename></term>
<listitem>
- <para>A special target unit that umounts all mount and
+ <para>A special target unit that unmounts all mount and
automount points on system shutdown.</para>
<para>Mounts that shall be unmounted on system shutdown
diff --git a/man/systemd.timer.xml b/man/systemd.timer.xml
index cfa13015b0..29e235e2dc 100644
--- a/man/systemd.timer.xml
+++ b/man/systemd.timer.xml
@@ -284,7 +284,7 @@
unloaded. Turning this off is particularly useful for
transient timer units that shall disappear after they first
elapse. Note that this setting has an effect on repeatedly
- starting the a timer unit that only elapses once: if
+ starting a timer unit that only elapses once: if
<varname>RemainAfterElapse=</varname> is on, it will not be
started again, and is guaranteed to elapse only once. However,
if <varname>RemainAfterLeapse=</varname> is off, it might be
diff --git a/man/systemd.unit.xml b/man/systemd.unit.xml
index 5b12378eda..126b1b5cb4 100644
--- a/man/systemd.unit.xml
+++ b/man/systemd.unit.xml
@@ -918,7 +918,7 @@
<filename>/var</filename> on the next following boot. Units
making use of this condition should order themselves before
<citerefentry><refentrytitle>systemd-update-done.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
- to make sure they run before the stamp files's modification
+ to make sure they run before the stamp file's modification
time gets reset indicating a completed update.</para>
<para><varname>ConditionFirstBoot=</varname> takes a boolean
diff --git a/man/tmpfiles.d.xml b/man/tmpfiles.d.xml
index 5bf1f2956b..3c847d74a9 100644
--- a/man/tmpfiles.d.xml
+++ b/man/tmpfiles.d.xml
@@ -421,7 +421,7 @@
<command>systemd-tmpfiles</command> will automatically add
the required base entries for user and group based on the
access mode of the file, unless base entries already exist
- or are explictly specified. The mask will be added if not
+ or are explicitly specified. The mask will be added if not
specified explicitly or already present. Lines of this type
accept shell-style globs in place of normal path names. This
can be useful for allowing additional access to certain
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-11-16 09:46:19 +0000