Merge pull request #20849 from keszybz/man-page-tags-and-links

Add license tags to doc pages, fixups and more internal links in man pages

docs/ARCHITECTURE.md

@@ -2,6 +2,7 @@
 title: systemd Repository Architecture
 category: Contributing
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Code Map

docs/AUTOMATIC_BOOT_ASSESSMENT.md

@@ -2,6 +2,7 @@
 title: Automatic Boot Assessment
 category: Booting
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Automatic Boot Assessment

docs/BLOCK_DEVICE_LOCKING.md

@@ -2,6 +2,7 @@
 title: Locking Block Device Access
 category: Interfaces
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Locking Block Device Access

docs/BOOT_LOADER_INTERFACE.md

@@ -2,6 +2,7 @@
 title: Boot Loader Interface
 category: Booting
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # The Boot Loader Interface

docs/BOOT_LOADER_SPECIFICATION.md

@@ -2,6 +2,7 @@
 title: Boot Loader Specification
 category: Booting
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # The Boot Loader Specification

docs/CGROUP_DELEGATION.md

@@ -2,6 +2,7 @@
 title: Control Group APIs and Delegation
 category: Interfaces
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Control Group APIs and Delegation

docs/CODE_OF_CONDUCT.md

@@ -2,6 +2,7 @@
 title: systemd Community Conduct Guidelines
 category: Contributing
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # The systemd Community Conduct Guidelines

docs/CODE_QUALITY.md

@@ -2,6 +2,7 @@
 title: Code Quality Tools
 category: Contributing
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Code Quality Tools

docs/CODING_STYLE.md

@@ -2,6 +2,7 @@
 title: Coding Style
 category: Contributing
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Coding Style

docs/CONTAINER_INTERFACE.md

@@ -2,6 +2,7 @@
 title: Container Interface
 category: Interfaces
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # The Container Interface

docs/CONTRIBUTING.md

@@ -2,6 +2,7 @@
 title: Contributing
 category: Contributing
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Contributing

docs/CONVERTING_TO_HOMED.md

@@ -2,6 +2,7 @@
 title: Converting Existing Users to systemd-homed
 category: Users, Groups and Home Directories
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Converting Existing Users to systemd-homed managed Users

docs/COREDUMP_PACKAGE_METADATA.md

@@ -2,6 +2,7 @@
 title: Package Metadata for Core Files
 category: Interfaces
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Package Metadata for Core Files

docs/DESKTOP_ENVIRONMENTS.md

@@ -2,6 +2,7 @@
 title: Desktop Environment Integration
 category: Concepts
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Desktop Environments

docs/DISCOVERABLE_PARTITIONS.md

@@ -2,6 +2,7 @@
 title: Discoverable Partitions Specification
 category: Concepts
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 # The Discoverable Partitions Specification
 

docs/DISTRO_PORTING.md

@@ -2,6 +2,7 @@
 title: Porting systemd To New Distributions
 category: Concepts
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Porting systemd To New Distributions

docs/ENVIRONMENT.md

@@ -2,6 +2,7 @@
 title: Known Environment Variables
 category: Interfaces
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Known Environment Variables

docs/GROUP_RECORD.md

@@ -2,6 +2,7 @@
 title: JSON Group Records
 category: Users, Groups and Home Directories
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # JSON Group Records

docs/GVARIANT-SERIALIZATION.md

@@ -2,6 +2,7 @@
 title: GVariant D-Bus Message Serialization
 category: Interfaces
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # GVariant D-Bus Message Serialization

docs/HACKING.md

@@ -2,6 +2,7 @@
 title: Hacking on systemd
 category: Contributing
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Hacking on systemd

docs/HOME_DIRECTORY.md

@@ -2,6 +2,7 @@
 title: Home Directories
 category: Users, Groups and Home Directories
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Home Directories

docs/INITRD_INTERFACE.md

@@ -2,6 +2,7 @@
 title: Initrd Interface
 category: Interfaces
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 

docs/JOURNAL_FILE_FORMAT.md

@@ -2,6 +2,7 @@
 title: Journal File Format
 category: Interfaces
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Journal File Format

docs/JOURNAL_NATIVE_PROTOCOL.md

@@ -2,6 +2,7 @@
 title: Native Journal Protocol
 category: Interfaces
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Native Journal Protocol

docs/PASSWORD_AGENTS.md

@@ -2,6 +2,7 @@
 title: Password Agents
 category: Interfaces
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Password Agents

docs/PORTABILITY_AND_STABILITY.md

@@ -2,6 +2,7 @@
 title: Interface Portability and Stability
 category: Interfaces
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Interface Portability and Stability Promise

docs/PORTABLE_SERVICES.md

@@ -2,6 +2,7 @@
 title: Portable Services Introduction
 category: Concepts
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Portable Services Introduction

docs/PREDICTABLE_INTERFACE_NAMES.md

@@ -2,6 +2,7 @@
 title: Predictable Network Interface Names
 category: Concepts
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Predictable Network Interface Names

docs/RANDOM_SEEDS.md

@@ -2,6 +2,7 @@
 title: Random Seeds
 category: Concepts
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Random Seeds

docs/RELEASE.md

@@ -2,6 +2,7 @@
 title: Steps to a Successful Release
 category: Contributing
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Steps to a Successful Release

docs/RESOLVED-VPNS.md

@@ -2,6 +2,7 @@
 title: systemd-resolved and VPNs
 category: Networking
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # `systemd-resolved.service` and VPNs

docs/ROOT_STORAGE_DAEMONS.md

@@ -2,6 +2,7 @@
 title: Storage Daemons for the Root File System
 category: Interfaces
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # systemd and Storage Daemons for the Root File System

docs/SECURITY.md

@@ -2,6 +2,7 @@
 title: Reporting of Security Vulnerabilities
 category: Contributing
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Reporting of Security Vulnerabilities

docs/TEMPORARY_DIRECTORIES.md

@@ -2,6 +2,7 @@
 title: Using /tmp/ and /var/tmp/ Safely
 category: Interfaces
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Using `/tmp/` and `/var/tmp/` Safely

docs/TESTING_WITH_SANITIZERS.md

@@ -2,6 +2,7 @@
 title: Testing systemd Using Sanitizers
 category: Contributing
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Testing systemd Using Sanitizers

docs/TRANSIENT-SETTINGS.md

@@ -2,6 +2,7 @@
 title: What Settings Are Currently Available For Transient Units?
 category: Interfaces
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # What Settings Are Currently Available For Transient Units?

docs/TRANSLATORS.md

@@ -2,6 +2,7 @@
 title: Notes for Translators
 category: Contributing
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Notes for Translators

docs/UIDS-GIDS.md

@@ -2,6 +2,7 @@
 title: Users, Groups, UIDs and GIDs on systemd Systems
 category: Users, Groups and Home Directories
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # Users, Groups, UIDs and GIDs on systemd Systems

docs/USERDB_AND_DESKTOPS.md

@@ -2,6 +2,7 @@
 title: systemd-homed and JSON User/Group Record Support in Desktop Environments
 category: Users, Groups and Home Directories
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # `systemd-homed` and JSON User/Group Record Support in Desktop Environments

docs/USER_GROUP_API.md

@@ -2,6 +2,7 @@
 title: User/Group Record Lookup API via Varlink
 category: Users, Groups and Home Directories
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # User/Group Record Lookup API via Varlink

docs/USER_NAMES.md

@@ -2,6 +2,7 @@
 title: User/Group Name Syntax
 category: Users, Groups and Home Directories
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # User/Group Name Syntax

docs/USER_RECORD.md

@@ -2,6 +2,7 @@
 title: JSON User Records
 category: Users, Groups and Home Directories
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 # JSON User Records

docs/index.md

@@ -1,5 +1,6 @@
 ---
 layout: default
+SPDX-License-Identifier: LGPL-2.1-or-later
 ---
 
 systemd is a suite of basic building blocks for a Linux system. It provides a system and service manager that runs as PID 1 and starts the rest of the system.

man/systemd-cryptenroll.xml

@@ -29,19 +29,21 @@
   <refsect1>
     <title>Description</title>
 
-    <para><command>systemd-cryptenroll</command> is a tool for enrolling hardware security tokens and devices into a
-    LUKS2 encrypted volume, which may then be used to unlock the volume during boot. Specifically, it supports
-    tokens and credentials of the following kind to be enrolled:</para>
+    <para><command>systemd-cryptenroll</command> is a tool for enrolling hardware security tokens and devices
+    into a LUKS2 encrypted volume, which may then be used to unlock the volume during boot. Specifically, it
+    supports tokens and credentials of the following kind to be enrolled:</para>
 
     <orderedlist>
-      <listitem><para>PKCS#11 security tokens and smartcards that may carry an RSA key pair (e.g. various YubiKeys)</para></listitem>
+      <listitem><para>PKCS#11 security tokens and smartcards that may carry an RSA key pair (e.g. various
+      YubiKeys)</para></listitem>
 
-      <listitem><para>FIDO2 security tokens that implement the <literal>hmac-secret</literal> extension (most FIDO2 keys, including YubiKeys)</para></listitem>
+      <listitem><para>FIDO2 security tokens that implement the <literal>hmac-secret</literal> extension (most
+      FIDO2 keys, including YubiKeys)</para></listitem>
 
       <listitem><para>TPM2 security devices</para></listitem>
 
       <listitem><para>Recovery keys. These are similar to regular passphrases, however are randomly generated
-      on the computer and thus generally have higher entropy than user chosen passphrases. Their character
+      on the computer and thus generally have higher entropy than user-chosen passphrases. Their character
       set has been designed to ensure they are easy to type in, while having high entropy. They may also be
       scanned off screen using QR codes. Recovery keys may be used for unlocking LUKS2 volumes wherever
       passphrases are accepted. They are intended to be used in combination with an enrolled hardware
@@ -75,9 +77,10 @@
       <varlistentry>
         <term><option>--recovery-key</option></term>
 
-        <listitem><para>Enroll a recovery key. Recovery keys are most identical to passphrases, but are
-        computer generated instead of human chosen, and thus have a guaranteed high entropy. The key uses a
-        character set that is easy to type in, and may be scanned off screen via a QR code.</para></listitem>
+        <listitem><para>Enroll a recovery key. Recovery keys are mostly identical to passphrases, but are
+        computer-generated instead of being chosen by a human, and thus have a guaranteed high entropy. The
+        key uses a character set that is easy to type in, and may be scanned off screen via a QR code.
+        </para></listitem>
       </varlistentry>
 
       <varlistentry>

man/systemd-sysv-generator.xml

@@ -31,7 +31,7 @@
     that creates wrapper .service units for
     <ulink url="https://savannah.nongnu.org/projects/sysvinit">SysV init</ulink>
     scripts in <filename>/etc/init.d/*</filename> at boot and when
-    configuration of the system manager is reloaded. This will allow
+    configuration of the system manager is reloaded. This allows
     <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>
     to support them similarly to native units.</para>
 
@@ -46,6 +46,10 @@
     <citerefentry><refentrytitle>systemd.special</refentrytitle><manvolnum>7</manvolnum></citerefentry>
     for more details.</para>
 
+    <para>Note that compatibility is quite comprehensive but not 100%, for more details see <ulink
+    url="https://www.freedesktop.org/wiki/Software/systemd/Incompatibilities">Incompatibilities with
+    SysV</ulink>.</para>
+
     <para>SysV runlevels have corresponding systemd targets
     (<filename>runlevel<replaceable>X</replaceable>.target</filename>).
     The wrapper unit that is generated will be wanted by those targets

man/systemd.automount.xml

@@ -3,7 +3,7 @@
   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
 
-<refentry id="systemd.automount">
+<refentry id="systemd.automount" xmlns:xi="http://www.w3.org/2001/XInclude">
   <refentryinfo>
     <title>systemd.automount</title>
     <productname>systemd</productname>
@@ -124,7 +124,11 @@
   <refsect1>
     <title>Options</title>
 
-    <para>Automount files must include an [Automount] section, which
+    <para>Automount unit files may include [Unit] and [Install] sections, which are described in
+    <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+    </para>
+
+    <para>Automount unit files must include an [Automount] section, which
     carries information about the file system automount points it
     supervises. The options specific to the [Automount] section of
     automount units are the following:</para>
@@ -157,6 +161,8 @@
         default.</para></listitem>
       </varlistentry>
     </variablelist>
+
+    <xi:include href="systemd.service.xml" xpointer="shared-unit-options" />
   </refsect1>
 
   <refsect1>

man/systemd.device.xml

@@ -147,7 +147,14 @@
       </varlistentry>
 
     </variablelist>
+  </refsect1>
 
+  <refsect1>
+    <title>Options</title>
+
+    <para>Device unit files may include [Unit] and [Install] sections, which are described in
+    <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>. No
+    options specific to this file type are supported.</para>
   </refsect1>
 
   <refsect1>

man/systemd.exec.xml

@@ -1512,33 +1512,40 @@ BindReadOnlyPaths=/var/lib/systemd</programlisting>
       <varlistentry>
         <term><varname>PrivateDevices=</varname></term>
 
-        <listitem><para>Takes a boolean argument. If true, sets up a new <filename>/dev/</filename> mount for the
-        executed processes and only adds API pseudo devices such as <filename>/dev/null</filename>,
-        <filename>/dev/zero</filename> or <filename>/dev/random</filename> (as well as the pseudo TTY subsystem) to it,
-        but no physical devices such as <filename>/dev/sda</filename>, system memory <filename>/dev/mem</filename>,
-        system ports <filename>/dev/port</filename> and others. This is useful to securely turn off physical device
-        access by the executed process. Defaults to false. Enabling this option will install a system call filter to
-        block low-level I/O system calls that are grouped in the <varname>@raw-io</varname> set, will also remove
-        <constant>CAP_MKNOD</constant> and <constant>CAP_SYS_RAWIO</constant> from the capability bounding set for the
-        unit (see above), and set <varname>DevicePolicy=closed</varname> (see
+        <listitem><para>Takes a boolean argument. If true, sets up a new <filename>/dev/</filename> mount for
+        the executed processes and only adds API pseudo devices such as <filename>/dev/null</filename>,
+        <filename>/dev/zero</filename> or <filename>/dev/random</filename> (as well as the pseudo TTY
+        subsystem) to it, but no physical devices such as <filename>/dev/sda</filename>, system memory
+        <filename>/dev/mem</filename>, system ports <filename>/dev/port</filename> and others. This is useful
+        to turn off physical device access by the executed process. Defaults to false.</para>
+
+        <para>Enabling this option will install a system call filter to block low-level I/O system calls that
+        are grouped in the <varname>@raw-io</varname> set, remove <constant>CAP_MKNOD</constant> and
+        <constant>CAP_SYS_RAWIO</constant> from the capability bounding set for the unit, and set
+        <varname>DevicePolicy=closed</varname> (see
         <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-        for details). Note that using this setting will disconnect propagation of mounts from the service to the host
-        (propagation in the opposite direction continues to work). This means that this setting may not be used for
-        services which shall be able to install mount points in the main mount namespace. The new
-        <filename>/dev/</filename> will be mounted read-only and 'noexec'. The latter may break old programs which try
-        to set up executable memory by using
+        for details). Note that using this setting will disconnect propagation of mounts from the service to
+        the host (propagation in the opposite direction continues to work). This means that this setting may
+        not be used for services which shall be able to install mount points in the main mount namespace. The
+        new <filename>/dev/</filename> will be mounted read-only and 'noexec'. The latter may break old
+        programs which try to set up executable memory by using
         <citerefentry><refentrytitle>mmap</refentrytitle><manvolnum>2</manvolnum></citerefentry> of
-        <filename>/dev/zero</filename> instead of using <constant>MAP_ANON</constant>. For this setting the same
-        restrictions regarding mount propagation and privileges apply as for <varname>ReadOnlyPaths=</varname> and
-        related calls, see above. If turned on and if running in user mode, or in system mode, but without the
-        <constant>CAP_SYS_ADMIN</constant> capability (e.g. setting <varname>User=</varname>),
-        <varname>NoNewPrivileges=yes</varname> is implied.</para>
+        <filename>/dev/zero</filename> instead of using <constant>MAP_ANON</constant>. For this setting the
+        same restrictions regarding mount propagation and privileges apply as for
+        <varname>ReadOnlyPaths=</varname> and related calls, see above. If turned on and if running in user
+        mode, or in system mode, but without the <constant>CAP_SYS_ADMIN</constant> capability (e.g. setting
+        <varname>User=</varname>), <varname>NoNewPrivileges=yes</varname> is implied.</para>
 
-        <para>Note that the implementation of this setting might be impossible (for example if mount namespaces are not
-        available), and the unit should be written in a way that does not solely rely on this setting for
-        security.</para>
+        <para>Note that the implementation of this setting might be impossible (for example if mount
+        namespaces are not available), and the unit should be written in a way that does not solely rely on
+        this setting for security.</para>
 
-        <xi:include href="system-only.xml" xpointer="singular"/></listitem>
+        <xi:include href="system-only.xml" xpointer="singular"/>
+
+        <para>When access to some but not all devices must be possible, the <varname>DeviceAllow=</varname>
+        setting might be used instead. See
+        <citerefentry><refentrytitle>systemd.resource-control</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+        </para></listitem>
       </varlistentry>
 
       <varlistentry>

man/systemd.mount.xml

@@ -3,7 +3,7 @@
   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
 
-<refentry id="systemd.mount">
+<refentry id="systemd.mount" xmlns:xi="http://www.w3.org/2001/XInclude">
   <refentryinfo>
     <title>systemd.mount</title>
     <productname>systemd</productname>
@@ -442,7 +442,11 @@
   <refsect1>
     <title>Options</title>
 
-    <para>Mount files must include a [Mount] section, which carries
+    <para>Mount unit files may include [Unit] and [Install] sections, which are described in
+    <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+    </para>
+
+    <para>Mount unit files must include a [Mount] section, which carries
     information about the file system mount points it supervises. A
     number of options that may be used in this section are shared with
     other unit types. These options are documented in
@@ -567,11 +571,7 @@
       </varlistentry>
     </variablelist>
 
-    <para>Check
-    <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-    and
-    <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-    for more settings.</para>
+    <xi:include href="systemd.service.xml" xpointer="shared-unit-options" />
   </refsect1>
 
   <refsect1>

man/systemd.path.xml

@@ -3,7 +3,7 @@
   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
 
-<refentry id="systemd.path">
+<refentry id="systemd.path" xmlns:xi="http://www.w3.org/2001/XInclude">
   <refentryinfo>
     <title>systemd.path</title>
     <productname>systemd</productname>
@@ -103,9 +103,12 @@
   <refsect1>
     <title>Options</title>
 
-    <para>Path files must include a [Path] section, which carries
-    information about the path(s) it monitors. The options specific to
-    the [Path] section of path units are the following:</para>
+    <para>Path unit files may include [Unit] and [Install] sections, which are described in
+    <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+    </para>
+
+    <para>Path unit files must include a [Path] section, which carries information about the path or paths it
+    monitors. The options specific to the [Path] section of path units are the following:</para>
 
     <variablelist class='unit-directives'>
       <varlistentry>
@@ -184,6 +187,8 @@
         to <option>0755</option>.</para></listitem>
       </varlistentry>
     </variablelist>
+
+    <xi:include href="systemd.service.xml" xpointer="shared-unit-options" />
   </refsect1>
 
   <refsect1>

man/systemd.resource-control.xml

@@ -928,6 +928,11 @@ RestrictNetworkInterfaces=~eth1</programlisting>
           url="https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html">Device Whitelist Controller</ulink>.
           In the unified cgroup hierarchy this functionality is implemented using eBPF filtering.</para>
 
+          <para>When access to <emphasis>all</emphasis> physical devices should be disallowed,
+          <varname>PrivateDevices=</varname> may be used instead. See
+          <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+          </para>
+
           <para>The device node specifier is either a path to a device node in the file system, starting with
           <filename>/dev/</filename>, or a string starting with either <literal>char-</literal> or
           <literal>block-</literal> followed by a device group name, as listed in

man/systemd.scope.xml

@@ -3,7 +3,7 @@
   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
 
-<refentry id="systemd.scope">
+<refentry id="systemd.scope" xmlns:xi="http://www.w3.org/2001/XInclude">
   <refentryinfo>
     <title>systemd.scope</title>
     <productname>systemd</productname>
@@ -89,6 +89,10 @@
   <refsect1>
     <title>Options</title>
 
+    <para>Socket files may include a [Unit] section, which is described in
+    <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+    </para>
+
     <para>Scope files may include a [Scope]
     section, which carries information about the scope and the
     units it contains. A number of options that may be used in
@@ -109,6 +113,8 @@
         <literal>infinity</literal> (the default) to configure no runtime limit.</para></listitem>
       </varlistentry>
     </variablelist>
+
+    <xi:include href="systemd.service.xml" xpointer="shared-unit-options" />
   </refsect1>
 
   <refsect1>

man/systemd.service.xml

@@ -50,15 +50,11 @@
     which configure resource control settings for the processes of the
     service.</para>
 
-    <para>If a service is requested under a certain name but no unit
-    configuration file is found, systemd looks for a SysV init script
-    by the same name (with the <filename>.service</filename> suffix
-    removed) and dynamically creates a service unit from that script.
-    This is useful for compatibility with SysV. Note that this
-    compatibility is quite comprehensive but not 100%. For details
-    about the incompatibilities, see the <ulink
-    url="https://www.freedesktop.org/wiki/Software/systemd/Incompatibilities">Incompatibilities
-    with SysV</ulink> document.</para>
+    <para>If SysV init compat is enabled, systemd automatically creates service units that wrap SysV init
+    scripts (the service name is the same as the name of the script, with a <literal>.service</literal>
+    suffix added); see
+    <citerefentry><refentrytitle>systemd-sysv-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
+    </para>
 
     <para>The <citerefentry><refentrytitle>systemd-run</refentrytitle><manvolnum>1</manvolnum></citerefentry>
     command allows creating <filename>.service</filename> and <filename>.scope</filename> units dynamically
@@ -138,7 +134,11 @@
   <refsect1>
     <title>Options</title>
 
-    <para>Service files must include a [Service]
+    <para>Service unit files may include [Unit] and [Install] sections, which are described in
+    <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+    </para>
+
+    <para>Service unit files must include a [Service]
     section, which carries information about the service and the
     process it supervises. A number of options that may be used in
     this section are shared with other unit types. These options are
@@ -1111,8 +1111,9 @@
 
     </variablelist>
 
-    <para>Check
-    <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> and
+    <para id='shared-unit-options'>Check
+    <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+    <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>, and
     <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry> for more
     settings.</para>
   </refsect1>

man/systemd.slice.xml

@@ -98,6 +98,14 @@
     </refsect2>
   </refsect1>
 
+  <refsect1>
+    <title>Options</title>
+
+    <para>Slice unit files may include [Unit] and [Install] sections, which are described in
+    <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+    No options specific to this file type are supported.</para>
+  </refsect1>
+
   <refsect1>
     <title>See Also</title>
     <para>

man/systemd.socket.xml

@@ -3,7 +3,7 @@
   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
 
-<refentry id="systemd.socket">
+<refentry id="systemd.socket" xmlns:xi="http://www.w3.org/2001/XInclude">
   <refentryinfo>
     <title>systemd.socket</title>
     <productname>systemd</productname>
@@ -159,7 +159,11 @@
   <refsect1>
     <title>Options</title>
 
-    <para>Socket files must include a [Socket] section, which carries
+    <para>Socket unit files may include [Unit] and [Install] sections, which are described in
+    <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+    </para>
+
+    <para>Socket unit files must include a [Socket] section, which carries
     information about the socket or FIFO it supervises. A number of
     options that may be used in this section are shared with other
     unit types. These options are documented in
@@ -839,12 +843,7 @@
 
     </variablelist>
 
-    <para>Check
-    <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-    and
-    <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-    for more settings.</para>
-
+    <xi:include href="systemd.service.xml" xpointer="shared-unit-options" />
   </refsect1>
 
   <refsect1>

man/systemd.swap.xml

@@ -3,9 +3,7 @@
   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
 
-<refentry id="systemd.swap"
-          xmlns:xi="http://www.w3.org/2001/XInclude">
-
+<refentry id="systemd.swap" xmlns:xi="http://www.w3.org/2001/XInclude">
   <refentryinfo>
     <title>systemd.swap</title>
     <productname>systemd</productname>
@@ -169,6 +167,10 @@
   <refsect1>
     <title>Options</title>
 
+    <para>Swap unit files may include [Unit] and [Install] sections, which are described in
+    <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+    </para>
+
     <para>Swap unit files must include a [Swap] section, which carries
     information about the swap device it supervises. A number of
     options that may be used in this section are shared with other
@@ -235,11 +237,7 @@
       </varlistentry>
     </variablelist>
 
-    <para>Check
-    <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-    and
-    <citerefentry><refentrytitle>systemd.kill</refentrytitle><manvolnum>5</manvolnum></citerefentry>
-    for more settings.</para>
+    <xi:include href="systemd.service.xml" xpointer="shared-unit-options" />
   </refsect1>
 
   <refsect1>

man/systemd.target.xml

@@ -84,6 +84,14 @@
     </refsect2>
   </refsect1>
 
+  <refsect1>
+    <title>Options</title>
+
+    <para>Target unit files may include [Unit] and [Install] sections, which are described in
+    <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+    No options specific to this file type are supported.</para>
+  </refsect1>
+
   <refsect1>
     <title>Example</title>
 

man/systemd.timer.xml

@@ -3,7 +3,7 @@
   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
 <!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
 
-<refentry id="systemd.timer">
+<refentry id="systemd.timer" xmlns:xi="http://www.w3.org/2001/XInclude">
   <refentryinfo>
     <title>systemd.timer</title>
     <productname>systemd</productname>
@@ -94,7 +94,11 @@
   <refsect1>
     <title>Options</title>
 
-    <para>Timer files must include a [Timer] section, which carries
+    <para>Timer unit files may include [Unit] and [Install] sections, which are described in
+    <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+    </para>
+
+    <para>Timer unit files must include a [Timer] section, which carries
     information about the timer it defines. The options specific to
     the [Timer] section of timer units are the following:</para>
 
@@ -178,7 +182,6 @@
         precise time configured with these settings, as they are
         subject to the <varname>AccuracySec=</varname> setting
         below.</para></listitem>
-
       </varlistentry>
 
       <varlistentry>
@@ -357,6 +360,8 @@
         <option>true</option>.</para></listitem>
       </varlistentry>
     </variablelist>
+
+    <xi:include href="systemd.service.xml" xpointer="shared-unit-options" />
   </refsect1>
 
   <refsect1>