systemd/man/systemd-inhibit.xml
Luca Boccassi 804874d26a logind: always check for inhibitor locks
Currently inhibitors are bypassed unless an explicit request is made to
check for them, or even in that case when the requestor is root or the
same uid as the holder of the lock.

But in many cases this makes it impractical to rely on inhibitor locks.
For example, in Debian there are several convoluted and archaic
workarounds that divert systemctl/reboot to some hacky custom scripts
to try and enforce blocking accidental reboots, when it's not expected
that the requestor will remember to specify the command line option
to enable checking for active inhibitor locks.

Also in many cases one wants to ensure that locks taken by a user are
respected by actions initiated by that same user.

Change logind so that inhibitors checks are not skipped in these
cases, and systemctl so that locks are checked in order to show a
friendly error message rather than "permission denied".

Add new block-weak and delay-weak modes that keep the previous
behaviour unchanged.
2024-07-25 12:22:36 +01:00

153 lines
5.7 KiB
XML

<?xml version='1.0'?> <!--*-nxml-*-->
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
<refentry id="systemd-inhibit"
xmlns:xi="http://www.w3.org/2001/XInclude">
<refentryinfo>
<title>systemd-inhibit</title>
<productname>systemd</productname>
</refentryinfo>
<refmeta>
<refentrytitle>systemd-inhibit</refentrytitle>
<manvolnum>1</manvolnum>
</refmeta>
<refnamediv>
<refname>systemd-inhibit</refname>
<refpurpose>Execute a program with an inhibition lock taken</refpurpose>
</refnamediv>
<refsynopsisdiv>
<cmdsynopsis>
<command>systemd-inhibit</command> <arg choice="opt" rep="repeat">OPTIONS</arg> <arg>COMMAND</arg> <arg choice="opt" rep="repeat">ARGUMENTS</arg>
</cmdsynopsis>
<cmdsynopsis>
<command>systemd-inhibit</command> <arg choice="opt" rep="repeat">OPTIONS</arg> <arg>--list</arg>
</cmdsynopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para><command>systemd-inhibit</command> may be used to execute a
program with a shutdown, sleep, or idle inhibitor lock taken. The
lock will be acquired before the specified command line is
executed and released afterwards.</para>
<para>Inhibitor locks may be used to block or delay system sleep
and shutdown requests from the user, as well as automatic idle
handling of the OS. This is useful to avoid system suspends while
an optical disc is being recorded, or similar operations that
should not be interrupted.</para>
<para>For more information see
<ulink url="https://systemd.io/INHIBITOR_LOCKS">Inhibitor Locks</ulink>.</para>
</refsect1>
<refsect1>
<title>Options</title>
<para>The following options are understood:</para>
<variablelist>
<varlistentry>
<term><option>--what=</option></term>
<listitem><para>Takes a colon-separated list of one or more
operations to inhibit:
<literal>shutdown</literal>,
<literal>sleep</literal>,
<literal>idle</literal>,
<literal>handle-power-key</literal>,
<literal>handle-suspend-key</literal>,
<literal>handle-hibernate-key</literal>,
<literal>handle-lid-switch</literal>,
for inhibiting reboot/power-off/halt/kexec/soft-reboot,
suspending/hibernating, the automatic idle detection, or the
low-level handling of the power/sleep key and the lid switch,
respectively. If omitted, defaults to
<literal>idle:sleep:shutdown</literal>.</para></listitem>
</varlistentry>
<varlistentry>
<term><option>--who=</option></term>
<listitem><para>Takes a short, human-readable descriptive
string for the program taking the lock. If not passed,
defaults to the command line string.</para></listitem>
</varlistentry>
<varlistentry>
<term><option>--why=</option></term>
<listitem><para>Takes a short, human-readable descriptive
string for the reason for taking the lock. Defaults to
"Unknown reason".</para></listitem>
</varlistentry>
<varlistentry>
<term><option>--mode=</option></term>
<listitem><para>Takes <literal>block</literal>, <literal>delay</literal>,
<literal>block-weak</literal> or <literal>delay-weak</literal> and describes how the lock is
applied. If <literal>block</literal> is used (the default), the lock prohibits any of the requested
operations without time limit, and only privileged users may override it. If
<literal>delay</literal> is used, the lock can only delay the requested operations for a limited
time. If the time elapses, the lock is ignored and the operation executed. The time limit may be
specified in
<citerefentry><refentrytitle>logind.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
Note that <literal>delay</literal> is only available for <literal>sleep</literal> and
<literal>shutdown</literal>. In addition, the weak variants will automatically and silently be
bypassed under some circumstances.</para></listitem>
</varlistentry>
<varlistentry>
<term><option>--list</option></term>
<listitem><para>Lists all active inhibition locks instead of
acquiring one.</para></listitem>
</varlistentry>
<xi:include href="standard-options.xml" xpointer="no-ask-password" />
<xi:include href="standard-options.xml" xpointer="no-pager" />
<xi:include href="standard-options.xml" xpointer="no-legend" />
<xi:include href="standard-options.xml" xpointer="help" />
<xi:include href="standard-options.xml" xpointer="version" />
</variablelist>
</refsect1>
<refsect1>
<title>Exit status</title>
<para>Returns the exit status of the executed program.</para>
</refsect1>
<refsect1>
<title>Example</title>
<programlisting># systemd-inhibit wodim foobar.iso</programlisting>
<para>This burns the ISO image
<filename>foobar.iso</filename> on a CD using
<citerefentry project='man-pages'><refentrytitle>wodim</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
and inhibits system sleeping, shutdown and idle while
doing so.</para>
</refsect1>
<xi:include href="common-variables.xml" />
<refsect1>
<title>See Also</title>
<para><simplelist type="inline">
<member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member>
<member><citerefentry><refentrytitle>logind.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry></member>
</simplelist></para>
</refsect1>
</refentry>