2019-01-03 01:16:34 +03:00
---
title: Known Environment Variables
2019-12-11 12:49:28 +03:00
category: Interfaces
2019-12-11 19:01:46 +03:00
layout: default
2021-09-14 17:05:21 +03:00
SPDX-License-Identifier: LGPL-2.1-or-later
2019-01-03 01:16:34 +03:00
---
2016-11-24 19:47:39 +03:00
# Known Environment Variables
A number of systemd components take additional runtime parameters via
environment variables. Many of these environment variables are not supported at
the same level as command line switches and other interfaces are: we don't
document them in the man pages and we make no stability guarantees for
them. While they generally are unlikely to be dropped any time soon again, we
do not want to guarantee that they stay around for good either.
Below is an (incomprehensive) list of the environment variables understood by
the various tools. Note that this list only covers environment variables not
documented in the proper man pages.
All tools:
2021-02-15 14:10:20 +03:00
* `$SYSTEMD_OFFLINE=[0|1]` — if set to `1` , then `systemctl` will refrain from
talking to PID 1; this has the same effect as the historical detection of
`chroot()` . Setting this variable to `0` instead has a similar effect as
2021-09-10 12:01:09 +03:00
`$SYSTEMD_IGNORE_CHROOT=1` ; i.e. tools will try to communicate with PID 1
even if a `chroot()` environment is detected. You almost certainly want to
set this to `1` if you maintain a package build system or similar and are
trying to use a modern container system and not plain `chroot()` .
2017-12-14 00:04:41 +03:00
2016-11-24 19:47:39 +03:00
* `$SYSTEMD_IGNORE_CHROOT=1` — if set, don't check whether being invoked in a
2017-12-14 00:04:41 +03:00
`chroot()` environment. This is particularly relevant for systemctl, as it
2021-02-15 14:10:20 +03:00
will not alter its behaviour for `chroot()` environments if set. Normally it
2017-12-14 00:04:41 +03:00
refrains from talking to PID 1 in such a case; turning most operations such
as `start` into no-ops. If that's what's explicitly desired, you might
2021-09-10 12:01:09 +03:00
consider setting `$SYSTEMD_OFFLINE=1` .
2016-11-24 19:47:39 +03:00
* `$SD_EVENT_PROFILE_DELAYS=1` — if set, the sd-event event loop implementation
will print latency information at runtime.
2019-08-01 16:33:35 +03:00
* `$SYSTEMD_PROC_CMDLINE` — if set, the contents are used as the kernel command
2021-02-15 14:10:20 +03:00
line instead of the actual one in `/proc/cmdline` . This is useful for
2019-08-01 16:33:35 +03:00
debugging, in order to test generators and other code against specific kernel
command lines.
2021-02-15 14:10:20 +03:00
* `$SYSTEMD_FSTAB` — if set, use this path instead of `/etc/fstab` . Only useful
2019-11-13 19:36:46 +03:00
for debugging.
2021-02-15 14:10:20 +03:00
* `$SYSTEMD_CRYPTTAB` — if set, use this path instead of `/etc/crypttab` . Only
useful for debugging. Currently only supported by
`systemd-cryptsetup-generator` .
2019-11-13 12:31:44 +03:00
2021-02-15 14:10:20 +03:00
* `$SYSTEMD_VERITYTAB` — if set, use this path instead of
`/etc/veritytab` . Only useful for debugging. Currently only supported by
`systemd-veritysetup-generator` .
veritysetup-generator: add support for veritytab
This adds the support for veritytab.
The veritytab file contains at most five fields, the first four are
mandatory, the last one is optional:
- The first field contains the name of the resulting verity volume; its
block device is set up /dev/mapper/</filename>.
- The second field contains a path to the underlying block data device,
or a specification of a block device via UUID= followed by the UUID.
- The third field contains a path to the underlying block hash device,
or a specification of a block device via UUID= followed by the UUID.
- The fourth field is the roothash in hexadecimal.
- The fifth field, if present, is a comma-delimited list of options.
The following options are recognized only: ignore-corruption,
restart-on-corruption, panic-on-corruption, ignore-zero-blocks,
check-at-most-once and root-hash-signature. The others options will
be implemented later.
Also, this adds support for the new kernel verity command line boolean
option "veritytab" which enables the read for veritytab, and the new
environment variable SYSTEMD_VERITYTAB which sets the path to the file
veritytab to read.
2020-11-14 17:21:39 +03:00
2019-11-18 21:47:50 +03:00
* `$SYSTEMD_EFI_OPTIONS` — if set, used instead of the string in the
2021-02-15 14:10:20 +03:00
`SystemdOptions` EFI variable. Analogous to `$SYSTEMD_PROC_CMDLINE` .
2016-12-12 15:42:06 +03:00
2021-02-15 13:50:55 +03:00
* `$SYSTEMD_DEFAULT_HOSTNAME` — override the compiled-in fallback hostname
(relevant in particular for the system manager and `systemd-hostnamed` ).
Must be a valid hostname (either a single label or a FQDN).
initrd: extend SYSTEMD_IN_INITRD to accept non-ramfs rootfs
Sometimes, non-ramfs initrd root are useful. Eg, for kdump, because
initramfs is memory consuming, so mount a compressed image in earlier
initrd, chroot into it then let systemd do the rest of job is a good
solution.
But systemd doesn't recognize the initrd environment if rootfs is not a
temporary fs. This is a reasonable check, because switch-root in initrd
will wipe the whole rootfs, will be a disaster if there are any
misdetect.
So extend SYSTEMD_IN_INITRD environment variable, now it accepts boolean
value and two extra keyword, "auto" and "lenient". "auto" is same as
before, and it's the default value. "lenient" will let systemd bypass
the rootfs check.
2021-01-12 19:04:53 +03:00
* `$SYSTEMD_IN_INITRD=[auto|lenient|0|1]` — if set, specifies initrd detection
method. Defaults to `auto` . Behavior is defined as follows:
`auto` : Checks if `/etc/initrd-release` exists, and a temporary fs is mounted
on `/` . If both conditions meet, then it's in initrd.
2021-01-17 09:43:14 +03:00
`lenient` : Similar to `auto` , but the rootfs check is skipped.
initrd: extend SYSTEMD_IN_INITRD to accept non-ramfs rootfs
Sometimes, non-ramfs initrd root are useful. Eg, for kdump, because
initramfs is memory consuming, so mount a compressed image in earlier
initrd, chroot into it then let systemd do the rest of job is a good
solution.
But systemd doesn't recognize the initrd environment if rootfs is not a
temporary fs. This is a reasonable check, because switch-root in initrd
will wipe the whole rootfs, will be a disaster if there are any
misdetect.
So extend SYSTEMD_IN_INITRD environment variable, now it accepts boolean
value and two extra keyword, "auto" and "lenient". "auto" is same as
before, and it's the default value. "lenient" will let systemd bypass
the rootfs check.
2021-01-12 19:04:53 +03:00
`0|1` : Simply overrides initrd detection. This is useful for debugging and
testing initrd-only programs in the main system.
2018-09-26 08:15:55 +03:00
2018-07-13 11:38:47 +03:00
* `$SYSTEMD_BUS_TIMEOUT=SECS` — specifies the maximum time to wait for method call
completion. If no time unit is specified, assumes seconds. The usual other units
are understood, too (us, ms, s, min, h, d, w, month, y). If it is not set or set
to 0, then the built-in default is used.
2018-11-06 19:59:58 +03:00
* `$SYSTEMD_MEMPOOL=0` — if set, the internal memory caching logic employed by
2021-02-15 14:10:20 +03:00
hash tables is turned off, and libc `malloc()` is used for all allocations.
2018-08-03 17:45:21 +03:00
2021-02-15 14:10:20 +03:00
* `$SYSTEMD_EMOJI=0` — if set, tools such as `systemd-analyze security` will
2018-11-06 19:59:58 +03:00
not output graphical smiley emojis, but ASCII alternatives instead. Note that
this only controls use of Unicode emoji glyphs, and has no effect on other
Unicode glyphs.
2019-11-13 14:06:58 +03:00
* `$RUNTIME_DIRECTORY` — various tools use this variable to locate the
2021-02-15 14:10:20 +03:00
appropriate path under `/run/` . This variable is also set by the manager when
`RuntimeDirectory=` is used, see systemd.exec(5).
2019-11-13 14:06:58 +03:00
2019-11-14 01:13:42 +03:00
* `$SYSTEMD_CRYPT_PREFIX` — if set configures the hash method prefix to use for
2021-02-15 14:10:20 +03:00
UNIX `crypt()` when generating passwords. By default the system's "preferred
method" is used, but this can be overridden with this environment variable.
Takes a prefix such as `$6$` or `$y$` . (Note that this is only honoured on
systems built with libxcrypt and is ignored on systems using glibc's
original, internal `crypt()` implementation.)
2019-11-14 01:13:42 +03:00
2020-09-24 00:19:09 +03:00
* `$SYSTEMD_RDRAND=0` — if set, the RDRAND instruction will never be used,
even if the CPU supports it.
2021-09-10 12:01:09 +03:00
* `$SYSTEMD_SECCOMP=0` — if set, seccomp filters will not be enforced, even if
2020-11-02 16:51:10 +03:00
support for it is compiled in and available in the kernel.
* `$SYSTEMD_LOG_SECCOMP=1` — if set, system calls blocked by seccomp filtering,
2021-02-15 14:10:20 +03:00
for example in `systemd-nspawn` , will be logged to the audit log, if the
kernel supports this.
2020-11-02 16:51:10 +03:00
2021-02-15 14:10:20 +03:00
`systemctl` :
2016-11-24 19:47:39 +03:00
* `$SYSTEMCTL_FORCE_BUS=1` — if set, do not connect to PID1's private D-Bus
listener, and instead always connect through the dbus-daemon D-bus broker.
* `$SYSTEMCTL_INSTALL_CLIENT_SIDE=1` — if set, enable or disable unit files on
the client side, instead of asking PID 1 to do this.
2021-02-15 14:10:20 +03:00
* `$SYSTEMCTL_SKIP_SYSV=1` — if set, do not call SysV compatibility hooks.
2016-11-24 19:47:39 +03:00
2021-02-15 14:10:20 +03:00
`systemd-nspawn` :
2016-11-24 19:47:39 +03:00
2021-02-15 14:10:20 +03:00
* `$SYSTEMD_NSPAWN_UNIFIED_HIERARCHY=1` — if set, force `systemd-nspawn` into
unified cgroup hierarchy mode.
2016-11-24 19:47:39 +03:00
2021-02-15 14:10:20 +03:00
* `$SYSTEMD_NSPAWN_API_VFS_WRITABLE=1` — if set, make `/sys/` , `/proc/sys/` ,
and friends writable in the container. If set to "network", leave only
`/proc/sys/net/` writable.
2016-11-24 19:47:39 +03:00
* `$SYSTEMD_NSPAWN_CONTAINER_SERVICE=…` — override the "service" name nspawn
uses to register with machined. If unset defaults to "nspawn", but with this
variable may be set to any other value.
* `$SYSTEMD_NSPAWN_USE_CGNS=0` — if set, do not use cgroup namespacing, even if
it is available.
* `$SYSTEMD_NSPAWN_LOCK=0` — if set, do not lock container images when running.
2021-02-15 14:10:20 +03:00
* `$SYSTEMD_NSPAWN_TMPFS_TMP=0` — if set, do not overmount `/tmp/` in the
2018-10-08 19:32:03 +03:00
container with a tmpfs, but leave the directory from the image in place.
2021-02-15 14:10:20 +03:00
`systemd-logind` :
2016-11-24 19:47:39 +03:00
* `$SYSTEMD_BYPASS_HIBERNATION_MEMORY_CHECK=1` — if set, report that
hibernation is available even if the swap devices do not provide enough room
for it.
2017-02-15 03:17:38 +03:00
2021-02-15 14:10:20 +03:00
* `$SYSTEMD_REBOOT_TO_FIRMWARE_SETUP` — if set, overrides `systemd-logind` 's
built-in EFI logic of requesting a reboot into the firmware. Takes a boolean.
If set to false, the functionality is turned off entirely. If set to true,
instead of requesting a reboot into the firmware setup UI through EFI a file,
`/run/systemd/reboot-to-firmware-setup` is created whenever this is
2018-10-23 16:53:18 +03:00
requested. This file may be checked for by services run during system
shutdown in order to request the appropriate operation from the firmware in
an alternative fashion.
* `$SYSTEMD_REBOOT_TO_BOOT_LOADER_MENU` — similar to the above, allows
2021-02-15 14:10:20 +03:00
overriding of `systemd-logind` 's built-in EFI logic of requesting a reboot
into the boot loader menu. Takes a boolean. If set to false, the
functionality is turned off entirely. If set to true, instead of requesting a
reboot into the boot loader menu through EFI, the file
`/run/systemd/reboot-to-boot-loader-menu` is created whenever this is
requested. The file contains the requested boot loader menu timeout in µs,
formatted in ASCII decimals, or zero in case no timeout is requested. This
file may be checked for by services run during system shutdown in order to
request the appropriate operation from the boot loader in an alternative
fashion.
2018-10-23 16:53:18 +03:00
* `$SYSTEMD_REBOOT_TO_BOOT_LOADER_ENTRY` — similar to the above, allows
2021-02-15 14:10:20 +03:00
overriding of `systemd-logind` 's built-in EFI logic of requesting a reboot
into a specific boot loader entry. Takes a boolean. If set to false, the
functionality is turned off entirely. If set to true, instead of requesting a
reboot into a specific boot loader entry through EFI, the file
2018-10-23 16:53:18 +03:00
`/run/systemd/reboot-to-boot-loader-entry` is created whenever this is
requested. The file contains the requested boot loader entry identifier. This
file may be checked for by services run during system shutdown in order to
request the appropriate operation from the boot loader in an alternative
fashion. Note that by default only boot loader entries which follow the [Boot
Loader Specification](https://systemd.io/BOOT_LOADER_SPECIFICATION) and are
placed in the ESP or the Extended Boot Loader partition may be selected this
way. However, if a directory `/run/boot-loader-entries/` exists, the entries
are loaded from there instead. The directory should contain the usual
directory hierarchy mandated by the Boot Loader Specification, i.e. the entry
drop-ins should be placed in
`/run/boot-loader-entries/loader/entries/*.conf` , and the files referenced by
the drop-ins (including the kernels and initrds) somewhere else below
`/run/boot-loader-entries/` . Note that all these files may be (and are
2021-02-15 14:10:20 +03:00
supposed to be) symlinks. `systemd-logind` will load these files on-demand,
2018-10-23 16:53:18 +03:00
these files can hence be updated (ideally atomically) whenever the boot
loader configuration changes. A foreign boot loader installer script should
hence synthesize drop-in snippets and symlinks for all boot entries at boot
2021-02-15 14:10:20 +03:00
or whenever they change if it wants to integrate with `systemd-logind` 's
APIs.
2018-10-23 16:53:18 +03:00
2021-02-15 14:10:20 +03:00
`systemd-udevd` :
2021-01-26 15:52:12 +03:00
2021-09-10 12:01:09 +03:00
* `$NET_NAMING_SCHEME=` — if set, takes a network naming scheme (i.e. one of
2021-01-26 15:52:12 +03:00
"v238", "v239", "v240"…, or the special value "latest") as parameter. If
2021-02-15 14:10:20 +03:00
specified udev's `net_id` builtin will follow the specified naming scheme
when determining stable network interface names. This may be used to revert
to naming schemes of older udev versions, in order to provide more stable
naming across updates. This environment variable takes precedence over the
kernel command line option `net.naming-scheme=` , except if the value is
prefixed with `:` in which case the kernel command line option takes
precedence, if it is specified as well.
2021-01-26 15:52:12 +03:00
2021-02-15 14:10:20 +03:00
`nss-systemd` :
2017-09-20 19:28:29 +03:00
* `$SYSTEMD_NSS_BYPASS_SYNTHETIC=1` — if set, `nss-systemd` won't synthesize
user/group records for the `root` and `nobody` users if they are missing from
`/etc/passwd` .
* `$SYSTEMD_NSS_DYNAMIC_BYPASS=1` — if set, `nss-systemd` won't return
user/group records for dynamically registered service users (i.e. users
registered through `DynamicUser=1` ).
* `$SYSTEMD_NSS_BYPASS_BUS=1` — if set, `nss-systemd` won't use D-Bus to do
dynamic user lookups. This is primarily useful to make `nss-systemd` work
safely from within `dbus-daemon` .
2018-04-23 11:14:15 +03:00
2021-02-15 14:10:20 +03:00
`systemd-timedated` :
2018-04-23 11:14:15 +03:00
* `$SYSTEMD_TIMEDATED_NTP_SERVICES=…` — colon-separated list of unit names of
NTP client services. If set, `timedatectl set-ntp on` enables and starts the
first existing unit listed in the environment variable, and
`timedatectl set-ntp off` disables and stops all listed units.
2018-07-04 16:36:06 +03:00
2021-02-15 14:10:20 +03:00
`systemd-sulogin-shell` :
2018-10-14 15:53:09 +03:00
* `$SYSTEMD_SULOGIN_FORCE=1` — This skips asking for the root password if the
root password is not available (such as when the root account is locked).
See `sulogin(8)` for more details.
2021-02-15 14:10:20 +03:00
`bootctl` and other tools that access the EFI System Partition (ESP):
2018-06-25 16:08:24 +03:00
* `$SYSTEMD_RELAX_ESP_CHECKS=1` — if set, the ESP validation checks are
relaxed. Specifically, validation checks that ensure the specified ESP path
is a FAT file system are turned off, as are checks that the path is located
on a GPT partition with the correct type UUID.
2018-11-20 06:37:01 +03:00
* `$SYSTEMD_ESP_PATH=…` — override the path to the EFI System Partition. This
may be used to override ESP path auto detection, and redirect any accesses to
2021-02-15 14:10:20 +03:00
the ESP to the specified directory. Note that unlike with `bootctl` 's
`--path=` switch only very superficial validation of the specified path is
done when this environment variable is used.
2018-11-20 06:37:01 +03:00
2021-02-15 14:10:20 +03:00
`systemd` itself:
2018-07-04 16:36:06 +03:00
* `$SYSTEMD_ACTIVATION_UNIT` — set for all NSS and PAM module invocations that
are done by the service manager on behalf of a specific unit, in child
processes that are later (after execve()) going to become unit
processes. Contains the full unit name (e.g. "foobar.service"). NSS and PAM
modules can use this information to determine in which context and on whose
behalf they are being called, which may be useful to avoid deadlocks, for
example to bypass IPC calls to the very service that is about to be
started. Note that NSS and PAM modules should be careful to only rely on this
data when invoked privileged, or possibly only when getppid() returns 1, as
setting environment variables is of course possible in any even unprivileged
contexts.
* `$SYSTEMD_ACTIVATION_SCOPE` — closely related to `$SYSTEMD_ACTIVATION_UNIT` ,
it is either set to `system` or `user` depending on whether the NSS/PAM
module is called by systemd in `--system` or `--user` mode.
2018-11-23 21:47:41 +03:00
2021-02-15 14:10:20 +03:00
`systemd-remount-fs` :
2018-11-23 21:47:41 +03:00
2019-06-27 10:54:20 +03:00
* `$SYSTEMD_REMOUNT_ROOT_RW=1` — if set and no entry for the root directory
2021-02-15 14:10:20 +03:00
exists in `/etc/fstab` (this file always takes precedence), then the root
2018-11-23 21:47:41 +03:00
directory is remounted writable. This is primarily used by
2021-02-15 14:10:20 +03:00
`systemd-gpt-auto-generator` to ensure the root partition is mounted writable
2018-11-23 21:47:41 +03:00
in accordance to the GPT partition flags.
2019-07-12 14:38:43 +03:00
2021-02-15 14:10:20 +03:00
`systemd-firstboot` and `localectl` :
2019-07-12 14:38:43 +03:00
2021-09-10 12:01:09 +03:00
* `$SYSTEMD_LIST_NON_UTF8_LOCALES=1` — if set, non-UTF-8 locales are listed among
2019-07-12 14:38:43 +03:00
the installed ones. By default non-UTF-8 locales are suppressed from the
selection, since we are living in the 21st century.
2021-01-12 16:55:11 +03:00
2021-02-15 14:10:20 +03:00
`systemd-sysext` :
2021-01-12 16:55:11 +03:00
2021-09-10 12:01:09 +03:00
* `$SYSTEMD_SYSEXT_HIERARCHIES` — this variable may be used to override which
2021-02-15 14:10:20 +03:00
hierarchies are managed by `systemd-sysext` . By default only `/usr/` and
`/opt/` are managed, and directories may be added or removed to that list by
setting this environment variable to a colon-separated list of absolute
paths. Only "real" file systems and directories that only contain "real" file
systems as submounts should be used. Do not specify API file systems such as
`/proc/` or `/sys/` here, or hierarchies that have them as submounts. In
particular, do not specify the root directory `/` here.
2021-02-10 00:20:32 +03:00
2021-02-15 14:10:20 +03:00
`systemd-tmpfiles` :
2021-02-10 00:20:32 +03:00
2021-09-10 12:01:09 +03:00
* `$SYSTEMD_TMPFILES_FORCE_SUBVOL` — if unset, `v` /`q`/`Q` lines will create
2021-02-15 14:10:20 +03:00
subvolumes only if the OS itself is installed into a subvolume. If set to `1`
(or another value interpreted as true), these lines will always create
subvolumes if the backing filesystem supports them. If set to `0` , these
lines will always create directories.
2021-03-01 22:42:33 +03:00
`systemd-sysv-generator` :
* `$SYSTEMD_SYSVINIT_PATH` — Controls where `systemd-sysv-generator` looks for
SysV init scripts.
* `$SYSTEMD_SYSVRCND_PATH` — Controls where `systemd-sysv-generator` looks for
SysV init script runlevel link farms.
2021-03-05 18:06:15 +03:00
2021-03-12 16:37:18 +03:00
systemd tests:
* `$SYSTEMD_TEST_DATA` — override the location of test data. This is useful if
a test executable is moved to an arbitrary location.
* `$SYSTEMD_TEST_NSS_BUFSIZE` — size of scratch buffers for "reentrant"
functions exported by the nss modules.
2021-03-05 18:06:15 +03:00
fuzzers:
* `$SYSTEMD_FUZZ_OUTPUT` — A boolean that specifies whether to write output to
stdout. Setting to true is useful in manual invocations, since all output is
suppressed by default.
* `$SYSTEMD_FUZZ_RUNS` — The number of times execution should be repeated in
manual invocations.
Note that is may be also useful to set `$SYSTEMD_LOG_LEVEL` , since all logging
is suppressed by default.
2021-02-03 23:50:27 +03:00
2021-09-10 12:01:09 +03:00
`systemd-importd` :
2021-02-03 23:50:27 +03:00
2021-09-10 12:01:09 +03:00
* `$SYSTEMD_IMPORT_BTRFS_SUBVOL` — takes a boolean, which controls whether to
2021-02-03 23:50:27 +03:00
prefer creating btrfs subvolumes over plain directories for machine
images. Has no effect on non-btrfs file systems where subvolumes are not
available anyway. If not set, defaults to true.
2021-09-10 12:01:09 +03:00
* `$SYSTEMD_IMPORT_BTRFS_QUOTA` — takes a boolean, which controls whether to set
2021-02-03 23:50:27 +03:00
up quota automatically for created btrfs subvolumes for machine images. If
not set, defaults to true. Has no effect if machines are placed in regular
directories, because btrfs subvolumes are not supported or disabled. If
enabled, the quota group of the subvolume is automatically added to a
combined quota group for all such machine subvolumes.
2021-09-10 12:01:09 +03:00
* `$SYSTEMD_IMPORT_SYNC` — takes a boolean, which controls whether to
2021-02-03 23:50:27 +03:00
synchronize images to disk after installing them, before completing the
operation. If not set, defaults to true. If disabled installation of images
will be quicker, but not as safe.
2021-09-10 12:01:09 +03:00
`systemd-dissect` , `systemd-nspawn` and all other tools that may operate on
disk images with `--image=` or similar:
* `$SYSTEMD_DISSECT_VERITY_SIDECAR` — takes a boolean, which controls whether to
load "sidecar" Verity metadata files. If enabled (which is the default),
whenever a disk image is used, a set of files with the `.roothash` ,
`.usrhash` , `.roothash.p7s` , `.usrhash.p7s` , `.verity` suffixes are searched
adjacent to disk image file, containing the Verity root hashes, their
signatures or the Verity data itself. If disabled this automatic discovery of
Verity metadata files is turned off.
* `$SYSTEMD_DISSECT_VERITY_EMBEDDED` — takes a boolean, which controls whether
to load the embedded Verity signature data. If enabled (which is the
default), Verity root hash information and a suitable signature is
automatically acquired from a signature partition, following the
[Discoverable Partitions
Specification](https://systemd.io/DISCOVERABLE_PARTITIONS). If disabled any
such partition is ignored. Note that this only disables discovery of the root
hash and its signature, the Verity data partition itself is still searched in
the GPT image.
* `$SYSTEMD_DISSECT_VERITY_SIGNATURE` — takes a boolean, which controls whether
to validate the signature of the Verity root hash if available. If enabled
(which is the default), the signature of suitable disk images is validated
against any of the certificates in `/etc/verity.d/*.crt` (and similar
directores in `/usr/lib/` , `/run` , …) or passed to the kernel for validation
against its built-in certificates.