How to mask a systemd unit in Linux?

Systemd is a system and service manager for Linux operating systems, providing a range of functionalities for managing system processes. In some cases, you may want to hide or disable a systemd unit to prevent it from starting automatically. This process is known as “masking” a systemd unit. In this article, we’ll explore the steps to mask a systemd unit in Linux.

What is Systemd?

Systemd is a suite of system management daemons, libraries, and utilities designed to centralize the management of system services. It replaces the traditional System V init scripts and provides features like the parallel startup of system services, on-demand activation of daemons, and dependency-based service control.

Systemd Units

Systemd units are configuration files that describe how a service, device, mount point, or other aspects of the system should be managed by systemd. Units are defined with files having extensions like .service, .socket, .mount, etc. They are located in directories such as /etc/systemd/system/ or /usr/lib/systemd/system/.

Method 1: Masking a Systemd Unit

Masking a systemd unit means making it impossible to start the unit, either manually or during system boot. This is achieved by creating a symlink from the unit file to /dev/null. The following steps demonstrate how to mask a systemd unit:

Step 1: Identify the Unit

Determine the systemd unit you want to mask. It could be a service, socket, target, etc. You can list all units using the systemctl list-units command or focus on specific types using systemctl list-units –type=TYPE. Use the following command:

systemctl list-units --type=your_unit_type

This command lists all active units of the specified type (your_unit_type). You need to replace your_unit_type with the actual type of the systemd unit you want to mask, such as ‘service‘, ‘socket’, ‘device’, etc.

For example:

systemctl list-units --type=service

Output:

Identify the service to mask

The command entered in the terminal listed all the active services in the system.

Step 2: Mask the Unit

Now, create a symbolic link to /dev/null in the systemd unit directory. This will effectively disable the unit. Use the following command:

sudo systemctl mask UNIT_NAME

This command creates a symbolic link ‘(symlink)’ from the systemd unit file to ‘/dev/null’, effectively disabling the unit. Replace your_unit_name with the actual name of the unit you want to mask.

For Example:

sudo systemctl mask apache2.service

Output:

Mask the service

By the command mentioned above we are masking apache2.service which has successfully created symlink.

Step 3: Verify the Masking:

Confirm that the unit is masked by checking its status with systemctl status. The output should indicate that the unit is “masked.” Use the following command:

systemctl status UNIT_NAME

The output should show something like “Loaded: masked” if the masking was successful.

For example:

systemctl status apache2.service

Output:

Check Status and Verify

By entering the above command we can clearly see int the output that the service has been masked successfully.

Step 4: (Optional) Unmasking the Unit:

Ensure that the unit is masked by checking its status.

sudo systemctl unmask UNIT_NAME

This command checks the status of the specified systemd unit (UNIT_NAME). It helps you verify that the unit is now inactive (dead) and masked. The output should indicate that the unit is no longer running.

For Example:

sudo systemctl unmask apache2.service

Output:

Unmasking service

By using the above command we are unmasking the apache2.service and output shows that unmasking has been done successfully.

Method 2: Disabling the unit

You can also achieve a similar effect by disabling the unit. Disabling a unit removes the symbolic links to the unit files, preventing it from being started.

sudo systemctl disable <unit_name>

Explanation:

• The ‘systemctl disable‘ command removes symbolic links related to the specified unit, preventing it from being started.
• This is an alternative method to achieve a similar effect to masking.

For example:

sudo systemctl disable nginx.service

Output:

Disabling unit

Output shows disabled that the unit has been disabled successfully.

To re-enable the unit :

sudo systemctl enable <unit_name>

Above command re-enables the unit and for more clarity refer to the below example:

sudo systemctl enable nginx.service

Re-enabling unit

Output shows that the unit has been re-enabled.

Method 3: Renaming the Unit File:

sudo mv /etc/systemd/system/<unit_name> /etc/systemd/system/<unit_name>.backup
sudo systemctl daemon-reload

• This command uses the mv (move) command to rename the systemd unit file. Replace <unit_name> with the actual name of the systemd unit you want to disable.
• For example, if you are working with the nginx.service unit, it would be:

sudo mv /etc/systemd/system/nginx.service /etc/systemd/system/nginx.service.backup

Output:

Renaming

By appending “.backup” to the filename, you effectively make the unit file inaccessible to systemd. This prevents systemd from recognizing and managing the service.

Masking Systemd Units in Linux: FAQs

What is masking a systemd unit?

Masking a systemd unit essentially renders it inaccessible. This means the service can’t be started manually, by other services, or even during boot. It’s considered the “strongest” form of disabling a service in systemd, like a “level 3 off switch.”

How do I mask a unit?

The command you need is systemctl mask <unit_name>. For example, to mask the “cups” service, you’d use systemctl mask cups.service. This creates a symbolic link pointing to /dev/null in the appropriate systemd directory, effectively disconnecting the service from the system.

When would I use masking instead of disabling?

There are a few situations where masking is preferable to disabling:

• Prevent accidental activation: Masking makes it virtually impossible to accidentally start the service, even through dependencies.
• Block unwanted boot services: Mashed services won’t even attempt to start during boot, potentially improving boot time.
• More persistent than disabling: Disabling removes links for auto-starting at boot, but masked units remain unaffected by configuration changes.

How do I unmask a unit if needed?

Use the command systemctl unmask <unit_name>. This removes the symbolic link and restores the unit’s normal operation.

Are there any risks or considerations with masking?

Masking a critical service or one required by another service can lead to system instability. Always double-check the unit name and understand its role before masking. Additionally, masked units won’t receive system updates unless unmasked first.

Conclusion

Masking a systemd unit in Linux is a straightforward process that involves stopping the unit and creating a symbolic link to /dev/null. This prevents the unit from starting automatically during system boot or when manually invoked. Always exercise caution when masking units, as it may impact system functionality, and only mask units that you are certain should be disabled.