How to set global environment variables to all services?

Question

I have seen that it should be possible, by using DefaultEnvironment= in /etc/systemd/system.conf. However, I'm not sure whether I can use expression expansions like PATH=$PATH:/whatever/path or not.

So, how can I set global default service environments, with expression expansions?

Answer 1

Other answers about setting PATH in /etc/environment or other places may work if you are calling shell commands from your units. However, if you you are trying to run:

ExecStart=mycommand

And you want mycommand to be derived from $PATH, then this is not going to work. systemd does not use $PATH to resolve these. It uses a list of paths which are defined at compile-time.

From systemd.service:

If the command is not a full (absolute) path, it will be resolved to a full path using a fixed search path determined at compilation time. Searched directories include /usr/local/bin/, /usr/bin/, /bin/ on systems using split /usr/bin/ and /bin/ directories, and their sbin/ counterparts on systems using split bin/ and sbin/. It is thus safe to use just the executable name in case of executables located in any of the "standard" directories, and an absolute path must be used in other cases. Using an absolute path is recommended to avoid ambiguity. Hint: this search path may be queried using systemd-path search-binaries-default.

The best practice is to use absolute paths when using Exec*= fields. This avoids the need for $PATH, and ensures the behavior of your service cannot change if someone sneaks an extra binary somewhere else like /usr/local/bin. Usually, non-templated services are not designed to be dynamic (designed to change contents or intent based on the local environment).

Answer 2

There are a couple of places this can be done.

The systemd man page does not indicate that you can append to a path as you are trying to do. Also, other mechanisms might replace the path, clearing your value from system.conf anyway. Note also that if path was empty, if you try to append to path this way, you will leave the null directory in the path, which translates to "." and it is considered a security hole to have the current directory in the path, so this may be a bad idea anyway.

Since you are using systemd, you may also be using pam_env. This tool sets environment variables from /etc/environment and /etc/security/pam_env.conf and these do support variable substitution, but see the note on the security hole above.

You said you wanted to set the variable for global services. But if you wanted to set it for shells, you could add something in /etc/profile.d/ which would be effective for sh, bash, zsh, and possibly others (but not csh). Scripts placed in this directory are sourced, and path should already be set, so appending to the path there would be safe. However, this may only work for login shells.