    # WARNING : This file is NOT a valid systemd service.
    # It was created to demonstrate/test KDE syntax highlighting.
    # It includes invalid sections, option names and option values.

    ; NOTE: Alerts in comments are supported.

    [Automount]
    Where = /the/mount/directory
    ExtraOptions = some,extra, mount , options, %I
    DirectoryMode = 0755
    TimeoutIdleSec = 5min 5s

    [Install]
    Alias = some.service some.invalid some_%b.service
    WantedBy = some.service some.socket some.invalid
    RequiredBy = some.service some.socket some.invalid
    UpheldBy = some.service some.socket some.invalid
    Also = some.service some.socket some.invalid
    DefaultInstance = id

    [Mount]
    What = /dev/disk/by-uuid/444c-0d9d-411e-a973-015b31acaa
    # NOTE: Since systemd version 256 fstab-style identifiers are supported too.
    What = UUID=444c-0d9d-411e-a973-015b31acaa
    Where = /the/mount/directory
    Type = btrfs
    Options = subvol=some_name,compress=lzo,noatime,noauto,nodev,nosuid
    SloppyOptions = on
    LazyUnmount = true
    ReadWriteOnly = true
    ForceUnmount = yes
    DirectoryMode = 0700
    TimeoutSec = 5 m 20 s
    # see [Service] for options from systemd.exec and systemd.kill

    [Path]
    PathExists = /some/absolute/path
    PathExistsGlob = /some/g[lo]b*
    PathChanged = /some/absolute/path
    PathModified = /some/absolute/path
    DirectoryNotEmpty = /some/absolute/path
    Unit = some@instance.service
    MakeDirectory = yes
    DirectoryMode = 0700
    TriggerLimitIntervalSec = 1min 10sec
    TriggerLimitBurst = 15

    [Service]
    ## from systemd.service
    Type = exec
    RemainAfterExit = false
    GuessMainPID = no
    PIDFile = some/path
    BusName = some.name
    ExecStart = /usr/bin/Xorg ${DISPLAY} ${XDG_VTNR} \
      -logfile %t/X.%i.log \
      -nolisten tcp \
      -quiet
    ExecStartPre = @/bin/start/pre some args
    ExecStartPost = -cmd arg, @cmd2 name -o \x0A
    ExecCondition = /bin/exec/condition
    ExecReload = /bin/exec/reload
    ExecStop = /bin/kill -SIGABRT $MAINPID
    ExecStopPost = -:!!/bin/stop/post
    RestartSec = 15
    RestartSteps = 2
    RestartMaxDelaySec = 150ms
    TimeoutStartSec = 5s 100ms
    TimeoutStopSec = infinity
    TimeoutAbortSec = 15
    TimeoutSec = 10
    TimeoutStartFailureMode = abort
    TimeoutStopFailureMode = kill
    RuntimeMaxSec = 1min 20 seconds
    RuntimeRandomizedExtraSec = 12
    WatchdogSec = 90
    Restart = on-watchdog
    RestartMode = direct
    SuccessExitStatus = PROTOCOL RUNTIME_DIRECTORY \
      SECCOMP 15 23 SIGUSR1 SIGXCPU
    RestartPreventExitStatus = 15 23 SIGUSR1 \
      SIGXCPU
    RestartForceExitStatus = SIGQUIT SIGSTOP 99
    RootDirectoryStartOnly = false
    NonBlocking = false
    NotifyAccess = exec
    Sockets = some.socket \
      some-other.socket
    FileDescriptorStoreMax = 5
    FileDescriptorStorePreserve = yes
    USBFunctionDescriptors = /some/absolute/path
    USBFunctionStrings = /some/absolute/path
    OOMPolicy = stop
    OpenFile = /some/path:fd-name:graceful,read-only
    ReloadSignal = SIGUSR1

    ## from systemd.exec
    ExecPaths = some/path some/other/path
    ExtensionImages = /source/path
    ExtensionDirectories = /source/path
    IPCNamespacePath = /some/absolute/path
    MemoryKSM = false
    NoExecPaths = some/path some/other/path
    PrivateIPC = false
    ## from systemd.exec Paths
    ExecSearchPath = /some/path:/some/other/path
    WorkingDirectory = ~
    RootDirectory = /some/path
    RootImage = /some/path
    RootImageOptions = partition_name,noauto
    RootEphemeral = false
    RootHash = /some/path
    RootHash = 0xABCDEF
    RootHashSignature =
    RootVerity = /some/path
    MountAPIVFS = true
    ProcSubset = pid
    BindPaths = /source/path,/destination/path,rbind \
      /source/path2,/destination/path2,norbind \
      /source/path3
    BindReadOnlyPaths = /source/path,/destination/path,rbind \
      /source/path2,/destination/path2,norbind \
      /source/path3
    MountImages = /source/path,dest
    ## from systemd.exec Credentials
    User = 1000
    Group = group-name
    DynamicUser = true
    SupplementaryGroups = group1 group-two 100 \
      one-more-group
    SetLoginEnvironment = false
    PAMName =
    LoadCredential = some_id:/path/to/credential/data
    LoadCredentialEncrypted = some_id:/path/to/credential/data
    # accepts an optional single trailing asterisk
    ImportCredential = some*
    SetCredential = some_id:some_credential
    SetCredentialEncrypted =  some_id:some_encrypted_credential
    ## from systemd.exec Capabilities
    CapabilityBoundingSet = ~ CAP_SYS_ADMIN CAP_DAC_OVERRIDE   CAP_SYS_PTRACE \
      CAP_NET_ADMIN  CAP_SYS_BOOT
    AmbientCapabilities = CAP_SYS_ADMIN \
      CAP_DAC_OVERRIDE
    ## from systemd.exec Security
    NoNewPrivileges = true
    SecureBits = keep-caps keep-caps-locked \
      no-setuid-fixup \
      no-setuid-fixup-locked
    ## from systemd.exec Mandatory Access Control
    SELinuxContext =
    AppArmorProfile = - someprofile
    SmackProcessLabel = -label
    ## from systemd.exec Process Properties
    LimitCPU = 15s:20s
    LimitFSIZE = 12G:24G
    LimitDATA = infinity
    LimitSTACK = 512K
    LimitCORE = 128K
    LimitRSS = 2G
    LimitNOFILE = 123:234
    LimitAS = 3G
    LimitNPROC = 4711
    LimitMEMLOCK = 12G
    LimitLOCKS = 321
    LimitSIGPENDING = 46
    LimitMSGQUEUE = 512K
    LimitNICE = +12 : +15
    LimitRTPRIO = 20 : 40
    LimitRTTIME = 12us : 15
    UMask = 0022
    CoredumpFilter = default private-dax shared-dax
    KeyringMode = private
    OOMScoreAdjust = 123
    TimerSlackNSec = 321
    Personality = x86-64
    IgnoreSIGPIPE = false
    ## from systemd.exec Scheduling
    Nice = +12
    CPUSchedulingPolicy = fifo
    CPUSchedulingPriority = 34
    CPUSchedulingResetOnFork = false
    CPUAffinity = 0 1, 2 , \
      3, 4-8
    NUMAPolicy = interleave
    NUMAMask = 1,2,3-8
    IOSchedulingClass = idle
    IOSchedulingPriority = 5
    ## from systemd.exec Sandboxing
    ProtectSystem = strict
    ProtectHome = read-only
    RuntimeDirectory = some/dir:some_symlink
    StateDirectory = some/dir
    CacheDirectory = some/dir
    LogsDirectory = some/dir
    ConfigurationDirectory = some/dir
    RuntimeDirectoryMode = 0755
    StateDirectoryMode = 0755
    CacheDirectoryMode = 0755
    LogsDirectoryMode = 0755
    ConfigurationDirectoryMode = 0755
    RuntimeDirectoryPreserve = restart
    TimeoutCleanSec = 20
    ReadWritePaths = some/dir
    ReadOnlyPaths = some/dir
    InaccessiblePaths = some/dir
    TemporaryFileSystem = /var:ro
    PrivateTmp = yes
    PrivateDevices = on
    PrivateNetwork = no
    NetworkNamespacePath = /some/path
    PrivateUsers = off
    ProtectHostname = false
    ProtectClock = no
    ProtectKernelTunables = yes
    ProtectKernelModules = true
    ProtectKernelLogs = yes
    ProtectControlGroups = y
    RestrictAddressFamilies = ~ AF_INET AF_VSOCK
    RestrictFileSystems = ~btrfs ntfs3 \
      @temporary
    RestrictNamespaces = cgroup net \
      ipc
    LockPersonality = yes
    MemoryDenyWriteExecute = true
    RestrictRealtime = true
    RestrictSUIDSGID = true
    RemoveIPC = no
    PrivateMounts = false
    MountFlags = shared
    ## from systemd.exec System Call Filtering
    SystemCallFilter = @debug @aio
    SystemCallErrorNumber = ETIMEDOUT
    SystemCallArchitectures = mips64-n32 \
      native sparc
    SystemCallLog = ~ some_name \
      another_name
    ## from systemd.exec System Call Environment
    Environment = DISPLAY=:%i
    Environment = XAUTHORITY=%t/Xauthority.%i \
      "var=value with spaces"
    Environment = XDG_VTNR=vt%i
    EnvironmentFile = - /some/path
    PassEnvironment = SOME VARIABLES TO PASS
    UnsetEnvironment = SOME VARIABLES TO BE UNSET
    ## from systemd.exec Logging and Standard Input/Output
    StandardInput = file:/some/absolute/path
    StandardOutput = journal+console
    StandardError = inherit
    StandardInputText = SWNrIHNpdHplIGRhIHVuJyBlc3NlIEtsb3B
    StandardInputData = yBkZW5rIG5hbnUhCkpldHogaXNzZSB1ZmYsIGVy
    LogLevelMax = info
    LogExtraFields = FIELD=VALUE OTHER_FIELD=VALUE2
    LogRateLimitIntervalSec = 1s 500ms
    LogRateLimitBurst = 50
    LogFilterPatterns = ~some_rx
    LogFilterPatterns = \x7esome_rx
    LogNamespace = some_name
    SyslogIdentifier = some_identifier
    SyslogFacility = daemon
    SyslogLevel = debug
    SyslogLevelPrefix = true
    TTYPath = /dev/console
    TTYReset = yes
    TTYVHangup = on
    TTYRows = 24
    TTYColumns = 80
    TTYVTDisallocate = true
    ## from systemd.exec System V Compatibility
    UtmpIdentifier = utid
    UtmpMode = init

    ## from systemd.kill
    KillMode = process
    KillSignal = SIGABRT
    RestartKillSignal = SIGHUP
    SendSIGHUP = yes
    SendSIGKILL = no
    FinalKillSignal = SIGABRT
    WatchdogSignal = SIGQUIT

    ## from systemd.resource-control
    CPUAccounting = yes
    CPUWeight = 1234
    StartupCPUWeight = 321
    CPUQuota = 123.4%
    CPUQuotaPeriodSec = 1s 23ms 45us
    AllowedCPUs = 0-8, 12
    StartupAllowedCPUs = 0-24
    AllowedMemoryNodes = 5-8, 12
    StartupAllowedMemoryNodes = 5-10, 12
    MemoryAccounting = yes
    MemoryMin = 10G
    MemoryLow = 20%
    StartupMemoryLow = 22%
    DefaultStartupMemoryLow = infinity
    MemoryHigh = 40 %
    StartupMemoryHigh = 12%
    MemoryMax = 60%
    StartupMemoryMax = 55%
    MemorySwapMax = 10G
    StartupMemorySwapMax = 5G
    MemoryZSwapMax = 2G
    MemoryZSwapWriteback = false
    StartupMemoryZSwapMax = 1500k
    TasksAccounting = on
    TasksMax = 50%
    IOAccounting = on
    IOWeight = 1000
    StartupIOWeight = 500
    IODeviceWeight = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 1000
    IOReadBandwidthMax = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 10M
    IOWriteBandwidthMax = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 5M
    IOReadIOPSMax = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 1K
    IOWriteIOPSMax = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 2K
    IODeviceLatencyTargetSec = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 5s 20ms 100us
    IPAccounting = on
    IPAddressAllow = 127.0.0.0/8 ::1/128
    IPAddressDeny = 127.0.0.0/8 ::1/128
    DevicePolicy = strict
    Slice = some.slice
    Delegate = bpf-firewall
    DelegateSubgroup = some-cgroup-name
    DisableControllers = cpu io
    ManagedOOMSwap = auto
    ManagedOOMMemoryPressure = kill
    ManagedOOMMemoryPressureLimit = 50%
    ManagedOOMPreference = omit
    MemoryPressureWatch = skip
    MemoryPressureThresholdSec = 50ms
    CoredumpReceive = true
    BPFProgram = bind6:/sys/fs/bpf/sock-addr-hook
    RestrictNetworkInterfaces = ~eth1 eth2
    NFTSet = cgroup:inet:filter:my_service \
      user:inet:filter:serviceuser

    [Slice]
    # The Slice section may include options of the resource-control option group.
    # See [Service] for available options of systemd.resource-control.

    [Socket]
    ListenStream = 0.0.0.0:4000
    ListenDatagram = /path/to/socket
    ListenFIFO = /some/path
    ListenSequentialPacket = @namespace
    ListenSpecial = /some/path
    ListenNetlink = kobject-uevent
    ListenMessageQueue = /queue
    ListenUSBFunction = /some/path
    SocketProtocol = sctp
    BindIPv6Only = both
    Backlog = 123
    BindToDevice = name
    SocketGroup = users
    SocketUser = someuser
    SocketMode = 0644
    DirectoryMode = 0744
    Accept = no
    Writable = yes
    FlushPending = true
    MaxConnections = 34
    MaxConnectionsPerSource = 10
    KeepAlive = yes
    KeepAliveTimeSec = 15s 30ms
    KeepAliveIntervalSec = 10s 123us
    KeepAliveProbes = 12
    NoDelay = false
    Priority = 5
    DeferAcceptSec = 1s 100ms
    ReceiveBuffer = 10K
    SendBuffer = 15K
    IPTOS = low-delay
    IPTTL = 12
    Mark = 12
    ReusePort = no
    SmackLabel = value
    SmackLabelIPIn = value
    SmackLabelIPOut = value
    SELinuxContextFromNet = true
    PipeSize = 1M
    MessageQueueMaxMessages = 12
    MessageQueueMessageSize = 1234
    FreeBind = yes
    Transparent = no
    Broadcast = true
    PassCredentials = yes
    PassSecurity = true
    PassPacketInfo = true
    Timestamping = nsec
    TCPCongestion = westwood
    ExecStartPre = +/usr/bin/start/pre
    ExecStartPost = @/usr/bin/start/post arg
    ExecStopPre = /usr/bin/stop/pre
    ExecStopPost = /usr/bin/stop/post
    TimeoutSec = 1m 30sec
    Service = some.service
    RemoveOnStop = yes
    Symlinks = /some/path /some/other/path
    FileDescriptorName = some_name
    TriggerLimitIntervalSec = 1s 500ms
    TriggerLimitBurst = 50
    PollLimitIntervalSec = 1s 300ms
    PollLimitBurst = 120
    PassFileDescriptorsToExec = true
    # see [Service] for options from systemd.exec and systemd.kill

    [Swap]
    What = /dev/disk/by-uuid/5db77-fde6-424e-a1bb-e88e8996c
    # NOTE: Since systemd version 256 fstab-style identifiers are supported too.
    What = UUID=5db77-fde6-424e-a1bb-e88e8996c
    Priority = 123
    Options = some,device,options
    TimeoutSec = 1m 20s
    # see [Service] for options from systemd.exec and systemd.kill

    [Timer]
    OnActiveSec = 90
    OnBootSec = 5min 15s 100ms
    OnStartupSec = 2 minutes
    OnUnitActiveSec = 1 min
    OnUnitInactiveSec = 1m 30s
    OnCalendar = daily
    AccuracySec = 1min 10sec
    RandomizedDelaySec = 30s
    FixedRandomDelay = yes
    OnClockChange = false
    OnTimezoneChange = true
    Unit = some_timed.service
    Persistent = true
    WakeSystem = no
    RemainAfterElapse = true

    [Unit]
    Description = Testing systemd unit
    Documentation = https://docs.kde.org/stable5/en/applications/katepart/highlight.html \
      man:/systemd.unit
    Requires = some.service
    Requisite = some-service-name.service
    Wants = some.service
    BindsTo = some.service
    BindsTo = %i.mount
    PartOf = some.service
    Upholds = some.service some-other.service
    Conflicts = some.service
    Before = some.service
    After = some.service some@instance.service
    OnFailure = some.service
    OnSuccess = some.service some-other.service
    PropagatesReloadTo = some.service
    ReloadPropagatedFrom = some.service
    JoinsNamespaceOf = some.service
    PropagatesStopTo = some.service some-other.service
    StopPropagatedFrom = some.service some-other.service
    RequiresMountsFor = /tmp /var/log %h
    WantsMountsFor = /tmp /var/log %h
    OnFailureJobMode = fail
    OnSuccessJobMode = replace
    IgnoreOnIsolate = true
    StopWhenUnneeded = false
    RefuseManualStart = false
    RefuseManualStop = true
    AllowIsolate = true
    DefaultDependencies = no
    SurviveFinalKillSignal = yes
    CollectMode = inactive
    FailureAction = reboot
    SuccessAction = none
    FailureActionExitStatus = 15
    SuccessActionExitStatus = 255
    JobTimeoutSec = 10
    JobRunningTimeoutSec = infinity
    JobTimeoutAction = none
    JobTimeoutRebootArgument = some argument
    StartLimitIntervalSec = 0
    StartLimitBurst = 10
    StartLimitAction = none
    RebootArgument = some argument
    ConditionArchitecture = x86
    ConditionVirtualization = |vmware
    ConditionHost = !shodan*
    ConditionKernelCommandLine = !kernel_option
    ConditionKernelVersion = | >= 4.*
    ConditionCredential = name
    ConditionEnvironment = SOME_ENVIRONMENT_VARIABLE=some_value
    ConditionSecurity = | ! selinux
    ConditionCapability = !CAP_NET_ADMIN
    ConditionACPower = true
    ConditionNeedsUpdate = !/var
    ConditionFirstBoot = |false
    ConditionPathExists = !/some/absolute/path
    ConditionPathExistsGlob = |!/m?t/s[ao]me/path*
    ConditionPathIsDirectory = !/some/path
    ConditionPathIsSymbolicLink = !/some/path
    ConditionPathIsMountPoint = /some/path
    ConditionPathIsReadWrite = !/some/path
    ConditionPathIsEncrypted = !/some/absolute/path
    ConditionDirectoryNotEmpty = !/some/path
    ConditionFileNotEmpty = !/some/path
    ConditionFileIsExecutable = !/some/path
    ConditionUser = |@system
    ConditionGroup = |groupname
    ConditionControlGroupController = memory
    ConditionMemory = | >= 1G
    ConditionCPUs = | < 8
    ConditionCPUFeature = | sse2
    ConditionOSRelease = ID=some-id
    ConditionMemoryPressure = 20%/5min
    ConditionCPUPressure = 12%/10sec
    ConditionIOPressure = 30% / 1min
    AssertArchitecture = x86
    AssertVirtualization = |vmware
    AssertHost = !shodan*
    AssertKernelCommandLine = !kernel_option
    AssertKernelVersion = !>=5.3
    AssertCredential = name
    AssertEnvironment = SOME_ENVIRONMENT_VARIABLE=some_value
    AssertSecurity = | ! selinux
    AssertCapability = !CAP_NET_ADMIN
    AssertACPower = true
    AssertNeedsUpdate = !/var
    AssertFirstBoot = |false
    AssertPathExists = !/some/absolute/path
    AssertPathExistsGlob = |!/mnt/*
    AssertPathIsDirectory = !/some/path
    AssertPathIsSymbolicLink = !/some/path
    AssertPathIsMountPoint = !/some/path
    AssertPathIsReadWrite = !/some/path
    AssertPathIsEncrypted = !/some/path
    AssertDirectoryNotEmpty = !/some/path
    AssertFileNotEmpty = !/some/path
    AssertFileIsExecutable = !/some/path
    AssertUser = |@system
    AssertGroup = |groupname
    AssertControlGroupController = memory
    AssertCPUFeature = | sse4_2
    AssertOSRelease = ID=some-id
    AssertMemoryPressure = 20%/5min
    AssertCPUPressure = 12%/10sec
    AssertIOPressure = 30% / 1min

    ###### invalid sections
    [Device]
    [Invalid]
    [Slice]
    [Target]

    ############
    # Extensions
    ############

    ###### option
    [Unit]
    Description = testing extensions
      X-this = some value
    X-multiple-lines = some.service \
     other service

    ###### section
    [X-Unit]
    name = value

    ## Comments in an extension section are just the same as elsewhere.

    Some text in an extension section.
    The extension section ends with the next section header.

    ########
    # Format
    ########

    ###### for options accepting multiple values, lines may be continued
    #      using a trailing backlash
    [Unit]
    Before = before-me.socket \
      before-me.service

    ###### additional spaces are OK
         [Unit]
      RequiresMountsFor   =    /tmp /var/log

    ########################################################
    # Testing valid and invalid values for defined contexts.
    ########################################################

    ###### invalid options
    [Unit]
    # missing assignment operator
    Description is invalid as it lacks the assignment operator
    # invalid option name
    InvalidOption = some text
    # WantedBy belongs to the [Install] section
    WantedBy = some.service some.socket

    ###### AC architecture
    [Unit]
    # see "architecture" for all possible values
    AssertArchitecture = alpha
    AssertArchitecture = | alpha
    AssertArchitecture = |! alpha
    AssertArchitecture = ! alpha
    # other options
    ConditionArchitecture = |! alpha
    ## invalid values
    AssertArchitecture = !| alpha
    AssertArchitecture = || alpha
    AssertArchitecture = !! alpha

    ###### AC boolean
    [Unit]
    # see "boolean" for all possible values
    AssertACPower = true
    AssertACPower = | true
    AssertACPower = | ! true
    AssertACPower = ! true
    # other options
    AssertFirstBoot = | ! true
    ConditionACPower = | ! true
    ConditionFirstBoot = | ! true
    ## invalid values
    AssertACPower = ! | true
    AssertACPower = | | true
    AssertACPower = !! true

    ###### AC capability
    [Unit]
    # see "capability" for all possible values
    AssertCapability = CAP_CHOWN
    AssertCapability = | CAP_CHOWN
    AssertCapability = |! CAP_CHOWN
    AssertCapability = ! CAP_CHOWN
    # other options
    ConditionCapability = |! CAP_CHOWN
    ## invalid values
    AssertCapability = !| CAP_CHOWN
    AssertCapability = || CAP_CHOWN
    AssertCapability = !! CAP_CHOWN

    ###### AC cardinal
    [Unit]
    ConditionCPUs = < 123456789
    ConditionCPUs = <= 123456789
    ConditionCPUs = = 123456789
    ConditionCPUs = != 123456789
    ConditionCPUs = >=123456789
    ConditionCPUs = > 123456789
    ConditionCPUs = |< 123456789
    ConditionCPUs = |<= 123456789
    ConditionCPUs = |= 123456789
    ConditionCPUs = | != 123456789
    ConditionCPUs = | >=123456789
    ConditionCPUs = | > 123456789
    ## other options
    ConditionCPUs = > 4
    ## invalid values
    ConditionCPUs = == 123456789
    ConditionCPUs = >> 123456789
    ConditionCPUs = = 123456789.987
    ConditionCPUs = || = 123456789.987

    ###### AC cardinal KMGT
    [Unit]
    ConditionMemory = > 123456789
    ConditionMemory = |< 123456789
    ConditionMemory = |! >= 1G
    ConditionMemory = | != 512K
    ## invalid values
    # no exabyte (yet)
    ConditionMemory = = 1E

    ###### AC cpu feature
    [Unit]
    # see "cpu feature" for all possible values
    ConditionCPUFeature = |! sse2

    ###### AC controller cg (assert/condition for control group controller)
    [Unit]
    AssertControlGroupController = cpu
    AssertControlGroupController = | cpu
    AssertControlGroupController = |! cpu
    AssertControlGroupController = ! cpu
    # other options
    ConditionControlGroupController = |! cpu
    ## invalid values
    AssertControlGroupController = !| cpu
    AssertControlGroupController = || cpu
    AssertControlGroupController = !! cpu

    ###### AC firmware
    [Unit]
    # see "firmware" for all possible values
    ConditionFirmware = |! uefi

    ###### AC group
    [Unit]
    AssertGroup = | name
    AssertGroup = |! name
    AssertGroup = ! name
    # other options
    ConditionGroup = |! name
    ## invalid values
    AssertGroup = !| name
    AssertGroup = || name
    AssertGroup = !! name

    ###### AC security
    [Unit]
    # see "security" for all possible values
    AssertSecurity = audit
    AssertSecurity = | audit
    AssertSecurity = |! audit
    AssertSecurity = ! audit
    # other options
    ConditionSecurity = |! audit
    ## invalid values
    AssertSecurity = !| audit
    AssertSecurity = || audit
    AssertSecurity = !! audit

    ###### AC text
    [Unit]
    AssertKernelCommandLine = option=value
    AssertKernelCommandLine = | arg
    AssertKernelCommandLine = |! arg
    AssertKernelCommandLine = ! arg
    # other options
    AssertDirectoryNotEmpty = |! /some/path
    AssertFileIsExecutable = |! /some/path
    AssertFileNotEmpty = |! /some/path
    AssertKernelVersion = |! arg
    AssertNeedsUpdate = |! /etc
    AssertPathExists = |! /some/path
    AssertPathIsDirectory = |! /some/path
    AssertPathIsEncrypted = |! /some/path
    AssertPathIsMountPoint = |! /some/path
    AssertPathIsReadWrite = |! /some/path
    AssertPathIsSymbolicLink = |! /some/path
    ConditionDirectoryNotEmpty = |! /some/path
    ConditionEnvironment = |! name=value
    ConditionFileIsExecutable = |! /some/path
    ConditionFileNotEmpty = |! /some/path
    ConditionKernelCommandLine = |! arg
    ConditionKernelVersion = |! arg
    ConditionNeedsUpdate = |! /var
    ConditionPathExists = |! /some/path
    ConditionPathIsDirectory = |! /some/path
    ConditionPathIsEncrypted = |! /some/path
    ConditionPathIsMountPoint = |! /some/path
    ConditionPathIsReadWrite = |! /some/path
    ConditionPathIsSymbolicLink = |! /some/path
    ## invalid values
    AssertKernelCommandLine = !| arg
    AssertKernelCommandLine = || arg
    AssertKernelCommandLine = !! arg

    ###### AC text *
    [Unit]
    AssertHost = hostname
    AssertHost = hostname*
    AssertHost = | hostname*
    AssertHost = |!hostname*
    AssertHost = !hostname*
    # other options
    ConditionHost = |!hostname*
    ## invalid values
    AssertHost = !| hostname*
    AssertHost = || hostname*
    AssertHost = !! hostname*

    ###### AC text glob
    [Unit]
    AssertPathExistsGlob = |!/s[ao]me/path*
    ## invalid values
    ConditionPathExistsGlob = !! /s?me/path*

    ###### AC threshold
    [Unit]
    # there is only a fixed set of time spans to choose from
    ConditionMemoryPressure = 10%/10sec
    ConditionMemoryPressure = 20%/1min
    ConditionMemoryPressure = | ! 30 % / 5min
    ## invalid values
    # invalid time span
    ConditionMemoryPressure = 30%/5sec
    # no %
    ConditionMemoryPressure = 30 / 10sec
    # no separator before time span
    ConditionMemoryPressure = 30% 10sec

    ###### AC user
    AssertUser = | @system
    AssertUser = | name
    AssertUser = |! @system
    AssertUser = ! name
    # other options
    ConditionUser = |! @system
    ## invalid values
    AssertUser = !| name
    AssertUser = || name
    AssertUser = !! name

    ###### AC virtualization
    # accepts boolean too
    AssertVirtualization = |true
    # see "virtualization" for all possible values
    AssertVirtualization = container
    AssertVirtualization = | container
    AssertVirtualization = |! container
    ConditionVirtualization = |! container
    AssertVirtualization = ! container
    ## invalid values
    AssertVirtualization = ! | true
    AssertVirtualization = | | true
    AssertVirtualization = !! true
    # multiple values
    AssertVirtualization = true false

    ###### - text
    [Service]
    AppArmorProfile = - some-profile
    AppArmorProfile =-profile

    ###### -+/path list
    [Service]
    ReadWritePaths = -/some/path
    ReadWritePaths = -+/some/path
    ReadWritePaths = +/some/path
    ReadWritePaths =+/some/path-+/ -/some/other/path \
      -+/one/more/path
    ## invalid values
    ReadWritePaths = - /some/path
    ReadWritePaths = + /some/path
    ReadWritePaths = +-/some/path

    ###### ~ address family list
    [Service]
    RestrictAddressFamilies = AF_ALG
    RestrictAddressFamilies = AF_APPLETALK
    RestrictAddressFamilies = AF_ASH
    RestrictAddressFamilies = AF_ATMPVC
    RestrictAddressFamilies = AF_ATMSVC
    RestrictAddressFamilies = AF_AX25
    RestrictAddressFamilies = AF_BLUETOOTH
    RestrictAddressFamilies = AF_BRIDGE
    RestrictAddressFamilies = AF_CAIF
    RestrictAddressFamilies = AF_CAN
    RestrictAddressFamilies = AF_DECnet
    RestrictAddressFamilies = AF_ECONET
    RestrictAddressFamilies = AF_FILE
    RestrictAddressFamilies = AF_IB
    RestrictAddressFamilies = AF_IEEE802154
    RestrictAddressFamilies = AF_INET
    RestrictAddressFamilies = AF_INET6
    RestrictAddressFamilies = AF_IPX
    RestrictAddressFamilies = AF_IRDA
    RestrictAddressFamilies = AF_ISDN
    RestrictAddressFamilies = AF_IUCV
    RestrictAddressFamilies = AF_KCM
    RestrictAddressFamilies = AF_KEY
    RestrictAddressFamilies = AF_LLC
    RestrictAddressFamilies = AF_LOCAL
    RestrictAddressFamilies = AF_MAX
    RestrictAddressFamilies = AF_MPLS
    RestrictAddressFamilies = AF_NETBEUI
    RestrictAddressFamilies = AF_NETLINK
    RestrictAddressFamilies = AF_NETROM
    RestrictAddressFamilies = AF_NFC
    RestrictAddressFamilies = AF_PACKET
    RestrictAddressFamilies = AF_PHONET
    RestrictAddressFamilies = AF_PPPOX
    RestrictAddressFamilies = AF_QIPCRTR
    RestrictAddressFamilies = AF_RDS
    RestrictAddressFamilies = AF_ROSE
    RestrictAddressFamilies = AF_ROUTE
    RestrictAddressFamilies = AF_RXRPC
    RestrictAddressFamilies = AF_SECURITY
    RestrictAddressFamilies = AF_SMC
    RestrictAddressFamilies = AF_SNA
    RestrictAddressFamilies = AF_TIPC
    RestrictAddressFamilies = AF_UNIX
    RestrictAddressFamilies = AF_UNSPEC
    RestrictAddressFamilies = AF_VSOCK
    RestrictAddressFamilies = AF_WANPIPE
    RestrictAddressFamilies = AF_X25
    RestrictAddressFamilies = AF_XDP
    RestrictAddressFamilies = ~ AF_XDP AF_LOCAL \
      AF_SECURITY
    # since version 249 an additional 'none' is supported
    RestrictAddressFamilies = none
    ## invalid values
    RestrictAddressFamilies = AF_INVALID
    # multiple values including `none`
    RestrictAddressFamilies = AF_ROUTE none AF_ROSE

    ###### ~ capability list
    # all the values of capability, but multple values for a single option entry are valid
    [Service]
    AmbientCapabilities = ~ CAP_NET_ADMIN CAP_NET_RAW \
      CAP_WAKE_ALARM
    CapabilityBoundingSet=~CAP_NET_ADMIN CAP_NET_RAW \
      CAP_WAKE_ALARM

    ###### ~ namespace list
    [Service]
    RestrictNamespaces = cgroup
    RestrictNamespaces = ipc
    RestrictNamespaces = mnt
    RestrictNamespaces = net
    RestrictNamespaces = pid
    RestrictNamespaces = user
    RestrictNamespaces = uts
    RestrictNamespaces = cgroup uts
    RestrictNamespaces = ~ cgroup pid \
      uts
    # includes boolean
    RestrictNamespaces = true
    RestrictNamespaces = false
    ## invalid values
    RestrictNamespaces = invalid
    RestrictNamespaces = ~ true
    # if boolean, no multiple values
    RestrictNamespaces = true cgroup

    ###### ~ system call filter list
    [Service]
    SystemCallFilter = @aio
    SystemCallFilter = @basic-io
    SystemCallFilter = @chown
    SystemCallFilter = @clock
    SystemCallFilter = @cpu-emulation
    SystemCallFilter = @debug
    SystemCallFilter = @default
    SystemCallFilter = @file-system
    SystemCallFilter = @io-event
    SystemCallFilter = @ipc
    SystemCallFilter = @keyring
    SystemCallFilter = @memlock
    SystemCallFilter = @module
    SystemCallFilter = @mount
    SystemCallFilter = @network-io
    SystemCallFilter = @obsolete
    SystemCallFilter = @privileged
    SystemCallFilter = @process
    SystemCallFilter = @raw-io
    SystemCallFilter = @reboot
    SystemCallFilter = @resources
    SystemCallFilter = @setuid
    SystemCallFilter = @signal
    SystemCallFilter = @swap
    SystemCallFilter = @sync
    SystemCallFilter = @system-service
    SystemCallFilter = @timer
    SystemCallFilter = @obsolete @timer \
      @swap
    SystemCallFilter = ~ @reboot @swap
    ## invalid values
    SystemCallFilter = invalid
    SystemCallFilter = @invalid @ sync

    ###### action
    [Unit]
    FailureAction = exit
    FailureAction = exit-force
    FailureAction = halt
    FailureAction = halt-force
    FailureAction = halt-immediate
    FailureAction = kexec
    FailureAction = kexec-force
    FailureAction = none
    FailureAction = poweroff
    FailureAction = poweroff-force
    FailureAction = poweroff-immediate
    FailureAction = reboot
    FailureAction = reboot-force
    FailureAction = reboot-immediate
    FailureAction = soft-reboot
    FailureAction = soft-reboot-force
    ## invalid values
    FailureAction = invalid
    FailureAction = invalid exit
    # multiple values
    FailureAction = none exit

    ###### architecture
    [Unit]
    ConditionArchitecture = alpha
    ConditionArchitecture = arc
    ConditionArchitecture = arc-be
    ConditionArchitecture = arm
    ConditionArchitecture = arm-be
    ConditionArchitecture = arm64
    ConditionArchitecture = arm64-be
    ConditionArchitecture = cris
    ConditionArchitecture = ia64
    ConditionArchitecture = m68k
    ConditionArchitecture = mips
    ConditionArchitecture = mips-le
    ConditionArchitecture = mips64
    ConditionArchitecture = mips64-le
    ConditionArchitecture = parisc
    ConditionArchitecture = parisc64
    ConditionArchitecture = ppc
    ConditionArchitecture = ppc-le
    ConditionArchitecture = ppc64
    ConditionArchitecture = ppc64-le
    ConditionArchitecture = s390
    ConditionArchitecture = s390x
    ConditionArchitecture = sh
    ConditionArchitecture = sh64
    ConditionArchitecture = sparc
    ConditionArchitecture = sparc64
    ConditionArchitecture = tilegx
    ConditionArchitecture = x86
    ConditionArchitecture = x86-64
    # special value "native"
    ConditionArchitecture = native
    ## invalid values
    ConditionArchitecture = invalid
    ConditionArchitecture = invalid x86
    # multiple values
    ConditionArchitecture = sparc x86

    ###### boolean
    [Unit]
    StopWhenUnneeded = 1
    StopWhenUnneeded = 0
    StopWhenUnneeded = true
    StopWhenUnneeded = t
    StopWhenUnneeded = false
    StopWhenUnneeded = f
    StopWhenUnneeded = yes
    StopWhenUnneeded = y
    StopWhenUnneeded = no
    StopWhenUnneeded = n
    StopWhenUnneeded = on
    StopWhenUnneeded = off
    ## invalid values
    StopWhenUnneeded = invalid
    # multiple values
    StopWhenUnneeded = false true

    ###### calendar
    [Timer]
    OnCalendar = daily
    OnCalendar = hourly
    OnCalendar = minutely
    OnCalendar = monthly
    OnCalendar = quarterly
    OnCalendar = semiannually
    OnCalendar = weekly
    OnCalendar = yearly
    OnCalendar = daily UTC
    OnCalendar = daily utc
    OnCalendar = monday *-12-* 17:00
    OnCalendar = Mon *-12-* 17:00
    ## invalid values
    OnCalendar = Mo *-12-* 17:00

    ###### capability
    [Unit]
    ConditionCapability = CAP_AUDIT_CONTROL
    ConditionCapability = CAP_AUDIT_READ
    ConditionCapability = CAP_AUDIT_WRITE
    ConditionCapability = CAP_BLOCK_SUSPEND
    ConditionCapability = CAP_CHECKPOINT_RESTORE
    ConditionCapability = CAP_CHOWN
    ConditionCapability = CAP_DAC_OVERRIDE
    ConditionCapability = CAP_DAC_READ_SEARCH
    ConditionCapability = CAP_FOWNER
    ConditionCapability = CAP_FSETID
    ConditionCapability = CAP_IPC_LOCK
    ConditionCapability = CAP_IPC_OWNER
    ConditionCapability = CAP_KILL
    ConditionCapability = CAP_LEASE
    ConditionCapability = CAP_LINUX_IMMUTABLE
    ConditionCapability = CAP_MAC_ADMIN
    ConditionCapability = CAP_MAC_OVERRIDE
    ConditionCapability = CAP_MKNOD
    ConditionCapability = CAP_NET_ADMIN
    ConditionCapability = CAP_NET_BIND_SERVICE
    ConditionCapability = CAP_NET_BROADCAST
    ConditionCapability = CAP_NET_RAW
    ConditionCapability = CAP_SETGID
    ConditionCapability = CAP_SETFCAP
    ConditionCapability = CAP_SETPCAP
    ConditionCapability = CAP_SETUID
    ConditionCapability = CAP_SYS_ADMIN
    ConditionCapability = CAP_SYS_BOOT
    ConditionCapability = CAP_SYS_CHROOT
    ConditionCapability = CAP_SYS_MODULE
    ConditionCapability = CAP_SYS_NICE
    ConditionCapability = CAP_SYS_PACCT
    ConditionCapability = CAP_SYS_PTRACE
    ConditionCapability = CAP_SYS_RAWIO
    ConditionCapability = CAP_SYS_RESOURCE
    ConditionCapability = CAP_SYS_TIME
    ConditionCapability = CAP_SYS_TTY_CONFIG
    ConditionCapability = CAP_SYSLOG
    ConditionCapability = CAP_WAKE_ALARM
    ## invalid values
    ConditionCapability = invalid
    # multiple values
    ConditionCapability = CAP_NET_ADMIN CAP_NET_RAW

    ###### cardinal
    [Unit]
    StartLimitBurst = 15
    ## invalid values
    StartLimitBurst = -10
    StartLimitBurst = 12.34
    StartLimitBurst = 10%
    StartLimitBurst = infinity
    # multiple values
    StartLimitBurst = 10 20

    ###### cardinal % infinity
    [Service]
    TasksMax = 15
    TasksMax = 10%
    TasksMax = infinity
    ## invalid values
    TasksMax = -10
    TasksMax = 12.34
    # multiple values
    TasksMax = 10 20
    TasksMax = infinity 20

    ###### cardinal %KGMT infinity
    [Service]
    MemoryMin = 123
    MemoryMin = 12K
    MemoryMin = 12M
    MemoryMin = 12G
    MemoryMin = 12T
    MemoryMin = 12 G
    MemoryMin = 20%
    MemoryMin = infinity
    ## invalid values
    MemoryMin = invalid
    # invalid bytes suffix
    MemoryMin = 12g
    MemoryMin = 12H
    MemoryMin = 12 E
    MemoryMin = 12P

    ###### cardinal KGMT
    [Socket]
    PipeSize = 123
    PipeSize = 12K
    PipeSize = 12M
    PipeSize = 12G
    PipeSize = 12T
    PipeSize = 12 G
    ## invalid values
    PipeSize = invalid
    PipeSize = infinity
    # invalid bytes suffix
    PipeSize = 12g
    PipeSize = 12H
    PipeSize = 12 E
    PipeSize = 12P
    PipeSize = 20%

    ###### cardinal KGMT infinity
    [Service]
    MemorySwapMax = 123
    MemorySwapMax = 12K
    MemorySwapMax = 12M
    MemorySwapMax = 12G
    MemorySwapMax = 12T
    MemorySwapMax = 12 G
    MemorySwapMax = infinity
    ## invalid values
    MemorySwapMax = invalid
    # invalid bytes suffix
    MemorySwapMax = 12g
    MemorySwapMax = 12H
    MemorySwapMax = 12 E
    MemorySwapMax = 12P
    MemorySwapMax = 20%

    ###### collect mode
    [Unit]
    CollectMode = inactive
    CollectMode = inactive-or-failed
    ## invalid values
    CollectMode = invalid
    CollectMode = invalid inactive
    # multiple values
    CollectMode = inactive-or-failed inactive

    ###### condition needs update
    [Unit]
    ConditionNeedsUpdate = !/etc
    ConditionNeedsUpdate = !/var
    ## invalid values
    ConditionNeedsUpdate = /home
    # multiple values
    ConditionNeedsUpdate = /etc /var

    ###### condition user
    [Unit]
    ConditionUser = @system
    ConditionUser = name1
    ConditionUser = 1050
    ## invalid values
    ConditionUser = -1050
    # multiple values
    ConditionUser = @system 1050

    ###### controller cg (control group controller)
    [Unit]
    AssertControlGroupController = cpu
    AssertControlGroupController = io
    AssertControlGroupController = memory
    AssertControlGroupController = pids
    AssertControlGroupController = v1
    AssertControlGroupController = v2
    # multiple values
    AssertControlGroupController = cpu memory
    ## invalid values
    AssertControlGroupController = invalid

    ###### controller list
    [Service]
    # single controller
    DisableControllers = blkio
    DisableControllers = bpf-devices
    DisableControllers = bpf-firewall
    DisableControllers = cpu
    DisableControllers = cpuacct
    DisableControllers = cpuset
    DisableControllers = devices
    DisableControllers = io
    DisableControllers = memory
    DisableControllers = pids
    # multiple controllers
    DisableControllers = cpu io \
      memory
    ## invalid values
    DisableControllers = dev invalid

    ###### cpu affinity
    [Service]
    # either "numa" or any of the values for "cpu index list"
    CPUAffinity = numa
    CPUAffinity = 0 1, 2 , \
      3, 4-8 , 10 - 12
    # since version 249 specifiers are supported
    CPUAffinity = %I
    ## invalid values
    CPUAffinity = numa-x
    # no multiple "numa"
    CPUAffinity = numa numa
    # no CPU index list and "numa"
    CPUAffinity = numa 0 1 2
    CPUAffinity = 0 1 2 numa

    ###### cpu feature
    [Unit]
    ConditionCPUFeature = abm
    ConditionCPUFeature = adx
    ConditionCPUFeature = aes
    ConditionCPUFeature = apic
    ConditionCPUFeature = avx
    ConditionCPUFeature = avx2
    ConditionCPUFeature = bmi1
    ConditionCPUFeature = bmi2
    ConditionCPUFeature = clflush
    ConditionCPUFeature = cmov
    ConditionCPUFeature = constant_tsc
    ConditionCPUFeature = cx16
    ConditionCPUFeature = cx8
    ConditionCPUFeature = de
    ConditionCPUFeature = f16c
    ConditionCPUFeature = fma3
    ConditionCPUFeature = fpu
    ConditionCPUFeature = fxsr
    ConditionCPUFeature = ht
    ConditionCPUFeature = lahf_lm
    ConditionCPUFeature = lm
    ConditionCPUFeature = mca
    ConditionCPUFeature = mce
    ConditionCPUFeature = mmx
    ConditionCPUFeature = monitor
    ConditionCPUFeature = movbe
    ConditionCPUFeature = msr
    ConditionCPUFeature = mtrr
    ConditionCPUFeature = osxsave
    ConditionCPUFeature = pae
    ConditionCPUFeature = pat
    ConditionCPUFeature = pclmul
    ConditionCPUFeature = pge
    ConditionCPUFeature = pni
    ConditionCPUFeature = popcnt
    ConditionCPUFeature = pse
    ConditionCPUFeature = pse36
    ConditionCPUFeature = rdrand
    ConditionCPUFeature = rdseed
    ConditionCPUFeature = rdtscp
    ConditionCPUFeature = sep
    ConditionCPUFeature = sha_ni
    ConditionCPUFeature = sse
    ConditionCPUFeature = sse2
    ConditionCPUFeature = sse4_1
    ConditionCPUFeature = sse4_2
    ConditionCPUFeature = ssse3
    ConditionCPUFeature = syscall
    ConditionCPUFeature = tsc
    ConditionCPUFeature = vme
    ConditionCPUFeature = xsave
    ## invalid values
    ConditionCPUFeature = invalid
    # multiple values
    ConditionCPUFeature = tsc mmx

    ###### cpu index list
    [Service]
    NUMAMask = 0 1 2
    NUMAMask = 0,1, 2
    # using ranges
    NUMAMask = 0-2
    NUMAMask = 0 - 2
    NUMAMask = 0 1, 2 , \
      3, 4-8 ,
    ## invalid values
    NUMAMask = 0 invalid 2, 3;4
    NUMAMask = 0-a1
    NUMAMask = numa

    ###### cpu scheduling policy
    [Service]
    CPUSchedulingPolicy = batch
    CPUSchedulingPolicy = fifo
    CPUSchedulingPolicy = idle
    CPUSchedulingPolicy = other
    CPUSchedulingPolicy = rr
    ## invalid values
    CPUSchedulingPolicy = invalid
    # multiple values
    CPUSchedulingPolicy = batch fifo

    ###### cpu scheduling priority
    [Service]
    CPUSchedulingPriority = 12
    CPUSchedulingPriority = 99
    ## invalid values
    CPUSchedulingPriority = invalid
    CPUSchedulingPriority = -12
    CPUSchedulingPriority = 0.12
    # out of range
    CPUSchedulingPriority = 0
    CPUSchedulingPriority = 100
    # multiple values
    CPUSchedulingPriority = 12 34

    ###### cpu weight
    [Service]
    CPUWeight = idle
    # integer 1..10000
    CPUWeight = 1
    CPUWeight = 12
    CPUWeight = 123
    CPUWeight = 1234
    CPUWeight = 1234
    CPUWeight = 10000
    ## invalid values
    CPUWeight = -1
    CPUWeight = 0
    CPUWeight = 10001
    CPUWeight = 12345
    CPUWeight = 12.3
    CPUWeight = invalid
    # multiple values
    CPUWeight = 1 10000

    ###### delegate
    [Service]
    # single boolean
    Delegate = false
    Delegate = true
    # single controller
    Delegate = blkio
    Delegate = bpf-devices
    Delegate = bpf-firewall
    Delegate = cpu
    Delegate = cpuacct
    Delegate = cpuset
    Delegate = devices
    Delegate = io
    Delegate = memory
    Delegate = pids
    # multiple controllers
    Delegate = cpu io \
      memory
    ## invalid values
    Delegate = invalid
    # multiple boolean values
    Delegate = on off

    ###### device cardinal KMGT
    [Service]
    IOReadIOPSMax = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 123
    IOReadIOPSMax = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 12K
    IOReadIOPSMax = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 12M
    IOReadIOPSMax = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 12G
    IOReadIOPSMax = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 12T
    IOReadIOPSMax = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 12 G
    IOReadIOPSMax = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 \
      10M
    ## invalid values
    IOReadIOPSMax = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 20%
    # invalid multiplier suffix
    IOReadIOPSMax = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 12g
    IOReadIOPSMax = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 12E
    # no device
    IOReadIOPSMax = 10
    IOReadIOPSMax = 10M

    ###### device policy
    [Service]
    DevicePolicy = auto
    DevicePolicy = closed
    DevicePolicy = strict
    ## invalid values
    DevicePolicy = invalid
    # multiple values
    DevicePolicy = auto closed

    ###### device time span
    [Service]
    IODeviceLatencyTargetSec = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 123
    IODeviceLatencyTargetSec = /dev/disk/by-path/pci-0000:00:1f.2-scsi-0:0:0:0 5s 20ms \
      100us
    ## invalid values
    # no device
    IODeviceLatencyTargetSec = 123
    IODeviceLatencyTargetSec = 5s 20ms 100us

    ###### exec
    [Service]
    # specifier and environment variable
    ExecStart = /some/cmd %u arg $var1 inside${var2}word ${var3} $var4
    ExecStart = cmd1 %h arg1_1 $var1, cmd2 %u arg2_1 $var2_1\
      $var2_2
    # escapes (not exactly the same as detected by HlCStringChar)
    ExecStart = cmd \, \' \" \\ \a \b \f \n \r \s \t \v \x0A \012 \u1234 \U12abcdef
    # prefix
    ExecStart = @/some/cmd arg "@!+-:"
    ExecStart = -/some/cmd-1 -option arg
    ExecStart = :/some/cmd arg
    ExecStart = +/some/cmd arg
    ExecStart = !/some/cmd arg
    ExecStart = !!/some/cmd arg
    ExecStart = @:-!!/some/cmd arg
    ExecStart = @!!-:/some/cmd arg
    ExecStart = @:-+/some/cmd arg
    ## invalid values
    # invalid prefix
    ExecStart = @ /some/cmd arg
    ExecStart = @ -/some/cmd arg
    ExecStart = +!/some/cmd arg
    ExecStart = !!!/some/cmd arg
    ExecStart = @+@/some/cmd arg
    ExecStart = @!!+/some/cmd arg

    ###### exit status
    [Service]
    SuccessExitStatus = 75
    SuccessExitStatus = ADDRESS_FAMILIES
    SuccessExitStatus = APPARMOR
    SuccessExitStatus = BPF
    SuccessExitStatus = CACHE_DIRECTORY
    SuccessExitStatus = CANTCREAT
    SuccessExitStatus = CAPABILITIES
    SuccessExitStatus = CGROUP
    SuccessExitStatus = CHDIR
    SuccessExitStatus = CHOWN
    SuccessExitStatus = CHROOT
    SuccessExitStatus = CONFIG
    SuccessExitStatus = CONFIGURATION_DIRECTORY
    SuccessExitStatus = CONFIRM
    SuccessExitStatus = CPUAFFINITY
    SuccessExitStatus = CREDENTIALS
    SuccessExitStatus = DATAERR
    SuccessExitStatus = EXCEPTION
    SuccessExitStatus = EXEC
    SuccessExitStatus = FAILURE
    SuccessExitStatus = FDS
    SuccessExitStatus = GROUP
    SuccessExitStatus = INVALIDARGUMENT
    SuccessExitStatus = IOERR
    SuccessExitStatus = IOPRIO
    SuccessExitStatus = KEYRING
    SuccessExitStatus = LIMITS
    SuccessExitStatus = LOGS_DIRECTORY
    SuccessExitStatus = MEMORY
    SuccessExitStatus = NAMESPACE
    SuccessExitStatus = NETWORK
    SuccessExitStatus = NICE
    SuccessExitStatus = NOHOST
    SuccessExitStatus = NOINPUT
    SuccessExitStatus = NOPERM
    SuccessExitStatus = NOPERMISSION
    SuccessExitStatus = NOTCONFIGURED
    SuccessExitStatus = NOTIMPLEMENTED
    SuccessExitStatus = NOTINSTALLED
    SuccessExitStatus = NOTRUNNING
    SuccessExitStatus = NOUSER
    SuccessExitStatus = NO_NEW_PRIVILEGES
    SuccessExitStatus = NUMA_POLICY
    SuccessExitStatus = OOM_ADJUST
    SuccessExitStatus = OSERR
    SuccessExitStatus = OSFILE
    SuccessExitStatus = PAM
    SuccessExitStatus = PERSONALITY
    SuccessExitStatus = PROTOCOL
    SuccessExitStatus = RUNTIME_DIRECTORY
    SuccessExitStatus = SECCOMP
    SuccessExitStatus = SECUREBITS
    SuccessExitStatus = SELINUX_CONTEXT
    SuccessExitStatus = SETSCHEDULER
    SuccessExitStatus = SETSID
    SuccessExitStatus = SIGNAL_MASK
    SuccessExitStatus = SMACK_PROCESS_LABEL
    SuccessExitStatus = SOFTWARE
    SuccessExitStatus = STATE_DIRECTORY
    SuccessExitStatus = STDERR
    SuccessExitStatus = STDIN
    SuccessExitStatus = STDOUT
    SuccessExitStatus = SUCCESS
    SuccessExitStatus = TEMPFAIL
    SuccessExitStatus = TIMERSLACK
    SuccessExitStatus = UNAVAILABLE
    SuccessExitStatus = USAGE
    SuccessExitStatus = USER
    # using signals (see values for context "signal" for a complete list of values)
    SuccessExitStatus = SIGABRT
    SuccessExitStatus = ADDRESS_FAMILIES 75 \
      23 SIGHUP
    ## invalid values
    SuccessExitStatus = invalid
    SuccessExitStatus = -23

    ###### exit type
    [Service]
    ExitType = main
    ExitType = cgroup
    ## invalid values
    ExitType = invalid
    # multiple values
    ExitType = main cgroup

    ###### failure mode
    [Service]
    TimeoutStartFailureMode = abort
    TimeoutStartFailureMode = kill
    TimeoutStartFailureMode = terminate
    ## invalid values
    TimeoutStartFailureMode = invalid
    # multiple values
    TimeoutStartFailureMode = abort kill

    ###### file mode
    [Automount]
    DirectoryMode = 755
    ## invalid values
    DirectoryMode = invalid
    # need octal digits
    DirectoryMode = 0758
    DirectoryMode = 075A
    # need 3 to 4 octal digits
    DirectoryMode = 07
    # multiple values
    DirectoryMode = 0755 0755

    ###### firmware
    [Unit]
    ConditionFirmware = uefi
    ConditionFirmware = device-tree
    ConditionFirmware = device-tree-compatible(some-device-tree)
    ConditionFirmware = device-tree-compatible(  some-device-tree )
    ConditionFirmware = smbios-field(board_name = "Custom Board")
    ## invalid values
    ConditionFirmware = invalid
    ConditionFirmware = device-tree-invalid
    # missing argument
    ConditionFirmware = device-tree-compatible
    ConditionFirmware = device-tree-compatible()
    ConditionFirmware = smbios-field
    ConditionFirmware = smbios-field()
    # multiple values
    ConditionFirmware = uefi device-tree

    ###### fs set
    [Service]
    RestrictFileSystems = @auxiliary-api
    RestrictFileSystems = @basic-api
    RestrictFileSystems = @common-block
    RestrictFileSystems = @historical-block
    RestrictFileSystems = @known
    RestrictFileSystems = @network
    RestrictFileSystems = @privileged-api
    RestrictFileSystems = @temporary
    ## invalid values
    RestrictFileSystems = invalid
    RestrictFileSystems = temporary

    ###### fs type
    # A selection of file system types to be used as `Type` in mount units.
    [Mount]
    Type = binfmt_misc
    Type = btrfs
    Type = configfs
    Type = debugfs
    Type = devtmpfs
    Type = efivarfs
    Type = exfat
    Type = ext2
    Type = ext3
    Type = ext4
    Type = f2fs
    Type = fuse
    Type = fusectl
    Type = gfs2
    Type = hugetlbfs
    Type = iso9660
    Type = jfs
    Type = mqueue
    Type = msdos
    Type = nfs
    Type = nilfs2
    Type = ntfs
    Type = ntfs3
    Type = ocfs2
    Type = overlay
    Type = proc
    Type = reiserfs
    Type = tmpfs
    Type = tracefs
    Type = udf
    Type = vfat
    Type = virtiofs
    Type = xfs
    ## invalid values
    Type = invalid
    Type = invalid ext4
    # multiple values
    Type = btrfs ext4

    ###### fs type set list
    ## list of fs type names and fs set names
    [Service]
    RestrictFileSystems = @auxiliary-api btrfs \
      nfs @temporary unknown

    ###### group and user
    [Service]
    User = 0
    User = 1000
    Group = 100
    User = some-name
    Group = some_name
    User = _some-name-1
    User = name1
    # using specifiers
    User = %i
    User = name-%i
    User = some-%i-name
    User = %U-name
    User = some-%i-name-%U
    ## invalid values
    # no negative integers
    User = -1000
    # no float
    User = 100.0
    # no name with leading digit
    User = 1name
    # no name with leading hyphen
    User = -name
    # multiple values
    User = 1000 1001

    ###### group list
    [Service]
    SupplementaryGroups = some-name %U some%iname \
      %Uname 1001 name%U

    ###### io scheduling class
    # see systemd.exec
    [Service]
    IOSchedulingClass = 0
    IOSchedulingClass = 1
    IOSchedulingClass = 2
    IOSchedulingClass = 3
    IOSchedulingClass = best-effort
    IOSchedulingClass = idle
    IOSchedulingClass = realtime
    ## invalid values
    IOSchedulingClass = invalid
    IOSchedulingClass = none
    IOSchedulingClass = 4
    IOSchedulingClass = 123
    IOSchedulingClass = -1
    # multiple values
    IOSchedulingClass = 1 idle
    IOSchedulingClass = idle idle
    IOSchedulingClass = idle 1

    ###### ip address list
    [Service]
    IPAddressAllow = any
    IPAddressAllow = localhost
    IPAddressAllow = link-local
    IPAddressDeny = multicast
    IPAddressAllow = localhost \
      multicast
    IPAddressAllow = 127.0.0.0/8 ::1/128 169.254.0.0/16 fe80::/64
    ## invalid values
    IPAddressAllow = invalid

    ###### ip bind
    [Socket]
    BindIPv6Only = both
    BindIPv6Only = default
    BindIPv6Only = ipv6-only
    ## invalid values
    BindIPv6Only = invalid
    # multiple values
    BindIPv6Only = both default

    ###### io scheduling priority
    [Service]
    IOSchedulingPriority = 0
    IOSchedulingPriority = 1
    IOSchedulingPriority = 2
    IOSchedulingPriority = 3
    IOSchedulingPriority = 4
    IOSchedulingPriority = 5
    IOSchedulingPriority = 6
    IOSchedulingPriority = 7
    ## invalid values
    IOSchedulingPriority = 8
    IOSchedulingPriority = 123
    IOSchedulingPriority = -1
    # multiple values
    IOSchedulingPriority = 0 3

    ###### ip tos (terms-of-service)
    [Socket]
    IPTOS = 15
    IPTOS = low-cost
    IPTOS = low-delay
    IPTOS = reliability
    IPTOS = throughput
    ## invalid values
    IPTOS = invalid
    # multiple values
    IPTOS = 15 20
    IPTOS = low-delay 15

    ###### keyring mode
    [Service]
    KeyringMode = inherit
    KeyringMode = private
    KeyringMode = shared
    ## invalid values
    KeyringMode = invalid
    # multiple values
    KeyringMode = shared private

    ###### kill mode
    [Service]
    KillMode = control-group
    KillMode = mixed
    KillMode = none
    KillMode = process
    ## invalid values
    KillMode = invalid
    # multiple values
    KillMode = mixed process

    ###### limit bytes
    [Service]
    LimitFSIZE = 123
    LimitFSIZE = 12K
    LimitFSIZE = 12M
    LimitFSIZE = 12G
    LimitFSIZE = 12T
    LimitFSIZE = 12P
    LimitFSIZE = 12E
    LimitFSIZE = 12 G
    LimitFSIZE = 12G:24G
    LimitFSIZE = 12 G:24 G
    LimitFSIZE = 12 G: 24 G
    LimitFSIZE = 12 G :24 G
    LimitFSIZE = 12 G : 24 G
    LimitFSIZE = infinity
    ## invalid values
    LimitFSIZE = invalid
    # invalid bytes suffix
    LimitFSIZE = 12g
    LimitFSIZE = 12H

    ###### limit nice level
    [Service]
    LimitNICE = -1
    LimitNICE = -12
    LimitNICE = -20
    LimitNICE = +1
    LimitNICE = +12
    LimitNICE = +19
    LimitNICE = 0
    LimitNICE = 9
    LimitNICE = 12
    LimitNICE = 23
    LimitNICE = 34
    LimitNICE = 40
    LimitNICE = -10:+10
    LimitNICE = 20:30
    LimitNICE = infinity
    ## invalid values
    LimitNICE = invalid
    LimitNICE = 0.2
    LimitNICE = 20 : infinity
    LimitNICE = infinity : 20
    # out of range
    LimitNICE = -21
    LimitNICE = -123
    LimitNICE = +20
    LimitNICE = +123
    LimitNICE = 41
    LimitNICE = 123

    ###### limit number
    [Service]
    LimitNOFILE = 123
    LimitNOFILE = 123:321
    LimitNOFILE = infinity
    ## invalid values
    LimitNOFILE = invalid
    # negative values
    LimitNOFILE = -123

    ###### limit time span
    [Service]
    LimitCPU = 15s 10us : 20s 5ms
    LimitCPU = infinity
    ## invalid values
    # only a single infinity
    LimitCPU = infinity : infinity
    LimitCPU = infinity : 10s 15ms
    LimitCPU = 10s 15ms : infinity

    ###### log facility
    [Service]
    SyslogFacility = auth
    SyslogFacility = authpriv
    SyslogFacility = cron
    SyslogFacility = daemon
    SyslogFacility = ftp
    SyslogFacility = kern
    SyslogFacility = local0
    SyslogFacility = local1
    SyslogFacility = local2
    SyslogFacility = local3
    SyslogFacility = local4
    SyslogFacility = local5
    SyslogFacility = local6
    SyslogFacility = local7
    SyslogFacility = lpr
    SyslogFacility = mail
    SyslogFacility = news
    SyslogFacility = syslog
    SyslogFacility = user
    SyslogFacility = uucp
    ## invalid values
    SyslogFacility = invalid
    # multiple values
    SyslogFacility = cron daemon

    ###### log level
    [Service]
    LogLevelMax = alert
    LogLevelMax = crit
    LogLevelMax = debug
    LogLevelMax = emerg
    LogLevelMax = err
    LogLevelMax = info
    LogLevelMax = notice
    LogLevelMax = warning
    ## invalid values
    LogLevelMax = invalid
    # multiple values
    LogLevelMax = info notice

    ###### memory mapping
    [Service]
    CoredumpFilter = all
    CoredumpFilter = default
    CoredumpFilter = private-anonymous
    CoredumpFilter = shared-anonymous
    CoredumpFilter = private-file-backed
    CoredumpFilter = shared-file-backed
    CoredumpFilter = elf-headers
    CoredumpFilter = private-huge
    CoredumpFilter = shared-huge
    CoredumpFilter = private-dax
    CoredumpFilter = shared-dax
    # multiple values
    CoredumpFilter = private-file-backed shared-dax
    ## invalid values
    CoredumpFilter = invalid
    CoredumpFilter = private-file-backed invalid elf-headers
    CoredumpFilter = invalid shared-dax
    # only spaces as separator
    CoredumpFilter = private-file-backed, shared-dax

    ###### memory pressure watch
    [Service]
    MemoryPressureWatch = auto
    MemoryPressureWatch = off
    MemoryPressureWatch = on
    MemoryPressureWatch = skip
    ## invalid values
    MemoryPressureWatch = invalid
    # multiple values
    MemoryPressureWatch = auto skip

    ###### mount flag
    [Service]
    MountFlags = private
    MountFlags = shared
    MountFlags = slave
    ## invalid values
    MountFlags = invalid
    # multiple values
    MountFlags = shared slave

    ###### nft set list
    [Service]
    NFTSet = cgroup:arp::filter::my_service
    NFTSet = cgroup:bridge::filter::my_service
    NFTSet = cgroup:inet::filter::my_service
    NFTSet = cgroup:ip::filter::my_service
    NFTSet = cgroup:ip6::filter::my_service
    NFTSet = cgroup:ip::filter::my_service
    NFTSet = cgroup:netdev::filter::my_service
    NFTSet = group:inet::filter::my_service
    NFTSet = user:inet::filter::my_service
    ## multiple sets
    NFTSet = cgroup:inet:filter:my_service \
      user:inet:filter:serviceuser
    ## invalid values
    NFTSet = invalid:inet::filter::my_service
    NFTSet = cgroup::invalid::filter::my_service

    ###### nice level
    [Service]
    Nice = -1
    Nice = -12
    Nice = -20
    Nice = +1
    Nice = +12
    Nice = +19
    Nice = 0
    Nice = 12
    Nice = 19
    ## invalid values
    Nice = invalid
    Nice = 0.2
    # out of range
    Nice = -21
    Nice = -123
    Nice = +20
    Nice = +123
    Nice = 20
    Nice = 30
    Nice = 123
    # multiple values
    Nice = 12 34

    ###### notify access
    [Service]
    NotifyAccess = all
    NotifyAccess = exec
    NotifyAccess = main
    NotifyAccess = none
    ## invalid values
    NotifyAccess = invalid
    # multiple values
    NotifyAccess = exec none

    ###### numa mask
    [Service]
    NUMAMask = all
    NUMAMask = 1,2,3-8
    ## invalid values
    NUMAMask = invalid
    # both all and cpu index list
    NUMAMask = all, 1,2,3-8
    NUMAMask = 1,2,3-8, all

    ###### numa policy
    [Service]
    NUMAPolicy = bind
    NUMAPolicy = default
    NUMAPolicy = interleave
    NUMAPolicy = local
    NUMAPolicy = preferred
    ## invalid values
    NUMAPolicy = invalid
    # multiple values
    NUMAPolicy = interleave local

    ###### on failure job mode
    [Unit]
    OnFailureJobMode = fail
    OnFailureJobMode = flush
    OnFailureJobMode = ignore-dependencies
    OnFailureJobMode = ignore-requirements
    OnFailureJobMode = isolate
    OnFailureJobMode = replace
    OnFailureJobMode = replace-irreversibly
    ## invalid values
    OnFailureJobMode = invalid
    OnFailureJobMode = invalid fail
    # multiple values
    OnFailureJobMode = replace fail

    ###### oom behavior (out-of-memory killer behavior)
    [Service]
    ManagedOOMSwap = auto
    ManagedOOMSwap = kill
    ## invalid values
    ManagedOOMSwap = invalid
    # multiple values
    ManagedOOMSwap = auto kill

    ###### oom preference (out-of-memory killer preference)
    [Service]
    ManagedOOMPreference = avoid
    ManagedOOMPreference = none
    ManagedOOMPreference = omit
    ## invalid values
    ManagedOOMPreference = invalid
    # multiple values
    ManagedOOMPreference = avoid none

    ###### oom policy (out-of-memory killer policy)
    [Service]
    OOMPolicy = continue
    OOMPolicy = kill
    OOMPolicy = stop
    ## invalid values
    OOMPolicy = invalid
    # multiple values
    OOMPolicy = kill stop

    ###### oom score adjust (out-of-memory killer score adjustment)
    [Service]
    OOMScoreAdjust = -1000
    OOMScoreAdjust = -123
    OOMScoreAdjust = 0
    OOMScoreAdjust = 321
    OOMScoreAdjust = +321
    OOMScoreAdjust = +1000
    OOMScoreAdjust = 1000
    ## invalid values
    OOMScoreAdjust = invalid
    OOMScoreAdjust = 1.2
    # out of range
    OOMScoreAdjust = -1001
    OOMScoreAdjust = +1001
    OOMScoreAdjust = 1001

    ###### open file option
    [Service]
    OpenFile = /some/path/:some-name:append,graceful,read-only,truncate
    ## invalid values
    OpenFile = /some/path/:some-name:some,invalid,options

    ###### percent
    [Slice]
    CPUQuota = 0.1%
    CPUQuota = 12 %
    CPUQuota = 123.4%
    ## invalid values
    CPUQuota = 10
    CPUQuota = invalid
    # multiple values
    CPUQuota = 10% 20%

    ###### personality
    [Service]
    Personality = arm
    Personality = arm-be
    Personality = arm64
    Personality = arm64-be
    Personality = ppc
    Personality = ppc-le
    Personality = ppc64
    Personality = ppc64-le
    Personality = s390
    Personality = s390x
    Personality = x86
    Personality = x86-64
    ## invalid values
    Personality = invalid
    Personality = alpha
    Personality = m68k
    # multiple values
    Personality = x86-64 s390x

    ###### proc subset
    [Service]
    ProcSubset = all
    ProcSubset = pid
    ## invalid values
    ProcSubset = invalid
    # multiple values
    ProcSubset = all pid

    ###### protect home
    [Service]
    ProtectHome = read-only
    ProtectHome = tmpfs
    ProtectHome = true
    ProtectHome = false
    ProtectHome = yes
    ## invalid values
    ProtectHome = invalid
    # multiple values
    ProtectHome = tmpfs true

    ###### protect system
    [Service]
    ProtectSystem = full
    ProtectSystem = strict
    ProtectSystem = true
    ProtectSystem = false
    ProtectSystem = yes
    ProtectSystem = no
    ## invalid values
    ProtectSystem = invalid
    # multiple values
    ProtectSystem = full true

    ###### restart
    [Service]
    Restart = always
    Restart = no
    Restart = on-abnormal
    Restart = on-abort
    Restart = on-failure
    Restart = on-success
    Restart = on-watchdog
    ## invalid values
    Restart = invalid
    # multiple values
    Restart = no on-abort

    ###### restart mode
    [Service]
    RestartMode = direct
    RestartMode = normal
    ## invalid values
    RestartMode = invalid
    # multiple values
    RestartMode = direct normal

    ###### runtime directory preserve
    [Service]
    RuntimeDirectoryPreserve = restart
    RuntimeDirectoryPreserve = true
    RuntimeDirectoryPreserve = false
    RuntimeDirectoryPreserve = yes
    RuntimeDirectoryPreserve = no
    ## invalid values
    RuntimeDirectoryPreserve = invalid
    # multiple values
    RuntimeDirectoryPreserve = restart no

    ###### secure bits list
    [Service]
    SecureBits = keep-caps
    SecureBits = keep-caps-locked
    SecureBits = no-setuid-fixup
    SecureBits = no-setuid-fixup-locked
    SecureBits = noroot
    SecureBits = noroot-locked
    SecureBits = keep-caps noroot-locked \
      no-setuid-fixup
    ## invalid values
    SecureBits = invalid

    ###### security
    [Unit]
    ConditionSecurity = apparmor
    ConditionSecurity = audit
    ConditionSecurity = ima
    ConditionSecurity = measured-uki
    ConditionSecurity = selinux
    ConditionSecurity = smack
    ConditionSecurity = tomoyo
    ConditionSecurity = tpm2
    ConditionSecurity = uefi-secureboot
    ## invalid values
    ConditionSecurity = invalid
    # multiple values
    ConditionSecurity = invalid selinux
    ConditionSecurity = apparmor selinux

    ###### service type
    [Service]
    Type = dbus
    Type = exec
    Type = forking
    Type = idle
    Type = notify
    Type = oneshot
    Type = simple
    ## invalid values
    Type = invalid
    # multiple values
    Type = exec forking

    ###### signal
    [Service]
    KillSignal = SIGABRT
    KillSignal = SIGALRM
    KillSignal = SIGBUS
    KillSignal = SIGCHLD
    KillSignal = SIGCLD
    KillSignal = SIGCONT
    KillSignal = SIGEMT
    KillSignal = SIGFPE
    KillSignal = SIGHUP
    KillSignal = SIGILL
    KillSignal = SIGINFO
    KillSignal = SIGINT
    KillSignal = SIGIO
    KillSignal = SIGIOT
    KillSignal = SIGKILL
    KillSignal = SIGLOST
    KillSignal = SIGPIPE
    KillSignal = SIGPOLL
    KillSignal = SIGPROF
    KillSignal = SIGPWR
    KillSignal = SIGQUIT
    KillSignal = SIGSEGV
    KillSignal = SIGSTKFLT
    KillSignal = SIGSTOP
    KillSignal = SIGSYS
    KillSignal = SIGTERM
    KillSignal = SIGTRAP
    KillSignal = SIGTSTP
    KillSignal = SIGTTIN
    KillSignal = SIGTTOU
    KillSignal = SIGUNUSED
    KillSignal = SIGURG
    KillSignal = SIGUSR1
    KillSignal = SIGUSR2
    KillSignal = SIGVTALRM
    KillSignal = SIGWINCH
    KillSignal = SIGXCPU
    KillSignal = SIGXFSZ
    ## invalid values
    KillSignal = SIG_INVALID

    ###### socket bind rule
    [Service]
    SocketBindAllow = any
    SocketBindAllow = ipv4:
    SocketBindAllow = ipv4:tcp:
    SocketBindAllow = ipv4:tcp:12345
    SocketBindAllow = ipv4:tcp:1-123
    SocketBindAllow = ipv6:udp:1-123
    SocketBindAllow = ipv6: udp:  1  -  123
    SocketBindAllow = tcp:
    SocketBindAllow = 12345
    SocketBindAllow = 123-456
    ## invalid values
    SocketBindAllow = ipv4 :
    SocketBindAllow = ipv5:tcp:
    SocketBindAllow = ipv4:udcp:
    SocketBindAllow = tcp:ipv4
    SocketBindAllow = ipv4:tcp: 12345
    # multiple values
    SocketBindAllow = any ipv4:

    ###### socket protocol
    [Socket]
    SocketProtocol = sctp
    SocketProtocol = udplite
    ## invalid values
    SocketProtocol = invalid
    # multiple values
    SocketProtocol = sctp udplite

    ###### standard input
    [Service]
    StandardInput = data
    StandardInput = fd
    StandardInput = fd:some_name
    StandardInput = file:/some/absolute/path
    StandardInput = null
    StandardInput = socket
    StandardInput = tty
    StandardInput = tty-fail
    StandardInput = tty-force
    ## invalid values
    StandardInput = invalid
    # multiple values
    StandardInput = null tty
    StandardInput = file:/some/absolute/path socket
    # no absolute path immediately after `file:`
    StandardInput = file:
    StandardInput = file:some//path
    StandardInput = file: /some/absolute/path

    ###### standard output
    [Service]
    # NOTE: Option StandardError accepts the same values.
    StandardOutput = append:/some/absolute/path
    StandardOutput = fd
    StandardOutput = fd:some_name
    StandardOutput = file:/some/absolute/path
    StandardOutput = inherit
    StandardOutput = journal
    StandardOutput = journal+console
    StandardOutput = kmsg
    StandardOutput = kmsg+console
    StandardOutput = null
    StandardOutput = socket
    StandardOutput = truncate:/some/absolute/path
    StandardOutput = tty
    ## invalid values
    StandardOutput = invalid
    StandardOutput = syslog
    # no absolute path immediately after append:, file:
    StandardOutput = append:
    StandardOutput = append:some/relative/path
    StandardOutput = append: /some/relative/path
    StandardOutput = file:
    StandardOutput = file:some/relative/path
    StandardOutput = file: /some/relative/path
    # multiple values
    StandardOutput = null tty
    StandardOutput = file:/some/absolute/path socket

    ###### system call architecture
    [Service]
    SystemCallArchitectures = mips64-le-n32
    SystemCallArchitectures = mips64-n32
    SystemCallArchitectures = native
    SystemCallArchitectures = x32
    # all values from "architecture" are also valid
    SystemCallArchitectures = alpha \
      mips sparc
    ## invalid values
    SystemCallArchitectures = invalid

    ###### system call errno
    [Service]
    SystemCallErrorNumber = kill
    SystemCallErrorNumber = log
    # from man errno(3)
    SystemCallErrorNumber = EACCES
    SystemCallErrorNumber = EADDRINUSE
    SystemCallErrorNumber = EADDRNOTAVAIL
    SystemCallErrorNumber = EAFNOSUPPORT
    SystemCallErrorNumber = EAGAIN
    SystemCallErrorNumber = EALREADY
    SystemCallErrorNumber = EBADE
    SystemCallErrorNumber = EBADF
    SystemCallErrorNumber = EBADFD
    SystemCallErrorNumber = EBADMSG
    SystemCallErrorNumber = EBADR
    SystemCallErrorNumber = EBADRQC
    SystemCallErrorNumber = EBADSLT
    SystemCallErrorNumber = EBUSY
    SystemCallErrorNumber = ECANCELED
    SystemCallErrorNumber = ECHILD
    SystemCallErrorNumber = ECHRNG
    SystemCallErrorNumber = ECOMM
    SystemCallErrorNumber = ECONNABORTED
    SystemCallErrorNumber = ECONNREFUSED
    SystemCallErrorNumber = ECONNRESET
    SystemCallErrorNumber = EDEADLK
    SystemCallErrorNumber = EDEADLOCK
    SystemCallErrorNumber = EDESTADDRREQ
    SystemCallErrorNumber = EDOM
    SystemCallErrorNumber = EDQUOT
    SystemCallErrorNumber = EEXIST
    SystemCallErrorNumber = EFAULT
    SystemCallErrorNumber = EFBIG
    SystemCallErrorNumber = EHOSTDOWN
    SystemCallErrorNumber = EHOSTUNREACH
    SystemCallErrorNumber = EHWPOISON
    SystemCallErrorNumber = EIDRM
    SystemCallErrorNumber = EILSEQ
    SystemCallErrorNumber = EINPROGRESS
    SystemCallErrorNumber = EINTR
    SystemCallErrorNumber = EINVAL
    SystemCallErrorNumber = EIO
    SystemCallErrorNumber = EISCONN
    SystemCallErrorNumber = EISDIR
    SystemCallErrorNumber = EISNAM
    SystemCallErrorNumber = EKEYEXPIRED
    SystemCallErrorNumber = EKEYREJECTED
    SystemCallErrorNumber = EKEYREVOKED
    SystemCallErrorNumber = EL2HLT
    SystemCallErrorNumber = EL2NSYNC
    SystemCallErrorNumber = EL3HLT
    SystemCallErrorNumber = EL3RST
    SystemCallErrorNumber = ELIBACC
    SystemCallErrorNumber = ELIBBAD
    SystemCallErrorNumber = ELIBEXEC
    SystemCallErrorNumber = ELIBMAX
    SystemCallErrorNumber = ELIBSCN
    SystemCallErrorNumber = ELNRNG
    SystemCallErrorNumber = ELOOP
    SystemCallErrorNumber = EMEDIUMTYPE
    SystemCallErrorNumber = EMFILE
    SystemCallErrorNumber = EMLINK
    SystemCallErrorNumber = EMSGSIZE
    SystemCallErrorNumber = EMULTIHOP
    SystemCallErrorNumber = ENAMETOOLONG
    SystemCallErrorNumber = ENETDOWN
    SystemCallErrorNumber = ENETRESET
    SystemCallErrorNumber = ENETUNREACH
    SystemCallErrorNumber = ENFILE
    SystemCallErrorNumber = ENOANO
    SystemCallErrorNumber = ENOBUFS
    SystemCallErrorNumber = ENODATA
    SystemCallErrorNumber = ENODEV
    SystemCallErrorNumber = ENOENT
    SystemCallErrorNumber = ENOEXEC
    SystemCallErrorNumber = ENOKEY
    SystemCallErrorNumber = ENOLCK
    SystemCallErrorNumber = ENOLINK
    SystemCallErrorNumber = ENOMEDIUM
    SystemCallErrorNumber = ENOMEM
    SystemCallErrorNumber = ENOMSG
    SystemCallErrorNumber = ENONET
    SystemCallErrorNumber = ENOPKG
    SystemCallErrorNumber = ENOPROTOOPT
    SystemCallErrorNumber = ENOSPC
    SystemCallErrorNumber = ENOSR
    SystemCallErrorNumber = ENOSTR
    SystemCallErrorNumber = ENOSYS
    SystemCallErrorNumber = ENOTBLK
    SystemCallErrorNumber = ENOTCONN
    SystemCallErrorNumber = ENOTDIR
    SystemCallErrorNumber = ENOTEMPTY
    SystemCallErrorNumber = ENOTRECOVERABLE
    SystemCallErrorNumber = ENOTSOCK
    SystemCallErrorNumber = ENOTSUP
    SystemCallErrorNumber = ENOTTY
    SystemCallErrorNumber = ENOTUNIQ
    SystemCallErrorNumber = ENXIO
    SystemCallErrorNumber = EOPNOTSUPP
    SystemCallErrorNumber = EOVERFLOW
    SystemCallErrorNumber = EOWNERDEAD
    SystemCallErrorNumber = EPERM
    SystemCallErrorNumber = EPFNOSUPPORT
    SystemCallErrorNumber = EPIPE
    SystemCallErrorNumber = EPROTO
    SystemCallErrorNumber = EPROTONOSUPPORT
    SystemCallErrorNumber = EPROTOTYPE
    SystemCallErrorNumber = ERANGE
    SystemCallErrorNumber = EREMCHG
    SystemCallErrorNumber = EREMOTE
    SystemCallErrorNumber = EREMOTEIO
    SystemCallErrorNumber = ERESTART
    SystemCallErrorNumber = ERFKILL
    SystemCallErrorNumber = EROFS
    SystemCallErrorNumber = ESHUTDOWN
    SystemCallErrorNumber = ESOCKTNOSUPPORT
    SystemCallErrorNumber = ESPIPE
    SystemCallErrorNumber = ESRCH
    SystemCallErrorNumber = ESTALE
    SystemCallErrorNumber = ESTRPIPE
    SystemCallErrorNumber = ETIME
    SystemCallErrorNumber = ETIMEDOUT
    SystemCallErrorNumber = ETOOMANYREFS
    SystemCallErrorNumber = ETXTBSY
    SystemCallErrorNumber = EUCLEAN
    SystemCallErrorNumber = EUNATCH
    SystemCallErrorNumber = EUSERS
    SystemCallErrorNumber = EWOULDBLOCK
    SystemCallErrorNumber = EXDEV
    SystemCallErrorNumber = EXFULL
    SystemCallErrorNumber = 1
    SystemCallErrorNumber = 12
    SystemCallErrorNumber = 123
    SystemCallErrorNumber = 1234
    SystemCallErrorNumber = 2
    SystemCallErrorNumber = 23
    SystemCallErrorNumber = 234
    SystemCallErrorNumber = 2345
    SystemCallErrorNumber = 3
    SystemCallErrorNumber = 34
    SystemCallErrorNumber = 345
    SystemCallErrorNumber = 3456
    SystemCallErrorNumber = 3999
    SystemCallErrorNumber = 4000
    SystemCallErrorNumber = 4009
    SystemCallErrorNumber = 4019
    SystemCallErrorNumber = 4089
    SystemCallErrorNumber = 4095
    ## invalid values
    SystemCallErrorNumber = invalid
    SystemCallErrorNumber = -12
    SystemCallErrorNumber = 0.12
    # out of range
    SystemCallErrorNumber = 0
    SystemCallErrorNumber = 4096
    SystemCallErrorNumber = 5000
    # multiple values
    SystemCallErrorNumber = ESPIPE EUCLEAN
    SystemCallErrorNumber = 123 EUCLEAN

    ###### time span
    [Timer]
    # without unit
    OnBootSec = 15
    # micro second
    OnBootSec = 123 usec
    OnBootSec = 123us
    # using UTF-8 "Micro Sign" U+00B5 &micro; &#181; &#xB5;
    OnBootSec = 123 µs
    # using UTF-8 "Greek Small Letter Mu" U+03BC &mu; &#956; &#x3BC;
    OnBootSec = 123 μs
    # milli second
    OnBootSec = 123 msec
    OnBootSec = 123ms
    # second
    OnBootSec = 74 s
    OnBootSec = 2sec
    OnBootSec = 12 second
    OnBootSec = 1 seconds
    # minute
    OnBootSec = 342 m
    OnBootSec = 2min
    OnBootSec = 7 minute
    OnBootSec = 1 minutes
    # hour
    OnBootSec = 2 h
    OnBootSec = 48   hr
    OnBootSec = 2hour
    OnBootSec = 2hours
    # day
    OnBootSec = 2 d
    OnBootSec = 1 day
    OnBootSec = 7  days
    # week
    OnBootSec = 2 w
    OnBootSec = 123 week
    OnBootSec = 0 weeks
    # month
    OnBootSec = 12 M
    OnBootSec = 7 month
    OnBootSec = 1 months
    # year
    OnBootSec = 1y
    OnBootSec = 123year
    OnBootSec = 12 years
    # combined
    OnBootSec = 55s500ms
    OnBootSec = 300ms20s 5day
    OnBootSec = 123 5 days 1m 12 1sec 123 \
      23 msec 13 1us
    # multiple hours
    OnBootSec = 7hr 2hr \
      1d 2w
    ## invalid values
    # mi is invalid
    OnBootSec = 1mi
    # hs is invalid
    OnBootSec = 2hs
    # ds is invalid
    OnBootSec = 7 ds 1y
    # unit without amount
    OnBootSec = 12 min sec
    OnBootSec = min 1 sec
    # invalid unit
    OnBootSec = 12foo 1 bar

    ###### timeout
    # all values from time span are valid
    [Unit]
    JobTimeoutSec = 0
    JobTimeoutSec = 12345
    JobTimeoutSec = 123 5 days 1m 12 1sec 123\
      23 msec 13 1us
    JobTimeoutSec = infinity
    ## invalid values
    JobTimeoutSec = invalid
    JobTimeoutSec = inf
    JobTimeoutSec = -10
    JobTimeoutSec = 0.235

    ###### timestamping
    [Socket]
    Timestamping = ns
    Timestamping = nsec
    Timestamping = off
    Timestamping = us
    Timestamping = usec
    # using UTF-8 "Micro Sign" U+00B5 &micro; &#181; &#xB5;
    Timestamping = µs
    # using UTF-8 "Greek Small Letter Mu" U+03BC &mu; &#956; &#x3BC;
    Timestamping = μs
    ## invalid values
    Timestamping = nanosec
    # multiple values
    Timestamping = nsec off

    ###### unit
    [Path]
    #### names
    Unit = some-name.service
    Unit = some.name.service
    Unit = some:name.service
    Unit = some@.service
    Unit = some@instance.service
    Unit = some@other-instance.service
    Unit = some@other.instance.service
    Unit = some@other:instance.service
    Unit = some@other@instance.service
    Unit = some@other%iinstance.service
    Unit = systemd-fsck@dev-nvme0n1p2.service
    Unit = some@%i.service
    Unit = dev-disk-by\x2duuid-5af23b\x2dfde6\x2d424e\x2da1bb\x2de88bc.swap
    ## invalid names
    # \x2x is an invalid escape as 2x is no hex number
    Unit = dev-disk-by\x2xuuid-5af23b\x2dfde6\x2d424e\x2da1bb\x2de88bc.swap
    #### extensions
    Unit = some.automount
    Unit = some.device
    Unit = some.mount
    Unit = some.service
    Unit = some.socket
    Unit = some.slice
    Unit = some.swap
    Unit = some.target
    ## invalid extension
    Unit = some.invalid
    # incomplete unit, missing extension
    Unit = some.
    # multiple values
    Unit = some.service some-other.service
    Unit = some.service.service \
      some.other.service.service

    ###### unit list
    [Unit]
    #### names
    After = some.service.service \
      some.other.service.service \
      some@instance.service \
      some@%i.service
    ## invalid values
    # incomplete unit, missing extension
    After = some. \
      some.service \
      some-other.service

    ###### unit list socket
    [Service]
    Sockets = some.socket some@instance.socket
    ## invalid values
    Sockets = some.service
    Sockets = some.service some.socket

    ###### unit service
    [Socket]
    Service = some.service
    Service = some@instance.service
    ## invalid values
    Service = some.invalid
    # other unit types
    Service = some.socket
    Service = some.target
    # multiple values
    Service = some.service other.service

    ###### unit slice
    [Service]
    Slice = some.slice
    Slice = some@instance.slice
    ## invalid values
    # other unit types
    Slice = some.service
    Slice = some.target
    # multiple values
    Slice = some.slice other.slice

    ###### utmp mode
    [Service]
    UtmpMode = init
    UtmpMode = login
    UtmpMode = user
    ## invalid values
    UtmpMode = invalid
    # multiple values
    UtmpMode = login user

    ###### variable assignments
    [Service]
    Environment = DISPLAY=:%i
    Environment = XAUTHORITY=%t/Xauthority.%i var1=15 \
      "var2=value with spaces" EMPTY=
    Environment = XDG_VTNR=vt%i
    LogExtraFields = NAME=VALUE

    ###### virtualization
    [Unit]
    ConditionVirtualization = acrn
    ConditionVirtualization = bhyve
    ConditionVirtualization = bochs
    ConditionVirtualization = docker
    ConditionVirtualization = google
    ConditionVirtualization = kvm
    ConditionVirtualization = lxc
    ConditionVirtualization = lxc-libvirt
    ConditionVirtualization = microsoft
    ConditionVirtualization = openvz
    ConditionVirtualization = oracle
    ConditionVirtualization = parallels
    ConditionVirtualization = qemu
    ConditionVirtualization = qnx
    ConditionVirtualization = rkt
    ConditionVirtualization = sre
    ConditionVirtualization = systemd-nspawn
    ConditionVirtualization = uml
    ConditionVirtualization = vmware
    ConditionVirtualization = wsl
    ConditionVirtualization = xen
    ConditionVirtualization = zvm
    # using boolean
    ConditionVirtualization = true
    # using generic type
    ConditionVirtualization = container
    ConditionVirtualization = vm
    # private users
    ConditionVirtualization = private-users
    # negated
    ConditionVirtualization = !vmware
    ## invalid values
    ConditionVirtualization = invalid
    ConditionVirtualization = invalid vmware
    # multiple values
    ConditionVirtualization = xen vmware

    ###### weight
    [Service]
    # integer 1..10000
    IOWeight = 1
    IOWeight = 12
    IOWeight = 123
    IOWeight = 1234
    IOWeight = 1234
    IOWeight = 10000
    ## invalid values
    IOWeight = -1
    IOWeight = 0
    IOWeight = 10001
    IOWeight = 12345
    IOWeight = 12.3
    IOWeight = invalid
    # multiple values
    IOWeight = 1 10000

    ###### working directory
    [Service]
    WorkingDirectory = ~
    WorkingDirectory = - ~
    WorkingDirectory = %h
    WorkingDirectory = /some/absolute/path
    WorkingDirectory = -/some/absolute-path
    WorkingDirectory = - /some/absolute/path
    ## invalid values
    # using `-` without a path
    WorkingDirectory = -
    # multiple paths
    WorkingDirectory = ~ /some/absolute/path
    WorkingDirectory = /some/absolute/path ~
    WorkingDirectory = /some/absolute/path /some/other/path
    WorkingDirectory = - - /some/absolute/path