Difference Between systemctl mask and systemctl disable

 1. Overview

In this tutorial, we’ll look at how to control processes using systemd. Most current Linux distros use systemd to manage all their services. Using systemd, we can set or alter the states of various services in our computer. First, we’ll look at how to disable and mask a service, and then, we’ll check out the differences between them.

2. Controlling systemd Services

Our system has a lot of services within it. Most services are either enabled, disabled, or masked. A service can be disabled or masked if it isn’t needed during boot or if it’s idle and not used. Further, if we don’t use a service and it interferes with other services, we can mask it.

Let’s look at the current state of various services:

$ sudo systemctl list-unit-files | grep -E 'disabled|masked'
acpid.service                                  disabled        enabled
alsa-utils.service                             masked          enabled
cryptdisks-early.service                       masked          enabled
cryptdisks.service                             masked          enabled
nftables.service                               disabled        enabled
[email protected]                        disabled        enabled
[email protected]                        disabled        enabled

3. systemctl disable

When we use systemctl enable to activate a service, systemd creates a symlink in /etc/systemd/system/ from the unit file in /lib/systemd/system/. As soon as this is set, we can start, stop, reload, and disable that service. Once the service is enabled, the target path and created link are displayed on the screen. Disabling a service deletes this symlink. As a result, the service won’t be loaded automatically on reboot.

A disabled service can be started with another service that needs it. The enable and disable options only configure the auto-start behavior for units, and other services that need them can easily override the disabled state.

To disable a service, let’s run:

$ sudo systemctl disable nftables.service
Removed /etc/systemd/system/sysinit.target.wants/nftables.service.

4. systemctl mask

Masking is a state of a unit file. It’s also known as the “third level of off” (stop-1st, disable-2nd, mask-3rd). If a service is masked, it means its unit file is symlinked to /dev/null. In other words, when we mask a service, a symlink is created from /etc/systemd/system to point /dev/null. This makes it “impossible” to load the service, even if another enabled service requires it.

For example, let’s say we have a service we never want to start manually or automatically. We can mask this service:

$ sudo systemctl mask nftables.service
Created symlink /etc/systemd/system/nftables.service → /dev/null.

We must note that systemctl mask name.service is equivalent to:

$ sudo ln -s /dev/null /etc/systemd/system/nftables.service

Also, we must be careful when using the mask option because if we mask a critical unit (like system.slice), we could prevent our system from booting normally. To unmask the unit, let’s run:

$ sudo systemctl unmask nftables.service
Removed /etc/systemd/system/nftables.service.

This time, instead of creating a symbolic link that points back to the service file, we’ve created one that points to the /dev/null device. Let’s try to start our masked Apache service to see what happens:

$ sudo systemctl start nftables.service
Failed to start nftables.service: Unit nftables.service is masked.

5. The Difference Between systemctl mask and systemctl disable

Now, let’s look at the differences between systemctl mask and disable:

6. Conclusion

In this tutorial, we’ve looked at systemctl mask and systemctl disable commands. Both of these commands help us control the state of various systemd processes. If our target is to temporarily deactivate a process at boot time, then we can use the disable option. Otherwise, we use the mask option to deactivate it permanently unless we later unmask it manually.