How to Unmask systemd Services

1. Overview

systemctl is a powerful and essential tool for managing services in Linux distributions, allowing users to start, stop, enable, disable, and query the status of system services. However, there may be instances when certain services may be masked, preventing standard management commands from affecting them.

In this tutorial, we’ll explore the process of unmasking systemctl in Linux.

2. What Is systemctl unmask?

systemctl unmask is a command used to remove the mask from a systemd unit, usually a service. It reverses the masking of a service, making it operational and accessible for system administrators.

3. Why Mask and Unmask Service?

Before diving into the unmasking process, it’s crucial to understand why a service might be masked.

In Linux, administrators may mask services for security and stability measures. One technique to prevent unintentional or accidental activation or manipulation of important system services is to use masking services.

On the other hand, we need to unmask a service when we require activation or to regain control over a particular service. When a service needs to be operational or configured according to specific requirements, unmasking becomes necessary. This allows administrators to approach this action with caution, consider the potential impact on system security and stability, and have the flexibility to manage and adjust services as needed.

4. Unmasking systemctl

Now that we have an idea why masking and unmasking a systemd service is necessary, it’s time to proceed with the unmasking process. Let’s see how we can do it and regain control.

4.1. Identifying the Masked Service and Its File Location

Before unmasking a service, we must identify the masked service. Let’s utilize systemctl along with the list-unit-files option to showcase a list of system unit files, then apply grep to filter out the masked service:

$ systemctl list-unit-files | grep masked
cgroupfs-mount.service                                                    masked          disabled
cryptdisks-early.service                                                  masked          disabled
rc.service                                                                masked          disabled
saned.service                                                             masked          disabled
sudo.service                                                              masked          enabled
x11-common.service                                                        masked          enabled
...

The above command output shows the currently masked services.

Let’s select x11-common.service, which we’ll be unmasking throughout this tutorial. First, let’s view the status of x11-common.service using systemctl:

$ sudo systemctl status x11-common.service
○ x11-common.service
     Loaded: masked (Reason: Unit x11-common.service is masked.)
     Active: inactive (dead)

The command output indicates that the x11-common.service is inactive and dead. The status also shows that the service is loaded but masked, meaning it’s intentionally disabled to prevent accidental activation or modification.

Similarly, to unmask the service, we need to find the path where the masked service file is located. We can search for the service file using the find command:

$ sudo find /etc /usr/lib -name "x11-common.service*"   
/usr/lib/systemd/system/x11-common.service

The above command searches for a file with the name x11-common.service in the /etc and /usr/lib directories and displays the location of the service file.

By default, the system creates the symbolic link for masked services in the /usr/lib/systemd/system directory. However, when we use the sudo systemctl mask command to mask a service, it creates a symbolic link in the /etc/systemd/system directory.

Let’s demonstrate this by using the sudo systemctl mask command to mask x11-common.service and observe the symbolic link that’s created:

$ sudo systemctl mask x11-common.service
Created symlink /etc/systemd/system/x11-common.service → /dev/null.

The result shows that the command successfully created the symbolic link in the /etc/systemd/system directory. As a result, the service will now be referenced from this location instead of the /usr/lib/systemd/system directory.

Therefore, we should consider both directories when searching for symbolic links that mask services.

4.2. Unmasking the Service With rm

Once we identify the correct path, we’ll proceed with removing the symbolic link using the sudo rm command:

$ sudo rm /usr/lib/systemd/system/x11-common.service 

We must always exercise caution when removing files with sudo rm, as it permanently deletes them. After removing the symbolic link, let’s reload the systemd daemon for the changes to take effect:

$ sudo systemctl daemon-reload

The absence of output indicates that the command successfully reloaded the system daemon.

4.3. Verifying Unmasking

Let’s verify if the service is unmasked using systemctl:

$ sudo systemctl status x11-common.service
○ x11-common.service - LSB: set up the X server and ICE socket directories
     Loaded: loaded (/etc/init.d/x11-common; generated)
     Active: inactive (dead)
       Docs: man:systemd-sysv-generator(8)

The above command result shows that the service is inactive. The service is loaded from the /etc/init.d/x11-common file, created by the systemd-sysv-generator, which suggests that x11-common.service is no longer masked. Once we unmask the service, we can manage (enable, disable, start, stop, status) the service using systemctl.

5. Conclusion

In this article, we explored the method to unmask systemctl services in Linux.

After identifying the masked service with systemctl and finding its file location, we need to remove the symbolic link using sudo rm, and then reload the daemon to unmask the service.

Unmasking systemd service units grants us control over previously masked services, but caution is essential to prevent unintended consequences when manipulating system services.