[PATCH] rtld: Add glibc.rtld.enable_secure tunable.

[Joe Simmons-Talbott]

On Wed, Dec 06, 2023 at 10:03:09AM +0000, Szabolcs Nagy wrote:
> The 12/05/2023 12:54, Joe Simmons-Talbott wrote:
> > On Tue, Dec 05, 2023 at 03:51:19PM +0000, Szabolcs Nagy wrote:
> > > The 12/05/2023 10:35, Joe Simmons-Talbott wrote:
> > > > Add a tunable for setting __libc_enable_secure to 1.  Does not set
> > > > __libc_enable_secure to 0 if the tunable is set to 0.  Ignores any
> > > > tunables following glib.rtld.enable_secure.  One use-case for this
> > > 
> > > why do you want to ignore later tunables?
> > 
> > Tunables are currently ignored in __tunables_init when __libc_enable_secure
> > is set.  Therefore once we set __libc_enable_secure during tunable
> > processing we should not set any more tunables.
> 
> i disagree.
> 
> imo foo:bar and bar:foo tunables should have the same effect.
> 
> if you want to eliminate some tunables, then process them in
> two passes. but i'm not convinced that is useful at all in this
> case: you introduce new code paths even though this is for
> testing secure execution, any new code path is going against
> that goal. just don't pass other tunables if you use this one
> for testing, that's much more reliable.
> 

I've updated the patch (v3) to not set any tunables if enable_secure is
set.

Thanks,
Joe