[patch v4 4/4] Add system-wide tunables: Filters

[DJ Delorie]

Florian Weimer <fweimer@redhat.com> writes:
> The program_short_invocation_name matching/configurability/filter.
>
> We have received feedback from support that any additional mechanism
> like that creates confusion.

I added logic to read /proc/self/exe if it exists, falling back to
argv[0] if it doesn't (containers, hurd, who knows what else).  Rather
than take out the shortening code, I added this feature:

* If the path in tunables.conf starts with a slash, the full path is
  compared.

* otherwise, the exe's basename is compared.

Thus, this matches exactly one program:

   [proc:/bin/ls]

and this matches a program regardless of location:

   [proc:tst-tunconf1]

(Note: the second case makes testing easier)

I don't think this adds a security hole, as the admins can simply choose
to not use the basename variant.