[PATCH v6 4/4] Add system-wide tunables: Filters

[Yury Khrustalev]

Hello DJ,

On Mon, Mar 16, 2026 at 09:39:39PM -0400, DJ Delorie wrote:
> 
> Add support for [proc:*] syntax where * matches /proc/self/exe
> (fallback: argv[0] unless AT_SECURE).  Tunables after such a
> line are limited to matching processes.
> 
> Note that this filter is reset when including a file or at
> end of file.
> 
> If the filename starts with a slash (example: [proc:/bin/foo]) the
> full path must match.  If not (example: [proc:foo]) the basename is
> matched.
> 
> Add support for filtering out AT_SECURE or non-AT_SECURE binaries:
> 
>   $glibc.only-for.unsecure-binaries=1
>   @glibc.only-for.secure-binaries=1

We probably need a bit information about /etc/tunables.conf in the
manual.

> 
> ...
>
> diff --git a/csu/libc-start.c b/csu/libc-start.c
> index 1c58561bce..ae36170045 100644
> --- a/csu/libc-start.c
> +++ b/csu/libc-start.c
> @@ -264,7 +264,7 @@ LIBC_START_MAIN (int (*main) (int, char **, char ** MAIN_AUXVEC_DECL),
>    _dl_aux_init (auxvec);
>  # endif
>  
> -  __tunables_init (__environ);
> +  __tunables_init (__environ, argv);

Nit: For some deeply intrinsic reason I prefer argv to go first.

>  
>    ARCH_INIT_CPU_FEATURES ();
>  
> diff --git a/elf/Makefile b/elf/Makefile
> index 5398fe0d2c..4fbd03cefc 100644
> --- a/elf/Makefile
> +++ b/elf/Makefile
> @@ -323,6 +323,7 @@ tests-internal := \
>    $(tests-static-internal) \
>    tst-tls1 \
>    tst-tls_tp_offset \
> +  tst-tunconf1 \
>    # tests-internal
>  
>  tests-static := $(tests-static-normal) $(tests-static-internal)
> @@ -333,6 +334,8 @@ tests-static += \
>    tst-tls9-static \
>    # tests-static
>  
> +tst-tunconf1-ENV = GLIBC_TUNABLES=glibc.malloc.tcache_count=5

If I add glibc.malloc.tcache_max=42 to this line, the test fails.
It looks like the environment variable overrides tunables.conf,
is this intentional?

In this test we probably should have the same tunable in both
environment and tunables.conf, and the test should check that
whatever has higher priority applies.

> 
> ...
> 
> diff --git a/elf/dl-tunables.c b/elf/dl-tunables.c
> index 29fcd4504b..acee6eb872 100644
> --- a/elf/dl-tunables.c
> +++ b/elf/dl-tunables.c
> @@ -291,13 +291,22 @@ parse_tunables (const char *valstring)
>     ENV_ALIAS to find values.  Later we will also use the tunable names to find
>     values.  */
>  void
> -__tunables_init (char **envp)
> +__tunables_init (char **envp, char **argv)
> 
> ...
> 
> +
> +	  /* Apply selected filter, if any.  */
> +	  switch (tec->flags & TUNCONF_FLAG_FILTER) {
> +	  case TUNCONF_FILTER_PERPROC:
> +	    /* Perform one-time calculations that aren't needed if we
> +	       don't use this filter.  */
> +	    if (prog_name_len == -1)
> +	      {
> +		ssize_t n = readlink ("/proc/self/exe",
> +				      exebuf, sizeof (exebuf) - 1);

Do we have to do this inside the for loop?

Thanks,
Yury