[PATCH v7 4/4] Add system-wide tunables: Filters

[Yury Khrustalev]

On Tue, Feb 10, 2026 at 11:33:51PM -0500, DJ Delorie wrote:
> Add support for [proc:*] syntax where * matches /proc/self/exe
> (fallback: argv[0] unless AT_SECURE).  Tunables after such a
> line are limited to matching processes.
> 
> Note that this filter is reset when including a file or at
> end of file.
> 
> If the filename starts with a slash (example: [proc:/bin/foo]) the
> full path must match.  If not (example: [proc:foo]) the basename is
> matched.
> 
> Add support for filtering out AT_SECURE or non-AT_SECURE binaries:

Does this commit also add support for !tunable, +tunable, and -tunable?

> 
>   $glibc.only-for.unsecure-binaries=1
>   @glibc.only-for.secure-binaries=1

More complications :)

Re: CI failure, FWIW, I've ran tests for i686 and all worked fine.

>
> ...
>
> diff --git a/csu/libc-start.c b/csu/libc-start.c
> index 1c58561bce..ae36170045 100644
> --- a/csu/libc-start.c
> +++ b/csu/libc-start.c

OK

>  
> ...
>
> diff --git a/elf/Makefile b/elf/Makefile
> index 5398fe0d2c..4fbd03cefc 100644
> --- a/elf/Makefile
> +++ b/elf/Makefile
>
> ...
>
> +tst-tunconf1-ENV = GLIBC_TUNABLES=glibc.malloc.tcache_count=5
> +

Could you use the new shiny

  tst-tunconf1-TUNABLES += glibc.malloc.tcache_count=5

or perhaps more correct in this case:

  tst-tunconf1-TUNABLES-only = glibc.malloc.tcache_count=5

?

>
> ...
>
> diff --git a/elf/cache.c b/elf/cache.c
> index fe8f66366f..4655cf961f 100644
> --- a/elf/cache.c
> +++ b/elf/cache.c
> @@ -304,9 +304,10 @@ print_extensions (struct cache_extension_all_loaded *ext,
>  	      >= (void *) & tec[count]);
>        for (i = 0; i < count; ++ i)
>  	{
> -	  printf("  [%d] %s : %s [flags 0x%08x",
> +	  printf("  [%d] %s (%d) : %s [flags 0x%08x",
>  		 i,
>  		 cache_data + tec[i].name_offset,
> +		 tec[i].tunable_id,

What is tunable id? Does it mean something to a user reading output
from ldconfig -p?

>
> ...
>
> diff --git a/elf/dl-tunables.c b/elf/dl-tunables.c
> index 20e4056d74..c9dc6b8b62 100644
> --- a/elf/dl-tunables.c
> +++ b/elf/dl-tunables.c

OK

>
> ...
>
> diff --git a/elf/dl-tunables.h b/elf/dl-tunables.h
> index 45aeed47bc..3f34329614 100644
> --- a/elf/dl-tunables.h
> +++ b/elf/dl-tunables.h

OK

>
> ...
>
> diff --git a/elf/ldconfig-parse.c b/elf/ldconfig-parse.c
> index b7bb664eb5..baddfdbac0 100644
> --- a/elf/ldconfig-parse.c
> +++ b/elf/ldconfig-parse.c

OK

>
> ...
>
> diff --git a/elf/ldconfig.c b/elf/ldconfig.c
> index 11b063eb5c..1ea55400f3 100644
> --- a/elf/ldconfig.c
> +++ b/elf/ldconfig.c

OK

>
> ...
>
> diff --git a/elf/tst-tunconf1.c b/elf/tst-tunconf1.c
> new file mode 100644
> index 0000000000..c95a7cb8ba
> --- /dev/null
> +++ b/elf/tst-tunconf1.c

OK

>
> ...
>
> diff --git a/elf/tst-tunconf1.root/etc/tunables.conf b/elf/tst-tunconf1.root/etc/tunables.conf
> new file mode 100644
> index 0000000000..6cd6c8a949
> --- /dev/null
> +++ b/elf/tst-tunconf1.root/etc/tunables.conf
> @@ -0,0 +1,15 @@
> +# These test the parser for both the overridability characters as well as
> +# tunables that either never exist, or only exist on some platforms.
> +!glibc.foo=19
> +-glibc.cpu.cached_memopt=1
> ++glibc.cpu.hwcaps=some,random,string
> +@glibc.test_secure=1
> +$glibc.test_unsecure=1

Too complicated...

> diff --git a/elf/tst-tunconf1.root/ldconfig.run b/elf/tst-tunconf1.root/ldconfig.run
> new file mode 100644
> index 0000000000..e69de29bb2

OK

> diff --git a/elf/tst-tunconf1.root/postclean.req b/elf/tst-tunconf1.root/postclean.req
> new file mode 100644
> index 0000000000..e69de29bb2

OK

> diff --git a/elf/tunconf.c b/elf/tunconf.c
> index 1b7bf0ac2b..8fae4bb652 100644
> --- a/elf/tunconf.c
> +++ b/elf/tunconf.c

OK

> diff --git a/elf/tunconf.h b/elf/tunconf.h
> index 9551119167..e880aa574a 100644
> --- a/elf/tunconf.h
> +++ b/elf/tunconf.h
> @@ -10,6 +10,9 @@
>  #define TUNCONF_OVERRIDE_STRICTER	0x00000008
>  #define TUNCONF_OVERRIDE_DENY		0x0000000C
>  
> +#define TUNCONF_EXCLUDE_SECURE		0x00000010
> +#define TUNCONF_EXCLUDE_UNSECURE	0x00000020
> +

Again, not sure why we need this at this stage.

>
> ...
>
> diff --git a/sysdeps/mach/hurd/dl-sysdep.c b/sysdeps/mach/hurd/dl-sysdep.c
> index 0e348d6440..fe6d453756 100644
> --- a/sysdeps/mach/hurd/dl-sysdep.c
> +++ b/sysdeps/mach/hurd/dl-sysdep.c

OK

> diff --git a/sysdeps/unix/sysv/linux/dl-sysdep.c b/sysdeps/unix/sysv/linux/dl-sysdep.c
> index cb1f94ee23..c2701f274c 100644
> --- a/sysdeps/unix/sysv/linux/dl-sysdep.c
> +++ b/sysdeps/unix/sysv/linux/dl-sysdep.c

OK

Thanks,
Yury