[PATCH v7 1/4] Add system-wide tunables: ldconfig part

[Adhemerval Zanella Netto]

On 28/05/26 09:55, Yury Khrustalev wrote:
> On Mon, Dec 04, 2023 at 08:48:18PM -0500, DJ Delorie wrote:
>> Adds support for reading /etc/tunables.conf
>>
>> The file contains one line per tunable, like this:
>>
>> glibc.foo.bar=14
>> glibc.malloc.more=0
>>
>> Additionally, each line can be prefixed with a single character
>> that controls overridability by the GLIBC_TUNABLES env var:
>>
>> !glibc.foo=0
>>    ^ May be made more secure
> 
> I think we should not do this. Allowing and forbidding override
> via env variable should be enough. It is not possible to define
> what "more secure" means unless we require this to be done for
> all existing tunables retrospectively. Also, some tunables are
> not related to security. In a nutshell, this "may be made more
> something" is highly speculative and will only lead to confusion.

I agree with Yury here, it is not clear from the patch semantic 'more
secure' adds that may/may not overridden can not already provide.