public inbox for glibc-cvs@sourceware.org
help / color / mirror / Atom feed
* [glibc] Reword description of SXID_* tunable properties
@ 2020-10-22 8:23 Siddhesh Poyarekar
0 siblings, 0 replies; only message in thread
From: Siddhesh Poyarekar @ 2020-10-22 8:23 UTC (permalink / raw)
To: glibc-cvs
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=6c2b579962853475747854127cfaf4ec4a8872a7
commit 6c2b579962853475747854127cfaf4ec4a8872a7
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
Date: Thu Oct 22 11:39:00 2020 +0530
Reword description of SXID_* tunable properties
The SXID_* tunable properties only influence processes that are
AT_SECURE, so make that a bit more explicit in the documentation and
comment.
Revisiting the code after a few years I managed to confuse myself, so
I imagine there could be others who may have incorrectly assumed like
I did that the SXID_ERASE tunables are not inherited by children of
non-AT_SECURE processes.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
Diff:
---
elf/dl-tunables.list | 11 ++++++-----
manual/README.tunables | 11 ++++++-----
2 files changed, 12 insertions(+), 10 deletions(-)
diff --git a/elf/dl-tunables.list b/elf/dl-tunables.list
index 35634ef24d..e1d8225128 100644
--- a/elf/dl-tunables.list
+++ b/elf/dl-tunables.list
@@ -21,12 +21,13 @@
# minval: Optional minimum acceptable value
# maxval: Optional maximum acceptable value
# env_alias: An alias environment variable
-# security_level: Specify security level of the tunable. Valid values are:
+# security_level: Specify security level of the tunable for AT_SECURE binaries.
+# Valid values are:
#
-# SXID_ERASE: (default) Don't read for AT_SECURE binaries and
-# removed so that child processes can't read it.
-# SXID_IGNORE: Don't read for AT_SECURE binaries, but retained for
-# non-AT_SECURE subprocesses.
+# SXID_ERASE: (default) Do not read and do not pass on to
+# child processes.
+# SXID_IGNORE: Do not read, but retain for non-AT_SECURE
+# subprocesses.
# NONE: Read all the time.
glibc {
diff --git a/manual/README.tunables b/manual/README.tunables
index fff6c2a87e..d8c768abcc 100644
--- a/manual/README.tunables
+++ b/manual/README.tunables
@@ -59,12 +59,13 @@ The list of allowed attributes are:
- env_alias: An alias environment variable
-- security_level: Specify security level of the tunable. Valid values:
+- security_level: Specify security level of the tunable for AT_SECURE
+ binaries. Valid values are:
- SXID_ERASE: (default) Don't read for AT_SECURE binaries and
- removed so that child processes can't read it.
- SXID_IGNORE: Don't read for AT_SECURE binaries, but retained for
- non-AT_SECURE subprocesses.
+ SXID_ERASE: (default) Do not read and do not pass on to
+ child processes.
+ SXID_IGNORE: Do not read, but retain for non-AT_SECURE
+ child processes.
NONE: Read all the time.
2. Use TUNABLE_GET/TUNABLE_SET/TUNABLE_SET_WITH_BOUNDS to get and set tunables.
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2020-10-22 8:23 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-22 8:23 [glibc] Reword description of SXID_* tunable properties Siddhesh Poyarekar
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).