Red Hat engineer has landed the system-wide tunables infrastructure today into Glibc Git. This now allows tunables to be defined with the /etc/tunables.conf configuration file as an alternative to specifying existing tunables within the GLIBC_TUNABLES= environment variable.
The /etc/tunables.conf allows specifying one Glibc tunable per line. Each line can also be prefixed with a single word or character that controls the overridability of using the user GLIBC_TUNABLES environment variable.
The tunables.conf configuration file also supports a [proc:*] syntax to allow pattern matching to different processes either on the basename or on the full path. Additionally, the system-wide tunables filtering also allows filtering AT_SECURE or non-AT_SECURE binaries too. This filtering will allow a lot of extra functionality to be applied by Glibc such as for trusted/untrusted binaries and other use-cases, especially with the ability now to block some tunables from being overrode via the environment variable.
More details on the new Glibc System-Wide Tunables support can be found via this documentation commit .
This system-wide tunables support will be part of the Glibc 2.44 release due out in August.