diff options
| -rw-r--r-- | elf/dl-tunables.list | 11 | ||||
| -rw-r--r-- | manual/README.tunables | 11 |
2 files changed, 12 insertions, 10 deletions
diff --git a/elf/dl-tunables.list b/elf/dl-tunables.list index 35634ef24d..e1d8225128 100644 --- a/elf/dl-tunables.list +++ b/elf/dl-tunables.list @@ -21,12 +21,13 @@ # minval: Optional minimum acceptable value # maxval: Optional maximum acceptable value # env_alias: An alias environment variable -# security_level: Specify security level of the tunable. Valid values are: +# security_level: Specify security level of the tunable for AT_SECURE binaries. +# Valid values are: # -# SXID_ERASE: (default) Don't read for AT_SECURE binaries and -# removed so that child processes can't read it. -# SXID_IGNORE: Don't read for AT_SECURE binaries, but retained for -# non-AT_SECURE subprocesses. +# SXID_ERASE: (default) Do not read and do not pass on to +# child processes. +# SXID_IGNORE: Do not read, but retain for non-AT_SECURE +# subprocesses. # NONE: Read all the time. glibc { diff --git a/manual/README.tunables b/manual/README.tunables index fff6c2a87e..d8c768abcc 100644 --- a/manual/README.tunables +++ b/manual/README.tunables @@ -59,12 +59,13 @@ The list of allowed attributes are: - env_alias: An alias environment variable -- security_level: Specify security level of the tunable. Valid values: +- security_level: Specify security level of the tunable for AT_SECURE + binaries. Valid values are: - SXID_ERASE: (default) Don't read for AT_SECURE binaries and - removed so that child processes can't read it. - SXID_IGNORE: Don't read for AT_SECURE binaries, but retained for - non-AT_SECURE subprocesses. + SXID_ERASE: (default) Do not read and do not pass on to + child processes. + SXID_IGNORE: Do not read, but retain for non-AT_SECURE + child processes. NONE: Read all the time. 2. Use TUNABLE_GET/TUNABLE_SET/TUNABLE_SET_WITH_BOUNDS to get and set tunables. |