man/man8/ldconfig.8: document system-wide tunables

man/man8/ldconfig.8: document system-wide tunables

[DJ Delorie]

diff --git a/man/man8/ldconfig.8 b/man/man8/ldconfig.8
index ee024b8f6..8574eae24 100644
--- a/man/man8/ldconfig.8
+++ b/man/man8/ldconfig.8
@@ -17,6 +17,8 @@ .SH SYNOPSIS
 .IR conf ]
 .RB [ \-r\~\c
 .IR root ]
+.RB [ \-t\~\c
+.IR tunconf ]
 .IR directory \~.\|.\|.
 .YS
 .SY /sbin/ldconfig
@@ -85,6 +87,11 @@ .SH DESCRIPTION
 .P
 Failure to follow this pattern may result in compatibility issues
 after an upgrade.
+.P
+If the file
+.IR /etc/tunables.conf
+exists, it contains one tunable per line.  These tunables are stored
+in the cache and applied to every process at its startup.
 .SH OPTIONS
 .TP
 .BI \-\-format= fmt
@@ -157,6 +164,12 @@ .SH OPTIONS
 .I root
 as the root directory.
 .TP
+.BI \-t\~ tunconf
+Use
+.I tunconf
+instead of
+.IR /etc/tunables.conf .
+.TP
 .B \-\-verbose
 .TQ
 .B \-v
@@ -177,9 +190,85 @@ .SH OPTIONS
 .B \-N
 is also specified,
 the cache is still rebuilt.
+.SH INCLUDES
+The files
+.IR /etc/ld.so.conf
+and
+.IR /etc/tunables.conf
+allow lines to start with the word
+.I include
+followed by a path wildcard, and will include any files matching that
+wildcard.
+.SH TUNABLES
+Each line in the file
+.I /etc/tunables.conf
+specifies a tunable, which is a name and value
+separated by an equals sign.
+Each line may include zero or more words or symbols at the beginning:
+.TP
+.B overridable
+.TQ
+.B +
+Allow the tunable to be overridden by the environment variable (this is the default).
+.TP
+.B nonoverridable
+.TQ
+.B \-
+Do not allow the tunable to be overridden by the environment variable.
+.TP
+.B onlysecure
+.TQ
+.B @
+The tunable only applies to AT_SECURE (i.e. setuid, or elevated
+capabilities) processes.
+.TP
+.B nonsecure
+.TQ
+.B $
+The tunable only applies to non-AT_SECURE processes (this is the default).
+.TP
+.B anysecure
+.TQ
+.B *
+The tunable only applies to both AT_SECURE and non-AT_SECURE processes.
+.P
+The file may also contain
+.I filters ,
+which limit the tunables following it, up to the end of the file (or
+end of the included file, or start of a new included file) or a line
+with only
+.B []
+on it.  The syntax is:
+.RS
+.P
+[
+.I filter
+:
+.I pattern
+]
+.RE
+.P
+.TP
+.B proc
+The
+.I proc
+filter limits the following tunables to processes starting from the
+file matching the pattern.  The file may be fully qualified or just
+the basename.
+.P
+Example config file:
+.P
+.RS
+.nf
+glibc.malloc.arenas_max=5
+onlysecure glibc.malloc.arenas_max=1
+-glibc.pthread.rseq=1
+[proc:/bin/bad.program]
+-glibc.pthread.rseq=0
+.fi
+.RE
+.P
 .SH FILES
-.\" FIXME Since glibc-2.3.4, "include" directives are supported in ld.so.conf
-.\"
 .\" FIXME Since glibc-2.4, "hwcap" directives are supported in ld.so.conf
 .PD 0
 .TP
@@ -191,6 +280,11 @@ .SH FILES
 one per line,
 in which to search for libraries.
 .TP
+.I /etc/tunables.conf
+contains a list of tunables,
+one per line,
+to apply to all newly created processes.
+.TP
 .I /etc/ld.so.cache
 contains an ordered list of libraries found in the directories
 specified in

Re: man/man8/ldconfig.8: document system-wide tunables

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 6058 bytes --]

Hi DJ,

On 2026-07-09T14:53:09-0400, DJ Delorie wrote:
> 
> diff --git a/man/man8/ldconfig.8 b/man/man8/ldconfig.8

I see some diagnostics after applying this patch:

	$ make lint-man build-catman -R -k
	make: warning: undefined variable 'GNUMAKEFLAGS'
	MANDOC		.tmp/man/man8/ldconfig.8.lint-man.mandoc.touch
	mandoc: .tmp/man/man8/ldconfig.8:212:85: STYLE: input text line longer than 80 bytes: Allow the tunable to...
	mandoc: .tmp/man/man8/ldconfig.8:250:2: WARNING: skipping paragraph macro: PP empty
	mandoc: .tmp/man/man8/ldconfig.8:270:2: WARNING: skipping paragraph macro: PP empty
	make: *** [/srv/alx/src/linux/man-pages/man-pages/contrib/share/mk/lint/man/mandoc.mk:30: .tmp/man/man8/ldconfig.8.lint-man.mandoc.touch] Error 1
	PCRE2GREP	.tmp/man/man8/ldconfig.8.lint-man.poems.touch
	lint-man-poems: .tmp/man/man8/ldconfig.8: Use semantic newlines (see man-pages(7)):
	    222:	The tunable only applies to AT_SECURE (i.e. setuid, or elevated
	make: *** [/srv/alx/src/linux/man-pages/man-pages/contrib/share/mk/lint/man/poems.mk:30: .tmp/man/man8/ldconfig.8.lint-man.poems.touch] Error 1
	make: Target 'lint-man' not remade because of errors.
	TROFF		.tmp/man/man8/ldconfig.8.cat.set
	an.tmac:.tmp/man/man8/ldconfig.8:92: style: .IR expects at least 2 arguments, got 1
	an.tmac:.tmp/man/man8/ldconfig.8:195: style: .IR expects at least 2 arguments, got 1
	an.tmac:.tmp/man/man8/ldconfig.8:197: style: .IR expects at least 2 arguments, got 1
	make: *** [/srv/alx/src/linux/man-pages/man-pages/contrib/share/mk/build/catman/troff.mk:33: .tmp/man/man8/ldconfig.8.cat.set] Error 1
	make: *** Deleting file '.tmp/man/man8/ldconfig.8.cat.set'
	make: Target 'build-catman' not remade because of errors.

> index ee024b8f6..8574eae24 100644
> --- a/man/man8/ldconfig.8
> +++ b/man/man8/ldconfig.8
> @@ -17,6 +17,8 @@ .SH SYNOPSIS
>  .IR conf ]
>  .RB [ \-r\~\c
>  .IR root ]
> +.RB [ \-t\~\c
> +.IR tunconf ]
>  .IR directory \~.\|.\|.
>  .YS
>  .SY /sbin/ldconfig
> @@ -85,6 +87,11 @@ .SH DESCRIPTION
>  .P
>  Failure to follow this pattern may result in compatibility issues
>  after an upgrade.
> +.P
> +If the file
> +.IR /etc/tunables.conf

	s/IR/I/

> +exists, it contains one tunable per line.  These tunables are stored

Please use semantic newlines.  See man-pages(7):

$ MANWIDTH=72 man man-pages | awk '/Use semantic newlines/,/^$/'
   Use semantic newlines
     In the source of a manual page, new sentences should be started on
     new lines, long sentences should be split  into  lines  at  clause
     breaks  (commas,  semicolons, colons, and so on), and long clauses
     should be split at phrase boundaries.  This convention,  sometimes
     known as "semantic newlines", makes it easier to see the effect of
     patches, which often operate at the level of individual sentences,
     clauses, or phrases.

> +in the cache and applied to every process at its startup.
>  .SH OPTIONS
>  .TP
>  .BI \-\-format= fmt
> @@ -157,6 +164,12 @@ .SH OPTIONS
>  .I root
>  as the root directory.
>  .TP
> +.BI \-t\~ tunconf
> +Use
> +.I tunconf
> +instead of
> +.IR /etc/tunables.conf .
> +.TP
>  .B \-\-verbose
>  .TQ
>  .B \-v
> @@ -177,9 +190,85 @@ .SH OPTIONS
>  .B \-N
>  is also specified,
>  the cache is still rebuilt.
> +.SH INCLUDES

I think this section belongs in new manual pages, ld.so.conf(5) and
tuinables.conf(5), which would describe the formats of those files.

> +The files
> +.IR /etc/ld.so.conf

	s/IR/I/

> +and
> +.IR /etc/tunables.conf

	s/IR/I/

> +allow lines to start with the word
> +.I include
> +followed by a path wildcard, and will include any files matching that
> +wildcard.

Please use semantic newlines.

> +.SH TUNABLES

Same here; I think this belongs in tunables.conf(5).


Have a lovely day!
Alex

> +Each line in the file
> +.I /etc/tunables.conf
> +specifies a tunable, which is a name and value
> +separated by an equals sign.
> +Each line may include zero or more words or symbols at the beginning:
> +.TP
> +.B overridable
> +.TQ
> +.B +
> +Allow the tunable to be overridden by the environment variable (this is the default).
> +.TP
> +.B nonoverridable
> +.TQ
> +.B \-
> +Do not allow the tunable to be overridden by the environment variable.
> +.TP
> +.B onlysecure
> +.TQ
> +.B @
> +The tunable only applies to AT_SECURE (i.e. setuid, or elevated
> +capabilities) processes.
> +.TP
> +.B nonsecure
> +.TQ
> +.B $
> +The tunable only applies to non-AT_SECURE processes (this is the default).
> +.TP
> +.B anysecure
> +.TQ
> +.B *
> +The tunable only applies to both AT_SECURE and non-AT_SECURE processes.
> +.P
> +The file may also contain
> +.I filters ,
> +which limit the tunables following it, up to the end of the file (or
> +end of the included file, or start of a new included file) or a line
> +with only
> +.B []
> +on it.  The syntax is:
> +.RS
> +.P
> +[
> +.I filter
> +:
> +.I pattern
> +]
> +.RE
> +.P
> +.TP
> +.B proc
> +The
> +.I proc
> +filter limits the following tunables to processes starting from the
> +file matching the pattern.  The file may be fully qualified or just
> +the basename.
> +.P
> +Example config file:
> +.P
> +.RS
> +.nf
> +glibc.malloc.arenas_max=5
> +onlysecure glibc.malloc.arenas_max=1
> +-glibc.pthread.rseq=1
> +[proc:/bin/bad.program]
> +-glibc.pthread.rseq=0
> +.fi
> +.RE
> +.P
>  .SH FILES
> -.\" FIXME Since glibc-2.3.4, "include" directives are supported in ld.so.conf
> -.\"
>  .\" FIXME Since glibc-2.4, "hwcap" directives are supported in ld.so.conf
>  .PD 0
>  .TP
> @@ -191,6 +280,11 @@ .SH FILES
>  one per line,
>  in which to search for libraries.
>  .TP
> +.I /etc/tunables.conf
> +contains a list of tunables,
> +one per line,
> +to apply to all newly created processes.
> +.TP
>  .I /etc/ld.so.cache
>  contains an ordered list of libraries found in the directories
>  specified in
> 
> 

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: man/man8/ldconfig.8: document system-wide tunables

[DJ Delorie]

Alejandro Colomar <alx@kernel.org> writes:
> 	mandoc: .tmp/man/man8/ldconfig.8:212:85: STYLE: input text line longer than 80 bytes: Allow the tunable to...

Fixed.

> 	mandoc: .tmp/man/man8/ldconfig.8:250:2: WARNING: skipping paragraph macro: PP empty
> 	mandoc: .tmp/man/man8/ldconfig.8:270:2: WARNING: skipping paragraph macro: PP empty

Fixed.  I think.  We need a better language for this ;-)

> 	lint-man-poems: .tmp/man/man8/ldconfig.8: Use semantic newlines (see man-pages(7)):
> 	    222:	The tunable only applies to AT_SECURE (i.e. setuid, or elevated

Maybe fixed?  Better at least.  The linter still complains despite me
splitting it up:

.B @
The tunable only applies to AT_SECURE
(i.e. setuid, or elevated capabilities)
processes.

> 	an.tmac:.tmp/man/man8/ldconfig.8:92: style: .IR expects at least 2 arguments, got 1
> 	an.tmac:.tmp/man/man8/ldconfig.8:195: style: .IR expects at least 2 arguments, got 1
> 	an.tmac:.tmp/man/man8/ldconfig.8:197: style: .IR expects at least 2 arguments, got 1

Fixed.

>> +.SH INCLUDES
>
> I think this section belongs in new manual pages, ld.so.conf(5) and
> tuinables.conf(5), which would describe the formats of those files.
>> +.SH TUNABLES
>
> Same here; I think this belongs in tunables.conf(5).

I looked for ld.so.conf.5 but didn't see one (which kinda surprised me,
but a lot of ldconfig isn't documented either in the man pages or in the
glibc manual) so went with "what was there".  I have a slight preference
for "get this change in quickly" as glibc is releasing with the new
funcionality soon(ish) but if you want me to split these two out, I can
do that too.  Or do it later.

>> +The files
>> +.IR /etc/ld.so.conf
>
> 	s/IR/I/

Really, really, want a better language for this... ;-)

diff --git a/man/man8/ldconfig.8 b/man/man8/ldconfig.8
index ee024b8f6..19f1ddf43 100644
--- a/man/man8/ldconfig.8
+++ b/man/man8/ldconfig.8
@@ -17,6 +17,8 @@ .SH SYNOPSIS
 .IR conf ]
 .RB [ \-r\~\c
 .IR root ]
+.RB [ \-t\~\c
+.IR tunconf ]
 .IR directory \~.\|.\|.
 .YS
 .SY /sbin/ldconfig
@@ -85,6 +87,11 @@ .SH DESCRIPTION
 .P
 Failure to follow this pattern may result in compatibility issues
 after an upgrade.
+.P
+If the file
+.I /etc/tunables.conf
+exists, it contains one tunable per line.  These tunables are stored
+in the cache and applied to every process at its startup.
 .SH OPTIONS
 .TP
 .BI \-\-format= fmt
@@ -157,6 +164,12 @@ .SH OPTIONS
 .I root
 as the root directory.
 .TP
+.BI \-t\~ tunconf
+Use
+.I tunconf
+instead of
+.IR /etc/tunables.conf .
+.TP
 .B \-\-verbose
 .TQ
 .B \-v
@@ -177,9 +190,85 @@ .SH OPTIONS
 .B \-N
 is also specified,
 the cache is still rebuilt.
+.SH INCLUDES
+The files
+.I /etc/ld.so.conf
+and
+.I /etc/tunables.conf
+allow lines to start with the word
+.I include
+followed by a path wildcard,
+and will include any files matching that wildcard.
+.SH TUNABLES
+Each line in the file
+.I /etc/tunables.conf
+specifies a tunable,
+which is a name and value separated by an equals sign.
+Each line may include zero or more words or symbols at the beginning:
+.TP
+.B overridable
+.TQ
+.B +
+Allow the tunable to be overridden by the environment variable
+(this is the default).
+.TP
+.B nonoverridable
+.TQ
+.B \-
+Do not allow the tunable to be overridden by the environment variable.
+.TP
+.B onlysecure
+.TQ
+.B @
+The tunable only applies to AT_SECURE
+(i.e. setuid, or elevated capabilities)
+processes.
+.TP
+.B nonsecure
+.TQ
+.B $
+The tunable only applies to non-AT_SECURE processes (this is the default).
+.TP
+.B anysecure
+.TQ
+.B *
+The tunable only applies to both AT_SECURE and non-AT_SECURE processes.
+.P
+The file may also contain
+.I filters ,
+which limit the tunables following it, up to the end of the file
+(or end of the included file, or start of a new included file)
+or a line with only
+.B []
+on it.  The syntax is:
+.RS
+.P
+[
+.I filter
+:
+.I pattern
+]
+.RE
+.TP
+.B proc
+The
+.I proc
+filter limits the following tunables to processes starting from the
+file matching the pattern.
+The file may be fully qualified or just the basename.
+.P
+Example config file:
+.P
+.RS
+.nf
+glibc.malloc.arenas_max=5
+onlysecure glibc.malloc.arenas_max=1
+-glibc.pthread.rseq=1
+[proc:/bin/bad.program]
+-glibc.pthread.rseq=0
+.fi
+.RE
 .SH FILES
-.\" FIXME Since glibc-2.3.4, "include" directives are supported in ld.so.conf
-.\"
 .\" FIXME Since glibc-2.4, "hwcap" directives are supported in ld.so.conf
 .PD 0
 .TP
@@ -191,6 +280,11 @@ .SH FILES
 one per line,
 in which to search for libraries.
 .TP
+.I /etc/tunables.conf
+contains a list of tunables,
+one per line,
+to apply to all newly created processes.
+.TP
 .I /etc/ld.so.cache
 contains an ordered list of libraries found in the directories
 specified in

Why we're stuck with man(7) (was: man/man8/ldconfig.8: document system-wide tunables)

[G. Branden Robinson]

[-- Attachment #1: Type: text/plain, Size: 4775 bytes --]

Hi DJ,

At 2026-07-10T14:12:10-0400, DJ Delorie wrote:
> Alejandro Colomar <alx@kernel.org> writes:
> > 	mandoc: .tmp/man/man8/ldconfig.8:250:2: WARNING: skipping paragraph macro: PP empty
> > 	mandoc: .tmp/man/man8/ldconfig.8:270:2: WARNING: skipping paragraph macro: PP empty
> 
> Fixed.  I think.  We need a better language for this ;-)

21 years ago I figured we'd get one that would conquer the world.  We
haven't.  Too bad.  I could have started working on groff back then.

Here's a summary of how we got here.

* man(7) (Bell Labs CSRC, 1979) was "good enough" ("worse is better").
  At least one generation of Unix people came up venerating the
  documents written using it.
* Many, many programmers don't want to _write_ documentation at all.
* Many programmers' managers regard documentation as an unwelcome
  friction slowing down the launch of a Minimum Viable Product.
* Many of the programmers who _do_ want to write documentation don't
  want to compose it in anything more complex than Markdown.
* Markdown can't do semantics.
∴ Goodbye, "semantic Web".

* People who did want a semantic Web ran into problems.
* XML overpromised and underdelivered.
* DocBook-XML was lexically overcomplicated--meaning hard to learn--with
  something like 400 elements.  A part-time practitioner, such as a
  person writing in a "real" programming language, could not retain the
  markup language in their head between periods of exile to
  Documentation Land.  Further, its toolchain, involving stuff like jade
  and opensp, was heavyweight and difficult to work with.  And also
  written in Java because Java was going to be the One Language to Rule
  them All, with C and C++ forgotten, by 2005 or so.
∴ "Semantics" got a bad rap because everyone with a fat wallet who
  backed it bet on a losing horse for the delivery of said semantics.
  They spent 10+ years telling the world that XML was the _only way to
  do semantics_.  And because venture capitalists and tech bros are
  infallible geniuses in black turtlenecks, everybody believed them.

* There's mdoc(7), which one might uncharitably say brought you the
  worst of all worlds.  Semantics?  Yes!  But many element types.  (Only
  about 1/4th as bloated as DocBook, though.  And Ingo Schwarze insists
  you can get by with much less than that.  Until you guess wrong and he
  reviews your document.  ;-) )  And if you don't like *roff as a macro
  system, wait until you discover mdoc!  It implements a macro processor
  on top of your macro processor!  And mdoc(7) was only created in the
  first place because AT&T were such jerks about the licensing of troff
  (and Unix generally).  So the Berkeley CSRG's mandate, I infer, was to
  spec out a macro system that could eventually be ripped free of troff
  and set down on top of something else.
* That decision, taken in maybe 1987 or 1988, predated by only one year
  the advent of James Clark's "groff", which BSD promptly shipped in
  Net/2 and later 4.4BSD.  (Later, its descendants ripped it out
  again, because GPL and C++ bad.  BAD!)
* That "other" macro system didn't arrive until about 2010, in the shape
  of mdocml(1)--now known as mandoc(1)--which, because man(7) documents
  had not had the decency to shrink below 90-95% of man pages on all
  systems, ended up reimplementing huge chunks of...troff.
∴ Almost the only people writing mdoc(7) are strident BSD partisans.
  You can write your man page in mdoc(7), but sooner or later you'll be
  asked why you aren't running *BSD, and you'll get treated like an
  idiot if you don't.  You will then understand how *BSD is a refuge
  from the evangelicalism of GNU people.[1]  ;-)

* In my estimation, TeX could have conquered this space too.  It was
  pristinely engineered (if idiosyncratically implemented), had tons of
  momentum, oodles of capable practitioners, and a benign, deific,
  universally esteemed figure behind it.
* TeX's holy mission is beautiful typography, and it's good at it.
* People read man pages on terminals 90%+ of the time.
* You can't do beautiful typography on terminals.
* Terminals can **** off.
∴ TeX ceded this ground without ever contesting it.

I've ventured my own proposal for the addition of a flexible semantic
system to man(7) with backwards compatibility, at the cost of only two
additional macro names.[2]  Literally no one has expressed interest.

So it goes.

Regards,
Branden

[1] mdoc(7) is fine.  It has some nice features, and insofar as I have
    a command of it, I'm happy to help people draft or improve their man
    pages that use it.  What it is not, is easier than man(7).

[2] https://lists.gnu.org/archive/html/groff/2022-12/msg00075.html

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: man/man8/ldconfig.8: document system-wide tunables

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 9326 bytes --]

Hi DJ,

On 2026-07-10T14:12:10-0400, DJ Delorie wrote:
> Alejandro Colomar <alx@kernel.org> writes:
> > 	mandoc: .tmp/man/man8/ldconfig.8:212:85: STYLE: input text line longer than 80 bytes: Allow the tunable to...
> 
> Fixed.
> 
> > 	mandoc: .tmp/man/man8/ldconfig.8:250:2: WARNING: skipping paragraph macro: PP empty
> > 	mandoc: .tmp/man/man8/ldconfig.8:270:2: WARNING: skipping paragraph macro: PP empty
> 
> Fixed.  I think.  We need a better language for this ;-)
> 
> > 	lint-man-poems: .tmp/man/man8/ldconfig.8: Use semantic newlines (see man-pages(7)):
> > 	    222:	The tunable only applies to AT_SECURE (i.e. setuid, or elevated
> 
> Maybe fixed?  Better at least.  The linter still complains despite me
> splitting it up:
> 
> .B @
> The tunable only applies to AT_SECURE
> (i.e. setuid, or elevated capabilities)
> processes.

You need to use a dummy character to tell this linter that you really
meant a dot followed by one space which doesn't terminate the sentence.

	(i.e.\& setuid, or elevated capabilities)

Other than that, it's better.

Also, man-pages(7) recommends using 'that is,' instead of 'i.e.,'.

$ MANWIDTH=72 man man-pages | awk '/Use of e.g.,/,/^$/'
   Use of e.g., i.e., etc., a.k.a., and similar
     In  general,  the  use  of  abbreviations  such as "e.g.", "i.e.",
     "etc.", "cf.", and "a.k.a." should be avoided, in favor  of  suit‐
     able  full  wordings ("for example", "that is", "and so on", "com‐
     pare to", "also known as").

> > 	an.tmac:.tmp/man/man8/ldconfig.8:92: style: .IR expects at least 2 arguments, got 1
> > 	an.tmac:.tmp/man/man8/ldconfig.8:195: style: .IR expects at least 2 arguments, got 1
> > 	an.tmac:.tmp/man/man8/ldconfig.8:197: style: .IR expects at least 2 arguments, got 1
> 
> Fixed.
> 
> >> +.SH INCLUDES
> >
> > I think this section belongs in new manual pages, ld.so.conf(5) and
> > tuinables.conf(5), which would describe the formats of those files.
> >> +.SH TUNABLES
> >
> > Same here; I think this belongs in tunables.conf(5).
> 
> I looked for ld.so.conf.5 but didn't see one (which kinda surprised me,
> but a lot of ldconfig isn't documented either in the man pages or in the
> glibc manual) so went with "what was there".  I have a slight preference
> for "get this change in quickly" as glibc is releasing with the new
> funcionality soon(ish) but if you want me to split these two out, I can
> do that too.  Or do it later.

I would very much prefer to split these out.

An incomplete ld.so.conf.5 page would be fine; we don't need to make it
perfect.  But the separate manual page would help keep this
documentation reasonably organized.

I can help to get this quickly in.

> >> +The files
> >> +.IR /etc/ld.so.conf
> >
> > 	s/IR/I/
> 
> Really, really, want a better language for this... ;-)

For remembering these, IR is for alternating italics and roman, and I
is for fully italics.

> 
> diff --git a/man/man8/ldconfig.8 b/man/man8/ldconfig.8
> index ee024b8f6..19f1ddf43 100644
> --- a/man/man8/ldconfig.8
> +++ b/man/man8/ldconfig.8
> @@ -17,6 +17,8 @@ .SH SYNOPSIS
>  .IR conf ]
>  .RB [ \-r\~\c
>  .IR root ]
> +.RB [ \-t\~\c
> +.IR tunconf ]
>  .IR directory \~.\|.\|.
>  .YS
>  .SY /sbin/ldconfig

LGTM.

> @@ -85,6 +87,11 @@ .SH DESCRIPTION
>  .P
>  Failure to follow this pattern may result in compatibility issues
>  after an upgrade.
> +.P
> +If the file
> +.I /etc/tunables.conf
> +exists, it contains one tunable per line.  These tunables are stored

After period, always start a new line.  After the comma, it's more a
matter of taste, but in general encouraged.  (semantic newlines)

	.P
	If the file
	.I /etc/tunables.conf
	exists,
	it contains one tunable per line.
	These tunables are stored in the cache
	and applied to every process at its startup.

> +in the cache and applied to every process at its startup.
>  .SH OPTIONS
>  .TP
>  .BI \-\-format= fmt
> @@ -157,6 +164,12 @@ .SH OPTIONS
>  .I root
>  as the root directory.
>  .TP
> +.BI \-t\~ tunconf
> +Use
> +.I tunconf
> +instead of
> +.IR /etc/tunables.conf .
> +.TP
>  .B \-\-verbose
>  .TQ
>  .B \-v

LGTM.

> @@ -177,9 +190,85 @@ .SH OPTIONS
>  .B \-N
>  is also specified,
>  the cache is still rebuilt.
> +.SH INCLUDES
> +The files
> +.I /etc/ld.so.conf
> +and
> +.I /etc/tunables.conf
> +allow lines to start with the word
> +.I include
> +followed by a path wildcard,
> +and will include any files matching that wildcard.
> +.SH TUNABLES
> +Each line in the file
> +.I /etc/tunables.conf
> +specifies a tunable,
> +which is a name and value separated by an equals sign.
> +Each line may include zero or more words or symbols at the beginning:
> +.TP
> +.B overridable
> +.TQ
> +.B +
> +Allow the tunable to be overridden by the environment variable
> +(this is the default).
> +.TP
> +.B nonoverridable
> +.TQ
> +.B \-
> +Do not allow the tunable to be overridden by the environment variable.
> +.TP
> +.B onlysecure
> +.TQ
> +.B @
> +The tunable only applies to AT_SECURE
> +(i.e. setuid, or elevated capabilities)
> +processes.
> +.TP
> +.B nonsecure
> +.TQ
> +.B $
> +The tunable only applies to non-AT_SECURE processes (this is the default).
> +.TP
> +.B anysecure
> +.TQ
> +.B *
> +The tunable only applies to both AT_SECURE and non-AT_SECURE processes.
> +.P
> +The file may also contain
> +.I filters ,
> +which limit the tunables following it, up to the end of the file
> +(or end of the included file, or start of a new included file)
> +or a line with only
> +.B []
> +on it.  The syntax is:
> +.RS
> +.P

You probably mean .IP, which means indented paragraph.

> +[
> +.I filter
> +:
> +.I pattern
> +]
> +.RE

For examples, we use .EX/.EE sections.  These ensure a monospaced font
in PDF or HTML.  See man-pages(7):

$ MANWIDTH=72 man man-pages | sed -n '/Indentation/,+18p'
   Indentation of structure definitions, shell session logs, and so on
     When  structure definitions, shell session logs, and so on are in‐
     cluded in running text, indent them by 4 spaces (i.e., a block en‐
     closed by .in +4n and .in), format them  using  the  .EX  and  .EE
     macros,  and surround them with suitable paragraph markers (either
     .P or .IP).  For example:

         .P
         .in +4n
         .EX
         int
         main(int argc, char *argv[])
         {
             return 0;
         }
         .EE
         .in
         .P

Is the white space intended?  I'd write one of these, depending on what
you actually mean (if I understood your intention correctly):

	.IP
	.in +4n
	.EX
	.RI [ filter : pattern ]
	.EE
	.in
or
	.IP
	.in +4n
	.EX
	.RI [\~ filter \~:\~ pattern \~]
	.EE
	.in

> +.TP
> +.B proc
> +The
> +.I proc

proc should consistently be in italics or bold, I think.  If it's a
literal value that users should type as is, it should be bold.

> +filter limits the following tunables to processes starting from the
> +file matching the pattern.
> +The file may be fully qualified or just the basename.
> +.P

For continuing the indentation of TP, you probably want IP.

BTW, you can check the effects of your patch as a diff with the
diffman-git(1) script.  It's already provided in some distros, and you
can also find in the repository of this project if your distro hasn't
packaged it yet.  It is a simple shell script, which you can find in
src/bin/diffman-git.  Its documentation is as usual under man/man1/.

Here's how it works:

	$ diffman-git HEAD^^
	--- HEAD^^^:man/man4/console_codes.4
	+++ HEAD^^:man/man4/console_codes.4
	@@ -439,7 +439,7 @@ DESCRIPTION
				       to txt.
	      ESC ] 1 ; txt ST         Set icon name to txt.
	      ESC ] 2 ; txt ST         Set window title to txt.
	-     ESC ] 4 ; num ; txt ST   Set ANSI color num to txt.
	+     ESC ] 4 ; num ; txt ST   Set color num (0‐255) to txt.
	      ESC ] 10 ; txt ST        Set dynamic text color to txt.
	      ESC ] 46 ; name ST       Change log file to name (nor‐
				       mally disabled by a compile‐

If you don't specify a commit, it shows the diff of the changes not
staged.

> +Example config file:
> +.P
> +.RS
> +.nf

You probably want monospace, and not just no-fill.  .EX/.EE sections
achieve this (EXample, Example End).

> +glibc.malloc.arenas_max=5
> +onlysecure glibc.malloc.arenas_max=1
> +-glibc.pthread.rseq=1

Hyphen-minus must be escaped as \-, otherwise, they're interpreted as
hyphens (not the thing you want).


Have a lovely night!
Alex

> +[proc:/bin/bad.program]
> +-glibc.pthread.rseq=0
> +.fi
> +.RE
>  .SH FILES
> -.\" FIXME Since glibc-2.3.4, "include" directives are supported in ld.so.conf
> -.\"
>  .\" FIXME Since glibc-2.4, "hwcap" directives are supported in ld.so.conf
>  .PD 0
>  .TP
> @@ -191,6 +280,11 @@ .SH FILES
>  one per line,
>  in which to search for libraries.
>  .TP
> +.I /etc/tunables.conf
> +contains a list of tunables,
> +one per line,
> +to apply to all newly created processes.
> +.TP
>  .I /etc/ld.so.cache
>  contains an ordered list of libraries found in the directories
>  specified in
> 

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: man/man8/ldconfig.8: document system-wide tunables

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 1043 bytes --]

Hi DJ,

On 2026-07-10T22:07:00+0200, Alejandro Colomar wrote:
> > I looked for ld.so.conf.5 but didn't see one (which kinda surprised me,
> > but a lot of ldconfig isn't documented either in the man pages or in the
> > glibc manual) so went with "what was there".  I have a slight preference
> > for "get this change in quickly" as glibc is releasing with the new
> > funcionality soon(ish) but if you want me to split these two out, I can
> > do that too.  Or do it later.
> 
> I would very much prefer to split these out.
> 
> An incomplete ld.so.conf.5 page would be fine; we don't need to make it
> perfect.  But the separate manual page would help keep this
> documentation reasonably organized.
> 
> I can help to get this quickly in.

I have added a small ld.so.conf(5) manual page (already pushed to
master).  This will allow you to add stuff there.  If you want to add
a tunables.conf(5) manual page, you can have a look at the ld.so.conf(5)
page.


Cheers,
Alex


-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Why we're stuck with man(7) (was: man/man8/ldconfig.8: document system-wide tunables)

[DJ Delorie]

"G. Branden Robinson" <g.branden.robinson@gmail.com> writes:
> * Markdown can't do semantics.

And roff has .IR ;-)

These days, most of the docs I write are in texinfo or HTML (raw html,
not markup).  I think I've experienced most of the formats on your list.
I think I've written converters between many things on your list.

Is there a canonical reference to the flavor of roff that we write to,
for modern systems' man page formatters?

Re: Why we're stuck with man(7) (was: man/man8/ldconfig.8: document system-wide tunables)

[DJ Delorie]

> Is there a canonical reference to the flavor of roff that we write to,
> for modern systems' man page formatters?

Nevermind, found it...

Re: Why we're stuck with man(7) (was: man/man8/ldconfig.8: document system-wide tunables)

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 677 bytes --]

Hi DJ,

On 2026-07-10T18:11:09-0400, DJ Delorie wrote:
> 
> "G. Branden Robinson" <g.branden.robinson@gmail.com> writes:
> > * Markdown can't do semantics.
> 
> And roff has .IR ;-)
> 
> These days, most of the docs I write are in texinfo or HTML (raw html,
> not markup).  I think I've experienced most of the formats on your list.
> I think I've written converters between many things on your list.
> 
> Is there a canonical reference to the flavor of roff that we write to,
> for modern systems' man page formatters?

groff_man(7) and groff_man_style(7) are what you're looking for,
I believe.


Cheers,
Alex

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: man/man8/ldconfig.8: document system-wide tunables

[DJ Delorie]

How about this?

diff --git a/man/man5/ld.so.conf.5 b/man/man5/ld.so.conf.5
index 481cf9152..aa27b73f6 100644
--- a/man/man5/ld.so.conf.5
+++ b/man/man5/ld.so.conf.5
@@ -9,6 +9,14 @@ .SH DESCRIPTION
 This file contains a list of directories,
 one per line,
 in which to search for libraries.
+The file allows lines to start with the word
+.I include
+followed by a path wildcard,
+and will include any files matching that wildcard.
+The file is parsed by
+.B \%ldconfig
+and the results stored in
+.IR /etc/ld.so.cache .
 .SH FILES
 .I /etc/ld.so.conf
 .SH SEE ALSO
diff --git a/man/man5/tunables.conf.5 b/man/man5/tunables.conf.5
new file mode 100644
index 000000000..d24eb0fa5
--- /dev/null
+++ b/man/man5/tunables.conf.5
@@ -0,0 +1,86 @@
+.TH tunables.conf 5 (date) "Linux man-pages (unreleased)"
+.SH NAME
+tunables.conf \- System-wide tunables configuration file
+.SH SYNOPSIS
+.nf
+.B /etc/tunables.conf
+.fi
+.SH DESCRIPTION
+Each line in the file
+.I /etc/tunables.conf
+specifies a tunable,
+which is a name and value separated by an equals sign.
+For a list of valid tunables,
+please consult the glibc manual.
+The file allows lines to start with the word
+.I include
+followed by a path wildcard,
+and will include any files matching that wildcard.
+The file is parsed by
+.B \%ldconfig
+and the results stored in
+.IR /etc/ld.so.cache .
+.P
+Each line may include zero or more words or symbols at the beginning:
+.TP
+.B overridable
+.TQ
+.B +
+Allow the tunable to be overridden by the environment variable
+(this is the default).
+.TP
+.B nonoverridable
+.TQ
+.B \-
+Do not allow the tunable to be overridden by the environment variable.
+.TP
+.B onlysecure
+.TQ
+.B @
+The tunable only applies to AT_SECURE
+(such as setuid, or elevated capabilities)
+processes.
+.TP
+.B nonsecure
+.TQ
+.B $
+The tunable only applies to non-AT_SECURE processes (this is the default).
+.TP
+.B anysecure
+.TQ
+.B *
+The tunable only applies to both AT_SECURE and non-AT_SECURE processes.
+.P
+The file may also contain
+.I filters ,
+which limit the tunables following it, up to the end of the file
+(or end of the included file, or start of a new included file)
+or a line with only
+.B []
+on it.  The syntax is:
+.IP
+.EX
+.RI [ filter : pattern ]
+.EE
+.TP
+.B proc
+The
+.I proc
+filter limits the following tunables to processes starting from the
+file matching the pattern.
+The file may be fully qualified or just the basename.
+.P
+Example config file:
+.IP
+.EX
+glibc.malloc.arenas_max=5
+onlysecure glibc.malloc.arenas_max=1
+-glibc.pthread.rseq=1
+[proc:/bin/bad.program]
+-glibc.pthread.rseq=0
+.EE
+.SH FILES
+.I /etc/ld.so.conf
+.SH SEE ALSO
+.BR ld.so (8),
+.BR ldconfig (8)
diff --git a/man/man8/ld.so.8 b/man/man8/ld.so.8
index 5f3c22ef2..40f129b71 100644
--- a/man/man8/ld.so.8
+++ b/man/man8/ld.so.8
@@ -792,7 +792,8 @@ .SH FILES
 .TP
 .I /etc/ld.so.cache
 File containing a compiled list of directories in which to search for
-shared objects and an ordered list of candidate shared objects.
+shared objects and an ordered list of candidate shared objects,
+and any system-wide tunables to be applied.
 See
 .BR ldconfig (8).
 .TP
diff --git a/man/man8/ldconfig.8 b/man/man8/ldconfig.8
index 9ac146b44..234169504 100644
--- a/man/man8/ldconfig.8
+++ b/man/man8/ldconfig.8
@@ -17,6 +17,8 @@ .SH SYNOPSIS
 .IR conf ]
 .RB [ \-r\~\c
 .IR root ]
+.RB [ \-t\~\c
+.IR tunconf ]
 .IR directory \~.\|.\|.
 .YS
 .SY /sbin/ldconfig
@@ -85,6 +87,13 @@ .SH DESCRIPTION
 .P
 Failure to follow this pattern may result in compatibility issues
 after an upgrade.
+.P
+If the file
+.I /etc/tunables.conf
+exists,
+it contains tunables to be applied to all processes.
+These tunables are stored
+in the cache and applied to every process at its startup.
 .SH OPTIONS
 .TP
 .BI \-\-format= fmt
@@ -157,6 +166,12 @@ .SH OPTIONS
 .I root
 as the root directory.
 .TP
+.BI \-t\~ tunconf
+Use
+.I tunconf
+instead of
+.IR /etc/tunables.conf .
+.TP
 .B \-\-verbose
 .TQ
 .B \-v
@@ -178,8 +193,6 @@ .SH OPTIONS
 is also specified,
 the cache is still rebuilt.
 .SH FILES
-.\" FIXME Since glibc-2.3.4, "include" directives are supported in ld.so.conf
-.\"
 .\" FIXME Since glibc-2.4, "hwcap" directives are supported in ld.so.conf
 .PD 0
 .TP
@@ -190,11 +203,17 @@ .SH FILES
 See
 .BR ld.so.conf (5).
 .TP
+.I /etc/tunables.conf
+See
+.BR tunables.conf (5).
+.TP
 .I /etc/ld.so.cache
 contains an ordered list of libraries found in the directories
 specified in
 .IR /etc/ld.so.conf ,
-as well as those found in the trusted directories.
+as well as those found in the trusted directories,
+and any system-wide tunables listed in
+.IR /etc/tunables.conf .
 .PD
 .SH SEE ALSO
 .BR ldd (1),

Re: man/man8/ldconfig.8: document system-wide tunables

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 7147 bytes --]

Hi DJ,

On 2026-07-13T12:24:19-0400, DJ Delorie wrote:
> 
> How about this?

Please split into separate patches with commit messages, and send one
email per patch (the usual git-format-patch(1) + git-send-email(1) would
work).

> diff --git a/man/man5/ld.so.conf.5 b/man/man5/ld.so.conf.5
> index 481cf9152..aa27b73f6 100644
> --- a/man/man5/ld.so.conf.5
> +++ b/man/man5/ld.so.conf.5
> @@ -9,6 +9,14 @@ .SH DESCRIPTION
>  This file contains a list of directories,
>  one per line,
>  in which to search for libraries.

Let's start a new paragraph:

	.P

> +The file allows lines to start with the word
> +.I include
> +followed by a path wildcard,

What is a path wildcard?  We should specify it, since different programs
treat wildcards differently.  Is it a glob(7)?

> +and will include any files matching that wildcard.
> +The file is parsed by
> +.B \%ldconfig

.BR \%ldconfig (8)

> +and the results stored in
> +.IR /etc/ld.so.cache .
>  .SH FILES
>  .I /etc/ld.so.conf
>  .SH SEE ALSO
> diff --git a/man/man5/tunables.conf.5 b/man/man5/tunables.conf.5
> new file mode 100644
> index 000000000..d24eb0fa5
> --- /dev/null
> +++ b/man/man5/tunables.conf.5
> @@ -0,0 +1,86 @@
> +.TH tunables.conf 5 (date) "Linux man-pages (unreleased)"
> +.SH NAME
> +tunables.conf \- System-wide tunables configuration file

s/System/system/.  See man-pages(7):

     NAME   The name of this manual page.

            See man(7) for important details of the line(s) that should
            follow the .SH NAME command.  All words in this  line  (in‐
            cluding  the word immediately following the "\-") should be
            in lowercase, except where English or technical terminolog‐
            ical convention dictates otherwise.

However, I think 'system-wide' is unnecessary here: 'tunables
configuration file' should be enough.  By being in /etc/, it is known to
be system-wide.

> +.SH SYNOPSIS
> +.nf
> +.B /etc/tunables.conf
> +.fi
> +.SH DESCRIPTION
> +Each line in the file
> +.I /etc/tunables.conf
> +specifies a tunable,
> +which is a name and value separated by an equals sign.

	.P

> +For a list of valid tunables,
> +please consult the glibc manual.

	.P

> +The file allows lines to start with the word
> +.I include
> +followed by a path wildcard,
> +and will include any files matching that wildcard.

Again, a glob(7)?

And:
	.P

> +The file is parsed by
> +.B \%ldconfig

	.BR \%ldconfig (8)

> +and the results stored in
> +.IR /etc/ld.so.cache .
> +.P
> +Each line may include zero or more words or symbols at the beginning:
> +.TP
> +.B overridable
> +.TQ
> +.B +
> +Allow the tunable to be overridden by the environment variable
> +(this is the default).

Which environment variable?
Should we document an ENVIRONMENT section in ldconfig(8)?

> +.TP
> +.B nonoverridable
> +.TQ
> +.B \-
> +Do not allow the tunable to be overridden by the environment variable.
> +.TP
> +.B onlysecure
> +.TQ
> +.B @
> +The tunable only applies to AT_SECURE

	.B AT_SECURE

> +(such as setuid, or elevated capabilities)

Do you mean the system call setuid(2)?  Or a setuid program?

> +processes.
> +.TP
> +.B nonsecure
> +.TQ
> +.B $
> +The tunable only applies to non-AT_SECURE processes (this is the default).

	.RB non- AT_SECURE

> +.TP
> +.B anysecure
> +.TQ
> +.B *
> +The tunable only applies to both AT_SECURE and non-AT_SECURE processes.
> +.P
> +The file may also contain
> +.I filters ,

	.IR filters ,

> +which limit the tunables following it, up to the end of the file

Please break the line after the comma.

> +(or end of the included file, or start of a new included file)
> +or a line with only
> +.B []
> +on it.  The syntax is:

New sentence, new line.

> +.IP
> +.EX
> +.RI [ filter : pattern ]
> +.EE

You should indent this compared to the surrounding text:

	.IP
	.in +4n
	.EX
	.RI [ filter : pattern ]
	.EE
	.in

> +.TP
> +.B proc
> +The
> +.I proc
> +filter limits the following tunables to processes starting from the
> +file matching the pattern.

What do you mean by processes starting from the file?  Processes that
exec(3) the file and its children?

> +The file may be fully qualified or just the basename.

'fully qualified' isn't something we say of paths.  We should say an
absolute pathname.  Is it only absolute pathnames and basenames?  How
about relative pathnames?

> +.P
> +Example config file:
> +.IP
> +.EX
> +glibc.malloc.arenas_max=5
> +onlysecure glibc.malloc.arenas_max=1
> +-glibc.pthread.rseq=1

	\-

> +[proc:/bin/bad.program]
> +-glibc.pthread.rseq=0

	\-

> +.EE

Have a lovely night!
Alex

> +.SH FILES
> +.I /etc/ld.so.conf
> +.SH SEE ALSO
> +.BR ld.so (8),
> +.BR ldconfig (8)
> diff --git a/man/man8/ld.so.8 b/man/man8/ld.so.8
> index 5f3c22ef2..40f129b71 100644
> --- a/man/man8/ld.so.8
> +++ b/man/man8/ld.so.8
> @@ -792,7 +792,8 @@ .SH FILES
>  .TP
>  .I /etc/ld.so.cache
>  File containing a compiled list of directories in which to search for
> -shared objects and an ordered list of candidate shared objects.
> +shared objects and an ordered list of candidate shared objects,
> +and any system-wide tunables to be applied.
>  See
>  .BR ldconfig (8).
>  .TP
> diff --git a/man/man8/ldconfig.8 b/man/man8/ldconfig.8
> index 9ac146b44..234169504 100644
> --- a/man/man8/ldconfig.8
> +++ b/man/man8/ldconfig.8
> @@ -17,6 +17,8 @@ .SH SYNOPSIS
>  .IR conf ]
>  .RB [ \-r\~\c
>  .IR root ]
> +.RB [ \-t\~\c
> +.IR tunconf ]
>  .IR directory \~.\|.\|.
>  .YS
>  .SY /sbin/ldconfig
> @@ -85,6 +87,13 @@ .SH DESCRIPTION
>  .P
>  Failure to follow this pattern may result in compatibility issues
>  after an upgrade.
> +.P
> +If the file
> +.I /etc/tunables.conf
> +exists,
> +it contains tunables to be applied to all processes.
> +These tunables are stored
> +in the cache and applied to every process at its startup.
>  .SH OPTIONS
>  .TP
>  .BI \-\-format= fmt
> @@ -157,6 +166,12 @@ .SH OPTIONS
>  .I root
>  as the root directory.
>  .TP
> +.BI \-t\~ tunconf
> +Use
> +.I tunconf
> +instead of
> +.IR /etc/tunables.conf .
> +.TP
>  .B \-\-verbose
>  .TQ
>  .B \-v
> @@ -178,8 +193,6 @@ .SH OPTIONS
>  is also specified,
>  the cache is still rebuilt.
>  .SH FILES
> -.\" FIXME Since glibc-2.3.4, "include" directives are supported in ld.so.conf
> -.\"
>  .\" FIXME Since glibc-2.4, "hwcap" directives are supported in ld.so.conf
>  .PD 0
>  .TP
> @@ -190,11 +203,17 @@ .SH FILES
>  See
>  .BR ld.so.conf (5).
>  .TP
> +.I /etc/tunables.conf
> +See
> +.BR tunables.conf (5).
> +.TP
>  .I /etc/ld.so.cache
>  contains an ordered list of libraries found in the directories
>  specified in
>  .IR /etc/ld.so.conf ,
> -as well as those found in the trusted directories.
> +as well as those found in the trusted directories,
> +and any system-wide tunables listed in
> +.IR /etc/tunables.conf .
>  .PD
>  .SH SEE ALSO
>  .BR ldd (1),
> 
> 

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: man/man8/ldconfig.8: document system-wide tunables

[DJ Delorie]

Alejandro Colomar <alx@kernel.org> writes:
> Please split into separate patches with commit messages,

How do you want them split?  Per man page, or one for breaking out
ld.so.conf and one for adding tunables.conf?

Also, I've been using the output of "git show" for these patches.

> Let's start a new paragraph:
>
> 	.P

We still need a better language ;-) ("why doesn't it know to start a
paragraph after a heading?" ;)

>> +The file allows lines to start with the word
>> +.I include
>> +followed by a path wildcard,
>
> What is a path wildcard?  We should specify it, since different programs
> treat wildcards differently.  Is it a glob(7)?

.P
The syntax allows lines to start with the word
.I include
followed by a path wildcard,
and will include any files matching that wildcard.
The wildcard is a path specification in the
.BR \%glob (7)
format.
Files matching that wildcard will be processed
as if their contents were included in the main config file.

>> +and will include any files matching that wildcard.
>> +The file is parsed by
>> +.B \%ldconfig
>
> .BR \%ldconfig (8)

Fixed.

> However, I think 'system-wide' is unnecessary here: 'tunables
> configuration file' should be enough.  By being in /etc/, it is known to
> be system-wide.

Fixed.

>> +.SH SYNOPSIS
>> +.nf
>> +.B /etc/tunables.conf
>> +.fi
>> +.SH DESCRIPTION
>> +Each line in the file
>> +.I /etc/tunables.conf
>> +specifies a tunable,
>> +which is a name and value separated by an equals sign.
>
> 	.P

Fixed, but that's a lot of one-sentence paragraphs.

>> +.IR /etc/ld.so.cache .
>> +.P
>> +Each line may include zero or more words or symbols at the beginning:
>> +.TP
>> +.B overridable
>> +.TQ
>> +.B +
>> +Allow the tunable to be overridden by the environment variable
>> +(this is the default).
>
> Which environment variable?

Fixed.

> Should we document an ENVIRONMENT section in ldconfig(8)?

No, the environment variable is read at runtime, not by ldconfig.

>> +(such as setuid, or elevated capabilities)
>
> Do you mean the system call setuid(2)?  Or a setuid program?

a set-user-ID program.  Fixed.

>> +.IP
>> +.EX
>> +.RI [ filter : pattern ]
>> +.EE
>
> You should indent this compared to the surrounding text:
>
> 	.IP
> 	.in +4n

Isn't that what the .IP does ?

>> +filter limits the following tunables to processes starting from the
>> +file matching the pattern.
>
> What do you mean by processes starting from the file?  Processes that
> exec(3) the file and its children?

It actually means exactly what it says, but I admit it can be confusing.
When the dynamic linker creates a process, and uses the image in file
/file/ as the template, that new process is affected.

i.e.  If you type "/usr/bin/ls" and the filter is "/usr/bin/ls", that
new copy of /usr/bin/ls is affected.

>> +The file may be fully qualified or just the basename.
>
> 'fully qualified' isn't something we say of paths.  We should say an
> absolute pathname.  Is it only absolute pathnames and basenames?  How
> about relative pathnames?

No, for security and logical reasons, it cannot be a relative path.  So
you end up with "one specific version of XYZ" or "any version of XYZ".
No wildcards either.  It's intended for rare exceptions.

commit a9b49369175e67e07b556ec28cd2d9d5538c0fe6
Author: DJ Delorie <dj@redhat.com>
Date:   Mon Jul 13 17:30:56 2026 -0400

    man/man8/ldconfig.8: document system-wide tunables

diff --git a/man/man5/ld.so.conf.5 b/man/man5/ld.so.conf.5
index 481cf9152..9954c74bc 100644
--- a/man/man5/ld.so.conf.5
+++ b/man/man5/ld.so.conf.5
@@ -6,9 +6,36 @@ .SH SYNOPSIS
 .B /etc/ld.so.conf
 .fi
 .SH DESCRIPTION
+.P
 This file contains a list of directories,
 one per line,
 in which to search for libraries.
+.P
+The file
+(and any other files included by it)
+is parsed by
+.B \%ldconfig
+and the results stored in
+.IR /etc/ld.so.cache .
+.P
+The syntax allows lines to start with the word
+.I include
+followed by a path wildcard,
+and will include any files matching that wildcard.
+The wildcard is a path specification in the
+.BR \%glob (7)
+format.
+Files matching that wildcard will be processed
+as if their contents were included in the main config file.
+.P
+Example config file:
+.IP
+.EX
+/lib
+/usr/lib
+/usr/local/lib
+include /etc/ld.so.conf.d/*.conf
+.EE
 .SH FILES
 .I /etc/ld.so.conf
 .SH SEE ALSO
diff --git a/man/man5/tunables.conf.5 b/man/man5/tunables.conf.5
new file mode 100644
index 000000000..b983a2bfe
--- /dev/null
+++ b/man/man5/tunables.conf.5
@@ -0,0 +1,112 @@
+.TH tunables.conf 5 (date) "Linux man-pages (unreleased)"
+.SH NAME
+tunables.conf \- tunables configuration file
+.SH SYNOPSIS
+.nf
+.B /etc/tunables.conf
+.fi
+.SH DESCRIPTION
+Each line in the file
+.I /etc/tunables.conf
+specifies a tunable,
+which is a name and value separated by an equals sign.
+.P
+For a list of valid tunables,
+please consult the glibc manual.
+.P
+The syntax allows lines to start with the word
+.I include
+followed by a path wildcard,
+and will include any files matching that wildcard.
+The wildcard is a path specification in the
+.BR \%glob (7)
+format.
+Files matching that wildcard will be processed
+as if their contents were included in the main config file.
+.P
+The file is parsed by
+.BR \%ldconfig (8)
+and the results stored in
+.IR /etc/ld.so.cache .
+The resulting data is read when a new process starts.
+.P
+Each line may include zero or more words or symbols at the beginning,
+which affect how each tunable affects each processes:
+.TP
+.B overridable
+.TQ
+.B +
+Allow the tunable to be overridden by the
+.B GLIBC_TUNABLES
+environment variable when the process runs
+(this is the default).
+.TP
+.B nonoverridable
+.TQ
+.B \-
+Do not allow the tunable to be overridden by the environment variable.
+.TP
+.B onlysecure
+.TQ
+.B @
+The tunable only applies to
+.B AT_SECURE
+processes,
+such as a set-user-ID process,
+or one with elevated capabilities.
+.TP
+.B nonsecure
+.TQ
+.B $
+The tunable only applies to
+.RB non- AT_SECURE
+processes (this is the default).
+.TP
+.B anysecure
+.TQ
+.B *
+The tunable only applies to both
+.B AT_SECURE
+and
+.RB non- AT_SECURE
+processes.
+.P
+The file may also contain
+.IR filters ,
+which limit the tunables following it,
+up to the end of the file
+(or end of the included file,
+or start of a new included file)
+or a line with only
+.B []
+on it.
+The syntax is:
+.IP
+.EX
+.RI [ filter : pattern ]
+.EE
+.TP
+.B proc
+The
+.I proc
+filter limits the following tunables to processes
+whose name matches the pattern.
+The pattern may be an absolute path
+or just the base name.
+.P
+Example config file:
+.IP
+.EX
+glibc.malloc.arenas_max=5
+onlysecure glibc.malloc.arenas_max=1
+\-glibc.pthread.rseq=1
+[proc:/bin/bad.program]
+\-glibc.pthread.rseq=0
+[proc:some.program]
+\-glibc.malloc.mmap_threshold=65536
+.EE
+.SH FILES
+.I /etc/ld.so.conf
+.SH SEE ALSO
+.BR ld.so (8),
+.BR ldconfig (8)
diff --git a/man/man8/ld.so.8 b/man/man8/ld.so.8
index 5f3c22ef2..40f129b71 100644
--- a/man/man8/ld.so.8
+++ b/man/man8/ld.so.8
@@ -792,7 +792,8 @@ .SH FILES
 .TP
 .I /etc/ld.so.cache
 File containing a compiled list of directories in which to search for
-shared objects and an ordered list of candidate shared objects.
+shared objects and an ordered list of candidate shared objects,
+and any system-wide tunables to be applied.
 See
 .BR ldconfig (8).
 .TP
diff --git a/man/man8/ldconfig.8 b/man/man8/ldconfig.8
index 9ac146b44..234169504 100644
--- a/man/man8/ldconfig.8
+++ b/man/man8/ldconfig.8
@@ -17,6 +17,8 @@ .SH SYNOPSIS
 .IR conf ]
 .RB [ \-r\~\c
 .IR root ]
+.RB [ \-t\~\c
+.IR tunconf ]
 .IR directory \~.\|.\|.
 .YS
 .SY /sbin/ldconfig
@@ -85,6 +87,13 @@ .SH DESCRIPTION
 .P
 Failure to follow this pattern may result in compatibility issues
 after an upgrade.
+.P
+If the file
+.I /etc/tunables.conf
+exists,
+it contains tunables to be applied to all processes.
+These tunables are stored
+in the cache and applied to every process at its startup.
 .SH OPTIONS
 .TP
 .BI \-\-format= fmt
@@ -157,6 +166,12 @@ .SH OPTIONS
 .I root
 as the root directory.
 .TP
+.BI \-t\~ tunconf
+Use
+.I tunconf
+instead of
+.IR /etc/tunables.conf .
+.TP
 .B \-\-verbose
 .TQ
 .B \-v
@@ -178,8 +193,6 @@ .SH OPTIONS
 is also specified,
 the cache is still rebuilt.
 .SH FILES
-.\" FIXME Since glibc-2.3.4, "include" directives are supported in ld.so.conf
-.\"
 .\" FIXME Since glibc-2.4, "hwcap" directives are supported in ld.so.conf
 .PD 0
 .TP
@@ -190,11 +203,17 @@ .SH FILES
 See
 .BR ld.so.conf (5).
 .TP
+.I /etc/tunables.conf
+See
+.BR tunables.conf (5).
+.TP
 .I /etc/ld.so.cache
 contains an ordered list of libraries found in the directories
 specified in
 .IR /etc/ld.so.conf ,
-as well as those found in the trusted directories.
+as well as those found in the trusted directories,
+and any system-wide tunables listed in
+.IR /etc/tunables.conf .
 .PD
 .SH SEE ALSO
 .BR ldd (1),

Re: man/man8/ldconfig.8: document system-wide tunables

[G. Branden Robinson]

[-- Attachment #1: Type: text/plain, Size: 1933 bytes --]

At 2026-07-13T17:33:05-0400, DJ Delorie wrote:
> Alejandro Colomar <alx@kernel.org> writes:
> > Please split into separate patches with commit messages,
> 
> How do you want them split?  Per man page, or one for breaking out
> ld.so.conf and one for adding tunables.conf?
> 
> Also, I've been using the output of "git show" for these patches.
> 
> > Let's start a new paragraph:
> >
> > 	.P
> 
> We still need a better language ;-) ("why doesn't it know to start a
> paragraph after a heading?" ;)

It does.

groff_man(7):

     .SH [heading‐text]
            Set heading‐text as a section heading.  Given no argument,
            SH plants a one‐line input trap; text on the next line
            becomes heading‐text.  The heading text is set in bold (or
            the font specified by the string HF), and, on typesetters,
            slightly larger than the base type size.  If the heading
            font \*[HF] is bold, use of an italic style in heading‐text
            is mapped to the bold‐italic style if available in the font
            family.  The inset level is reset to 1; see subsection
            “Horizontal and vertical spacing” below.  Text lines after
                                                      ^^^^^^^^^^^^^^^^
            the call are set as an ordinary paragraph (P).
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

> > You should indent this compared to the surrounding text:
> >
> > 	.IP
> > 	.in +4n
> 
> Isn't that what the .IP does ?

There were difficulties, some imposed by the previous Linux man-pages
maintainer, Michael Kerrisk.

https://lore.kernel.org/linux-man/a79fc055-c7ab-1793-04eb-eb4f678e5035@gmail.com/

The better language that doesn't yet exist would, of course, solve all
of everyone's problems at once, even the problems that are mutually
exclude each other's solutions.

Regards,
Branden

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: man/man8/ldconfig.8: document system-wide tunables

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 14872 bytes --]

Hi DJ,

On 2026-07-13T17:33:05-0400, DJ Delorie wrote:
> Alejandro Colomar <alx@kernel.org> writes:
> > Please split into separate patches with commit messages,
> 
> How do you want them split?  Per man page, or one for breaking out
> ld.so.conf and one for adding tunables.conf?

One per logical change.

The documentation of tunables is one logical change, even if it covers
several pages.

The documentation of an include directive in ld.so.conf(5) is a separate
logical change.

I think the -t flag of ldconfig(8) could be considered a separate change
too.

> 
> Also, I've been using the output of "git show" for these patches.

I suggest using git-format-patch(1).  It's very similar to git-show(1),
except that it can then be applied on my side with git-am(1).

git-format-patch(1) is best paired with git-send-email(1), but if that's
too inconvenient for you, you can paste it as if it were the output of
git-show(1).  For that, you may want to use the --stdout flag of
git-format-patch(1).

> > Let's start a new paragraph:
> >
> > 	.P
> 
> We still need a better language ;-)

I actually like it for its simplicity.  Once you learn the few macros,
there's not much more that you need to learn.

> ("why doesn't it know to start a
> paragraph after a heading?" ;)

There's no heading (what do you consider a heading?).  It was just a
new line after period.

Actually, after a heading (a section heading is .SH) it knows to start
a new paragraph:

	.SH DESCRIPTION
	First paragraph.
	No need for '.P' before this.
	.P
	Second paragraph.

But that text was:

	@@ -9,6 +9,14 @@ .SH DESCRIPTION
	 This file contains a list of directories,
	 one per line,
	 in which to search for libraries.
	+The file allows lines to start with the word
	+.I include
	+followed by a path wildcard,
	+and will include any files matching that wildcard.

So we need a .P because there's just text there (no headings).

> >> +The file allows lines to start with the word
> >> +.I include
> >> +followed by a path wildcard,
> >
> > What is a path wildcard?  We should specify it, since different programs
> > treat wildcards differently.  Is it a glob(7)?
> 
> .P
> The syntax allows lines to start with the word
> .I include
> followed by a path wildcard,
> and will include any files matching that wildcard.
> The wildcard is a path specification in the
> .BR \%glob (7)
> format.

'wildcard' is a technical term referring to a specific pattern (a string
containing '?', '*', or '[') in glob(7).  I suggest using 'glob(7)
pattern' instead.  How about this?:

	The syntax allows lines to start with the keyword
	.B include
	followed by a pathname
	.BR glob (7)
	pattern.

> Files matching that wildcard will be processed

And then
	Files matching that pattern will be processed

> as if their contents were included in the main config file.
> 
> >> +and will include any files matching that wildcard.
> >> +The file is parsed by
> >> +.B \%ldconfig
> >
> > .BR \%ldconfig (8)
> 
> Fixed.
> 
> > However, I think 'system-wide' is unnecessary here: 'tunables
> > configuration file' should be enough.  By being in /etc/, it is known to
> > be system-wide.
> 
> Fixed.
> 
> >> +.SH SYNOPSIS
> >> +.nf
> >> +.B /etc/tunables.conf
> >> +.fi
> >> +.SH DESCRIPTION
> >> +Each line in the file
> >> +.I /etc/tunables.conf
> >> +specifies a tunable,
> >> +which is a name and value separated by an equals sign.
> >
> > 	.P
> 
> Fixed, but that's a lot of one-sentence paragraphs.

Given they are about different topics, that's fine.  Especially, since
the page is small.  Eyes will be able to find the information they want
easily, skipping paragraphs that are not interesting.  Otherwise, the
brain must parse the entire paragraph, looking for the sentence that is
interesting.

> >> +.IR /etc/ld.so.cache .
> >> +.P
> >> +Each line may include zero or more words or symbols at the beginning:
> >> +.TP
> >> +.B overridable
> >> +.TQ
> >> +.B +
> >> +Allow the tunable to be overridden by the environment variable
> >> +(this is the default).
> >
> > Which environment variable?
> 
> Fixed.
> 
> > Should we document an ENVIRONMENT section in ldconfig(8)?
> 
> No, the environment variable is read at runtime, not by ldconfig.

Then maybe document this environment vairable in ld.so(8) (which already
has an ENVIRONMENT section)?

> >> +(such as setuid, or elevated capabilities)
> >
> > Do you mean the system call setuid(2)?  Or a setuid program?
> 
> a set-user-ID program.  Fixed.
> 
> >> +.IP
> >> +.EX
> >> +.RI [ filter : pattern ]
> >> +.EE
> >
> > You should indent this compared to the surrounding text:
> >
> > 	.IP
> > 	.in +4n
> 
> Isn't that what the .IP does ?

Oh, sorry, I misread the context.  So, you're already outside of the
tagged paragraph, and back in the non-indented text.  Then, we want:

	.P
	.in +4n
	...
	.in

The reason we use .in instead of .IP is to have a consistent indentation
level that can be applied independent of whether we're in a P or IP
paragraph (sometimes we want P, and sometimes IP; whatever the context
uses).

> >> +filter limits the following tunables to processes starting from the
> >> +file matching the pattern.
> >
> > What do you mean by processes starting from the file?  Processes that
> > exec(3) the file and its children?
> 
> It actually means exactly what it says, but I admit it can be confusing.
> When the dynamic linker creates a process, and uses the image in file
> /file/ as the template, that new process is affected.
> 
> i.e.  If you type "/usr/bin/ls" and the filter is "/usr/bin/ls", that

"type" isn't very specific.  The shell first forks, which I guess isn't
important, and then that file is exec(3)'d, which (I guess) is what
triggers all this?

> new copy of /usr/bin/ls is affected.

Hmm.

> >> +The file may be fully qualified or just the basename.
> >
> > 'fully qualified' isn't something we say of paths.  We should say an
> > absolute pathname.  Is it only absolute pathnames and basenames?  How
> > about relative pathnames?
> 
> No, for security and logical reasons, it cannot be a relative path.  So
> you end up with "one specific version of XYZ" or "any version of XYZ".
> No wildcards either.  It's intended for rare exceptions.

Ok.  Then basename or absolute pathname, I think.

> 
> commit a9b49369175e67e07b556ec28cd2d9d5538c0fe6
> Author: DJ Delorie <dj@redhat.com>
> Date:   Mon Jul 13 17:30:56 2026 -0400
> 
>     man/man8/ldconfig.8: document system-wide tunables
> 
> diff --git a/man/man5/ld.so.conf.5 b/man/man5/ld.so.conf.5
> index 481cf9152..9954c74bc 100644
> --- a/man/man5/ld.so.conf.5
> +++ b/man/man5/ld.so.conf.5
> @@ -6,9 +6,36 @@ .SH SYNOPSIS
>  .B /etc/ld.so.conf
>  .fi
>  .SH DESCRIPTION
> +.P
>  This file contains a list of directories,
>  one per line,
>  in which to search for libraries.
> +.P
> +The file
> +(and any other files included by it)
> +is parsed by
> +.B \%ldconfig
> +and the results stored in
> +.IR /etc/ld.so.cache .
> +.P
> +The syntax allows lines to start with the word
> +.I include
> +followed by a path wildcard,
> +and will include any files matching that wildcard.
> +The wildcard is a path specification in the
> +.BR \%glob (7)
> +format.
> +Files matching that wildcard will be processed
> +as if their contents were included in the main config file.
> +.P
> +Example config file:

I think the example should go in an EXAMPLES section after FILES and
before SEE ALSO.  (See man-pages(7) for the order of sections.)

> +.IP
> +.EX
> +/lib
> +/usr/lib
> +/usr/local/lib
> +include /etc/ld.so.conf.d/*.conf
> +.EE
>  .SH FILES
>  .I /etc/ld.so.conf

	.SH
	Example configuration file:
	.P
	.in +4n
	.EX
	/lib
	/usr/lib
	/usr/local/lib
	include /etc/ld.so.conf.d/*.conf
	.EE
	.in

>  .SH SEE ALSO
> diff --git a/man/man5/tunables.conf.5 b/man/man5/tunables.conf.5
> new file mode 100644
> index 000000000..b983a2bfe
> --- /dev/null
> +++ b/man/man5/tunables.conf.5
> @@ -0,0 +1,112 @@
> +.TH tunables.conf 5 (date) "Linux man-pages (unreleased)"
> +.SH NAME
> +tunables.conf \- tunables configuration file
> +.SH SYNOPSIS
> +.nf
> +.B /etc/tunables.conf
> +.fi
> +.SH DESCRIPTION
> +Each line in the file
> +.I /etc/tunables.conf
> +specifies a tunable,

Maybe we can say it more visually:

	which is a string of the form
	.IB name = value \f[R].\f[]

> +which is a name and value separated by an equals sign.
> +.P
> +For a list of valid tunables,
> +please consult the glibc manual.

Any specific link?

> +.P
> +The syntax allows lines to start with the word
> +.I include
> +followed by a path wildcard,

	followed by a path glob(7) pattern,

> +and will include any files matching that wildcard.

The line above seems redundant with the sentence 'Files matching ...'.
I'd remove this line, as the other seems more specific.

> +The wildcard is a path specification in the
> +.BR \%glob (7)
> +format.

And then remove the sentence above.

> +Files matching that wildcard will be processed
> +as if their contents were included in the main config file.

s/wildcard/pattern/

> +.P
> +The file is parsed by
> +.BR \%ldconfig (8)
> +and the results stored in
> +.IR /etc/ld.so.cache .
> +The resulting data is read when a new process starts.

Is this accurate?  New processes start with fork(1), but it's when they
exec(1) that the actual file that they run is loaded.

> +.P
> +Each line may include zero or more words or symbols at the beginning,

s/include/be preceded by/?

Also, maybe s/words/keywords/?

Also, is white space important after a symbol?  Is it optional,
mandatory, or forbidden?

> +which affect how each tunable affects each processes:
> +.TP
> +.B overridable
> +.TQ
> +.B +
> +Allow the tunable to be overridden by the
> +.B GLIBC_TUNABLES
> +environment variable when the process runs
> +(this is the default).
> +.TP
> +.B nonoverridable
> +.TQ
> +.B \-
> +Do not allow the tunable to be overridden by the environment variable.

	the
	.B GLIBC_TUNABLES
	environment variable.

> +.TP
> +.B onlysecure
> +.TQ
> +.B @
> +The tunable only applies to

s/only applies/applies only/

> +.B AT_SECURE
> +processes,

Is it really processes or programs?  

> +such as a set-user-ID process,

Same here.  Set-user-ID is a property of a program, not of a process,
I believe.  In fact, no ocurrences of set-user-ID in the manual pages
are followed by 'process', and 10 are followed by 'program':

	$ grep -ro set-user-ID.pro.... 
	man3/getlogin.3:set-user-ID program
	man3/realpath.3:set-user-ID program
	man7/pthreads.7:set-user-ID program
	man7/user_namespaces.7:set-user-ID program
	man7/credentials.7:set-user-ID program
	man7/capabilities.7:set-user-ID program
	man7/keyrings.7:set-user-ID program
	man2/access.2:set-user-ID program
	man2/access.2:set-user-ID program
	man2/execve.2:set-user-ID program

> +or one with elevated capabilities.
> +.TP
> +.B nonsecure
> +.TQ
> +.B $
> +The tunable only applies to
> +.RB non- AT_SECURE
> +processes (this is the default).
> +.TP
> +.B anysecure
> +.TQ
> +.B *
> +The tunable only applies to both
> +.B AT_SECURE
> +and
> +.RB non- AT_SECURE
> +processes.
> +.P
> +The file may also contain
> +.IR filters ,
> +which limit the tunables following it,
> +up to the end of the file
> +(or end of the included file,
> +or start of a new included file)
> +or a line with only
> +.B []
> +on it.
> +The syntax is:
> +.IP

	.P
	.in +4n

> +.EX
> +.RI [ filter : pattern ]
> +.EE

	.in

> +.TP
> +.B proc
> +The
> +.I proc

Since it's a literal value:

	.B proc

> +filter limits the following tunables to processes
> +whose name matches the pattern.
> +The pattern may be an absolute path
> +or just the base name.
> +.P
> +Example config file:
> +.IP
> +.EX
> +glibc.malloc.arenas_max=5
> +onlysecure glibc.malloc.arenas_max=1
> +\-glibc.pthread.rseq=1
> +[proc:/bin/bad.program]
> +\-glibc.pthread.rseq=0
> +[proc:some.program]
> +\-glibc.malloc.mmap_threshold=65536
> +.EE

The example should go to EXAMPLES after FILES.

> +.SH FILES
> +.I /etc/ld.so.conf

	.SH EXAMPLES
	Example configuration file:
	.P
	.in +4n
	.EX
	...
	.EE


Have a lovely night!
Alex

> +.SH SEE ALSO
> +.BR ld.so (8),
> +.BR ldconfig (8)
> diff --git a/man/man8/ld.so.8 b/man/man8/ld.so.8
> index 5f3c22ef2..40f129b71 100644
> --- a/man/man8/ld.so.8
> +++ b/man/man8/ld.so.8
> @@ -792,7 +792,8 @@ .SH FILES
>  .TP
>  .I /etc/ld.so.cache
>  File containing a compiled list of directories in which to search for
> -shared objects and an ordered list of candidate shared objects.
> +shared objects and an ordered list of candidate shared objects,
> +and any system-wide tunables to be applied.
>  See
>  .BR ldconfig (8).
>  .TP
> diff --git a/man/man8/ldconfig.8 b/man/man8/ldconfig.8
> index 9ac146b44..234169504 100644
> --- a/man/man8/ldconfig.8
> +++ b/man/man8/ldconfig.8
> @@ -17,6 +17,8 @@ .SH SYNOPSIS
>  .IR conf ]
>  .RB [ \-r\~\c
>  .IR root ]
> +.RB [ \-t\~\c
> +.IR tunconf ]
>  .IR directory \~.\|.\|.
>  .YS
>  .SY /sbin/ldconfig
> @@ -85,6 +87,13 @@ .SH DESCRIPTION
>  .P
>  Failure to follow this pattern may result in compatibility issues
>  after an upgrade.
> +.P
> +If the file
> +.I /etc/tunables.conf
> +exists,
> +it contains tunables to be applied to all processes.
> +These tunables are stored
> +in the cache and applied to every process at its startup.
>  .SH OPTIONS
>  .TP
>  .BI \-\-format= fmt
> @@ -157,6 +166,12 @@ .SH OPTIONS
>  .I root
>  as the root directory.
>  .TP
> +.BI \-t\~ tunconf
> +Use
> +.I tunconf
> +instead of
> +.IR /etc/tunables.conf .
> +.TP
>  .B \-\-verbose
>  .TQ
>  .B \-v
> @@ -178,8 +193,6 @@ .SH OPTIONS
>  is also specified,
>  the cache is still rebuilt.
>  .SH FILES
> -.\" FIXME Since glibc-2.3.4, "include" directives are supported in ld.so.conf
> -.\"
>  .\" FIXME Since glibc-2.4, "hwcap" directives are supported in ld.so.conf
>  .PD 0
>  .TP
> @@ -190,11 +203,17 @@ .SH FILES
>  See
>  .BR ld.so.conf (5).
>  .TP
> +.I /etc/tunables.conf
> +See
> +.BR tunables.conf (5).
> +.TP
>  .I /etc/ld.so.cache
>  contains an ordered list of libraries found in the directories
>  specified in
>  .IR /etc/ld.so.conf ,
> -as well as those found in the trusted directories.
> +as well as those found in the trusted directories,
> +and any system-wide tunables listed in
> +.IR /etc/tunables.conf .
>  .PD
>  .SH SEE ALSO
>  .BR ldd (1),
> 

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: man/man8/ldconfig.8: document system-wide tunables

[G. Branden Robinson]

[-- Attachment #1: Type: text/plain, Size: 1629 bytes --]

[self-follow-up]

At 2026-07-13T17:22:37-0500, G. Branden Robinson wrote:
> At 2026-07-13T17:33:05-0400, DJ Delorie wrote:
> > Alejandro Colomar <alx@kernel.org> writes:
> > > You should indent this compared to the surrounding text:
> > >
> > > 	.IP
> > > 	.in +4n
> > 
> > Isn't that what the .IP does ?
> 
> There were difficulties, some imposed by the previous Linux man-pages
> maintainer, Michael Kerrisk.

I worded that sentence like crap, and threw shade on Michael when I
didn't mean to.  There was a very pretty _constraint problem_ that
Michael posed to me--one I was unable to solve.  Sorry, Michael!

I sympathize with the problem, and don't often endorse "punching through
the floor" to employ "raw" *roff requests in a man(7) document, but this
was an exception.  The Linux man-pages corpus is huge; Michael then and
Alex now have a large management challenge, so it's reasonable to
facilitate shuffling EX/EE examples from place to place in that corpus
with simple copy-and-paste operations.

> https://lore.kernel.org/linux-man/a79fc055-c7ab-1793-04eb-eb4f678e5035@gmail.com/

That link remains a good précis of the problem.  One could show up my
man(7) composition abilities and earn my gratitude by solving that
constraint problem using only macros from the package.  :)

Alternatively, if I think of a backward-compatible extension I can add
to groff man(7) that would eliminate the need for these `in` requests,
I'd likely implement it.  I welcome design suggestions!

I should not send mails after a 12-hour session preparing a release
candidate...

Regards,
Branden

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]