Re: [PATCH] audit: Don't spam logs with SECCOMP_KILL/RET_ERRNO by default

From	Andi Kleen <andi@firstfloor.org>
Newsgroups	linux.kernel
Subject	Re: [PATCH] audit: Don't spam logs with SECCOMP_KILL/RET_ERRNO by default
Date	2016-04-12 00:00 +0200
Message-ID	<rmS2e-4ac-11@gated-at.bofh.it> (permalink)
References	<rmBup-8cM-1@gated-at.bofh.it> <rmKel-6GA-5@gated-at.bofh.it> <rmMpQ-8jk-37@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Mon, Apr 11, 2016 at 10:58:06AM -0500, Eric Paris wrote:
> Just an FYI originally the idea was to follow the pattern of logging
> set by core dumps see kernel/auditsc.c::audit_core_dumps(). Which is
> gated by audit_enable but not anything else. I believe at that time the
> only option was kill, which meant, much like the core dumper, spam was
> not a likely result given the initiator is killed.

Given that user space now uses audit independently for its own
logging I don't think making things depend only on audit_enable
is good practice anymore.

> 
> I'm all for a way to shut up unsolicited audit messages, especially
> seccomp with errno or trap. I think it would be best to default 'KILL'
> to on and everything else to off. I'm no so sure a sysctl is the right
> way though. Enabling more forms of 'seccomp audit' should really be a
> part of the audit policy.

That was my original patch -- make it conditional on syscall auditing.

If that's the right approach please apply that one.

-Andi

Thread

[PATCH] audit: Don't spam logs with SECCOMP_KILL/RET_ERRNO by default Andi Kleen <andi@firstfloor.org> - 2016-04-11 06:20 +0200
  Re: [PATCH] audit: Don't spam logs with SECCOMP_KILL/RET_ERRNO by default Paul Moore <paul@paul-moore.com> - 2016-04-11 15:40 +0200
    Re: [PATCH] audit: Don't spam logs with SECCOMP_KILL/RET_ERRNO by  default Eric Paris <eparis@redhat.com> - 2016-04-11 18:00 +0200
      Re: [PATCH] audit: Don't spam logs with SECCOMP_KILL/RET_ERRNO by  default Andi Kleen <andi@firstfloor.org> - 2016-04-12 00:00 +0200
      Re: [PATCH] audit: Don't spam logs with SECCOMP_KILL/RET_ERRNO by default Paul Moore <paul@paul-moore.com> - 2016-04-12 03:20 +0200

csiph-web