Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1572896

[PATCH v2 0/4] Improved seccomp logging

Show all headers | View raw

This patch set is the second revision of the following two previously
submitted patch sets:

http://lkml.kernel.org/r/1483375990-14948-1-git-send-email-tyhicks@canonical.com
http://lkml.kernel.org/r/1483377999-15019-2-git-send-email-tyhicks@canonical.com

The patch set aims to address some known deficiencies in seccomp's current
logging capabilities:

  1. Inability to log all filter actions.
  2. Inability to selectively enable filtering; e.g. devs want noisy logging,
     users want relative quiet.
  3. Consistent behavior with audit enabled and disabled.
  4. Inability to easily develop a filter due to the lack of a
     permissive/complain mode.

The first three items were outlined by Paul Moore and are issues that I agree
with. The last one is one that I'm particularly interested in.

I deviated a little from the plan that he laid out to address the third issue.
Looking back at Paul's feedback, he wanted a way to log seccomp actions even
when the audit subsystem is disabled at build time. I felt like the bigger
problem is that, while it is common for kernels to be built with audit support,
it is far less common to actually have auditd running. Therefore, my approach
was to improve the situation when kernel audit support is enabled at build time
but audit_enabled is false at runtime. The audit subsystem forwards messages
onto syslog in that situation.

Tyler

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH v2 0/4] Improved seccomp logging Tyler Hicks <tyhicks@canonical.com> - 2017-02-03 06:40 +0100
  [PATCH v2 3/4] seccomp: Create an action to log before allowing Tyler Hicks <tyhicks@canonical.com> - 2017-02-03 06:40 +0100
    Re: [PATCH v2 3/4] seccomp: Create an action to log before allowing Kees Cook <keescook@chromium.org> - 2017-02-08 01:40 +0100
      Re: [PATCH v2 3/4] seccomp: Create an action to log before allowing Kees Cook <keescook@chromium.org> - 2017-02-09 23:00 +0100
      Re: [PATCH v2 3/4] seccomp: Create an action to log before allowing Kees Cook <keescook@chromium.org> - 2017-02-11 01:20 +0100
        Re: [PATCH v2 3/4] seccomp: Create an action to log before allowing Tyler Hicks <tyhicks@canonical.com> - 2017-02-11 01:20 +0100
      Re: [PATCH v2 3/4] seccomp: Create an action to log before allowing Tyler Hicks <tyhicks@canonical.com> - 2017-02-11 01:20 +0100
  [PATCH v2 2/4] seccomp: Add sysctl to configure actions that should be logged Tyler Hicks <tyhicks@canonical.com> - 2017-02-03 06:40 +0100
    Re: [PATCH v2 2/4] seccomp: Add sysctl to configure actions that  should be logged Kees Cook <keescook@chromium.org> - 2017-02-08 01:40 +0100
      Re: [PATCH v2 2/4] seccomp: Add sysctl to configure actions that  should be logged Tyler Hicks <tyhicks@canonical.com> - 2017-02-11 01:00 +0100
        Re: [PATCH v2 2/4] seccomp: Add sysctl to configure actions that  should be logged Kees Cook <keescook@chromium.org> - 2017-02-11 01:10 +0100
  [PATCH v2 1/4] seccomp: Add sysctl to display available actions Tyler Hicks <tyhicks@canonical.com> - 2017-02-03 06:40 +0100
    Re: [PATCH v2 1/4] seccomp: Add sysctl to display available actions Kees Cook <keescook@chromium.org> - 2017-02-08 01:10 +0100
      Re: [PATCH v2 1/4] seccomp: Add sysctl to display available actions Tyler Hicks <tyhicks@canonical.com> - 2017-02-08 01:50 +0100
        Re: [PATCH v2 1/4] seccomp: Add sysctl to display available actions Kees Cook <keescook@chromium.org> - 2017-02-08 01:50 +0100
  [PATCH v2 4/4] seccomp: Add tests for SECCOMP_RET_LOG Tyler Hicks <tyhicks@canonical.com> - 2017-02-03 06:40 +0100
    Re: [PATCH v2 4/4] seccomp: Add tests for SECCOMP_RET_LOG Kees Cook <keescook@chromium.org> - 2017-02-08 01:50 +0100
  Re: [PATCH v2 0/4] Improved seccomp logging Kees Cook <keescook@chromium.org> - 2017-02-08 01:00 +0100

csiph-web