On Mon, Apr 11, 2016 at 10:58:06AM -0500, Eric Paris wrote: > Just an FYI originally the idea was to follow the pattern of logging > set by core dumps see kernel/auditsc.c::audit_core_dumps(). Which is > gated by audit_enable but not anything else. I believe at that time the > only option was kill, which meant, much like the core dumper, spam was > not a likely result given the initiator is killed.
Given that user space now uses audit independently for its own logging I don't think making things depend only on audit_enable is good practice anymore. > > I'm all for a way to shut up unsolicited audit messages, especially > seccomp with errno or trap. I think it would be best to default 'KILL' > to on and everything else to off. I'm no so sure a sysctl is the right > way though. Enabling more forms of 'seccomp audit' should really be a > part of the audit policy. That was my original patch -- make it conditional on syscall auditing. If that's the right approach please apply that one. -Andi
