Re: [PATCH v2 4/4] seccomp: Don't special case audited processes when logging

2018-05-02 Thread Paul Moore
On Wed, May 2, 2018 at 12:57 PM, Kees Cook wrote: > On Wed, May 2, 2018 at 8:53 AM, Tyler Hicks wrote: >> diff --git a/kernel/seccomp.c b/kernel/seccomp.c >> index da78835..9029d9d 100644 >> --- a/kernel/seccomp.c >> +++ b/kernel/seccomp.c >> @@ -584,18 +584,13 @@ static inline void seccomp_log(u

Re: [PATCH v2 4/4] seccomp: Don't special case audited processes when logging

2018-05-02 Thread Kees Cook
On Wed, May 2, 2018 at 8:53 AM, Tyler Hicks wrote: > diff --git a/kernel/seccomp.c b/kernel/seccomp.c > index da78835..9029d9d 100644 > --- a/kernel/seccomp.c > +++ b/kernel/seccomp.c > @@ -584,18 +584,13 @@ static inline void seccomp_log(unsigned long syscall, > long signr, u32 action, >

[PATCH v2 4/4] seccomp: Don't special case audited processes when logging

2018-05-02 Thread Tyler Hicks
Seccomp logging for "handled" actions such as RET_TRAP, RET_TRACE, or RET_ERRNO can be very noisy for processes that are being audited. This patch modifies the seccomp logging behavior to treat processes that are being inspected via the audit subsystem the same as processes that aren't under inspec