Re: [PATCH v2 3/4] seccomp: Audit attempts to modify the actions_logged sysctl

James Morris
2018-05-02T21:17:37Z

On Wed, 2 May 2018, Tyler Hicks wrote:

> type=CONFIG_CHANGE msg=audit(1525275325.613:142): op=seccomp-logging
> actions=kill_process,kill_thread,errno,trace,log
> old-actions=kill_process,kill_thread,errno,trace,log res=1
>
> No audit records are generated when reading the actions_logged sysctl.
>
> Suggested-by: Steve Grubb <sgrubb@redhat.com>
> Signed-off-by: Tyler Hicks <tyhicks@canonical.com>

Reviewed-by: James Morris <james.morris@microsoft.com>

--
James Morris
<jmorris@namei.org>