From: Richard Guy Briggs <rgb@redhat.com>
To: Andy Lutomirski <luto@amacapital.net>
Cc: linux-audit@redhat.com,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: Should audit_seccomp check audit_enabled?
Date: Fri, 23 Oct 2015 15:13:01 -0400 [thread overview]
Message-ID: <20151023191301.GD1577@madcap2.tricolour.ca> (raw)
In-Reply-To: <CALCETrWM2_6OmVK6oZGtZpyFY0gAkLN4uadKdZ+zqvW6T_M58w@mail.gmail.com>
On 15/10/23, Andy Lutomirski wrote:
> I would argue that, if auditing is off, audit_seccomp shouldn't do
> anything. After all, unlike e.g. selinux, seccomp is not a systemwide
> policy, and seccomp signals might be ordinary behavior that's internal
> to the seccomp-using application. IOW, for people with audit compiled
> in and subscribed by journald but switched off, I think that the
> records shouldn't be emitted.
>
> If you agree, I can send the two-line patch.
This sounds reasonable to me. It isn't an AVC. Steve? Paul?
> --Andy
- RGB
--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
prev parent reply other threads:[~2015-10-23 19:13 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-10-23 16:19 Should audit_seccomp check audit_enabled? Andy Lutomirski
2015-10-23 17:01 ` Kees Cook
2015-10-23 19:38 ` Paul Moore
2015-10-23 20:51 ` Steve Grubb
2015-10-23 20:58 ` Paul Moore
2015-10-23 21:08 ` Andy Lutomirski
2015-10-23 21:07 ` Andy Lutomirski
2015-10-23 21:22 ` Kees Cook
2015-10-23 21:24 ` Andy Lutomirski
2015-10-24 2:24 ` Paul Moore
2015-10-23 19:13 ` Richard Guy Briggs [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20151023191301.GD1577@madcap2.tricolour.ca \
--to=rgb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox