From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: Re: seccomp and audit_enabled Date: Mon, 12 Oct 2015 11:40:16 -0400 Message-ID: <4636418.ofTBd0bpCf@sifl> References: <56188AE9.4030306@suse.de> <9092019.92r82W6k9o@sifl> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx05.extmail.prod.ext.phx2.redhat.com [10.5.110.29]) by int-mx14.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t9CFeOH9002521 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Mon, 12 Oct 2015 11:40:24 -0400 Received: from mail-qk0-f177.google.com (mail-qk0-f177.google.com [209.85.220.177]) by mx1.redhat.com (Postfix) with ESMTPS id 66D7B344F71 for ; Mon, 12 Oct 2015 15:40:18 +0000 (UTC) Received: by qkht68 with SMTP id t68so59428986qkh.3 for ; Mon, 12 Oct 2015 08:40:17 -0700 (PDT) In-Reply-To: <9092019.92r82W6k9o@sifl> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Tony Jones , keescook@chromium.org Cc: linux-security-module@vger.kernel.org, linux-audit@redhat.com List-Id: linux-audit@redhat.com My apologies for the resend, I had the wrong email for Kees. On Monday, October 12, 2015 11:29:43 AM Paul Moore wrote: > On Friday, October 09, 2015 08:50:01 PM Tony Jones wrote: > > Hi. > > > > What is the expected handling of AUDIT_SECCOMP if audit_enabled == 0? > > Opera browser makes use of a sandbox and if audit_enabled == 0 (and no > > auditd is running) there is a lot of messages dumped to the klog. The fix > > to __audit_seccomp() is trivial, similar to c2412d91c and I can send a > > patch, I'm just not sure if seccomp is somehow special? > > I'm adding Kees to this since he looks after the seccomp kernel bits these > days. While there isn't anything special about seccomp from an audit > perspective, the seccomp audit record can be a really nice thing as it is > the only indication you may get that seccomp has stepped in and done > "something" other than allow the syscall to progress normally. > > I would be a little more concerned that you are seeing a flood of seccomp > messages from Opera, that is something that most likely warrants some closer > inspection. Are all the records the same/similar? Can you paste some into > email? -- paul moore www.paul-moore.com