From: Tony Jones <tonyj@suse.de>
To: Steve Grubb <sgrubb@redhat.com>, linux-audit@redhat.com
Cc: Paul Moore <paul@paul-moore.com>,
linux-security-module <linux-security-module@vger.kernel.org>
Subject: Re: seccomp and audit_enabled
Date: Fri, 6 Nov 2015 13:45:43 -0800 [thread overview]
Message-ID: <563D1F87.4070201@suse.de> (raw)
In-Reply-To: <1489773.CGhBT1IxtY@x2>
On 10/13/2015 01:03 PM, Steve Grubb wrote:
>> No, it's the default audit.rules (-D, -b320). No actual rules loaded.
>> Let me add some instrumentation and figure out what's going on. auditd
>> is masked (via systemd) but systemd-journal seems to set audit_enabled=1
>> during startup (at least on our systems).
>
> Tony,
>
> We have bz 1227379
> https://bugzilla.redhat.com/show_bug.cgi?id=1227379
>
> There is a patch attached to disable systemd's propensity to turn on the audit
> system. Are people complaining and opening bugs in your distribution? If so,
> that might add more ammunition to get that fixed.
Hi Steve
we only have the one bug and it's related to:
1) noisy klog between when systemd enables audit and user manually disables it (rh bz#1160046)
2) after user manually disables audit (audit_enabled=0) seccomp messages still are output.
tony
next prev parent reply other threads:[~2015-11-06 21:45 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-10-10 3:50 seccomp and audit_enabled Tony Jones
2015-10-12 15:29 ` Paul Moore
2015-10-12 15:40 ` Paul Moore
2015-10-12 17:53 ` Tony Jones
2015-10-12 20:45 ` Kees Cook
2015-10-13 16:11 ` Paul Moore
2015-10-13 17:18 ` Tony Jones
2015-10-13 19:19 ` Paul Moore
2015-10-13 19:46 ` Tony Jones
2015-10-13 20:03 ` Steve Grubb
2015-11-06 21:45 ` Tony Jones [this message]
2015-11-06 21:36 ` Tony Jones
2015-11-20 17:51 ` Tony Jones
2015-11-20 21:26 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=563D1F87.4070201@suse.de \
--to=tonyj@suse.de \
--cc=linux-audit@redhat.com \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=sgrubb@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).