From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: Re: seccomp and audit_enabled Date: Mon, 12 Oct 2015 11:29:43 -0400 Message-ID: <9092019.92r82W6k9o@sifl> References: <56188AE9.4030306@suse.de> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx03.extmail.prod.ext.phx2.redhat.com [10.5.110.27]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t9CFTkmQ012961 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Mon, 12 Oct 2015 11:29:47 -0400 Received: from mail-qg0-f41.google.com (mail-qg0-f41.google.com [209.85.192.41]) by mx1.redhat.com (Postfix) with ESMTPS id 01AF78F263 for ; Mon, 12 Oct 2015 15:29:45 +0000 (UTC) Received: by qgt47 with SMTP id 47so122131192qgt.2 for ; Mon, 12 Oct 2015 08:29:45 -0700 (PDT) In-Reply-To: <56188AE9.4030306@suse.de> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Tony Jones , Kees Cook Cc: linux-security-module@vger.kernel.org, linux-audit@redhat.com List-Id: linux-audit@redhat.com On Friday, October 09, 2015 08:50:01 PM Tony Jones wrote: > Hi. > > What is the expected handling of AUDIT_SECCOMP if audit_enabled == 0? > Opera browser makes use of a sandbox and if audit_enabled == 0 (and no > auditd is running) there is a lot of messages dumped to the klog. The fix > to __audit_seccomp() is trivial, similar to c2412d91c and I can send a > patch, I'm just not sure if seccomp is somehow special? I'm adding Kees to this since he looks after the seccomp kernel bits these days. While there isn't anything special about seccomp from an audit perspective, the seccomp audit record can be a really nice thing as it is the only indication you may get that seccomp has stepped in and done "something" other than allow the syscall to progress normally. I would be a little more concerned that you are seeing a flood of seccomp messages from Opera, that is something that most likely warrants some closer inspection. Are all the records the same/similar? Can you paste some into email? -- paul moore www.paul-moore.com