From mboxrd@z Thu Jan 1 00:00:00 1970 From: James Morris Subject: Re: [PATCH v2 3/4] seccomp: Audit attempts to modify the actions_logged sysctl Date: Thu, 3 May 2018 07:17:37 +1000 (AEST) Message-ID: References: <1525276400-7161-1-git-send-email-tyhicks@canonical.com> <1525276400-7161-4-git-send-email-tyhicks@canonical.com> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Return-path: In-Reply-To: <1525276400-7161-4-git-send-email-tyhicks@canonical.com> Sender: linux-kernel-owner@vger.kernel.org To: Tyler Hicks Cc: linux-kernel@vger.kernel.org, Kees Cook , Andy Lutomirski , Will Drewry , Paul Moore , Eric Paris , Steve Grubb , Jonathan Corbet , linux-audit@redhat.com, linux-security-module@vger.kernel.org, linux-doc@vger.kernel.org List-Id: linux-audit@redhat.com On Wed, 2 May 2018, Tyler Hicks wrote: > type=CONFIG_CHANGE msg=audit(1525275325.613:142): op=seccomp-logging > actions=kill_process,kill_thread,errno,trace,log > old-actions=kill_process,kill_thread,errno,trace,log res=1 > > No audit records are generated when reading the actions_logged sysctl. > > Suggested-by: Steve Grubb > Signed-off-by: Tyler Hicks Reviewed-by: James Morris -- James Morris