From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752577AbdBCFiC (ORCPT ); Fri, 3 Feb 2017 00:38:02 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:32840 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752272AbdBCFiB (ORCPT ); Fri, 3 Feb 2017 00:38:01 -0500 From: Tyler Hicks To: Paul Moore , Eric Paris , Kees Cook , Andy Lutomirski , Will Drewry Cc: linux-audit@redhat.com, linux-kernel@vger.kernel.org Subject: [PATCH v2 0/4] Improved seccomp logging Date: Fri, 3 Feb 2017 05:37:38 +0000 Message-Id: <1486100262-32391-1-git-send-email-tyhicks@canonical.com> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This patch set is the second revision of the following two previously submitted patch sets: http://lkml.kernel.org/r/1483375990-14948-1-git-send-email-tyhicks@canonical.com http://lkml.kernel.org/r/1483377999-15019-2-git-send-email-tyhicks@canonical.com The patch set aims to address some known deficiencies in seccomp's current logging capabilities: 1. Inability to log all filter actions. 2. Inability to selectively enable filtering; e.g. devs want noisy logging, users want relative quiet. 3. Consistent behavior with audit enabled and disabled. 4. Inability to easily develop a filter due to the lack of a permissive/complain mode. The first three items were outlined by Paul Moore and are issues that I agree with. The last one is one that I'm particularly interested in. I deviated a little from the plan that he laid out to address the third issue. Looking back at Paul's feedback, he wanted a way to log seccomp actions even when the audit subsystem is disabled at build time. I felt like the bigger problem is that, while it is common for kernels to be built with audit support, it is far less common to actually have auditd running. Therefore, my approach was to improve the situation when kernel audit support is enabled at build time but audit_enabled is false at runtime. The audit subsystem forwards messages onto syslog in that situation. Tyler