From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752962AbbJWTNs (ORCPT ); Fri, 23 Oct 2015 15:13:48 -0400 Received: from mx1.redhat.com ([209.132.183.28]:42529 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752007AbbJWTNG (ORCPT ); Fri, 23 Oct 2015 15:13:06 -0400 Date: Fri, 23 Oct 2015 15:13:01 -0400 From: Richard Guy Briggs To: Andy Lutomirski Cc: "linux-kernel@vger.kernel.org" , linux-audit@redhat.com, Kees Cook , Paul Moore , Steve Grubb Subject: Re: Should audit_seccomp check audit_enabled? Message-ID: <20151023191301.GD1577@madcap2.tricolour.ca> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 15/10/23, Andy Lutomirski wrote: > I would argue that, if auditing is off, audit_seccomp shouldn't do > anything. After all, unlike e.g. selinux, seccomp is not a systemwide > policy, and seccomp signals might be ordinary behavior that's internal > to the seccomp-using application. IOW, for people with audit compiled > in and subscribed by journald but switched off, I think that the > records shouldn't be emitted. > > If you agree, I can send the two-line patch. This sounds reasonable to me. It isn't an AVC. Steve? Paul? > --Andy - RGB -- Richard Guy Briggs Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545