linux-kernel - Re: [PATCH] Don't audit SECCOMP_KILL/RET_ERRNO when syscall auditing is disabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHC9VhSqu3fTW1BV-+6MtLqT5Jioj_jx60ECB9WL=O638Xa3-g@mail.gmail.com>
Date:	Mon, 11 Apr 2016 09:23:49 -0400
From:	Paul Moore <paul@...l-moore.com>
To:	Andi Kleen <andi@...stfloor.org>
Cc:	Andi Kleen <ak@...ux.intel.com>, Eric Paris <eparis@...hat.com>,
	linux-kernel@...r.kernel.org, linux-audit@...hat.com
Subject: Re: [PATCH] Don't audit SECCOMP_KILL/RET_ERRNO when syscall auditing
 is disabled

On Mon, Apr 11, 2016 at 12:07 AM, Andi Kleen <andi@...stfloor.org> wrote:
> On Sun, Apr 10, 2016 at 10:30:10PM -0400, Paul Moore wrote:
>> On Sun, Apr 10, 2016 at 6:31 PM, Andi Kleen <ak@...ux.intel.com> wrote:
>> > On Sun, Apr 10, 2016 at 06:17:53PM -0400, Paul Moore wrote:
>> >> On Sat, Apr 9, 2016 at 10:41 PM, Andi Kleen <andi@...stfloor.org> wrote:
>> >> >> What kernel version are you using?  I believe we fixed that in Linux
>> >> >> 4.5 with the following:
>> >> >
>> >> > This is 4.6-rc2.
>> >> >>
>> >> >>   commit 96368701e1c89057bbf39222e965161c68a85b4b
>> >> >>   From: Paul Moore <pmoore@...hat.com>
>> >> >>   Date: Wed, 13 Jan 2016 10:18:55 -0400 (09:18 -0500)
>> >> >>
>> >> >>   audit: force seccomp event logging to honor the audit_enabled flag
>> >> >
>> >> > No you didn't fix it because audit_enabled is always enabled by systemd
>> >> > for user space auditing, see the original description of my patch.
>> >>
>> >> [NOTE: adding the audit list to the CC line]
>> >
>> > This mailing list is marked subscriber only in MAINTAINERS so I
>> > intentionally didn't add it. It's unlikely that my emails
>> > will make it through.
>>
>> Steve Grubb checks it on a regular basis and approves anything
>> remotely audit related.  Please make use of it in the future; it's
>> listed in MAINTAINERS for a reason.
>
> Nothing has appeared by now. A mailing list that does not allow
> real time discussion is fairly useless.
>
> Dropped again.

Re-added.

There is always value in having the conversation archived.

-- 
paul moore
www.paul-moore.com