summaryrefslogtreecommitdiff
path: root/kernel/auditsc.c
diff options
context:
space:
mode:
authorTyler Hicks <tyhicks@canonical.com>2018-05-04 04:08:15 +0300
committerPaul Moore <paul@paul-moore.com>2018-05-08 09:04:23 +0300
commit326bee0286d7f6b0d780f5b75a35ea9fe489a802 (patch)
treef1eb4381cc90194fe772decba3168e578981993e /kernel/auditsc.c
parentea6eca778500b0aaf6e5f10dac4d2cd745c2a50b (diff)
downloadlinux-326bee0286d7f6b0d780f5b75a35ea9fe489a802.tar.xz
seccomp: Don't special case audited processes when logging
Seccomp logging for "handled" actions such as RET_TRAP, RET_TRACE, or RET_ERRNO can be very noisy for processes that are being audited. This patch modifies the seccomp logging behavior to treat processes that are being inspected via the audit subsystem the same as processes that aren't under inspection. Handled actions will no longer be logged just because the process is being inspected. Since v4.14, applications have the ability to request logging of handled actions by using the SECCOMP_FILTER_FLAG_LOG flag when loading seccomp filters. With this patch, the logic for deciding if an action will be logged is: if action == RET_ALLOW: do not log else if action not in actions_logged: do not log else if action == RET_KILL: log else if action == RET_LOG: log else if filter-requests-logging: log else: do not log Reported-by: Steve Grubb <sgrubb@redhat.com> Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Kees Cook <keescook@chromium.org> Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'kernel/auditsc.c')
-rw-r--r--kernel/auditsc.c14
1 files changed, 13 insertions, 1 deletions
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 46ef2c23618d..0d4e7ab847b1 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2466,7 +2466,19 @@ void audit_core_dumps(long signr)
audit_log_end(ab);
}
-void __audit_seccomp(unsigned long syscall, long signr, int code)
+/**
+ * audit_seccomp - record information about a seccomp action
+ * @syscall: syscall number
+ * @signr: signal value
+ * @code: the seccomp action
+ *
+ * Record the information associated with a seccomp action. Event filtering for
+ * seccomp actions that are not to be logged is done in seccomp_log().
+ * Therefore, this function forces auditing independent of the audit_enabled
+ * and dummy context state because seccomp actions should be logged even when
+ * audit is not in use.
+ */
+void audit_seccomp(unsigned long syscall, long signr, int code)
{
struct audit_buffer *ab;