diff options
author | Tyler Hicks <tyhicks@canonical.com> | 2018-05-04 01:08:15 +0000 |
---|---|---|
committer | Paul Moore <paul@paul-moore.com> | 2018-05-08 02:04:23 -0400 |
commit | 326bee0286d7f6b0d780f5b75a35ea9fe489a802 (patch) | |
tree | f1eb4381cc90194fe772decba3168e578981993e /kernel/seccomp.c | |
parent | ea6eca778500b0aaf6e5f10dac4d2cd745c2a50b (diff) | |
download | op-kernel-dev-326bee0286d7f6b0d780f5b75a35ea9fe489a802.zip op-kernel-dev-326bee0286d7f6b0d780f5b75a35ea9fe489a802.tar.gz |
seccomp: Don't special case audited processes when logging
Seccomp logging for "handled" actions such as RET_TRAP, RET_TRACE, or
RET_ERRNO can be very noisy for processes that are being audited. This
patch modifies the seccomp logging behavior to treat processes that are
being inspected via the audit subsystem the same as processes that
aren't under inspection. Handled actions will no longer be logged just
because the process is being inspected. Since v4.14, applications have
the ability to request logging of handled actions by using the
SECCOMP_FILTER_FLAG_LOG flag when loading seccomp filters.
With this patch, the logic for deciding if an action will be logged is:
if action == RET_ALLOW:
do not log
else if action not in actions_logged:
do not log
else if action == RET_KILL:
log
else if action == RET_LOG:
log
else if filter-requests-logging:
log
else:
do not log
Reported-by: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'kernel/seccomp.c')
-rw-r--r-- | kernel/seccomp.c | 17 |
1 files changed, 7 insertions, 10 deletions
diff --git a/kernel/seccomp.c b/kernel/seccomp.c index f5630d1..5386749 100644 --- a/kernel/seccomp.c +++ b/kernel/seccomp.c @@ -584,18 +584,15 @@ static inline void seccomp_log(unsigned long syscall, long signr, u32 action, } /* - * Force an audit message to be emitted when the action is RET_KILL_*, - * RET_LOG, or the FILTER_FLAG_LOG bit was set and the action is - * allowed to be logged by the admin. + * Emit an audit message when the action is RET_KILL_*, RET_LOG, or the + * FILTER_FLAG_LOG bit was set. The admin has the ability to silence + * any action from being logged by removing the action name from the + * seccomp_actions_logged sysctl. */ - if (log) - return __audit_seccomp(syscall, signr, action); + if (!log) + return; - /* - * Let the audit subsystem decide if the action should be audited based - * on whether the current task itself is being audited. - */ - return audit_seccomp(syscall, signr, action); + audit_seccomp(syscall, signr, action); } /* |