Should audit_seccomp check audit_enabled?
Andy Lutomirski
luto at amacapital.net
Fri Oct 23 16:19:04 UTC 2015
I would argue that, if auditing is off, audit_seccomp shouldn't do
anything. After all, unlike e.g. selinux, seccomp is not a systemwide
policy, and seccomp signals might be ordinary behavior that's internal
to the seccomp-using application. IOW, for people with audit compiled
in and subscribed by journald but switched off, I think that the
records shouldn't be emitted.
If you agree, I can send the two-line patch.
--Andy
--
Andy Lutomirski
AMA Capital Management, LLC
More information about the Linux-audit
mailing list