Limiting SECCOMP audit events

[Paul Moore]

On December 15, 2017 10:47:17 AM Tyler Hicks <tyhicks at canonical.com> wrote:
> On 12/15/2017 08:08 AM, Paul Moore wrote:

...

>> * Are we sure about removing the audit_enabled check? People got pretty
>> upset when it wasn't there in the past.
>
> Do you have any references to the complaints so that we can understand
> them better? I remember being surprised by commit 96368701 adding the
> audit_enabled check (my fault for not watching the list closer) and
> having to revert it in Ubuntu with a distro patch.

I'm somewhat limited at the moment (replying by phone) so I can't my find
it for you, but check the audit mailing list for the discussion.