[lkml]   [2012]   [Mar]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH] audit: always report seccomp violations
When a program violates its own seccomp rules, that is a pretty dire
situation, and the audit message should always be reported (not just
when there is already a rule active for the process).

This change makes the audit_seccomp() logic similar to audit_core_dumps()
(it does not require an active context). Since core dumps are more
common, they sit behind an "audit_enabled" test. Audit reports of seccomp
failures should always be visible, and fall back to printk when auditd
is not running.

Signed-off-by: Kees Cook <>
include/linux/audit.h | 8 +-------
kernel/auditsc.c | 11 +++++++++--
2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/include/linux/audit.h b/include/linux/audit.h
index ed3ef19..596077f 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -463,7 +463,7 @@ extern void audit_putname(const char *name);
extern void __audit_inode(const char *name, const struct dentry *dentry);
extern void __audit_inode_child(const struct dentry *dentry,
const struct inode *parent);
-extern void __audit_seccomp(unsigned long syscall);
+extern void audit_seccomp(unsigned long syscall);
extern void __audit_ptrace(struct task_struct *t);

static inline int audit_dummy_context(void)
@@ -508,12 +508,6 @@ static inline void audit_inode_child(const struct dentry *dentry,
void audit_core_dumps(long signr);

-static inline void audit_seccomp(unsigned long syscall)
- if (unlikely(!audit_dummy_context()))
- __audit_seccomp(syscall);
static inline void audit_ptrace(struct task_struct *t)
if (unlikely(!audit_dummy_context()))
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index af1de0f..a5caecd 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2693,7 +2693,7 @@ static void audit_log_abend(struct audit_buffer *ab, char *reason, long signr)
* @signr: signal value
* If a process ends with a core dump, something fishy is going on and we
- * should record the event for investigation.
+ * should record the event for investigation, if auditing is enabled.
void audit_core_dumps(long signr)
@@ -2710,7 +2710,14 @@ void audit_core_dumps(long signr)

-void __audit_seccomp(unsigned long syscall)
+ * audit_seccomp - record information about processes that violate seccomp
+ * @syscall: syscall number that triggered the seccomp violation
+ *
+ * If a process violates its own seccomp rules, something has gone very
+ * wrong, and this event should always be reported for investigation.
+ */
+void audit_seccomp(unsigned long syscall)
struct audit_buffer *ab;

Kees Cook
Chrome OS Security

 \ /
  Last update: 2012-03-24 00:51    [W:0.050 / U:3.344 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site