[lkml]   [2017]   [Aug]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[PATCH v6 0/6] Improved seccomp logging
This patch set aims to improve logging in seccomp by:

1) Empowering administrators to be able to permit or quiet logging of
specific seccomp actions
2) Allowing applications to request logging of all actions, except for
RET_ALLOW, in the filter being loaded (subject to the
administrator's wishes in #1)
3) By making it possible for application developers to request logging
of specific syscalls while developing filters for their application
(subject to the administrator's wishes in #1)

With this patch set applied, the logic for deciding if an action will be
logged is as described in the commit message of the final patch.

* Changes since v5:
- Rebase onto
+ Redefine the value of SECCOMP_FILTER_FLAG_LOG to account for the
detect_seccomp_filter_flags selftest
- Reorder patches to move SECCOMP_GET_ACTION_AVAIL patch behind
actions_avail sysctl patch (kees)
- Reorder patches to move the selftest to detect filter flag support
before the patch that adds SECCOMP_FILTER_FLAG_LOG (kees)
- Add psuedo code showing the high level logic of when and when not to
log to the commit message of each patch that changes the logging
behavior (inspired by kees)
- Add Suggested-by to the SECCOMP_GET_ACTION_AVAIL patch to credit
Andy for the idea (tyhicks)
- Use sizeof(seccomp_actions_avail), instead of strlen(), to avoid
variable length "names" array in seccomp_actions_logged_handler()
- Only check the actions_logged sysctl value for "kill" when first
introducing the actions_logged sysctl since filters cannot yet set
the FILTER_FLAG_LOG flag (kees)
- Mention how the actions_logged sysctl could quiet SECCOMP_RET_LOG
actions in seccomp_filter.rst documentation (kees)


 \ /
  Last update: 2017-08-11 06:34    [W:0.071 / U:5.528 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site