Re: [PATCH v3 0/4] Improved seccomp logging

2017-05-02 Thread Andy Lutomirski
On Mon, May 1, 2017 at 7:41 PM, Tyler Hicks wrote: > On 04/27/2017 07:42 PM, Kees Cook wrote: >> On Thu, Apr 27, 2017 at 3:17 PM, Tyler Hicks wrote: >>> Quick update... I finished the move from the high-water mark >>> log_max_action sysctl to the bitmask based actions_logged sysctl. >> >> Awesome

Re: [PATCH v3 0/4] Improved seccomp logging

2017-05-01 Thread Tyler Hicks
On 04/27/2017 07:42 PM, Kees Cook wrote: > On Thu, Apr 27, 2017 at 3:17 PM, Tyler Hicks wrote: >> Quick update... I finished the move from the high-water mark >> log_max_action sysctl to the bitmask based actions_logged sysctl. > > Awesome! > >> Unfortunately, I've just realized that SECCOMP_SET

Re: [PATCH v3 0/4] Improved seccomp logging

2017-04-27 Thread Kees Cook
On Thu, Apr 27, 2017 at 3:17 PM, Tyler Hicks wrote: > Quick update... I finished the move from the high-water mark > log_max_action sysctl to the bitmask based actions_logged sysctl. Awesome! > Unfortunately, I've just realized that SECCOMP_SET_LOGGING, or any > process-wide logging configuratio

Re: [PATCH v3 0/4] Improved seccomp logging

2017-04-27 Thread Tyler Hicks
On 04/10/2017 10:59 PM, Kees Cook wrote: > On Fri, Apr 7, 2017 at 4:46 PM, Tyler Hicks wrote: >> On 04/07/2017 05:46 PM, Kees Cook wrote: >>> Does the app-controlled bitmask apply to the filter, the process, the >>> process tree, or something else? e.g. systemd launches an app with a >>> filter, l

Re: [PATCH v3 0/4] Improved seccomp logging

2017-04-10 Thread Kees Cook
On Mon, Apr 10, 2017 at 8:57 AM, Andy Lutomirski wrote: > On Fri, Apr 7, 2017 at 3:16 PM, Tyler Hicks wrote: >> On 02/22/2017 12:46 PM, Kees Cook wrote: >>> On Thu, Feb 16, 2017 at 3:29 PM, Kees Cook wrote: On Wed, Feb 15, 2017 at 7:24 PM, Andy Lutomirski wrote: > On Mon, Feb 13,

Re: [PATCH v3 0/4] Improved seccomp logging

2017-04-10 Thread Kees Cook
On Fri, Apr 7, 2017 at 4:46 PM, Tyler Hicks wrote: > On 04/07/2017 05:46 PM, Kees Cook wrote: >> Does the app-controlled bitmask apply to the filter, the process, the >> process tree, or something else? e.g. systemd launches an app with a >> filter, leaving the defaults alone, then later process i

Re: [PATCH v3 0/4] Improved seccomp logging

2017-04-10 Thread Tyler Hicks
On 04/10/2017 10:57 AM, Andy Lutomirski wrote: > On Fri, Apr 7, 2017 at 3:16 PM, Tyler Hicks wrote: >> On 02/22/2017 12:46 PM, Kees Cook wrote: >>> On Thu, Feb 16, 2017 at 3:29 PM, Kees Cook wrote: On Wed, Feb 15, 2017 at 7:24 PM, Andy Lutomirski wrote: > On Mon, Feb 13, 2017 at 7

Re: [PATCH v3 0/4] Improved seccomp logging

2017-04-10 Thread Andy Lutomirski
On Fri, Apr 7, 2017 at 3:16 PM, Tyler Hicks wrote: > On 02/22/2017 12:46 PM, Kees Cook wrote: >> On Thu, Feb 16, 2017 at 3:29 PM, Kees Cook wrote: >>> On Wed, Feb 15, 2017 at 7:24 PM, Andy Lutomirski >>> wrote: On Mon, Feb 13, 2017 at 7:45 PM, Tyler Hicks wrote: > This patch set is th

Re: [PATCH v3 0/4] Improved seccomp logging

2017-04-10 Thread Steve Grubb
On Friday, April 7, 2017 6:16:08 PM EDT Tyler Hicks wrote: > On 02/22/2017 12:46 PM, Kees Cook wrote: > > On Thu, Feb 16, 2017 at 3:29 PM, Kees Cook wrote: > >> On Wed, Feb 15, 2017 at 7:24 PM, Andy Lutomirski wrote: > >>> On Mon, Feb 13, 2017 at 7:45 PM, Tyler Hicks wrote: > This patch s

Re: [PATCH v3 0/4] Improved seccomp logging

2017-04-07 Thread Tyler Hicks
On 04/07/2017 05:46 PM, Kees Cook wrote: > On Fri, Apr 7, 2017 at 3:16 PM, Tyler Hicks wrote: >> On 02/22/2017 12:46 PM, Kees Cook wrote: >>> On Thu, Feb 16, 2017 at 3:29 PM, Kees Cook wrote: On Wed, Feb 15, 2017 at 7:24 PM, Andy Lutomirski wrote: > On Mon, Feb 13, 2017 at 7:45 PM

Re: [PATCH v3 0/4] Improved seccomp logging

2017-04-07 Thread Kees Cook
On Fri, Apr 7, 2017 at 3:16 PM, Tyler Hicks wrote: > On 02/22/2017 12:46 PM, Kees Cook wrote: >> On Thu, Feb 16, 2017 at 3:29 PM, Kees Cook wrote: >>> On Wed, Feb 15, 2017 at 7:24 PM, Andy Lutomirski >>> wrote: On Mon, Feb 13, 2017 at 7:45 PM, Tyler Hicks wrote: > This patch set is th

Re: [PATCH v3 0/4] Improved seccomp logging

2017-04-07 Thread Tyler Hicks
On 02/22/2017 12:46 PM, Kees Cook wrote: > On Thu, Feb 16, 2017 at 3:29 PM, Kees Cook wrote: >> On Wed, Feb 15, 2017 at 7:24 PM, Andy Lutomirski wrote: >>> On Mon, Feb 13, 2017 at 7:45 PM, Tyler Hicks wrote: This patch set is the third revision of the following two previously submitted

Re: [PATCH v3 0/4] Improved seccomp logging

2017-02-22 Thread Kees Cook
On Thu, Feb 16, 2017 at 3:29 PM, Kees Cook wrote: > On Wed, Feb 15, 2017 at 7:24 PM, Andy Lutomirski wrote: >> On Mon, Feb 13, 2017 at 7:45 PM, Tyler Hicks wrote: >>> This patch set is the third revision of the following two previously >>> submitted patch sets: >>> >>> v1: >>> http://lkml.kerne

Re: [PATCH v3 0/4] Improved seccomp logging

2017-02-22 Thread Kees Cook
On Fri, Feb 17, 2017 at 9:00 AM, Andy Lutomirski wrote: > On Thu, Feb 16, 2017 at 3:29 PM, Kees Cook wrote: >> On Wed, Feb 15, 2017 at 7:24 PM, Andy Lutomirski wrote: >> If someone was going to do this, they could just as well set up a >> tracer to use RET_TRAP. (And this is what things like min

Re: [PATCH v3 0/4] Improved seccomp logging

2017-02-17 Thread Andy Lutomirski
On Thu, Feb 16, 2017 at 3:29 PM, Kees Cook wrote: > On Wed, Feb 15, 2017 at 7:24 PM, Andy Lutomirski wrote: >> On Mon, Feb 13, 2017 at 7:45 PM, Tyler Hicks wrote: >>> This patch set is the third revision of the following two previously >>> submitted patch sets: >>> >>> v1: >>> http://lkml.kerne

Re: [PATCH v3 0/4] Improved seccomp logging

2017-02-16 Thread Kees Cook
On Wed, Feb 15, 2017 at 7:24 PM, Andy Lutomirski wrote: > On Mon, Feb 13, 2017 at 7:45 PM, Tyler Hicks wrote: >> This patch set is the third revision of the following two previously >> submitted patch sets: >> >> v1: >> http://lkml.kernel.org/r/1483375990-14948-1-git-send-email-tyhi...@canonical

Re: [PATCH v3 0/4] Improved seccomp logging

2017-02-16 Thread Tyler Hicks
On 02/15/2017 09:24 PM, Andy Lutomirski wrote: > On Mon, Feb 13, 2017 at 7:45 PM, Tyler Hicks wrote: >> This patch set is the third revision of the following two previously >> submitted patch sets: >> >> v1: >> http://lkml.kernel.org/r/1483375990-14948-1-git-send-email-tyhi...@canonical.com >> v1

Re: [PATCH v3 0/4] Improved seccomp logging

2017-02-15 Thread Andy Lutomirski
On Mon, Feb 13, 2017 at 7:45 PM, Tyler Hicks wrote: > This patch set is the third revision of the following two previously > submitted patch sets: > > v1: > http://lkml.kernel.org/r/1483375990-14948-1-git-send-email-tyhi...@canonical.com > v1: > http://lkml.kernel.org/r/1483377999-15019-2-git-se

[PATCH v3 0/4] Improved seccomp logging

2017-02-13 Thread Tyler Hicks
This patch set is the third revision of the following two previously submitted patch sets: v1: http://lkml.kernel.org/r/1483375990-14948-1-git-send-email-tyhi...@canonical.com v1: http://lkml.kernel.org/r/1483377999-15019-2-git-send-email-tyhi...@canonical.com v2: http://lkml.kernel.org/r/1486