Re: [PATCH v4 2/4] seccomp: Add sysctl to configure actions that should be logged

2017-02-16 Thread Tyler Hicks
On 02/16/2017 12:40 PM, Tyler Hicks wrote: > On 02/15/2017 07:10 PM, Kees Cook wrote: >> On Mon, Feb 13, 2017 at 7:55 PM, Tyler Hicks wrote: >>> diff --git a/kernel/seccomp.c b/kernel/seccomp.c >>> index e36dfe9..270a227 100644 >>> --- a/kernel/seccomp.c >>> +++ b/kernel/seccomp.c >>> @@ -509,6 +5

Re: [PATCH v4 2/4] seccomp: Add sysctl to configure actions that should be logged

2017-02-16 Thread Tyler Hicks
On 02/15/2017 07:10 PM, Kees Cook wrote: > On Mon, Feb 13, 2017 at 7:55 PM, Tyler Hicks wrote: >> diff --git a/kernel/seccomp.c b/kernel/seccomp.c >> index e36dfe9..270a227 100644 >> --- a/kernel/seccomp.c >> +++ b/kernel/seccomp.c >> @@ -509,6 +509,22 @@ static void seccomp_send_sigsys(int syscal

Re: [PATCH v4 2/4] seccomp: Add sysctl to configure actions that should be logged

2017-02-15 Thread Kees Cook
On Mon, Feb 13, 2017 at 7:55 PM, Tyler Hicks wrote: > diff --git a/kernel/seccomp.c b/kernel/seccomp.c > index e36dfe9..270a227 100644 > --- a/kernel/seccomp.c > +++ b/kernel/seccomp.c > @@ -509,6 +509,22 @@ static void seccomp_send_sigsys(int syscall, int reason) > } > #endif /* CONFIG_SECCOMP_

[PATCH v4 2/4] seccomp: Add sysctl to configure actions that should be logged

2017-02-13 Thread Tyler Hicks
Administrators can write to this sysctl to set the maximum seccomp action that should be logged. Any actions with values greater than what's written to the sysctl will not be logged. For example, all SECCOMP_RET_KILL, SECCOMP_RET_TRAP, and SECCOMP_RET_ERRNO actions would be logged if "errno" were