Tyler Hicks
e66a399779
seccomp: Filter flag to log all actions except SECCOMP_RET_ALLOW
...
Add a new filter flag, SECCOMP_FILTER_FLAG_LOG, that enables logging for
all actions except for SECCOMP_RET_ALLOW for the given filter.
SECCOMP_RET_KILL actions are always logged, when "kill" is in the
actions_logged sysctl, and SECCOMP_RET_ALLOW actions are never logged,
regardless of this flag.
This flag can be used to create noisy filters that result in all
non-allowed actions to be logged. A process may have one noisy filter,
which is loaded with this flag, as well as a quiet filter that's not
loaded with this flag. This allows for the actions in a set of filters
to be selectively conveyed to the admin.
Since a system could have a large number of allocated seccomp_filter
structs, struct packing was taken in consideration. On 64 bit x86, the
new log member takes up one byte of an existing four byte hole in the
struct. On 32 bit x86, the new log member creates a new four byte hole
(unavoidable) and consumes one of those bytes.
Unfortunately, the tests added for SECCOMP_FILTER_FLAG_LOG are not
capable of inspecting the audit log to verify that the actions taken in
the filter were logged.
With this patch, the logic for deciding if an action will be logged is:
if action == RET_ALLOW:
do not log
else if action == RET_KILL && RET_KILL in actions_logged:
log
else if filter-requests-logging && action in actions_logged:
log
else if audit_enabled && process-is-being-audited:
log
else:
do not log
Signed-off-by: Tyler Hicks <tyhicks@canonical.com >
Signed-off-by: Kees Cook <keescook@chromium.org >
2017-08-14 13:46:46 -07:00
..
2017-07-09 18:48:37 -07:00
2017-06-01 14:26:23 -07:00
2017-04-25 09:04:29 +02:00
2017-07-17 14:54:58 +02:00
2017-04-12 18:51:01 +02:00
2017-07-07 17:25:19 +02:00
2017-05-15 17:07:30 +02:00
2017-01-09 10:04:09 +09:00
2017-07-07 12:40:27 -07:00
2016-06-28 00:38:53 +02:00
2017-07-12 10:04:56 -07:00
2017-07-03 20:55:59 -07:00
2017-06-15 09:45:06 +01:00
2017-05-15 17:42:31 +02:00
2017-07-11 09:55:47 -07:00
2017-07-17 21:21:24 -04:00
2017-07-03 03:42:10 -07:00
2017-06-20 10:30:49 +02:00
2017-07-13 12:07:44 -07:00
2017-06-19 19:38:24 +02:00
2017-06-19 19:09:19 +02:00
2017-04-11 16:29:54 +01:00
2017-06-01 15:28:27 +05:30
2017-06-29 14:30:49 +02:00
2017-07-12 16:26:05 -07:00
2017-06-08 17:57:38 +02:00
2017-07-03 01:43:45 -07:00
2017-05-16 10:01:57 +05:30
2017-05-17 10:49:25 +01:00
2017-07-19 08:55:18 -07:00
2017-06-29 17:34:57 +02:00
2017-07-06 11:38:59 -07:00
2017-07-13 13:56:24 -07:00
2016-09-14 20:37:50 +02:00
2017-07-22 08:55:16 -07:00
2017-06-15 11:41:37 +01:00
2017-07-10 15:23:45 -07:00
2016-12-01 14:45:08 +01:00
2015-08-05 13:38:07 +01:00
2012-10-08 13:50:20 +10:30
2013-09-24 10:35:17 +01:00
2013-12-02 11:24:18 +00:00
2013-03-12 13:59:14 -07:00
2015-01-28 18:45:23 -05:00
2017-07-04 22:35:16 +01:00
2017-03-30 09:35:54 +02:00
2012-03-16 10:38:24 -04:00
2017-08-14 13:46:45 -07:00
2016-10-11 15:06:31 -07:00
2017-03-02 08:32:46 +01:00
2017-07-12 16:26:05 -07:00
2016-05-04 23:41:14 +02:00
2012-09-10 11:13:16 -07:00
2017-06-08 18:52:36 -07:00
2017-06-30 12:00:51 -07:00
2017-07-03 17:00:59 -06:00
2012-03-04 17:54:34 -05:00
2017-07-10 16:32:34 -07:00
2016-10-07 18:46:26 -07:00
2014-12-22 16:43:06 +00:00
2017-06-27 12:05:27 -06:00
2017-06-20 15:42:32 -04:00
2017-07-03 13:08:04 -07:00
2017-06-27 12:13:45 -06:00
2017-07-06 16:24:33 -07:00
2017-07-01 16:15:13 -07:00
2017-07-20 15:20:27 -07:00
2017-07-17 13:37:56 -07:00
2017-07-03 02:22:52 -07:00
2017-07-10 10:51:53 -07:00
2017-07-10 16:32:34 -07:00
2017-07-10 16:32:34 -07:00
2017-07-03 16:56:28 -06:00
2016-02-22 08:51:38 +01:00
2017-06-30 12:00:51 -07:00
2017-02-14 08:29:56 -07:00
2017-06-28 14:45:21 -04:00
2010-03-24 16:31:22 -07:00
2017-06-07 15:32:12 +02:00
2017-07-14 12:37:41 -07:00
2016-04-19 16:54:26 -07:00
2017-06-12 10:54:47 +02:00
2017-07-03 16:14:51 -07:00
2014-01-21 20:18:26 -08:00
2017-04-20 12:09:55 -06:00
2017-07-06 20:57:13 -07:00
2017-07-06 16:24:29 -07:00
2017-07-19 08:55:18 -07:00
2015-06-25 17:00:38 -07:00
2017-07-19 08:55:18 -07:00
2013-11-15 09:32:21 +09:00
2015-12-07 00:02:05 +00:00
2008-04-30 08:29:54 -07:00
2017-06-12 13:20:20 +02:00
2017-04-18 18:01:52 +02:00
2008-06-04 14:56:12 +01:00
2015-11-24 09:56:43 +01:00
2016-08-02 16:11:27 -04:00
2017-06-09 11:45:25 +02:00
2017-06-22 15:43:47 +01:00
2011-09-23 12:05:29 +05:30
2013-09-13 15:09:52 +02:00
2017-05-26 10:10:46 +02:00
2017-07-14 13:12:32 -07:00
2017-07-03 18:08:06 -07:00
2017-07-12 16:26:00 -07:00
2017-06-09 11:52:07 +02:00
2017-07-19 08:55:18 -07:00
2017-07-10 16:32:31 -07:00
2015-11-16 09:27:32 +05:30
2017-07-19 08:55:18 -07:00
2013-05-12 14:16:21 +02:00
2017-05-16 08:44:22 -03:00
2016-07-26 16:19:19 -07:00
2017-01-20 14:32:39 -08:00
2017-03-03 01:45:28 +01:00
2017-05-05 15:54:45 +08:00
2016-09-06 13:08:40 +09:00
2017-07-07 09:44:06 -07:00
2017-07-07 09:49:24 +10:00
2016-06-05 10:36:01 -07:00
2017-06-19 11:03:51 -04:00
2016-09-26 22:16:41 +05:30
2017-07-14 16:09:55 -03:00
2017-06-28 06:55:00 -07:00
2017-01-31 09:03:20 +05:30
2015-09-08 15:35:28 -07:00
2017-06-15 13:46:00 +02:00
2016-06-13 21:43:05 -06:00
2016-08-04 08:50:07 -04:00
2014-09-29 00:04:55 -04:00
2013-03-03 23:59:59 -08:00
2012-10-13 10:46:48 +01:00
2017-06-18 10:08:55 -06:00
2015-04-14 16:49:05 -07:00
2017-05-08 17:15:11 -07:00
2017-03-02 08:42:36 +01:00
2008-01-28 23:21:18 +01:00
2016-05-27 16:03:22 -07:00
2016-05-17 15:48:12 -04:00
2017-07-06 07:02:24 -04:00
2017-06-20 12:18:27 +02:00
2017-07-12 16:26:01 -07:00
2017-02-03 08:28:25 -08:00
2016-10-06 09:07:44 -04:00
2017-07-10 16:32:35 -07:00
2017-04-04 11:22:42 +09:00
2016-10-03 09:11:14 -07:00
2016-05-02 16:24:49 +02:00
2013-09-26 15:06:58 -07:00
2012-10-13 10:46:48 +01:00
2016-10-15 10:03:15 -07:00
2016-12-05 19:01:16 -05:00
2017-07-06 16:24:30 -07:00
2009-06-18 19:50:21 +08:00
2017-07-03 18:44:02 -04:00
2017-03-29 14:50:21 -06:00
2009-12-17 10:58:17 -05:00
2017-06-30 12:00:51 -07:00
2017-07-19 08:55:18 -07:00
2017-07-09 09:31:22 -07:00
2017-06-23 19:59:08 -04:00
2017-06-09 11:52:08 +02:00
2012-10-13 10:46:48 +01:00
2017-07-07 20:09:10 -04:00
2017-07-20 09:27:29 -04:00
2017-07-12 13:32:46 +02:00
2009-06-18 13:04:05 -07:00
2016-05-10 15:43:09 -04:00
2006-09-30 01:47:55 +02:00
2017-07-12 16:26:03 -07:00
2016-05-28 15:48:31 -04:00
2017-06-30 13:49:53 -07:00
2013-04-30 10:09:06 +02:00
2017-07-10 11:11:25 +02:00
2017-06-15 14:25:38 +02:00
2017-06-30 04:14:14 -04:00
2017-07-10 16:32:31 -07:00
2017-07-15 12:00:42 -07:00
2017-06-12 20:48:05 -04:00
2016-09-05 13:52:38 +02:00
2012-10-13 10:46:48 +01:00
2017-07-08 21:51:43 +02:00
2017-06-09 09:27:32 -06:00
2017-06-30 09:47:24 +03:00
2016-05-03 16:00:54 -04:00
2017-06-16 11:48:40 -04:00
2017-07-01 07:39:08 -07:00
2017-06-21 14:37:12 -04:00
2017-06-20 07:25:17 -03:00
2017-07-01 07:39:08 -07:00
2017-07-05 09:54:15 +02:00
2017-03-24 20:51:49 -04:00
2017-07-10 16:32:34 -07:00
2014-05-14 16:40:04 -07:00
2016-07-13 17:27:24 -07:00
2017-07-09 10:24:46 -07:00
2012-10-09 16:22:40 +09:00
2012-10-09 16:22:39 +09:00
2012-03-20 12:47:48 +01:00
2017-07-10 10:51:53 -07:00
2012-12-09 00:20:28 -05:00
2014-09-23 23:13:13 -07:00
2017-06-30 12:00:51 -07:00
2017-07-19 08:55:18 -07:00
2017-01-05 15:01:55 -06:00
2017-06-22 18:21:25 +02:00
2017-07-04 12:46:16 +02:00
2017-06-22 18:29:34 +02:00
2015-09-16 15:47:51 +02:00
2017-07-17 09:22:34 -07:00
2013-04-29 15:42:02 -04:00
2007-07-31 15:39:40 -07:00
2017-02-01 09:13:58 +01:00
2013-11-13 12:09:07 +09:00
2017-07-12 16:25:59 -07:00
2014-10-14 15:05:34 -04:00
2017-07-12 16:26:00 -07:00
2017-06-30 12:00:51 -07:00
2017-07-03 21:13:25 -07:00
2017-07-10 16:32:31 -07:00
2017-07-06 16:24:34 -07:00
2017-06-30 12:00:51 -07:00
2012-07-21 10:34:00 -07:00
2017-07-19 08:55:18 -07:00
2017-07-08 11:05:34 +02:00
2017-05-08 17:15:14 -07:00
2016-12-12 18:55:06 -08:00
2017-06-26 10:39:40 +02:00
2017-07-10 12:28:46 +02:00
2017-06-20 12:18:27 +02:00
2011-09-16 19:20:20 -04:00
2013-07-03 16:07:43 -07:00
2017-06-05 15:29:22 -04:00
2017-07-03 16:54:58 -07:00
2013-01-06 01:11:25 -08:00
2009-06-16 19:47:57 -07:00
2017-07-10 16:32:33 -07:00
2017-03-08 09:38:43 +01:00
2017-07-19 15:33:50 -07:00
2015-01-25 23:16:29 -05:00
2017-03-02 12:17:22 -08:00
2015-11-25 09:22:02 -07:00
2017-07-19 08:55:18 -07:00
2015-08-10 14:29:27 +05:30
2012-03-16 10:38:24 -04:00
2017-01-14 11:31:50 +01:00
2017-06-22 10:29:53 -04:00
2017-01-04 13:22:38 -07:00
2017-07-06 16:24:35 -07:00
2017-07-06 16:24:35 -07:00
2017-07-06 16:24:35 -07:00
2017-02-24 17:46:56 -08:00
2017-07-06 16:24:34 -07:00
2016-05-19 19:12:14 -07:00
2017-07-12 16:26:04 -07:00
2017-05-18 16:59:06 +02:00
2017-06-16 11:48:37 -04:00
2017-02-24 17:46:54 -08:00
2017-06-30 12:00:51 -07:00
2017-07-07 18:39:15 -07:00
2017-06-20 15:42:32 -04:00
2016-07-26 16:19:19 -07:00
2017-07-10 16:32:33 -07:00
2017-05-23 10:04:41 +02:00
2017-07-19 08:55:18 -07:00
2015-03-12 18:46:08 -07:00
2017-07-02 15:37:23 -07:00
2017-06-30 12:00:51 -07:00
2009-04-01 07:38:54 -04:00
2016-07-01 23:45:18 +08:00
2017-06-30 12:00:51 -07:00
2017-06-29 13:50:38 -07:00
2017-06-19 22:06:28 -04:00
2017-04-14 10:05:36 +02:00
2017-07-08 11:23:29 +01:00
2017-07-17 17:01:10 +02:00
2017-07-01 07:39:08 -07:00
2017-07-13 16:00:15 -04:00
2017-07-13 16:00:12 -04:00
2017-07-21 11:51:19 -04:00
2017-07-13 17:12:07 -04:00
2017-07-13 16:00:15 -04:00
2017-07-12 16:26:02 -07:00
2017-07-06 16:24:32 -07:00
2017-07-06 16:24:35 -07:00
2016-02-16 13:04:58 -05:00
2017-07-06 11:30:07 -04:00
2017-07-10 09:09:57 +03:00
2017-07-20 08:41:56 -06:00
2017-07-10 14:27:39 +02:00
2017-06-22 11:14:48 -05:00
2017-05-17 10:21:16 +01:00
2017-06-13 14:00:16 -04:00
2017-05-22 18:01:46 +02:00
2017-07-10 15:23:45 -07:00
2017-06-19 22:06:28 -04:00
2013-03-29 17:54:33 -07:00
2017-05-26 10:10:37 +02:00
2017-07-10 16:32:31 -07:00
2017-07-06 16:24:31 -07:00
2017-07-07 19:38:17 -07:00
2014-04-03 16:21:00 -07:00
2012-10-13 10:46:48 +01:00
2017-06-30 12:00:51 -07:00
2016-11-17 18:47:58 -06:00
2017-07-07 13:41:28 -05:00
2017-06-07 12:20:49 +02:00
2017-07-08 15:51:57 -07:00
2017-06-20 15:42:32 -04:00
2017-03-22 19:18:43 -07:00
2017-03-16 09:57:08 +01:00
2017-07-05 12:31:59 -07:00
2016-03-14 15:43:11 -04:00
2017-07-03 02:01:15 -07:00
2017-06-30 12:00:51 -07:00
2017-03-02 08:42:38 +01:00
2017-07-03 08:31:43 +02:00
2016-06-28 00:42:10 +02:00
2017-06-13 15:15:08 +02:00
2017-06-24 01:41:55 +02:00
2017-06-28 01:52:52 +02:00
2017-06-28 01:52:52 +02:00
2017-06-11 17:08:19 -07:00
2017-06-20 12:18:27 +02:00
2017-06-25 21:58:46 -04:00
2017-06-08 16:29:28 +02:00
2012-10-13 10:46:48 +01:00
2016-03-02 17:13:02 -08:00
2017-03-03 01:43:47 +01:00
2011-03-31 11:26:23 -03:00
2017-06-30 12:00:51 -07:00
2017-06-28 22:49:11 +10:00
2017-06-22 02:55:34 +02:00
2016-12-12 19:56:15 -08:00
2017-05-18 10:07:40 -04:00
2017-07-03 15:12:52 -07:00
2017-06-06 20:01:15 +01:00
2016-03-17 15:09:34 -07:00
2017-06-22 11:46:48 -04:00
2010-02-08 18:19:41 -06:00
2017-07-15 12:44:02 -07:00
2010-02-10 17:47:17 -08:00
2017-06-29 10:48:57 +01:00
2012-05-17 15:18:37 +02:00
2017-06-08 18:52:26 -07:00
2017-06-08 18:52:26 -07:00
2017-06-08 18:52:40 -07:00
2017-06-08 18:52:40 -07:00
2017-06-08 18:52:40 -07:00
2017-06-08 18:18:19 +02:00
2017-07-02 11:24:36 +02:00
2017-07-03 16:20:28 +01:00
2012-03-24 10:08:39 -07:00
2017-04-04 17:36:10 +02:00
2017-05-21 13:11:00 -04:00
2017-06-14 00:00:42 +02:00
2016-02-24 09:12:45 +01:00
2017-05-01 10:26:40 -04:00
2017-05-03 15:52:10 -07:00
2017-05-03 15:52:09 -07:00
2017-01-18 10:43:15 -08:00
2007-05-02 11:56:33 +01:00
2017-07-12 23:11:23 +02:00
2017-06-08 10:35:49 +02:00
2017-05-27 18:51:41 -04:00
2017-06-07 17:15:46 +01:00
2017-04-14 14:06:52 -06:00
2017-06-15 14:30:14 +02:00
2017-07-19 08:55:18 -07:00
2017-07-01 09:08:42 -07:00
2017-08-14 13:46:46 -07:00
2012-10-13 10:46:48 +01:00
2017-06-23 11:55:57 +10:00
2016-04-30 09:26:55 -07:00
2017-07-19 08:55:18 -07:00
2015-02-13 21:21:39 -08:00
2016-10-07 18:46:30 -07:00
2017-05-18 17:38:24 +02:00
2017-01-19 14:17:05 +01:00
2012-10-13 10:46:48 +01:00
2017-07-06 16:24:30 -07:00
2014-07-02 16:01:51 +02:00
2017-06-30 12:00:51 -07:00
2015-02-12 18:54:09 -08:00
2017-07-06 20:57:13 -07:00
2017-05-18 10:07:40 -04:00
2017-07-05 12:31:59 -07:00
2017-07-12 16:26:03 -07:00
2017-07-06 16:24:30 -07:00
2017-06-15 12:12:40 -04:00
2005-04-16 15:20:36 -07:00
2017-01-12 09:33:39 +01:00
2017-06-08 08:25:29 -07:00
2017-06-08 18:52:42 -07:00
2017-06-08 18:52:35 -07:00
2017-06-08 18:52:38 -07:00
2016-03-25 16:37:42 -07:00
2008-05-26 16:15:32 +02:00
2017-03-08 09:18:02 +01:00
2010-08-09 16:48:44 -04:00
2012-02-24 10:05:59 +01:00
2017-05-26 10:10:36 +02:00
2016-04-21 10:47:26 +10:00
2017-07-15 12:00:42 -07:00
2017-06-09 11:00:46 +02:00
2017-06-15 00:55:44 +02:00
2017-07-06 16:24:31 -07:00
2017-07-10 16:32:33 -07:00
2017-07-10 16:32:30 -07:00
2005-04-16 15:20:36 -07:00
2017-05-27 15:38:06 -04:00
2011-03-15 00:43:46 +01:00
2017-07-19 08:55:18 -07:00
2017-05-25 18:30:51 +02:00
2015-06-25 17:00:39 -07:00
2017-07-03 16:56:25 -06:00
2017-03-02 08:42:29 +01:00
2013-12-07 01:03:14 +01:00
2017-06-29 22:21:21 -04:00
2010-05-27 09:12:51 -07:00
2017-07-06 20:57:13 -07:00
2017-06-20 22:13:59 -07:00
2017-03-03 01:45:39 +01:00
2017-01-10 18:31:55 -08:00
2015-04-22 17:06:49 +02:00
2010-11-29 08:55:25 +11:00
2017-07-20 09:27:29 -04:00
2014-11-19 22:01:15 -05:00
2016-11-22 17:40:00 -05:00
2015-11-05 19:34:48 -08:00
2017-06-13 17:10:57 -04:00
2017-06-30 12:00:51 -07:00
2017-07-19 08:55:18 -07:00
2017-07-08 10:15:02 -07:00
2016-02-10 13:19:03 +00:00
2015-12-18 17:48:50 -08:00
2017-07-10 07:40:49 -04:00
2017-04-18 16:54:19 +02:00
2017-06-30 12:00:51 -07:00
2005-04-16 15:20:36 -07:00
2011-06-15 20:04:00 -07:00
2017-06-30 12:00:51 -07:00
2017-07-05 17:09:27 -07:00
2016-04-06 16:14:24 +01:00
2017-06-22 16:15:45 -07:00
2017-07-13 12:23:54 -07:00
2017-07-06 16:24:35 -07:00
2017-05-12 15:57:15 -07:00
2017-07-06 16:24:35 -07:00
2017-07-05 09:54:14 +02:00
2017-06-09 11:54:54 +02:00
2017-06-20 12:19:14 +02:00
2017-06-20 12:19:14 +02:00
2012-10-13 10:46:48 +01:00
2017-06-06 10:15:20 -07:00
2017-03-22 20:11:33 -06:00
2014-08-08 15:57:26 -07:00