Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752800AbdG1U4f (ORCPT ); Fri, 28 Jul 2017 16:56:35 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:49851 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752614AbdG1U4e (ORCPT ); Fri, 28 Jul 2017 16:56:34 -0400 From: Tyler Hicks To: Kees Cook Cc: Andy Lutomirski , Will Drewry , Paul Moore , Eric Paris , John Crispin , linux-audit@redhat.com, linux-kernel@vger.kernel.org, linux-api@vger.kernel.org Subject: [PATCH v5 0/6] Improved seccomp logging Date: Fri, 28 Jul 2017 20:55:46 +0000 Message-Id: <1501275352-30045-1-git-send-email-tyhicks@canonical.com> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 590 Lines: 14 This is an update to the previous seccomp logging patch sets. The main difference in this revision compared to the last is that the application now has the ability to request that all actions in a filter, except for RET_ALLOW, should be logged. This is done with a new filter flag. In support of that change, the log_max_action sysctl was renamed to actions_logged as it now lists the actions that an admin has allowed to be logged. The admin has the final say in what actions get logged. Please see the individual patches for summaries of changes since the last revision. Thanks! Tyler