Re: seccomp and audit_enabled
On 10/13/2015 12:19 PM, Paul Moore wrote:
Yes, if systemd is involved it enables audit; we've had some
discussions with the systemd folks about fixing that, but they haven't
gone very far. I'm still a little curious as to why
audit_dummy_context() is false in this case, but I haven't looked at
how systemd/auditctl start/config the system too closely.
Sorry for the delay here.
A context is allocated by audit_alloc() because there is no uid/gid filter for the task
but the dummy flag is left false. Because audit has been disabled (manually following
systemd enabling),
dummy never gets set in the syscall entry path (based on !audit_n_rules). So the
unlikely(!audit_dummy_context())
in audit_seccomp succeeds.
Tony