Re: [PATCH] audit: do a quick exit when syscall number is invalid
On Wed, Mar 30, 2022 at 10:29 PM CGEL <cgel.zte(a)gmail.com> wrote:
On Wed, Mar 30, 2022 at 10:48:12AM -0400, Paul Moore wrote:
>
> If audit is not generating SYSCALL records, even for invalid/ENOSYS
> syscalls, I would consider that a bug which should be fixed.
If we fix this bug, do you think audit invalid/ENOSYS syscalls better
be forcible or be a rule that can be configure? I think configure is
better.
It isn't clear to me exactly what you are asking, but I would expect
the existing audit syscall filtering mechanism to work regardless if
the syscall is valid or not. Beware that there are some limitations
to the audit syscall filter, which are unfortunately baked into the
current design/implementation, which may affect this to some extent.
--
paul-moore.com