Re: Limiting SECCOMP audit events
On December 15, 2017 10:47:17 AM Tyler Hicks <tyhicks(a)canonical.com> wrote:
On 12/15/2017 08:08 AM, Paul Moore wrote:
...
> * Are we sure about removing the audit_enabled check? People got
pretty
> upset when it wasn't there in the past.
Do you have any references to the complaints so that we can understand
them better? I remember being surprised by commit 96368701 adding the
audit_enabled check (my fault for not watching the list closer) and
having to revert it in Ubuntu with a distro patch.
I'm somewhat limited at the moment (replying by phone) so I can't my find
it for you, but check the audit mailing list for the discussion.