Re: Limiting SECCOMP audit events
On Thursday, December 14, 2017 10:04:48 AM EST Tyler Hicks wrote:
On 12/13/2017 05:58 PM, Steve Grubb wrote:
> Over the last month, the amount of seccomp events in audit logs is
> sky-rocketing. I have over a million events in the last 2 days. Most of
> this is generated by firefox and qt webkit.
>
> I am wondering if the audit package should ship a file for
>
> /usr/lib/sysctl.d/60-auditd.conf
>
> wherein it has
>
> kernel.seccomp.actions_logged = kill_process kill_thread errno
I agree with Kees here. IMO, you only want "kill_process kill_thread"
which is the default.
The default appears to be all of the types of events without setting
kernel.seccomp.actions_logged.
> Also, has anyone verified this sysctl is filtering audit events?
Even
> with the above, I have over a million events on a 4.14.3 kernel. Firefox
> alone is generating over 50,000 events per hour.
Yes. I tested it a lot as the changes were being upstreamed and again
when I backported the changes to Ubuntu releases 17.10, 17.04, and 16.04
LTS. Those kernels have been released for a month and a half now and I
haven't heard of any issues.
Apparently I misunderstood this as a filter for audit events to be blocked.
I'll install a Fedora VM and see if I can determine what's
happening.
I'm testing on F27 if that matters. It would appear to me that seccomp filtering is
becoming more used and is now dominating the events going into the audit logs.
# uptime
10:17:34 up 1:27, 1 user, load average: 0.23, 0.39, 0.53
[root@x2 ~]# ausearch --start today --raw | aureport --event --summary -i
Event Summary Report
======================
total type
======================
35561 SECCOMP
1041 SYSCALL
134 SERVICE_START
75 NETFILTER_CFG
46 SERVICE_STOP
46 CONFIG_CHANGE
24 AVC
All of the seccomp events are trap types.
-Steve
Attachments:
- attachment.html (text/html — 9.8 KB)