Re: [PATCH] audit: set TIF_AUDIT_SYSCALL only if audit filter has been populated
On Sat, Mar 10, 2018 at 10:15 AM, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Wed, 7 Mar 2018 18:43:42 -0500
Paul Moore <paul(a)paul-moore.com> wrote:
> ... and I just realized that linux-audit isn't on the To/CC line,
> adding them now.
>
> Link to the patch is below.
>
> * https://marc.info/?t=152041887600003&r=1&w=2
Yes...I wished I was in on the beginning of this discussion. Here's the
problem. We need all tasks auditable unless specifically dismissed as
uninteresting. This would be a task,never rule.
The way we look at it, is if it boots with audit=1, then we know auditd
is expected to run at some point. So, we need all tasks to stay
auditable. If they weren't and auditd enabled auditing, then we'd need
to walk the whole proctable and stab TIF_AUDIT_SYSCALL into every
process in the system. It was decided that this is too ugly.
When was that decided? That's what this patch does.