Re: [PATCH v2 3/4] seccomp: Audit attempts to modify the actions_logged sysctl
On Wed, 2 May 2018, Tyler Hicks wrote:
type=CONFIG_CHANGE msg=audit(1525275325.613:142):
op=seccomp-logging
actions=kill_process,kill_thread,errno,trace,log
old-actions=kill_process,kill_thread,errno,trace,log res=1
No audit records are generated when reading the actions_logged sysctl.
Suggested-by: Steve Grubb <sgrubb(a)redhat.com>
Signed-off-by: Tyler Hicks <tyhicks(a)canonical.com>
Reviewed-by: James Morris <james.morris(a)microsoft.com>
--
James Morris
<jmorris(a)namei.org>