Re: [PATCH v6 3/6] seccomp: Sysctl to configure actions that are allowed to be logged

On 08/11/2017 02:17 PM, Kees Cook wrote: > One thought here: should "kill" be always forced on during a write? > This flag effectively cannot be disabled, so listing it (or not) in > the sysctl may be confusing... "kill" can be silenced in the current implementation. Lets hammer out whether or not that's the right thing to do and then we can discuss the sysctl behavior on write. I don't personally have any concerns about an admin being able to silence RET_KILL logs but let me know if you are against it.