Tyler Hicks
0ddec0fc89
seccomp: Sysctl to configure actions that are allowed to be logged ...
Adminstrators can write to this sysctl to set the seccomp actions that
are allowed to be logged. Any actions not found in this sysctl will not
be logged.
For example, all SECCOMP_RET_KILL, SECCOMP_RET_TRAP, and
SECCOMP_RET_ERRNO actions would be loggable if "kill trap errno" were
written to the sysctl. SECCOMP_RET_TRACE actions would not be logged
since its string representation ("trace") wasn't present in the sysctl
value.
The path to the sysctl is:
/proc/sys/kernel/seccomp/actions_logged
The actions_avail sysctl can be read to discover the valid action names
that can be written to the actions_logged sysctl with the exception of
"allow". SECCOMP_RET_ALLOW actions cannot be configured for logging.
The default setting for the sysctl is to allow all actions to be logged
except SECCOMP_RET_ALLOW. While only SECCOMP_RET_KILL actions are
currently logged, an upcoming patch will allow applications to request
additional actions to be logged.
There's one important exception to this sysctl. If a task is
specifically being audited, meaning that an audit context has been
allocated for the task, seccomp will log all actions other than
SECCOMP_RET_ALLOW despite the value of actions_logged. This exception
preserves the existing auditing behavior of tasks with an allocated
audit context.
With this patch, the logic for deciding if an action will be logged is:
if action == RET_ALLOW:
do not log
else if action == RET_KILL && RET_KILL in actions_logged:
log
else if audit_enabled && task-is-being-audited:
log
else:
do not log
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
2017-08-14 13:46:45 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2017-07-20 16:33:39 -07:00
mm, cpuset: always use seqlock when changing task's nodemask
2017-07-06 16:24:34 -07:00
config: android-base: disable CONFIG_NFSD and CONFIG_NFS_FS
2017-06-09 11:47:38 +02:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>
2017-03-02 08:42:34 +01:00
Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2017-07-21 11:12:48 -07:00
gcov: support GCC 7.1
2017-05-12 15:57:15 -07:00
genirq/PM: Properly pretend disabled state when force resuming interrupts
2017-07-17 22:32:20 +02:00
livepatch: Fix stacking of patches with respect to RCU
2017-06-20 10:42:19 +02:00
Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2017-07-21 11:11:23 -07:00
More power management updates for v4.13-rc1
2017-07-10 15:16:21 -07:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk
2017-07-05 11:11:26 -07:00
rcu: Remove RCU CPU stall warnings from Tiny RCU
2017-06-08 18:52:45 -07:00
Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2017-07-21 11:16:12 -07:00
Merge branch 'timers-compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-07-05 15:34:35 -07:00
trace: fix the errors caused by incompatible type of RCU variables
2017-07-20 09:27:29 -04:00
sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>
2017-03-02 08:42:39 +01:00
async: Adjust system_state checks
2017-05-23 10:01:37 +02:00
Merge branch 'stable-4.13' of git://git.infradead.org/users/pcmoore/audit
2017-07-20 10:22:26 -07:00
audit: style fix
2017-06-12 18:07:43 -04:00
Merge branch 'fsnotify' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2017-05-03 11:05:15 -07:00
Merge branch 'fsnotify' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2017-05-03 11:05:15 -07:00
Merge branch 'fsnotify' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2017-05-03 11:05:15 -07:00
audit: kernel generated netlink traffic should have a portid of 0
2017-05-02 10:16:05 -04:00
Merge branch 'stable-4.13' of git://git.infradead.org/users/pcmoore/audit
2017-07-05 11:24:05 -07:00
Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-07-06 20:57:13 -07:00
smp/hotplug: Replace BUG_ON and react useful
2017-07-11 22:25:44 +02:00
kdump: protect vmcoreinfo data under the crash memory
2017-07-12 16:26:00 -07:00
doc: ReSTify credentials.txt
2017-05-18 10:30:19 -06:00
sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>
2017-03-02 08:42:39 +01:00
kernel/exit.c: avoid undefined behaviour when calling wait4()
2017-07-10 16:32:36 -07:00
lib/extable.c: use bsearch() library function in search_extable()
2017-07-10 16:32:35 -07:00
fork,random: use get_random_canary() to set tsk->stack_canary
2017-07-12 16:26:03 -07:00
Now that IPC and other changes have landed, enable manual markings for
2017-07-19 08:55:18 -07:00
kernel/groups.c: use sort library function
2017-07-10 16:32:34 -07:00
kernel/hung_task.c: defer showing held locks
2017-05-08 17:15:10 -07:00
jump_label: Reorder hotplug lock and jump_label_lock
2017-05-26 10:10:45 +02:00
kernel/kallsyms.c: replace all_var with IS_ENABLED(CONFIG_KALLSYMS_ALL)
2017-07-10 16:32:34 -07:00
kcmp: add KCMP_EPOLL_TFD mode to compare epoll target files
2017-07-12 16:26:01 -07:00
kcov: simplify interrupt check
2017-05-08 17:15:12 -07:00
kdump: protect vmcoreinfo data under the crash memory
2017-07-12 16:26:00 -07:00
kdump: protect vmcoreinfo data under the crash memory
2017-07-12 16:26:00 -07:00
kexec_file: adjust declaration of kexec_purgatory
2017-07-12 16:26:02 -07:00
kexec_file: adjust declaration of kexec_purgatory
2017-07-12 16:26:02 -07:00
kmod: throttle kmod thread limit
2017-07-14 15:05:13 -07:00
kprobes: Ensure that jprobe probepoints are at function entry
2017-07-08 11:05:35 +02:00
kexec: move vmcoreinfo out of the kernel's .bss section
2017-07-12 16:25:59 -07:00
cgroup, kthread: close race window where new kthreads can be migrated to non-root cgroups
2017-03-17 10:18:47 -04:00
sched/headers: Prepare to move sched_info_on() and force_schedstat_enabled() from <linux/sched.h> to <linux/sched/stat.h>
2017-03-02 08:42:39 +01:00
kernel/watchdog: split up config options
2017-07-12 16:26:02 -07:00
Fix: Disable sys_membarrier when nohz_full is enabled
2017-01-23 11:32:16 -08:00
mm, memory_hotplug: replace for_device by want_memblock in arch_add_memory
2017-07-06 16:24:32 -07:00
Modules updates for v4.13
2017-07-12 17:22:01 -07:00
kernel/notifier.c: simplify expression
2017-02-24 17:46:56 -08:00
perf: Add PERF_RECORD_NAMESPACES to include namespaces related info
2017-03-13 15:57:41 -03:00
padata: Avoid nested calls to cpus_read_lock() in pcrypt_init_padata()
2017-05-26 10:10:37 +02:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h>
2017-03-02 08:42:34 +01:00
boot/param: Move next_arg() function to lib/cmdline.c for later reuse
2017-04-18 10:37:13 +02:00
mm: update callers to use HASH_ZERO flag
2017-07-06 16:24:33 -07:00
pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
2017-05-13 17:26:01 -05:00
sched/headers: Prepare to move sched_info_on() and force_schedstat_enabled() from <linux/sched.h> to <linux/sched/stat.h>
2017-03-02 08:42:39 +01:00
ptrace: Properly initialize ptracer_cred on fork
2017-05-23 07:40:44 -05:00
Merge branch 'work.splice' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2017-05-02 11:38:06 -07:00
seccomp: Sysctl to configure actions that are allowed to be logged
2017-08-14 13:46:45 -07:00
kernel/signal.c: avoid undefined behaviour in kill_something_info
2017-07-10 16:32:36 -07:00
smp, cpumask: Use non-atomic cpumask_{set,clear}_cpu()
2017-05-23 10:01:32 +02:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>
2017-03-02 08:42:35 +01:00
sched/core: Remove 'task' parameter and rename tsk_restore_flags() to current_restore_flags()
2017-04-11 09:06:32 +02:00
stacktrace/x86: add function for detecting reliable stack traces
2017-03-08 09:18:02 +01:00
stop_machine: Provide stop_machine_cpuslocked()
2017-05-26 10:10:36 +02:00
fix a braino in compat_sys_getrlimit()
2017-07-12 09:15:00 -07:00
kernel/watchdog: split up config options
2017-07-12 16:26:02 -07:00
kernel/sysctl_binary.c: check name array length in deprecated_sysctl_warning()
2017-07-12 16:26:00 -07:00
taskstats: add e/u/stime for TGID command
2017-05-08 17:15:12 -07:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/clock.h>
2017-03-02 08:42:27 +01:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task.h>
2017-03-02 08:42:35 +01:00
sched/headers: Prepare to move cputime functionality from <linux/sched.h> into <linux/sched/cputime.h>
2017-03-02 08:42:39 +01:00
ucount: Remove the atomicity from ucount->count
2017-03-06 15:26:37 -06:00
sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h>
2017-03-02 08:42:31 +01:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/user.h>
2017-03-02 08:42:29 +01:00
sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>
2017-03-02 08:42:29 +01:00
sched/headers: Prepare to move the task_lock()/unlock() APIs to <linux/sched/task.h>
2017-03-02 08:42:38 +01:00
sched/headers: Remove <linux/rwsem.h> from <linux/sched.h>
2017-03-03 01:45:36 +01:00
kernel/watchdog.c: use better pr_fmt prefix
2017-07-14 15:05:13 -07:00
kernel/watchdog: split up config options
2017-07-12 16:26:02 -07:00
sched/wait: Rename wait_queue_t => wait_queue_entry_t
2017-06-20 12:18:27 +02:00
0ddec0fc89