Messages in this thread | | | From | Andy Lutomirski <> | Date | Wed, 14 Mar 2018 00:22:22 +0000 | Subject | Re: [PATCH] audit: set TIF_AUDIT_SYSCALL only if audit filter has been populated |
| |
On Sat, Mar 10, 2018 at 10:15 AM, Steve Grubb <sgrubb@redhat.com> wrote: > On Wed, 7 Mar 2018 18:43:42 -0500 > Paul Moore <paul@paul-moore.com> wrote: >> ... and I just realized that linux-audit isn't on the To/CC line, >> adding them now. >> >> Link to the patch is below. >> >> * https://marc.info/?t=152041887600003&r=1&w=2 > > Yes...I wished I was in on the beginning of this discussion. Here's the > problem. We need all tasks auditable unless specifically dismissed as > uninteresting. This would be a task,never rule. > > The way we look at it, is if it boots with audit=1, then we know auditd > is expected to run at some point. So, we need all tasks to stay > auditable. If they weren't and auditd enabled auditing, then we'd need > to walk the whole proctable and stab TIF_AUDIT_SYSCALL into every > process in the system. It was decided that this is too ugly.
When was that decided? That's what this patch does.
| |