Messages in this thread | | | From | Paul Moore <> | Date | Thu, 31 Mar 2022 10:16:23 -0400 | Subject | Re: [PATCH] audit: do a quick exit when syscall number is invalid |
| |
On Wed, Mar 30, 2022 at 10:29 PM CGEL <cgel.zte@gmail.com> wrote: > On Wed, Mar 30, 2022 at 10:48:12AM -0400, Paul Moore wrote: > > > > If audit is not generating SYSCALL records, even for invalid/ENOSYS > > syscalls, I would consider that a bug which should be fixed. > > If we fix this bug, do you think audit invalid/ENOSYS syscalls better > be forcible or be a rule that can be configure? I think configure is > better.
It isn't clear to me exactly what you are asking, but I would expect the existing audit syscall filtering mechanism to work regardless if the syscall is valid or not. Beware that there are some limitations to the audit syscall filter, which are unfortunately baked into the current design/implementation, which may affect this to some extent.
-- paul-moore.com
| |