search

mistifyio / mistify

The Mistify monorepo
http://mistify.io
MIT License
1 stars 0 forks source link

Investigate System Call Auditing #42

Open pjnorton opened 8 years ago

pjnorton commented 8 years ago

As part of developing secure containers in Mistify, investigate what exists and needs to be added/augmented for auditing sys calls.

trisk commented 8 years ago

SECCOMP_RET_KILL calls audit_seccomp() with SIGSYS as the second parameter (signr) explicitly, while SECCOMP_RET_ERRNO and SECCOMP_RET_TRAP call audit_seccomp() with 0 as the second parameter.

audit_seccomp is a no-op if signr is 0, so it only prints an audit trace if the process is killed.

However, our phase1 filter returns SECCOMP_PHASE1_SKIP which may allow _TIF_SYSCALL_AUDIT to work if requested.