search

pjnorton / lochness

0 stars 0 forks source link

Investigate System Call Auditing #42

Open pjnorton opened 8 years ago

pjnorton commented 8 years ago

Issue by pjnorton Mon Feb 29 20:01:28 2016 Originally opened as https://github.com/mistifyio/mistify/issues/42

As part of developing secure containers in Mistify, investigate what exists and needs to be added/augmented for auditing sys calls.

pjnorton commented 8 years ago

Comment by trisk Wed Mar 2 16:29:17 2016

SECCOMP_RET_KILL calls audit_seccomp() with SIGSYS as the second parameter (signr) explicitly, while SECCOMP_RET_ERRNO and SECCOMP_RET_TRAP call audit_seccomp() with 0 as the second parameter.

audit_seccomp is a no-op if signr is 0, so it only prints an audit trace if the process is killed.

However, our phase1 filter returns SECCOMP_PHASE1_SKIP which may allow _TIF_SYSCALL_AUDIT to work if requested.