Re: [PATCH v2 3/4] seccomp: Audit attempts to modify the actions_logged sysctl

[James Morris]

On Wed, 2 May 2018, Tyler Hicks wrote:

>  type=CONFIG_CHANGE msg=audit(1525275325.613:142): op=seccomp-logging
>  actions=kill_process,kill_thread,errno,trace,log
>  old-actions=kill_process,kill_thread,errno,trace,log res=1
> 
> No audit records are generated when reading the actions_logged sysctl.
> 
> Suggested-by: Steve Grubb <sgrubb@xxxxxxxxxx>
> Signed-off-by: Tyler Hicks <tyhicks@xxxxxxxxxxxxx>


Reviewed-by: James Morris <james.morris@xxxxxxxxxxxxx>

-- 
James Morris
<jmorris@xxxxxxxxx>