The seccomp path was using AUDIT_ANOM_ABEND from when seccomp mode 1 could only kill a process. While we still want to make sure an audit record is forced on a kill, this should use a separate record type since seccomp mode 2 introduces other behaviors. In the case of "handled" behaviors (process wasn't killed), only emit a record if the process is under inspection. This change also fixes userspace examination of seccomp audit events, since it was considered malformed due to missing fields of the AUDIT_ANOM_ABEND event type.
Showing the changes to include/uapi/linux (1 of 3 files). Show all
Unified · Split
| @@ -106,6 +106,7 @@ · 105 unmodified lines | ||
| 106 | 106 | #define AUDIT_MMAP 1323 /* Record showing descriptor and flags in mmap */ |
| 107 | 107 | #define AUDIT_NETFILTER_PKT 1324 /* Packets traversing netfilter chains */ |
| 108 | 108 | #define AUDIT_NETFILTER_CFG 1325 /* Netfilter chain modifications */ |
| 109 | +#define AUDIT_SECCOMP 1326 /* Secure Computing event */ | |
| 109 | 110 | |
| 110 | 111 | #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ |
| 111 | 112 | #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ |