audit: Don't spam logs with SECCOMP_KILL/RET_ERRNO by default

From: Andi Kleen <[email protected]>

When I run chrome on my opensuse system every time I open a new tab the system log is spammed with:

audit[16857]: SECCOMP auid=1000 uid=1000 gid=100 ses=1 pid=16857 comm="chrome" exe="/opt/google/chrome/chrome" sig=0 arch=c000003e syscall=273 compat=0 ip=0x7fe27c11a444 code=0x50000

This happens because chrome uses SECCOMP for its sandbox, and for some reason always reaches a SECCOMP_KILL or more likely SECCOMP_RET_ERRNO in the rule set.

The seccomp auditing was originally added by Eric with

commit 85e7bac33b8d5edafc4e219c7dfdb3d48e0b4e31
Author: Eric Paris <[email protected]>
Date: Tue Jan 3 14:23:05 2012 -0500

seccomp: audit abnormal end to a process due to seccomp

The audit system likes to collect information about processes that end abnormally (SIGSEGV) as this may me useful intrusion detection information. This patch adds audit support to collect information when seccomp forces a task to exit because of misbehavior in a similar way.

I don't have any other syscall auditing enabled, just the standard user space auditing used by the systemd and PAM userland. So basic auditing is alwas enabled, but no other kernel auditing.

Add a sysctl to enable this unconditional behavior with default to off. This replaces an earlier patch that simply checked whether syscall auditing was on, but Paul Moore preferred this more elaborate approach.

v2: Use correct ifdef that checks for CONFIG_SECCOMP too.

---
 Documentation/sysctl/kernel.txt |  9 +++++++++
 include/linux/audit.h           |  4 +++-
 kernel/seccomp.c                |  4 ++++
 kernel/sysctl.c                 | 11 +++++++++++
 4 files changed, 27 insertions(+), 1 deletion(-)

index 57653a4..abc6ef9 100644
@@ -21,6 +21,7 @@ show up in /proc/sys/kernel:
 - acct
 - acpi_video_flags
 - auto_msgmni
+- audit_log_seccomp
 - bootloader_type	     [ X86 only ]
 - bootloader_version	     [ X86 only ]
 - callhome		     [ S390 only ]

@@ -129,6 +130,14 @@ upon memory add/remove or upon ipc namespace creation/removal.
 Echoing "1" into this file enabled msgmni automatic recomputing.
 Echoing "0" turned it off. auto_msgmni default value was 1.
 
+==============================================================
+
+audit_log_seccomp
+
+When this variable is set to 1 every SECCOMP_KILL/SECCOMP_RET_ERRNO
+results in an audit log. This is generally a bad idea because
+it leads to a audit message every time Chrome opens a new tab.
+Defaults to 0.
 
 ==============================================================
 

index e38e3fc..c7787ba 100644
@@ -315,9 +315,11 @@ static inline void audit_inode_child(struct inode *parent,
 }
 void audit_core_dumps(long signr);
 
+extern int audit_log_seccomp;
+
 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
 {
-	if (!audit_enabled)
+	if (!audit_enabled || !audit_log_seccomp)
 		return;
 
 	/* Force a record to be reported if a signal was delivered. */

index e1e5a35..09a8b03 100644
@@ -25,6 +25,10 @@
 #include <asm/syscall.h>
 #endif
 
+#ifdef CONFIG_AUDIT
+int audit_log_seccomp __read_mostly = 0;
+#endif
+
 #ifdef CONFIG_SECCOMP_FILTER
 #include <linux/filter.h>
 #include <linux/pid.h>

index 725587f..997377d 100644
@@ -65,6 +65,7 @@
 #include <linux/sched/sysctl.h>
 #include <linux/kexec.h>
 #include <linux/bpf.h>
+#include <linux/audit.h>
 
 #include <asm/uaccess.h>
 #include <asm/processor.h>

@@ -529,6 +530,16 @@ static struct ctl_table kern_table[] = {
 		.proc_handler	= proc_dointvec,
 	},
 #endif
+#if defined(CONFIG_AUDIT) && defined(CONFIG_SECCOMP)
+	{
+		.procname	= "audit-log-seccomp",
+		.data		= &audit_log_seccomp,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec,
+	},
+
+#endif
 	{
 		.procname	= "print-fatal-signals",
 		.data		= &print_fatal_signals,

2.7.4