From mboxrd@z Thu Jan  1 00:00:00 1970
From: Paul Moore <paul@paul-moore.com>
Subject: Re: Limiting SECCOMP audit events
Date: Fri, 15 Dec 2017 15:54:16 -0500
Message-ID: <1605bf4c4c0.280e.85c95baa4474aabc7814e68940a78392@paul-moore.com>
References: <58203247.sCqcla2mis@x2>
	<36cd827f-201c-8f76-2883-ecd930cbb1f4@canonical.com>
	<3499769.OM7YpPIT3e@x2> <20171214230629.GA451@sec>
	<1605a80e588.280e.85c95baa4474aabc7814e68940a78392@paul-moore.com>
	<20171215154713.GA16170@sec>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (ext-mx02.extmail.prod.ext.phx2.redhat.com
	[10.5.110.26])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id BD99265EB7
	for <linux-audit@redhat.com>; Fri, 15 Dec 2017 20:54:23 +0000 (UTC)
Received: from mail-io0-f193.google.com (mail-io0-f193.google.com
	[209.85.223.193])
	(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
	(No client certificate requested)
	by mx1.redhat.com (Postfix) with ESMTPS id 82B05883B8
	for <linux-audit@redhat.com>; Fri, 15 Dec 2017 20:54:22 +0000 (UTC)
Received: by mail-io0-f193.google.com with SMTP id s37so3947315ioe.10
	for <linux-audit@redhat.com>; Fri, 15 Dec 2017 12:54:22 -0800 (PST)
In-Reply-To: <20171215154713.GA16170@sec>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Tyler Hicks <tyhicks@canonical.com>, Steve Grubb <sgrubb@redhat.com>
Cc: Linux Audit <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com

On December 15, 2017 10:47:17 AM Tyler Hicks <tyhicks@canonical.com> wrote:
> On 12/15/2017 08:08 AM, Paul Moore wrote:

...

>> * Are we sure about removing the audit_enabled check? People got pretty
>> upset when it wasn't there in the past.
>
> Do you have any references to the complaints so that we can understand
> them better? I remember being surprised by commit 96368701 adding the
> audit_enabled check (my fault for not watching the list closer) and
> having to revert it in Ubuntu with a distro patch.

I'm somewhat limited at the moment (replying by phone) so I can't my find
it for you, but check the audit mailing list for the discussion.