3 ms·
At least on my distro (OpenSUSE Tumbleweed, systemd 249, kernel 5.16.0), SystemCallLog doesn't fire for calls that are filtered; the process is killed first. Ev
by Arnavion 5y ago
At least on my distro (OpenSUSE Tumbleweed, systemd 249, kernel 5.16.0), SystemCallLog doesn't fire for calls that are filtered; the process is killed first. Even if I set SystemCallErrorNumber=EPERM I don't see the audit log generated. The log only gets generated if the syscall wasn't filtered.
- growse 5y agoHow strange. If I take a service and set SystemCallFilter=@basic-io SystemCallLog=~@basic-io and then restart it, I get a bunch of audit SECCOMP log messages (and the service fails to start): audit[1185972]: SECCOMP auid=4294967295 uid=63946 gid=63946 ses=4294967295 subj==unconfined pid=1185972 comm="(t-online)" exe="/usr/lib/systemd/systemd" sig=0 arch=c000003e syscall=59 compat=0 ip=0x7f5c632f66c7 code=0x7ffc0000 This is debian bullseye and systemd 247. I wonder if your audit logs are going somewhere else?