On Thu, 2016-12-29 at 01:52 +0200, Alchemist wrote:
> 2016-12-28 14:44 GMT+02:00 Patrick O'Callaghan <pocallaghan(a)gmail.com>:
>
>> On Tue, 2016-12-27 at 21:17 +0200, Alchemist wrote:
>>> 2016-12-27 21:00 GMT+02:00 Patrick O'Callaghan
<pocallaghan(a)gmail.com>:
>>>
>>>> On Tue, 2016-12-27 at 08:48 -0500, Tom Horsley wrote:
>>>>> On Tue, 27 Dec 2016 13:35:09 +0000
>>>>> Patrick O'Callaghan wrote:
>>>>>
>>>>>> b) can be turned off?
>>>>>
>>>>> Edit grub.cfg and put audit=0 on the kernel command line.
>>>>> Disable the auditd service.
>>>>> No more audit messages from anything :-).
>>>>
>>>> Wasn't really the question. I want to know what it's telling me
before
>>>> I decide whether to turn it off.
>>>>
>>>>
>>>>
>>>
>>>
http://billauer.co.il/blog/2015/08/linux-google-chrome-aw-snap-seccomp/
>>
>> Thanks, I had used ausearch to confirm these are SECCOMP errors, i.e.
>> problems with Chrome sandboxing (which apparently have been around for
>> a long time). However the URL above recommends just running Chrome
>> without the sandbox, which a) isn't a solution and b) is no longer
>> supported.
>>
>> Now that I know what it is, I can just ignore the audit errors.
>>
>>
>
> Yes, or you may add something like
>
> -a exclude,always -F msgtype=1326
> or
> -a exclude,always -F exe=/opt/google/chrome/chrome
>
> to /etc/audit/audit.rules
> systemctl restart auditd
systemctl doesn't work for this. You have to run "service restart auditd"
> see man auditctl
>
> Because depending on Your Chrome usage, it could flood logs and make
> difficult to search something truly important.
I've tried the second version (excluding the executable) but I'm still getting
floods of audit messages:
$ sudo auditctl exclude exe="/opt/google/chrome/chrome"
$ journal -e
Dec 29 11:53:42 bree audit[4208]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=4208
comm="chrome" exe="/opt/google/chrome/chrome" sig=0 arch=c000003e
syscall=2 compat=0 ip=0x7f6
Dec 29 11:53:42 bree audit[4208]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=4208
comm="chrome" exe="/opt/google/chrome/chrome" sig=0 arch=c000003e
syscall=2 compat=0 ip=0x7f6
Dec 29 11:53:51 bree audit[4208]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=4208
comm="chrome" exe="/opt/google/chrome/chrome" sig=0 arch=c000003e
syscall=2 compat=0 ip=0x7f6
Dec 29 11:53:51 bree audit[4208]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=4208
comm="chrome" exe="/opt/google/chrome/chrome" sig=0 arch=c000003e
syscall=2 compat=0 ip=0x7f6
Dec 29 11:54:00 bree audit[4208]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=4208
comm="chrome" exe="/opt/google/chrome/chrome" sig=0 arch=c000003e
syscall=2 compat=0 ip=0x7f6
Dec 29 11:54:00 bree audit[4208]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=4208
comm="chrome" exe="/opt/google/chrome/chrome" sig=0 arch=c000003e
syscall=2 compat=0 ip=0x7f6
Dec 29 11:54:09 bree audit[4208]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=4208
comm="chrome" exe="/opt/google/chrome/chrome" sig=0 arch=c000003e
syscall=2 compat=0 ip=0x7f6
Dec 29 11:54:09 bree audit[4208]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=4208
comm="chrome" exe="/opt/google/chrome/chrome" sig=0 arch=c000003e
syscall=2 compat=0 ip=0x7f6
Dec 29 11:54:20 bree audit[4208]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=4208
comm="chrome" exe="/opt/google/chrome/chrome" sig=0 arch=c000003e
syscall=2 compat=0 ip=0x7f6
Dec 29 11:54:20 bree audit[4208]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=4208
comm="chrome" exe="/opt/google/chrome/chrome" sig=0 arch=c000003e
syscall=2 compat=0 ip=0x7f6
Dec 29 11:54:27 bree audit[4208]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=4208
comm="chrome" exe="/opt/google/chrome/chrome" sig=0 arch=c000003e
syscall=2 compat=0 ip=0x7f6
Dec 29 11:54:27 bree audit[4208]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=4208
comm="chrome" exe="/opt/google/chrome/chrome" sig=0 arch=c000003e
syscall=2 compat=0 ip=0x7f6
Dec 29 11:54:39 bree audit[4208]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3
subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=4208
comm="chrome" exe="/opt/google/chrome/chrome" sig=0 arch=c000003e
syscall=2 compat=0 ip=0x7f6
etc. etc.
The audit documentation is not helpful. Any ideas?
Have you tried
# semanage boolean --on unconfined_chrome_sandbox_transition
which "allows unconfined to chrome sandbox transition". I have it set on
my machine and I don't get those alerts. YMMV
----------------------------------------------------------------------
- Rick Stevens, Systems Engineer, AllDigital ricks(a)alldigital.com -
- AIM/Skype: therps2 ICQ: 226437340 Yahoo: origrps2 -
- -
- Charter Member of the International Sarcasm Society -
- "Yeah, like we need YOUR support!" -
----------------------------------------------------------------------