> What kernel version are you using? I believe we fixed that in Linux > 4.5 with the following:
This is 4.6-rc2. > > commit 96368701e1c89057bbf39222e965161c68a85b4b > From: Paul Moore <pmo...@redhat.com> > Date: Wed, 13 Jan 2016 10:18:55 -0400 (09:18 -0500) > > audit: force seccomp event logging to honor the audit_enabled flag No you didn't fix it because audit_enabled is always enabled by systemd for user space auditing, see the original description of my patch. -Andi
