On Tue, Jun 16, 2020 at 12:49 AM Kees Cook [off-list ref] wrote:

For systems that provide multiple syscall maps based on architectures
(e.g. AUDIT_ARCH_X86_64 and AUDIT_ARCH_I386 via CONFIG_COMPAT), allow
a fast way to pin the process to a specific syscall mapping, instead of
needing to generate all filters with an architecture check as the first
filter action.

Can you allow specification of the reject action?  I can see people
wanting TRAP instead, for example.