Dear Maintainer,

  The error shows up every time when cpu "online" event triggers "kdump-config try-reload",
with error message : "kdump-config: failed to unload kdump kernel" (in syslog), due to
kexec_load system call (belongs to "@reboot" set) is missing in whitelist i.e. "SystemCallFilter"
setting in systemd-udevd.service.
  In SMP system, performing the following command can trigger cpu "online" event:
echo 0 > /sys/devices/system/cpu/cpu1/online
echo 1 > /sys/devices/system/cpu/cpu1/online
  kdump kernel is expected to be unloaded and reloaded successfully in this scenario rather than
getting such error message.

Control: reassign -1 kdump-tools 1:1.8.1
"kdump-config try-reload",
(in syslog), due to
whitelist i.e. "SystemCallFilter" 
"online" event:
in this scenario rather than

There is no such rule in the udev package, it comes from kdump-tools:

https://sources.debian.org/data/main/k/kdump-tools/1%3A1.10.3/debian/kdump-tools.udev

If a package adds rules that require additional permissions, then it's
that package that needs to ship a drop-in to allow them, otherwise the
attack surface is increased even for those that don't use it.

kdump-tools maintainers, please ship a drop-in like this together with
your udev rule:

/usr/lib/systemd/system/systemd-udevd.service.d/debian-kdump-tools-
kexec.conf
[Service]
SystemCallFilter=@reboot

(note that I haven't tested this)