CONFIG_AUDITSYSCALL has pointless overhead

[Andrew Lutomirski]

[emailing maintainers directly because the list is subscribers-only]

$ sudo auditctl -l
No rules

<system call overhead is 68 ns>

$ sudo auditctl -A task,never

<system call overhead is now 42 ns>

This is on Fedora 15 on kernel.org's 2.6.39 and various 3.0 rc builds
on Sandy Bridge.  The auditing path that, as far as I can tell, does
nothing accounts for over one third of system call overhead.  (On
older machines this effect is a little less impressive because all
system calls are quite a bit slower.  It still takes 40ns on Nehalem,
but the base cost is closer to 120 ns.)

The culprit seems to be audit_alloc in auditsc.c, which sets
TIF_SYSCALL_AUDIT even when there isn't anything to audit.  Maybe
something else in the kernel needs audit_set_auditable, but then the
docs should indicate that setting syscall auditing to never is
different from having no rules at all.  This seems unlikely.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/