Re: [PATCH 0/3] audit: Measure and reduce syscall filtering overhead

[Paul Moore]

On Sun, Aug 23, 2026 at 2:10 PM Stanislav Kinsburskii
<skinsburskii@xxxxxxxxx> wrote:
> On Thu, Aug 06, 2026 at 06:01:18PM -0700, Stanislav Kinsburskii wrote:
> > This series adds a repeatable microbenchmark for audit's fixed syscall
> > overhead and uses it to address two cases where audit continues doing work
> > which cannot produce a record.
>
> A gentle ping on this series.

As I just mentioned to another submitter, your patch hit the mailing
list at a time when the audit/dev branch was closed to everything
except for critical fixes.  We have a doc, listed in the audit
MAINTAINERS entry, which describes the management of the audit tree
and our processes:

https://github.com/linux-audit/audit-kernel/blob/main/README.md

Beyond that, while I have briefly looked at your patchset, I haven't
had a chance yet to properly review it.  Given a quick glance, patch
2/3 seems good and reasonable; it even cleans up some macro ugliness,
which is very nice.  I'm not sure about enshrining an audit benchmark
in the kernel selftests, as you do in patch 1/3, although it might be
worthwhile as part of the audit-testsuite; I want to think on that a
bit more.  In the past others have proposed similar things as you've
done in patch 3/3, but I really dislike the idea of adding more
filtering to the audit filter; I'd much rather see what we can do to
fix/improve the existing filtering.

Anyway, that's where things are at, but it basically boils down to
"yes, I've seen your patches, and no I haven't finished reviewing them
yet; your patience is appreciated.".

--
paul-moore.com