Re: [PATCH] audit: speedup for syscalls when auditing is disabled

[Eric Paris]

On Tue, 2010-08-24 at 11:14 -0400, Miloslav Trmac wrote:
> ----- "Eric Paris" <eparis@xxxxxxxxxx> wrote:
> > Add a new spot in the assembly which will call a function which will
> > check if audit_n_rules > 0 and if so will set TIF_SYSCALL_AUDIT and if
> > not will clear TIF_SYSCALL_AUDIT?  It might make things slightly worse
> > on systems which explictly disable audit and the flag would always be
> > clear on every task (like you did with the explicit rule) but I'm
> > guessing might be a win on systems with no rules which are wasting time
> > on the audit slow path.....
> Is "audit_n_rules" a specific enough trigger?  Right now, even if
> there are no rules configured at all, audit_log_start() while
> processing a syscall will mark that syscall for auditing, and all
> collected information about the syscall will be logged at syscall
> exit.
> 
> Would the suggested change break this behavior?

That's correct, if there are 0 rules we still collect information while
knowing that it will get thrown away at the end (since obviously no rule
is going to switch the state from 'build' to 'on')

The only real loss is that a syscall in progress when a rule is loaded
would get audited today and wouldn't get audited with my new proposal.
I don't see that as an unacceptable race.....

-Eric

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/