Re: [PATCH 0/3] audit: Measure and reduce syscall filtering overhead

[Stanislav Kinsburskii]

On Thu, Aug 06, 2026 at 06:01:18PM -0700, Stanislav Kinsburskii wrote:
> This series adds a repeatable microbenchmark for audit's fixed syscall
> overhead and uses it to address two cases where audit continues doing work
> which cannot produce a record.
> 

A gentle ping on this series.

Thanks,
Stanislav

> Patch 1 adds audit_bench, a manually run getpid(2) microbenchmark under
> tools/testing/selftests/audit.  It leaves policy management to the caller
> so the same workload can measure different rule configurations without
> silently changing the system policy.
> 
> Patch 2 fixes audit_n_rules and audit_signals accounting when rules are
> removed automatically with a watch or tree, or after an LSM rule update
> fails.  These paths could leave the counters nonzero after the last
> applicable rule had disappeared, causing every subsequent syscall to
> allocate a non-dummy audit context.  It also centralizes rule accounting
> so all rule removal paths share the same bookkeeping.
> 
> The median getpid latency in the same unpinned VM was:
> 
>                                   no rules   stale state   fixed
>   automatically removed watch       38 ns       55 ns      38 ns
>   automatically removed tree        38 ns       59 ns      38 ns
> 
> Patch 3 builds on those lifecycle helpers.  It maintains an aggregate mask
> of the syscall numbers present in exit rules and checks that mask before
> walking the exit filter list.  The mask is architecture-independent and
> therefore conservative: overlapping syscall numbers may cause an
> unnecessary scan, but cannot suppress a match.
> 
> For an unrelated getpid workload, the median latency scaled as follows:
> 
>   exit rules                         1       32      128      256
>   before                            55 ns    71 ns   428 ns   791 ns
>   after                             55 ns    55 ns    55 ns    55 ns
> 
> The aggregate mask is updated through the centralized accounting helpers.
> Insertion sets the relevant bits before publishing the rule with
> list_add_rcu(); removal unlinks the rule before clearing them.  This keeps
> the lockless rejection test conservative during concurrent rule changes.
> 
> The series does not change the audit userspace ABI or rule matching
> semantics.  The benchmark and complete reproduction procedures are
> documented in the individual patches.
> 
> ---
> Stanislav Kinsburskii (3):
>       selftests/audit: Add syscall overhead benchmark
>       audit: Fix filter rule accounting after automatic removal
>       audit: Skip exit filtering for syscalls without rules
> 
>  MAINTAINERS                                 |   1 +
>  kernel/audit.h                              |   7 +
>  kernel/audit_tree.c                         |   1 +
>  kernel/audit_watch.c                        |   2 +
>  kernel/auditfilter.c                        | 140 +++++++++++------
>  kernel/auditsc.c                            |  13 ++
>  tools/testing/selftests/Makefile            |   1 +
>  tools/testing/selftests/audit/.gitignore    |   2 +
>  tools/testing/selftests/audit/Makefile      |   9 ++
>  tools/testing/selftests/audit/README        |  30 ++++
>  tools/testing/selftests/audit/audit_bench.c | 227 ++++++++++++++++++++++++++++
>  11 files changed, 389 insertions(+), 44 deletions(-)
> ---
> base-commit: ea2bff00da89d7767d677bb68470130ba96f4928
> change-id: 20260806-audit-96a1e71d38b1
> 
> Best regards,
> -- 
> Stanislav Kinsburskii <skinsburskii@xxxxxxxxx>
>