audit: speed up audit syscall entry
v2 cover audit: speed up audit syscall entry
These fixes should speed up audit syscall entry by doing away with the audit entry filter check, moving up the valid connection check before filling in the context and not caring if there is a bug when audit is disabled.
Richard Guy Briggs (3):
audit: deprecate the AUDIT_FILTER_ENTRY filter
audit: bail ASAP on syscall entry
audit: bail before bug check if audit disabled
kernel/auditfilter.c | 4 ++-- kernel/auditsc.c | 22 ++++++++++------------ 2 files changed, 12 insertions(+), 14 deletions(-)
Signature · 1 line
1.8.3.1
PATCH v2 1/3 audit: deprecate the AUDIT_FILTER_ENTRY filter
The audit entry filter has been long deprecated with userspace support finally removed in audit-v2.6.7 and plans to remove kernel support have existed since kernel-v2.6.31.
Remove it.
Passes audit-testsuite.
See: https://github.com/linux-audit/audit-kernel/issues/6
--- kernel/auditfilter.c | 4 ++-- kernel/auditsc.c | 3 ++- 2 files changed, 4 insertions(+), 3 deletions(-)
kernel/auditfilter.c +2 -2
@@ -258,8 +258,8 @@ static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data * goto exit_err;#ifdef CONFIG_AUDITSYSCALL case AUDIT_FILTER_ENTRY : -if (rule->action ==AUDIT_ALWAYS ) - goto exit_err; +pr_err ("AUDIT_FILTER_ENTRY is deprecated\n" ); + goto exit_err;case AUDIT_FILTER_EXIT :case AUDIT_FILTER_TASK :#endif
kernel/auditsc.c +2 -1
@@ -1530,7 +1530,8 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2, context->dummy = !audit_n_rules;if (!context->dummy && state ==AUDIT_BUILD_CONTEXT ) { context->prio =0 ; - state =audit_filter_syscall (tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY ]); +if (auditd_test_task (tsk)) +return ; }if (state ==AUDIT_DISABLED )return ;
Signature · 1 line
1.8.3.1
PATCH v2 2/3 audit: bail ASAP on syscall entry
In reply to Richard Guy BriggsSince removing the audit entry filter, test for early return before setting up any context state.
--- kernel/auditsc.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
kernel/auditsc.c +9 -9
@@ -1519,23 +1519,23 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,if (!audit_enabled)return ; - context->arch =syscall_get_arch (); - context->major = major; - context->argv[0 ] = a1; - context->argv[1 ] = a2; - context->argv[2 ] = a3; - context->argv[3 ] = a4; - state = context->state; +if (state ==AUDIT_DISABLED ) +return ; + context->dummy = !audit_n_rules;if (!context->dummy && state ==AUDIT_BUILD_CONTEXT ) { context->prio =0 ;if (auditd_test_task (tsk))return ; } -if (state ==AUDIT_DISABLED ) -return ; + context->arch =syscall_get_arch (); + context->major = major; + context->argv[0 ] = a1; + context->argv[1 ] = a2; + context->argv[2 ] = a3; + context->argv[3 ] = a4; context->serial =0 ; context->ctime =current_kernel_time64 (); context->in_syscall =1 ;
Signature · 1 line
1.8.3.1
Paul Moore
maintainerRe: [PATCH V2 2/3] audit: bail ASAP on syscall entry
Quoted 7 lines · Richard Guy Briggs
Since removing the audit entry filter, test for early return before setting up any context state.
Signed-off-by Richard Guy Briggs <[email protected]>--- kernel/auditsc.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
Sigh.
First off, thanks for making the changes, I think the end result of 1/3+2/3 is better than the v1 patch.
However, this really didn't need to be two patches, please combine 1/3 and 2/3 and resubmit. I know I've done the patch squashing for you in the past, but I think it's time to start pushing some of this work back to you.
Moving forward, if I provide feedback and do not explicitly suggest creating a new patch, please incorporate the changes into the existing patches.
Quoted 40 lines
kernel/auditsc.c +9
-10@@ -1519,23 +1519,23 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,if (!audit_enabled)return ; - context->arch =syscall_get_arch (); - context->major = major; - context->argv[0 ] = a1; - context->argv[1 ] = a2; - context->argv[2 ] = a3; - context->argv[3 ] = a4; - state = context->state; +if (state ==AUDIT_DISABLED ) +return ; + context->dummy = !audit_n_rules;if (!context->dummy && state ==AUDIT_BUILD_CONTEXT ) { context->prio =0 ;if (auditd_test_task (tsk))return ; } -if (state ==AUDIT_DISABLED ) -return ; + context->arch =syscall_get_arch (); + context->major = major; + context->argv[0 ] = a1; + context->argv[1 ] = a2; + context->argv[2 ] = a3; + context->argv[3 ] = a4; context->serial =0 ; context->ctime =current_kernel_time64 (); context->in_syscall =1 ; --1.8.3.1
Signature · 2 lines
paul moore www.paul-moore.com
PATCH v2 3/3 audit: bail before bug check if audit disabled
In reply to Richard Guy BriggsIf audit is disabled, who cares if there is a bug indicating syscall in process or names already recorded. Bail immediately on audit disabled.
--- kernel/auditsc.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
kernel/auditsc.c +1 -4
@@ -1511,14 +1511,11 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,struct audit_context *context = tsk->audit_context;enum audit_state state; -if (!context) +if (!audit_enabled || !context)return ;BUG_ON (context->in_syscall || context->name_count); -if (!audit_enabled) -return ; - state = context->state;if (state ==AUDIT_DISABLED )return ;
Signature · 1 line
1.8.3.1