Skip to contentSkip to conversation

audit: speed up audit syscall entry

PATCH In review Richard Guy Briggs 2 participants 4 messages Feb 15, 2018 Audit

lore
Share & tools
lore

Richard Guy Briggs

author
#0 lore raw

v3 cover audit: speed up audit syscall entry

These fixes should speed up audit syscall entry by doing away with the audit entry filter check, moving up the valid connection check before filling in the context and not caring if there is a bug when audit is disabled.

Passes audit-testsuite.
See: https://github.com/linux-audit/audit-kernel/issues/6

v3:
- squash patch 1 and 2
v2:
- bail earlier to avoid setting up unneeded state
- don't bother checking for bug when disabled

Richard Guy Briggs (2):
audit: deprecate the AUDIT_FILTER_ENTRY filter
audit: bail before bug check if audit disabled

 kernel/auditfilter.c |  4 ++--
 kernel/auditsc.c     | 22 ++++++++++------------
 2 files changed, 12 insertions(+), 14 deletions(-)
Signature · 1 line
1.8.3.1
author
#1 lore raw

PATCH v3 1/2 audit: deprecate the AUDIT_FILTER_ENTRY filter

The audit entry filter has been long deprecated with userspace support finally removed in audit-v2.6.7 and plans to remove kernel support have existed since kernel-v2.6.31.
Remove it.

Since removing the audit entry filter, test for early return before setting up any context state.

Passes audit-testsuite.

See: https://github.com/linux-audit/audit-kernel/issues/6

Signed-off-by Richard Guy Briggs <[email protected]>
---
 kernel/auditfilter.c |  4 ++--
 kernel/auditsc.c     | 21 +++++++++++----------
 2 files changed, 13 insertions(+), 12 deletions(-)
kernel/auditfilter.c +2 -2
index 4a1758a..1bbf5de 100644
@@ -258,8 +258,8 @@ static inline struct audit_entry *audit_to_entry_common(struct audit_rule_data *
 		goto exit_err;
 #ifdef CONFIG_AUDITSYSCALL
 	case AUDIT_FILTER_ENTRY:
-		if (rule->action == AUDIT_ALWAYS)
-			goto exit_err;
+		pr_err("AUDIT_FILTER_ENTRY is deprecated\n");
+		goto exit_err;
 	case AUDIT_FILTER_EXIT:
 	case AUDIT_FILTER_TASK:
 #endif
kernel/auditsc.c +11 -10
index e80459f..bc534bf 100644
@@ -1519,22 +1519,23 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
 	if (!audit_enabled)
 		return;
 
-	context->arch	    = syscall_get_arch();
-	context->major      = major;
-	context->argv[0]    = a1;
-	context->argv[1]    = a2;
-	context->argv[2]    = a3;
-	context->argv[3]    = a4;
-
 	state = context->state;
+	if (state == AUDIT_DISABLED)
+		return;
+
 	context->dummy = !audit_n_rules;
 	if (!context->dummy && state == AUDIT_BUILD_CONTEXT) {
 		context->prio = 0;
-		state = audit_filter_syscall(tsk, context, &audit_filter_list[AUDIT_FILTER_ENTRY]);
+		if (auditd_test_task(tsk))
+			return;
 	}
-	if (state == AUDIT_DISABLED)
-		return;
 
+	context->arch	    = syscall_get_arch();
+	context->major      = major;
+	context->argv[0]    = a1;
+	context->argv[1]    = a2;
+	context->argv[2]    = a3;
+	context->argv[3]    = a4;
 	context->serial     = 0;
 	context->ctime = current_kernel_time64();
 	context->in_syscall = 1;
Signature · 1 line
1.8.3.1
author
#2 lore raw

PATCH v3 2/2 audit: bail before bug check if audit disabled

In reply to Richard Guy Briggs

If audit is disabled, who cares if there is a bug indicating syscall in process or names already recorded. Bail immediately on audit disabled.

Signed-off-by Richard Guy Briggs <[email protected]>
---
 kernel/auditsc.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)
kernel/auditsc.c +1 -4
index bc534bf..4e0a4ac 100644
@@ -1511,14 +1511,11 @@ void __audit_syscall_entry(int major, unsigned long a1, unsigned long a2,
 	struct audit_context *context = tsk->audit_context;
 	enum audit_state     state;
 
-	if (!context)
+	if (!audit_enabled || !context)
 		return;
 
 	BUG_ON(context->in_syscall || context->name_count);
 
-	if (!audit_enabled)
-		return;
-
 	state = context->state;
 	if (state == AUDIT_DISABLED)
 		return;
Signature · 1 line
1.8.3.1
maintainer
#3 lore raw
In reply to Richard Guy Briggs
Quoted 14 lines · Richard Guy Briggs

These fixes should speed up audit syscall entry by doing away with the audit entry filter check, moving up the valid connection check before filling in the context and not caring if there is a bug when audit is disabled.

Passes audit-testsuite.
See: https://github.com/linux-audit/audit-kernel/issues/6

v3:
- squash patch 1 and 2
v2:
- bail earlier to avoid setting up unneeded state
- don't bother checking for bug when disabled

Quoted 7 lines

Richard Guy Briggs (2):
audit: deprecate the AUDIT_FILTER_ENTRY filter
audit: bail before bug check if audit disabled

 kernel/auditfilter.c |  4 ++--
 kernel/auditsc.c     | 22 ++++++++++------------
 2 files changed, 12 insertions(+), 14 deletions(-)

Both patches merged into audit/next, thanks.

Signature · 2 lines
paul moore
www.paul-moore.com