linux-kernel - CONFIG_AUDITSYSCALL has pointless overhead

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAObL_7HV0fTQ7D2vxbowKN4NVeHyaKSdvJtjSr5Zgfegz=B2Pg@mail.gmail.com>
Date:	Wed, 6 Jul 2011 11:29:58 -0400
From:	Andrew Lutomirski <luto@....edu>
To:	viro@...iv.linux.org.uk, eparis@...hat.com,
	linux-kernel@...r.kernel.org
Subject: CONFIG_AUDITSYSCALL has pointless overhead

[emailing maintainers directly because the list is subscribers-only]

$ sudo auditctl -l
No rules

<system call overhead is 68 ns>

$ sudo auditctl -A task,never

<system call overhead is now 42 ns>

This is on Fedora 15 on kernel.org's 2.6.39 and various 3.0 rc builds
on Sandy Bridge.  The auditing path that, as far as I can tell, does
nothing accounts for over one third of system call overhead.  (On
older machines this effect is a little less impressive because all
system calls are quite a bit slower.  It still takes 40ns on Nehalem,
but the base cost is closer to 120 ns.)

The culprit seems to be audit_alloc in auditsc.c, which sets
TIF_SYSCALL_AUDIT even when there isn't anything to audit.  Maybe
something else in the kernel needs audit_set_auditable, but then the
docs should indicate that setting syscall auditing to never is
different from having no rules at all.  This seems unlikely.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/