linux-kernel - Re: [PATCH] audit: Only use the syscall slowpath when syscall audit rules exist

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1400745.hJLGxDlRLu@x2>
Date:	Mon, 03 Feb 2014 15:23:59 -0500
From:	Steve Grubb <sgrubb@...hat.com>
To:	Andy Lutomirski <luto@...capital.net>
Cc:	linux-audit@...hat.com, linux-kernel@...r.kernel.org,
	Andi Kleen <andi@...stfloor.org>,
	Oleg Nesterov <oleg@...hat.com>, Eric Paris <eparis@...hat.com>
Subject: Re: [PATCH] audit: Only use the syscall slowpath when syscall audit rules exist

On Monday, February 03, 2014 09:53:23 AM Andy Lutomirski wrote:
> This toggles TIF_SYSCALL_AUDIT as needed when rules change instead of
> leaving it set whenever rules might be set in the future.  This reduces
> syscall latency from >60ns to closer to 40ns on my laptop.

Does this mean that we have processes that don't have the  TIF_SYSCALL_AUDIT 
flag set? When rules get loaded, how do we get the flag put back into all 
processes?

The theory of ops is supposed to be that for anyone not needing audit, there 
is only the cost of  "if (tif & TIF_SYSCALL_AUDIT)". That should be it. If you 
have audit enabled or had it enabled (which means it might be loaded with new 
rules), we want to inspect the syscall. There should be a short circuit based 
on checking that any rules has ever been loaded or are currently loaded before 
doing any real collection.

-Steve

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/