linux-kernel - Re: [PATCH] audit: Reduce overhead using a coarse clock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170704165308.ls4i5qa4sz6cpn5x@techsingularity.net>
Date:   Tue, 4 Jul 2017 17:53:08 +0100
From:   Mel Gorman <mgorman@...hsingularity.net>
To:     Deepa Dinamani <deepa.kernel@...il.com>
Cc:     Arnd Bergmann <arnd@...db.de>, Paul Moore <paul@...l-moore.com>,
        Richard Guy Briggs <rgb@...hat.com>,
        Tony Jones <tonyj@...e.com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] audit: Reduce overhead using a coarse clock

On Tue, Jul 04, 2017 at 09:23:55AM -0700, Deepa Dinamani wrote:
> > The patch in question has no explanation as to why a fully-accurate timestamp
> > is required and is likely an oversight.  Using a coarser, but monotically
> > increasing, timestamp the overhead can be eliminated.
> 
> You are right. I was trying to use ktime_get* functions preferably.
> I was aware that current_kernel_time64() could also be used if lesser
> granularity was preferred and that it was faster.
> I forgot to note that in the commit text.
> 

Given the severe overhead (roughly 10% to redis, sysbench-threads), would
you be willing to accept the coarser granularity to avoid audit taking
a major performance hit? I didn't mention it in my own changelog but a
similar 10% hit is also visible in the will-it-scale microbenchmarks that
focus on system calls so it's a fairly broad impact.

-- 
Mel Gorman
SUSE Labs