Re: [PATCH 1/3] selftests/audit: Add syscall overhead benchmark

[Paul Moore <paul@paul-moore.com>]

On Aug  6, 2026 Stanislav Kinsburskii <skinsburskii@gmail.com> wrote:
> 
> Add a microbenchmark which repeatedly invokes getpid(2) and reports the
> per-operation latency across multiple repetitions. The workload avoids
> filesystem and other syscall-specific work so the fixed audit syscall
> overhead remains visible.
> 
> The benchmark deliberately leaves audit policy management to the caller.
> This permits comparisons with increasing numbers of unrelated exit rules
> and with automatically removed watch or tree rules without modifying an
> existing policy unexpectedly.
> 
> Signed-off-by: Stanislav Kinsburskii <skinsburskii@gmail.com>
> ---
>  MAINTAINERS                                 |   1 +
>  tools/testing/selftests/Makefile            |   1 +
>  tools/testing/selftests/audit/.gitignore    |   2 +
>  tools/testing/selftests/audit/Makefile      |   9 ++
>  tools/testing/selftests/audit/README        |  30 ++++
>  tools/testing/selftests/audit/audit_bench.c | 227 ++++++++++++++++++++++++++++
>  6 files changed, 270 insertions(+)

Thanks for this Stanislav, but I'm not certain that we want to merge this
into the kernel and have this become the defacto standard for audit
performance.  It's a simple, easy to understand test, but I worry that it
might be too simplistic to properly characterize audit performance.

... and no, I'm sorry, but I don't have a better suggestion off the top
of my head :)

However, audit_bench might be useful as part of the manual_tests in the
audit-testsuite?

 https://github.com/linux-audit/audit-testsuite

--
paul-moore.com