From mboxrd@z Thu Jan 1 00:00:00 1970 From: Miloslav Trmac Subject: Re: [PATCH] audit: speedup for syscalls when auditing is disabled Date: Tue, 24 Aug 2010 11:14:56 -0400 (EDT) Message-ID: <1147049992.1241541282662896620.JavaMail.root@zmail07.collab.prod.int.phx2.redhat.com> References: <1282621410.26616.406.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1282621410.26616.406.camel@localhost.localdomain> Sender: linux-kernel-owner@vger.kernel.org To: Eric Paris Cc: linux-audit@redhat.com, linux-kernel@vger.kernel.org, anton@samba.org, Al Viro , Michael Neuling List-Id: linux-audit@redhat.com ----- "Eric Paris" wrote: > Add a new spot in the assembly which will call a function which will > check if audit_n_rules > 0 and if so will set TIF_SYSCALL_AUDIT and if > not will clear TIF_SYSCALL_AUDIT? It might make things slightly worse > on systems which explictly disable audit and the flag would always be > clear on every task (like you did with the explicit rule) but I'm > guessing might be a win on systems with no rules which are wasting time > on the audit slow path..... Is "audit_n_rules" a specific enough trigger? Right now, even if there are no rules configured at all, audit_log_start() while processing a syscall will mark that syscall for auditing, and all collected information about the syscall will be logged at syscall exit. Would the suggested change break this behavior? Mirek