Re: [PATCH 3/3] audit: Skip exit filtering for syscalls without rules

[Paul Moore <paul@paul-moore.com>]

On Aug  6, 2026 Stanislav Kinsburskii <skinsburskii@gmail.com> wrote:
> 
> Audit walks every exit filter rule for each audited syscall, even when no
> rule contains the current syscall number. Policies with many unrelated
> rules therefore add linear overhead to otherwise uninteresting syscalls.
> 
> Maintain a reference count for each syscall bit present in exit filter
> rules and derive an aggregate interest mask. Update the mask through the
> centralized rule lifecycle helpers, which cover explicit and automatic
> rule removal. Use the mask as a lockless rejection test before entering
> the exit filter RCU traversal.
> 
> The mask is architecture-independent. Syscall number overlap between
> architectures can cause an unnecessary scan but cannot suppress a match.
> 
> The aggregate bit must be set before list_add_rcu() publishes a new rule.
> Otherwise, a reader could observe the rule after publication while the
> aggregate mask still rejects its syscall. Move audit_rule_account()
> before the list insertion to provide this ordering. Rule removal already
> uses the inverse safe ordering: it unlinks the rule before clearing the
> aggregate bit, so a concurrent reader can only perform an unnecessary
> scan, not miss a rule.
> 
> To measure the effect, install increasing numbers of distinct statx rules
> in a disposable VM and benchmark the unrelated getpid syscall after each
> set is installed:
> 
>   for nr_rules in 1 32 128 256; do
>           auditctl -D
>           for uid in $(seq 1 $nr_rules); do
>                   auditctl -a always,exit -F arch=b64 -S statx \
>                            -F uid=$uid
>           done
>           audit_bench
>   done
> 
> Without this change, the same unpinned VM produced:
> 
>   1 rule:
>     median=55 ns/op
>   32 rules:
>     median=71 ns/op
>   128 rules:
>     median=428 ns/op
>   256 rules:
>     median=791 ns/op
> 
> With this change, it produced:
> 
>   1 rule:
>     median=55 ns/op
>   32 rules:
>     median=55 ns/op
>   128 rules:
>     median=55 ns/op
>   256 rules:
>     median=55 ns/op
> 
> Signed-off-by: Stanislav Kinsburskii <skinsburskii@gmail.com>
> ---
>  kernel/audit.h       |  2 ++
>  kernel/auditfilter.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++-
>  kernel/auditsc.c     | 13 ++++++++++++
>  3 files changed, 70 insertions(+), 1 deletion(-)

We've had similar proposals in the past, and I'll say the same thing I've
said in the past: I'm not certain that our answer to filter performance is
to add additional complexity and filtering.  It may turn out that an
approach like this is the only option, but I'd really like to see more
effort put into improving a singular filter mechanism (either the current
approach or a replacement design) before we start layering on additional
complexity.

--
paul-moore.com