From: Steve Grubb <sgrubb@redhat.com>
To: Andy Lutomirski <luto@amacapital.net>
Cc: linux-audit@redhat.com, linux-kernel@vger.kernel.org,
Andi Kleen <andi@firstfloor.org>, Oleg Nesterov <oleg@redhat.com>,
Eric Paris <eparis@redhat.com>
Subject: Re: [PATCH] audit: Only use the syscall slowpath when syscall audit rules exist
Date: Mon, 03 Feb 2014 15:23:59 -0500 [thread overview]
Message-ID: <1400745.hJLGxDlRLu@x2> (raw)
In-Reply-To: <a8356e46aed7213128e84a888170391adb6afe30.1391449825.git.luto@amacapital.net>
On Monday, February 03, 2014 09:53:23 AM Andy Lutomirski wrote:
> This toggles TIF_SYSCALL_AUDIT as needed when rules change instead of
> leaving it set whenever rules might be set in the future. This reduces
> syscall latency from >60ns to closer to 40ns on my laptop.
Does this mean that we have processes that don't have the TIF_SYSCALL_AUDIT
flag set? When rules get loaded, how do we get the flag put back into all
processes?
The theory of ops is supposed to be that for anyone not needing audit, there
is only the cost of "if (tif & TIF_SYSCALL_AUDIT)". That should be it. If you
have audit enabled or had it enabled (which means it might be loaded with new
rules), we want to inspect the syscall. There should be a short circuit based
on checking that any rules has ever been loaded or are currently loaded before
doing any real collection.
-Steve
next prev parent reply other threads:[~2014-02-03 20:24 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-02-03 17:53 [PATCH] audit: Only use the syscall slowpath when syscall audit rules exist Andy Lutomirski
2014-02-03 18:11 ` Oleg Nesterov
2014-02-03 18:33 ` Andy Lutomirski
2014-02-03 20:23 ` Steve Grubb [this message]
2014-02-03 22:08 ` Andy Lutomirski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1400745.hJLGxDlRLu@x2 \
--to=sgrubb@redhat.com \
--cc=andi@firstfloor.org \
--cc=eparis@redhat.com \
--cc=linux-audit@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=oleg@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox