Re: [PATCH] audit: clear thread flag for new children

Chris Wright
2007-10-26T22:43:00Z

* Tony Jones (tonyj@suse.de) wrote:
> From: Tony Jones <tonyj@suse.de>
> Minor performance enhancement.
>
> Thread flag TIF_SYSCALL_AUDIT is not cleared for new children when audit
> context creation has been disabled (auditctl -e0). This can cause new children
> forked from a parent created when audit was enabled to not take the fastest
> syscall path thru entry.S
>
> Signed-off-by: Tony Jones <tonyj@suse.de>

Yeah, I think that's the right thing to do. Doesn't have an
audit_context anyway.

Acked-by: Chris Wright <chrisw@sous-sol.org>