Re: Sycall Rules vs Watch Rules
On Tuesday, September 19, 2023 8:26:04 PM EDT Amjad Gabbar wrote:
> The perm fields select the right system calls
> that should be reported on.
That is accurate from a functional perspective. There is no change in the
events logged. But there is a difference in performance. This is most
evident for syscalls not part of the perm fields.
<snip>
If we look at the performance numbers for the file rules as is, the
auditing percentage is about 14%.
Now if we were to just add the specific syscalls that the perm fields
filter on in the rules file, the auditing percentage would drop to around
2%.
I think I am mis-remembering something, or there was a change way back in the
beginning. The plan was that we could optimize access by letting the kernel
pick the relevant syscalls based on the permissions. User space would just
define the permissions and the kernel would make it so.
But there were several redesigns of the file auditing. I looked back as far as
the 3.1 kernel and it always follows lookup the syscall, if it's relevant,
then check the rest of the fields in the rule. This eventually checks the set
of syscalls selected by the perms.
The way that it should have worked is when perms is given, throw away any
syscalls and set the mask based on the perms selected. That would have been
optimal and it was what Al Viro and I talked about long ago. However, it went
through several redesigns.
The problem now is that user space has no list of syscalls that match each
permission. And then, there's no good way to sync based on mixing and
matching kernels and user space. The kernel may have an updated syscall list
user space doesn't know about and vice versa.
I think you are on to something important. But I am surprised my concept of
how it works doesn't match the implementation. (Al Viro did the original
implementation way back around 2006/7.) The best solution would be a kernel
modification so that there are no mismatched lists. A suboptimal solution
would be to maintain 2 lists and hope they don't change. Which by the way, I
think the kernel lists are outdated again. (Syscalls keep getting added -
quotactl_fd for example)
-Steve