Re: [RFC PATCH 2/9] audit,io_uring,io-wq: add some basic audit support to io_uring

... If we moved the _entry and _exit calls into the individual operation case blocks (quick openat example below) so that only certain operations were able to be audited would that be acceptable assuming the high frequency ops were untouched? My initial gut feeling was that this would involve >50% of the ops, but Steve Grubb seems to think it would be less; it may be time to look at that a bit more seriously, but if it gets a NACK regardless it isn't worth the time - thoughts? case IORING_OP_OPENAT: audit_uring_entry(req->opcode); ret = io_openat(req, issue_flags); audit_uring_exit(!ret, ret); break;