Re: [PATCH] audit: speedup for syscalls when auditing is disabled

We found that when auditing is disabled using "auditctl -D", that there's still a significant overhead when doing syscalls. This overhead is not present when a single never rule is inserted using "auditctl -a task,never". Using Anton's null syscall microbenchmark from http://ozlabs.org/~anton/junkcode/null_syscall.c we currently have on a powerpc machine: # auditctl -D No rules # ./null_syscall null_syscall: 739.03 cycles 100.00% # auditctl -a task,never # ./null_syscall null_syscall: 204.63 cycles 100.00% This doesn't seem right, as we'd hope that auditing would have the same minimal impact when disabled via -D as when we have a single never rule. The patch below creates a fast path when initialising a task. If the rules list for tasks is empty (the disabled -D option), we mark auditing as disabled for this task. When this is applied, our null syscall benchmark improves in the disabled case to match the single never rule case. # auditctl -D No rules # ./null_syscall null_syscall: 204.62 cycles 100.00% # auditctl -a task,never # ./null_syscall null_syscall: 204.63 cycles 100.00% Reported-by: Anton Blanchard <anton(a)samba.org&gt; Signed-off-by: Michael Neuling <mikey(a)neuling.org&gt; --- I'm not familiar with the auditing code/infrastructure so I may have misunderstood something here diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 1b31c13..1cd6ec7 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -666,6 +666,11 @@ static enum audit_state audit_filter_task(struct task_struct *tsk, char **key) enum audit_state state; rcu_read_lock(); + /* Fast path. If the list is empty, disable auditing */ + if (list_empty(&audit_filter_list[AUDIT_FILTER_TASK])) { + rcu_read_unlock(); + return AUDIT_DISABLED; + } list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TASK], list) { if (audit_filter_rules(tsk, &e->rule, NULL, NULL, &state)) { if (state == AUDIT_RECORD_CONTEXT)