Re: [RFC, v1, 1/1] audit: speed up syscall rule match while exiting syscall

From 82ebcf43481be21ee3e32ec1749b42f651737880 Mon Sep 17 00:00:00 2001 From: Yang Yang <yang.yang29(a)zte.com.cn&gt; Date: Wed, 13 Jan 2021 20:18:04 +0800 Subject: [PATCH] [RFC,v1,1/1] speed up syscall rule match while exiting syscall If user add any syscall rule, in all syscalls, audit_filter_syscall() traverses struct list_head audit_filter_list to find out whether current syscall match one rule. This takes o(n), which is not necessary, specially for user who add a very few syscall rules. On the other hand, user may not much care about rule add/delete speed. So do o(n) calculate at rule changing, and ease the burden of audit_filter_syscall(). Define audit_syscall[NR_syscalls], every element stands for one syscall. audit_filter_syscall() checks audit_syscall[NR_syscalls]. audit_syscall[n] == 0 indicates no rule audit syscall n, do a quick exit. audit_syscall[n] > 0 indicates at least one rule audit syscall n. audit_syscall[n] update when syscall rule changes. Signed-off-by: Yang Yang <yang.yang29(a)zte.com.cn&gt; --- include/linux/audit.h | 2 ++ kernel/audit.c | 2 ++ kernel/auditfilter.c | 16 ++++++++++++++++ kernel/auditsc.c | 9 ++++++++- 4 files changed, 28 insertions(+), 1 deletion(-)