Re: [PATCH lazy audit

Killing audit overhead in case when no rules are loaded. More detailed log (this is a composite of patch series from audit git tree, see audit.b23.. lspp.b23 in there for individual changesets):

[PATCH] introduce audit rules counter [PATCH] mark context of syscall entered with no rules as dummy [PATCH] don't bother with aux entires for dummy context [PATCH] take filling ->pid, etc. out of audit_get_context() move that stuff downstream and into the only branch where it'll be used. diff --git a/fs/namei.c b/fs/namei.c index 0ab26cb..55a1312 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -159,7 +159,7 @@ char * getname(const char __user * filen #ifdef CONFIG_AUDITSYSCALL void putname(const char *name) { - if (unlikely(current->audit_context)) + if (unlikely(!audit_dummy_context())) audit_putname(name); else __putname(name);

+extern int audit_n_rules; #else #define audit_alloc(t) ({ 0; }) #define audit_free(t) do { ; } while (0) #define audit_syscall_entry(ta,a,b,c,d,e) do { ; } while (0) #define audit_syscall_exit(f,r) do { ; } while (0) +#define audit_dummy_context() 0 #define audit_getname(n) do { ; } while (0) #define audit_putname(n) do { ; } while (0) #define __audit_inode(n,i) do { ; } while (0)