Re: [PATCH] audit: always enable syscall auditing when supported and audit is enabled

Hello Paul, On 28/01/2019 15:19, Paul Moore wrote: >>> time also enables syscall auditing; this patch simplifies the Kconfig >>> menus by removing the option to disable syscall auditing when audit >>> is selected and the target arch supports it. >>> >>> Signed-off-by: Paul Moore <pmoore(a)redhat.com&gt; >> this patch is responsible for massive performance degradation for those >> who used only CONFIG_SECURITY_APPARMOR. >> >> And the numbers are, take the following test for instance: >> >> dd if=/dev/zero of=/dev/null count=2M >> >> ARM64: 500MB/s -> 350MB/s >> ARM: 400MB/s -> 300MB/s > Hi there. > > Out of curiosity, what kernel/distribution are you running, or is this > a custom kernel compile? Can you also share the output of 'auditctl This test was carried out with Linux 4.9. Custom built.

> -l' from your system? The general approach taken by everyone to > turn-off the per-syscall audit overhead is to add the "-a never,task" > rule to their audit configuration: > > # auditctl -a never,task > > If you are using Fedora/CentOS/RHEL, or a similarly configured system, This is an embedded distribution. We are not using auditctl or any other audit-related user-space packages. > you can find this configuration in the /etc/audit/audit.rules file (be > warned, that file is automatically generated based on > /etc/audit/rules.d). I suppose in this case rule list must be empty. Is there a way to check this without extra user-space packages?