From 82ebcf43481be21ee3e32ec1749b42f651737880 Mon Sep 17 00:00:00 2001 From: Yang Yang <yang.yang29(a)zte.com.cn&gt; Date: Wed, 13 Jan 2021 20:18:04 +0800 Subject: [PATCH] [RFC,v1,1/1] speed up syscall rule match while exiting syscall If user add any syscall rule, in all syscalls, audit_filter_syscall() traverses struct list_head audit_filter_list to find out whether current syscall match one rule. This takes o(n), which is not necessary, specially for user who add a very few syscall rules. On the other hand, user may not much care about rule add/delete speed. So do o(n) calculate at rule changing, and ease the burden of audit_filter_syscall(). Define audit_syscall[NR_syscalls], every element stands for one syscall. audit_filter_syscall() checks audit_syscall[NR_syscalls]. audit_syscall[n] == 0 indicates no rule audit syscall n, do a quick exit. audit_syscall[n] > 0 indicates at least one rule audit syscall n. audit_syscall[n] update when syscall rule changes. Signed-off-by: Yang Yang <yang.yang29(a)zte.com.cn&gt; --- include/linux/audit.h | 2 ++ kernel/audit.c | 2 ++ kernel/auditfilter.c | 16 ++++++++++++++++ kernel/auditsc.c | 9 ++++++++- 4 files changed, 28 insertions(+), 1 deletion(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 82b7c11..56a8c61 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -549,6 +549,8 @@ static inline void audit_log_nfcfg(const char *name, u8 af, extern int audit_n_rules; extern int audit_signals; +extern u32 audit_syscall[NR_syscalls]; +extern int audit_in_mask(const struct audit_krule *rule, unsigned long val); #else /* CONFIG_AUDITSYSCALL */ static inline int audit_alloc(struct task_struct *task) { diff --git a/kernel/audit.c b/kernel/audit.c index 1ffc2e0..d233a95 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -208,6 +208,8 @@ struct audit_reply { struct sk_buff *skb; }; +u32 audit_syscall[NR_syscalls] = {0}; + /** * auditd_test_task - Check to see if a given task is an audit daemon * @task: the task to check diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index 333b3bc..c7e60cd 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -936,6 +936,7 @@ static inline int audit_add_rule(struct audit_entry *entry) int err = 0; #ifdef CONFIG_AUDITSYSCALL int dont_count = 0; + int i = 0; /* If any of these, don't count towards total */ switch(entry->rule.listnr) { @@ -957,6 +958,13 @@ static inline int audit_add_rule(struct audit_entry *entry) return err; } +#ifdef CONFIG_AUDITSYSCALL + if (entry->rule.listnr == AUDIT_FILTER_EXIT && !watch && !tree) { + for (i = 0; i < NR_syscalls; i++) + audit_syscall[i] += !(!audit_in_mask(&entry->rule, i)); + } +#endif + if (watch) { /* audit_filter_mutex is dropped and re-taken during this call */ err = audit_add_watch(&entry->rule, &list); @@ -1018,6 +1026,7 @@ int audit_del_rule(struct audit_entry *entry) int ret = 0; #ifdef CONFIG_AUDITSYSCALL int dont_count = 0; + int i = 0; /* If any of these, don't count towards total */ switch(entry->rule.listnr) { @@ -1035,6 +1044,13 @@ int audit_del_rule(struct audit_entry *entry) goto out; } +#ifdef CONFIG_AUDITSYSCALL + if (entry->rule.listnr == AUDIT_FILTER_EXIT && !e->rule.watch && !e->rule.tree) { + for (i = 0; i < NR_syscalls; i++) + audit_syscall[i] -= !(!audit_in_mask(&entry->rule, i)); + } +#endif + if (e->rule.watch) audit_remove_watch_rule(&e->rule); diff --git a/kernel/auditsc.c b/kernel/auditsc.c index ce8c9e2..2a74436 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -783,7 +783,7 @@ static enum audit_state audit_filter_task(struct task_struct *tsk, char **key) return AUDIT_BUILD_CONTEXT; } -static int audit_in_mask(const struct audit_krule *rule, unsigned long val) +int audit_in_mask(const struct audit_krule *rule, unsigned long val) { int word, bit; @@ -814,6 +814,13 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk, if (auditd_test_task(tsk)) return AUDIT_DISABLED; + mutex_lock(&audit_filter_mutex); + if (!audit_syscall[ctx->major]) { + mutex_unlock(&audit_filter_mutex); + return AUDIT_BUILD_CONTEXT; + } + mutex_unlock(&audit_filter_mutex); + rcu_read_lock(); list_for_each_entry_rcu(e, list, list) { if (audit_in_mask(&e->rule, ctx->major) && -- 2.15.2