This series adds a repeatable microbenchmark for audit's fixed syscall
overhead and uses it to address two cases where audit continues doing work
which cannot produce a record.
Patch 1 adds audit_bench, a manually run getpid(2) microbenchmark under
tools/testing/selftests/audit. It leaves policy management to the caller
so the same workload can measure different rule configurations without
silently changing the system policy.
Patch 2 fixes audit_n_rules and audit_signals accounting when rules are
removed automatically with a watch or tree, or after an LSM rule update
fails. These paths could leave the counters nonzero after the last
applicable rule had disappeared, causing every subsequent syscall to
allocate a non-dummy audit context. It also centralizes rule accounting
so all rule removal paths share the same bookkeeping.
The median getpid latency in the same unpinned VM was:
no rules stale state fixed
automatically removed watch 38 ns 55 ns 38 ns
automatically removed tree 38 ns 59 ns 38 ns
Patch 3 builds on those lifecycle helpers. It maintains an aggregate mask
of the syscall numbers present in exit rules and checks that mask before
walking the exit filter list. The mask is architecture-independent and
therefore conservative: overlapping syscall numbers may cause an
unnecessary scan, but cannot suppress a match.
For an unrelated getpid workload, the median latency scaled as follows:
exit rules 1 32 128 256
before 55 ns 71 ns 428 ns 791 ns
after 55 ns 55 ns 55 ns 55 ns
The aggregate mask is updated through the centralized accounting helpers.
Insertion sets the relevant bits before publishing the rule with
list_add_rcu(); removal unlinks the rule before clearing them. This keeps
the lockless rejection test conservative during concurrent rule changes.
The series does not change the audit userspace ABI or rule matching
semantics. The benchmark and complete reproduction procedures are
documented in the individual patches.
---
Stanislav Kinsburskii (3):
selftests/audit: Add syscall overhead benchmark
audit: Fix filter rule accounting after automatic removal
audit: Skip exit filtering for syscalls without rules
MAINTAINERS | 1 +
kernel/audit.h | 7 +
kernel/audit_tree.c | 1 +
kernel/audit_watch.c | 2 +
kernel/auditfilter.c | 140 +++++++++++------
kernel/auditsc.c | 13 ++
tools/testing/selftests/Makefile | 1 +
tools/testing/selftests/audit/.gitignore | 2 +
tools/testing/selftests/audit/Makefile | 9 ++
tools/testing/selftests/audit/README | 30 ++++
tools/testing/selftests/audit/audit_bench.c | 227 ++++++++++++++++++++++++++++
11 files changed, 389 insertions(+), 44 deletions(-)
---
base-commit: ea2bff00da89d7767d677bb68470130ba96f4928
change-id: 20260806-audit-96a1e71d38b1
Best regards,
--
Stanislav Kinsburskii <[email protected]>
