On Monday, February 03, 2014 09:53:23 AM Andy Lutomirski wrote: > This toggles TIF_SYSCALL_AUDIT as needed when rules change instead of > leaving it set whenever rules might be set in the future. This reduces > syscall latency from >60ns to closer to 40ns on my laptop.
Does this mean that we have processes that don't have the TIF_SYSCALL_AUDIT flag set? When rules get loaded, how do we get the flag put back into all processes? The theory of ops is supposed to be that for anyone not needing audit, there is only the cost of "if (tif & TIF_SYSCALL_AUDIT)". That should be it. If you have audit enabled or had it enabled (which means it might be loaded with new rules), we want to inspect the syscall. There should be a short circuit based on checking that any rules has ever been loaded or are currently loaded before doing any real collection. -Steve -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
