Re: [PATCH] audit: Only use the syscall slowpath when syscall audit rules exist

2014-02-03 Thread Andy Lutomirski
On Mon, Feb 3, 2014 at 12:23 PM, Steve Grubb wrote: > On Monday, February 03, 2014 09:53:23 AM Andy Lutomirski wrote: >> This toggles TIF_SYSCALL_AUDIT as needed when rules change instead of >> leaving it set whenever rules might be set in the future. This reduces >> syscall latency from >60ns to

Re: [PATCH] audit: Only use the syscall slowpath when syscall audit rules exist

2014-02-03 Thread Steve Grubb
On Monday, February 03, 2014 09:53:23 AM Andy Lutomirski wrote: > This toggles TIF_SYSCALL_AUDIT as needed when rules change instead of > leaving it set whenever rules might be set in the future. This reduces > syscall latency from >60ns to closer to 40ns on my laptop. Does this mean that we have

Re: [PATCH] audit: Only use the syscall slowpath when syscall audit rules exist

2014-02-03 Thread Andy Lutomirski
On Mon, Feb 3, 2014 at 10:11 AM, Oleg Nesterov wrote: > On 02/03, Andy Lutomirski wrote: >> >> @@ -911,6 +918,47 @@ static inline struct audit_context >> *audit_alloc_context(enum audit_state state) >> return context; >> } >> >> +void audit_inc_n_rules() >> +{ >> + struct task_struct *

Re: [PATCH] audit: Only use the syscall slowpath when syscall audit rules exist

2014-02-03 Thread Oleg Nesterov
On 02/03, Andy Lutomirski wrote: > > @@ -911,6 +918,47 @@ static inline struct audit_context > *audit_alloc_context(enum audit_state state) > return context; > } > > +void audit_inc_n_rules() > +{ > + struct task_struct *p, *g; > + > + write_lock(&n_rules_lock); > + > + if (au

[PATCH] audit: Only use the syscall slowpath when syscall audit rules exist

2014-02-03 Thread Andy Lutomirski
This toggles TIF_SYSCALL_AUDIT as needed when rules change instead of leaving it set whenever rules might be set in the future. This reduces syscall latency from >60ns to closer to 40ns on my laptop. Cc: Oleg Nesterov Cc: Steve Grubb Cc: Eric Paris Signed-off-by: Andy Lutomirski --- This is