From: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
To: paul@paul-moore.com, eparis@redhat.com,
linux-kernel@vger.kernel.org, audit@vger.kernel.org
Cc: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Subject: [PATCH] audit: use pid.is_auditd to make auditd_test_task() faster
Date: Fri, 14 Apr 2023 03:13:25 +0000 [thread overview]
Message-ID: <20230414031325.82840-1-eiichi.tsukata@nutanix.com> (raw)
auditd_test_task() is a hot path of system call auditing. This patch
introduces a new bit field "is_auditd" in pid struct which can be used
for faster check of registered audit daemon.
Benchmark
=========
Run the following command:
dd if=/dev/zero of=/dev/null bs=1 count=5M
With rule:
-a never,exit -F arch=b64 -S uname
Result:
Base line : 2.572 sec
/w this patch: 2.412 sec (6.6% faster)
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
---
include/linux/pid.h | 4 ++++
kernel/audit.c | 22 ++--------------------
kernel/audit.h | 3 ++-
kernel/pid.c | 3 +++
4 files changed, 11 insertions(+), 21 deletions(-)
diff --git a/include/linux/pid.h b/include/linux/pid.h
index 343abf22092e..5fe38e254c9a 100644
--- a/include/linux/pid.h
+++ b/include/linux/pid.h
@@ -68,6 +68,10 @@ struct pid
wait_queue_head_t wait_pidfd;
struct rcu_head rcu;
struct upid numbers[1];
+#ifdef CONFIG_AUDIT
+ /* registered audit daemon tgid */
+ unsigned is_auditd:1;
+#endif
};
extern struct pid init_struct_pid;
diff --git a/kernel/audit.c b/kernel/audit.c
index 9bc0b0301198..964d1a20c32d 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -208,26 +208,6 @@ struct audit_reply {
struct sk_buff *skb;
};
-/**
- * auditd_test_task - Check to see if a given task is an audit daemon
- * @task: the task to check
- *
- * Description:
- * Return 1 if the task is a registered audit daemon, 0 otherwise.
- */
-int auditd_test_task(struct task_struct *task)
-{
- int rc;
- struct auditd_connection *ac;
-
- rcu_read_lock();
- ac = rcu_dereference(auditd_conn);
- rc = (ac && ac->pid == task_tgid(task) ? 1 : 0);
- rcu_read_unlock();
-
- return rc;
-}
-
/**
* audit_ctl_lock - Take the audit control lock
*/
@@ -478,6 +458,7 @@ static void auditd_conn_free(struct rcu_head *rcu)
struct auditd_connection *ac;
ac = container_of(rcu, struct auditd_connection, rcu);
+ ac->pid->is_auditd = 0;
put_pid(ac->pid);
put_net(ac->net);
kfree(ac);
@@ -505,6 +486,7 @@ static int auditd_set(struct pid *pid, u32 portid, struct net *net)
if (!ac_new)
return -ENOMEM;
ac_new->pid = get_pid(pid);
+ ac_new->pid->is_auditd = 1;
ac_new->portid = portid;
ac_new->net = get_net(net);
diff --git a/kernel/audit.h b/kernel/audit.h
index c57b008b9914..aecf334a699f 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -214,7 +214,8 @@ extern bool audit_ever_enabled;
extern void audit_log_session_info(struct audit_buffer *ab);
-extern int auditd_test_task(struct task_struct *task);
+/* Check to see if a given task is an audit daemon */
+#define auditd_test_task(tsk) task_tgid(tsk)->is_auditd
#define AUDIT_INODE_BUCKETS 32
extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS];
diff --git a/kernel/pid.c b/kernel/pid.c
index 3fbc5e46b721..c0efaeee99a0 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -183,6 +183,9 @@ struct pid *alloc_pid(struct pid_namespace *ns, pid_t *set_tid,
tmp = ns;
pid->level = ns->level;
+#ifdef CONFIG_AUDIT
+ pid->is_auditd = 0;
+#endif
for (i = ns->level; i >= 0; i--) {
int tid = 0;
--
2.39.2
next reply other threads:[~2023-04-14 3:14 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-14 3:13 Eiichi Tsukata [this message]
2023-04-14 14:44 ` [PATCH] audit: use pid.is_auditd to make auditd_test_task() faster Paul Moore
2023-04-17 11:42 ` Eiichi Tsukata
2023-04-17 20:27 ` Paul Moore
2023-04-18 7:15 ` Eiichi Tsukata
2023-04-18 8:13 ` kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230414031325.82840-1-eiichi.tsukata@nutanix.com \
--to=eiichi.tsukata@nutanix.com \
--cc=audit@vger.kernel.org \
--cc=eparis@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=paul@paul-moore.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).