Messages in this thread Patch in this message | | | From | Eiichi Tsukata <> | Subject | [PATCH] audit: use pid.is_auditd to make auditd_test_task() faster | Date | Fri, 14 Apr 2023 03:13:25 +0000 |
| |
auditd_test_task() is a hot path of system call auditing. This patch introduces a new bit field "is_auditd" in pid struct which can be used for faster check of registered audit daemon.
Benchmark =========
Run the following command:
dd if=/dev/zero of=/dev/null bs=1 count=5M
With rule:
-a never,exit -F arch=b64 -S uname
Result:
Base line : 2.572 sec /w this patch: 2.412 sec (6.6% faster)
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com> --- include/linux/pid.h | 4 ++++ kernel/audit.c | 22 ++-------------------- kernel/audit.h | 3 ++- kernel/pid.c | 3 +++ 4 files changed, 11 insertions(+), 21 deletions(-)
diff --git a/include/linux/pid.h b/include/linux/pid.h index 343abf22092e..5fe38e254c9a 100644 --- a/include/linux/pid.h +++ b/include/linux/pid.h @@ -68,6 +68,10 @@ struct pid wait_queue_head_t wait_pidfd; struct rcu_head rcu; struct upid numbers[1]; +#ifdef CONFIG_AUDIT + /* registered audit daemon tgid */ + unsigned is_auditd:1; +#endif }; extern struct pid init_struct_pid; diff --git a/kernel/audit.c b/kernel/audit.c index 9bc0b0301198..964d1a20c32d 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -208,26 +208,6 @@ struct audit_reply { struct sk_buff *skb; }; -/** - * auditd_test_task - Check to see if a given task is an audit daemon - * @task: the task to check - * - * Description: - * Return 1 if the task is a registered audit daemon, 0 otherwise. - */ -int auditd_test_task(struct task_struct *task) -{ - int rc; - struct auditd_connection *ac; - - rcu_read_lock(); - ac = rcu_dereference(auditd_conn); - rc = (ac && ac->pid == task_tgid(task) ? 1 : 0); - rcu_read_unlock(); - - return rc; -} - /** * audit_ctl_lock - Take the audit control lock */ @@ -478,6 +458,7 @@ static void auditd_conn_free(struct rcu_head *rcu) struct auditd_connection *ac; ac = container_of(rcu, struct auditd_connection, rcu); + ac->pid->is_auditd = 0; put_pid(ac->pid); put_net(ac->net); kfree(ac); @@ -505,6 +486,7 @@ static int auditd_set(struct pid *pid, u32 portid, struct net *net) if (!ac_new) return -ENOMEM; ac_new->pid = get_pid(pid); + ac_new->pid->is_auditd = 1; ac_new->portid = portid; ac_new->net = get_net(net); diff --git a/kernel/audit.h b/kernel/audit.h index c57b008b9914..aecf334a699f 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -214,7 +214,8 @@ extern bool audit_ever_enabled; extern void audit_log_session_info(struct audit_buffer *ab); -extern int auditd_test_task(struct task_struct *task); +/* Check to see if a given task is an audit daemon */ +#define auditd_test_task(tsk) task_tgid(tsk)->is_auditd #define AUDIT_INODE_BUCKETS 32 extern struct list_head audit_inode_hash[AUDIT_INODE_BUCKETS]; diff --git a/kernel/pid.c b/kernel/pid.c index 3fbc5e46b721..c0efaeee99a0 100644 --- a/kernel/pid.c +++ b/kernel/pid.c @@ -183,6 +183,9 @@ struct pid *alloc_pid(struct pid_namespace *ns, pid_t *set_tid, tmp = ns; pid->level = ns->level; +#ifdef CONFIG_AUDIT + pid->is_auditd = 0; +#endif for (i = ns->level; i >= 0; i--) { int tid = 0; -- 2.39.2
| |