From: "Sverdlin, Alexander (Nokia - DE/Ulm)" <alexander.sverdlin@nokia.com>
To: Paul Moore <pmoore@redhat.com>,
"linux-audit@redhat.com" <linux-audit@redhat.com>,
Richard Guy Briggs <rbriggs@redhat.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Alexei Starovoitov <ast@kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] audit: always enable syscall auditing when supported and audit is enabled
Date: Mon, 28 Jan 2019 08:34:35 +0000 [thread overview]
Message-ID: <5490ae28-251b-bfda-38a6-5be201a4a8d8@nokia.com> (raw)
In-Reply-To: <20151208164237.15736.42955.stgit@localhost>
Hello Paul,
On 08/12/2015 17:42, Paul Moore wrote:
> To the best of our knowledge, everyone who enables audit at compile
> time also enables syscall auditing; this patch simplifies the Kconfig
> menus by removing the option to disable syscall auditing when audit
> is selected and the target arch supports it.
>
> Signed-off-by: Paul Moore <pmoore@redhat.com>
this patch is responsible for massive performance degradation for those
who used only CONFIG_SECURITY_APPARMOR.
And the numbers are, take the following test for instance:
dd if=/dev/zero of=/dev/null count=2M
ARM64: 500MB/s -> 350MB/s
ARM: 400MB/s -> 300MB/s
(with some particular CPU frequencies).
Should we revert this patch?
> ---
> init/Kconfig | 11 +++--------
> 1 file changed, 3 insertions(+), 8 deletions(-)
>
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
>
> diff --git a/init/Kconfig b/init/Kconfig
> index c24b6f7..d4663b1 100644
> --- a/init/Kconfig
> +++ b/init/Kconfig
> @@ -299,20 +299,15 @@ config AUDIT
> help
> Enable auditing infrastructure that can be used with another
> kernel subsystem, such as SELinux (which requires this for
> - logging of avc messages output). Does not do system-call
> - auditing without CONFIG_AUDITSYSCALL.
> + logging of avc messages output). System call auditing is included
> + on architectures which support it.
>
> config HAVE_ARCH_AUDITSYSCALL
> bool
>
> config AUDITSYSCALL
> - bool "Enable system-call auditing support"
> + def_bool y
> depends on AUDIT && HAVE_ARCH_AUDITSYSCALL
> - default y if SECURITY_SELINUX
> - help
> - Enable low-overhead system-call auditing infrastructure that
> - can be used independently or with another kernel subsystem,
> - such as SELinux.
>
> config AUDIT_WATCH
> def_bool y
>
--
Best regards,
Alexander Sverdlin.
next parent reply other threads:[~2019-01-28 8:34 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20151208164237.15736.42955.stgit@localhost>
2019-01-28 8:34 ` Sverdlin, Alexander (Nokia - DE/Ulm) [this message]
2019-01-28 14:19 ` [PATCH] audit: always enable syscall auditing when supported and audit is enabled Paul Moore
2019-01-28 14:36 ` Sverdlin, Alexander (Nokia - DE/Ulm)
2019-01-28 14:52 ` Paul Moore
2019-01-28 15:38 ` Sverdlin, Alexander (Nokia - DE/Ulm)
2019-01-28 16:26 ` Paul Moore
2019-01-28 20:03 ` Steve Grubb
2019-01-28 20:08 ` Paul Moore
2019-01-28 21:19 ` Steve Grubb
2019-01-28 21:49 ` Richard Guy Briggs
2019-01-28 22:01 ` Paul Moore
2019-01-28 14:45 ` Sverdlin, Alexander (Nokia - DE/Ulm)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5490ae28-251b-bfda-38a6-5be201a4a8d8@nokia.com \
--to=alexander.sverdlin@nokia.com \
--cc=ast@kernel.org \
--cc=daniel@iogearbox.net \
--cc=gregkh@linuxfoundation.org \
--cc=linux-audit@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=pmoore@redhat.com \
--cc=rbriggs@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).