Re: Sycall Rules vs Watch Rules
Amjad Gabbar <[email protected]> Tue, 19 Sep 2023 19:26:04 -0500
| Newsgroups | com.redhat.linux-audit |
|---|---|
| Message-ID | <CAJcJf=SJxd3bnu2Pi4Ps5fL8NUowQrvuVn+VgrBK5bY0pUdbAg@mail.gmail.com> |
--===============0219415409905688062== Content-Type: multipart/alternative; boundary="0000000000005d23af0605bf6c0f" --0000000000005d23af0605bf6c0f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, > The perm fields select the right system calls > that should be reported on. That is accurate from a functional perspective. There is no change in the events logged. But there is a difference in performance. This is most evident for syscalls not part of the perm fields. Futex is a syscall that I see called fairly often in my system, which is not part of the perm fields. As an example, I selected the ospp rules file to measure performance via a synthetic test- https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v4= 2.rules stress-ng =E2=80=94futex 1 =E2=80=94futex-ops 1000000 If we look at the performance numbers for the file rules as is, the auditing percentage is about 14%. Now if we were to just add the specific syscalls that the perm fields filter on in the rules file, the auditing percentage would drop to around 2%. Again this synthetic test is just for demonstration purposes but helps explain the point. Basically for syscalls not part of the perm fields we filter them at a much later stage in the AUDIT_PERM case(due to -S all) whereas if we use specific syscalls within the rule itself, we would exit the processing in audit_filter_syscall itself for uninteresting syscalls, hence improving the performance. >I see a 1 line change that I am testing. Let me know if you need any help. I did have a partial PR ready for submission but wanted to get your opinions before submitting anything. Regards Ali Adnan On Tue, Sep 19, 2023 at 6:33 PM Steve Grubb <[email protected]> wrote: > Hello, > > On Tuesday, September 12, 2023 5:20:54 PM EDT Amjad Gabbar wrote: > > Based on this and some experiments I have been performing, I would > suggest > > changing how a lot of the FileSystem rules are written and illustrated. > > Ex - > > > https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-d= ss > > -v31.rules#L34-L35 > > > > The rule in the repository is > > -a always,exit -F path=3D/etc/sudoers -F perm=3Dwa -F > > key=3D10.2.2-priv-config-changes > > > > My suggestion is to instead change the rule based on the permissions > > defined. The above rule would change to the following based on the kern= el > > being used. > > -a always,exit -S <list of syscalls in audit_write.h and audit_read.h > > +open,openat> -F path=3D/etc/sudoers -F perm=3Dwa -F > > key=3D10.2.2-priv-config-changes > > That should be exactly what the kernel does with the perm fields. The per= m > fields select the right system calls that should be reported on. > > > This is higher performance because we are limiting the syscalls instead > of > > making use of -S all which has more paths of evaluation for each and > every > > syscall. > > > > Same thing for watches. Watches are inherently -S all rules which are > very > > performance intensive. > > > https://github.com/linux-audit/audit-userspace/blob/1482cec74f2d9472f81dd= 4f > > 0533484bd0c26decd/lib/libaudit.c#L805 > > There should be no difference in performance between watches and syscall > based file auditing. > > > Ideally we should limit the syscalls based on the permissions being use= d. > > > > I have implemented the same in my environment rules and have noticed a > > massive performance difference with no difference in the events being > > logged since we anyways filter eventually based on the permissions. > > > > Let me know what you all think. > > I'm looking into this more. I see a 1 line change that I am testing. > > -Steve > > > On Wed, Sep 6, 2023 at 2:58 PM Richard Guy Briggs <[email protected]> > wrote: > > > On 2023-09-06 10:56, Amjad Gabbar wrote: > > > > Hi, > > > > > > > > I have done some analysis and digging into how both the watch rules > and > > > > syscall rules are translated. > > > > > > > > From my understanding, in terms of logging, both the below rules ar= e > > > > similar. There is no difference in either of the rules. > > > > > > > > 1. -w /etc -p wa -k ETC_WATCH > > > > > > They are similar in this case. > > > -w behaves differently depending on the existance of the watched enti= ty > > > and the presence of a trailing "/". This is why the form above is > > > deprecated. > > > > > > > 2. -a always,exit -F arch=3Db64 -S <all syscalls part of the write = and > > > > attr > > > > classes> -F dir=3D/etc -F perm=3Dwa -k ETC_WATCH > > > > > > > > The write and attr classes consist of syscalls in > > > > =E2=80=9Cinclude/asm-generic/audit_*.h=E2=80=9C. > > > > > > > > The perm flag is needed in the second case for including open/open= at > > > > > > > > syscalls which are not a part of the write and attr syscall list. > > > > > > > > I'd like to verify if what I mentioned earlier is accurate, and I > have > > > > an > > > > additional point but depends on whether this is accurate. > > > > > > > > Ali > > > > > > - RGB > > > > > > -- > > > Richard Guy Briggs <[email protected]> > > > Sr. S/W Engineer, Kernel Security, Base Operating Systems > > > Remote, Ottawa, Red Hat Canada > > > Upstream IRC: SunRaycer > > > Voice: +1.613.860 2354 SMS: +1.613.518.6570 > > > > > --0000000000005d23af0605bf6c0f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"auto">Hi,</div><div dir=3D"auto"><br></div><div dir=3D"auto">&g= t; The perm fields select the right system calls=C2=A0</div><div dir=3D"aut= o">> that should be reported on.</div><div dir=3D"auto"><br></div><div d= ir=3D"auto">That is accurate from a functional perspective. There is no cha= nge in the events logged. But there is a difference in performance. This is= most evident for syscalls not part of the perm fields.</div><div dir=3D"au= to"><br></div><div dir=3D"auto">Futex is a syscall that I see called fairly= often in my system, which is not part of the perm fields.</div><div dir=3D= "auto">As an example, I selected the ospp rules file to measure =C2=A0perfo= rmance via a synthetic test-=C2=A0<div><a href=3D"https://github.com/linux-= audit/audit-userspace/blob/master/rules/30-ospp-v42.rules">https://github.c= om/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules</a></div= ><div dir=3D"auto"><br></div><div dir=3D"auto">stress-ng =E2=80=94futex 1 = =E2=80=94futex-ops 1000000=C2=A0</div><div dir=3D"auto"><br></div><div dir= =3D"auto">If we look at the performance numbers for the file rules as is, t= he auditing percentage is about 14%.</div><div dir=3D"auto"><br></div><div = dir=3D"auto">Now if we were to just add the specific syscalls that the perm= fields filter on in the rules file, the auditing percentage would drop to = around 2%.</div><div dir=3D"auto"><br></div><div dir=3D"auto">Again this sy= nthetic test is just for demonstration purposes but helps explain the point= . Basically for syscalls not part of the perm fields we filter them at a mu= ch later stage in the AUDIT_PERM case(due to -S all) whereas if we use spec= ific syscalls within the rule itself, we would exit the processing in audit= _filter_syscall itself for uninteresting syscalls, hence improving the perf= ormance.</div><div dir=3D"auto"><br></div><div dir=3D"auto">>I=C2=A0<spa= n style=3D"background-color:rgba(0,0,0,0);border-color:rgb(0,0,0) rgb(0,0,0= ) rgb(0,0,0) rgb(204,204,204);color:rgb(0,0,0)">see a 1 line change that I = am testing.</span></div><div dir=3D"auto"><span style=3D"background-color:r= gba(0,0,0,0);border-color:rgb(0,0,0) rgb(0,0,0) rgb(0,0,0) rgb(204,204,204)= ;color:rgb(0,0,0)">Let me know if you need any help. I did have a partial P= R ready for submission but wanted to get your opinions before submitting an= ything.</span></div><div dir=3D"auto"><span style=3D"background-color:rgba(= 0,0,0,0);border-color:rgb(0,0,0) rgb(0,0,0) rgb(0,0,0) rgb(204,204,204);col= or:rgb(0,0,0)"><br></span></div><div dir=3D"auto"><span style=3D"background= -color:rgba(0,0,0,0);border-color:rgb(0,0,0) rgb(0,0,0) rgb(0,0,0) rgb(204,= 204,204);color:rgb(0,0,0)">Regards</span></div><div dir=3D"auto"><span styl= e=3D"background-color:rgba(0,0,0,0);border-color:rgb(0,0,0) rgb(0,0,0) rgb(= 0,0,0) rgb(204,204,204);color:rgb(0,0,0)">Ali Adnan</span></div><div dir=3D= "auto"><br></div></div><div><div class=3D"gmail_quote"><div dir=3D"ltr" cla= ss=3D"gmail_attr">On Tue, Sep 19, 2023 at 6:33 PM Steve Grubb <<a href= =3D"mailto:[email protected]">[email protected]</a>> wrote:<br></div><bl= ockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-lef= t-width:1px;border-left-style:solid;padding-left:1ex;border-left-color:rgb(= 204,204,204)">Hello,<br> <br> On Tuesday, September 12, 2023 5:20:54 PM EDT Amjad Gabbar wrote:<br> > Based on this and some experiments I have been performing, I would sug= gest<br> > changing how a lot of the FileSystem rules are written and illustrated= .<br> > Ex -<br> > <a href=3D"https://github.com/linux-audit/audit-userspace/blob/master/= rules/30-pci-dss" rel=3D"noreferrer" target=3D"_blank">https://github.com/l= inux-audit/audit-userspace/blob/master/rules/30-pci-dss</a><br> > -v31.rules#L34-L35<br> > <br> > The rule in the repository is<br> > -a always,exit -F path=3D/etc/sudoers -F perm=3Dwa -F<br> > key=3D10.2.2-priv-config-changes<br> > <br> > My suggestion is to instead change the rule based on the permissions<b= r> > defined. The above rule would change to the following based on the ker= nel<br> > being used.<br> > -a always,exit -S <list of syscalls in audit_write.h and audit_read= .h<br> > +open,openat> -F path=3D/etc/sudoers -F perm=3Dwa -F<br> > key=3D10.2.2-priv-config-changes<br> <br> That should be exactly what the kernel does with the perm fields. The perm = <br> fields select the right system calls that should be reported on.<br> <br> > This is higher performance because we are limiting the syscalls instea= d of<br> > making use of -S all which has more paths of evaluation for each and e= very<br> > syscall.<br> > <br> > Same thing for watches. Watches are inherently -S all rules which are = very<br> > performance intensive.<br> > <a href=3D"https://github.com/linux-audit/audit-userspace/blob/1482cec= 74f2d9472f81dd4f" rel=3D"noreferrer" target=3D"_blank">https://github.com/l= inux-audit/audit-userspace/blob/1482cec74f2d9472f81dd4f</a><br> > 0533484bd0c26decd/lib/libaudit.c#L805<br> <br> There should be no difference in performance between watches and syscall <b= r> based file auditing.<br> <br> > Ideally we should limit the syscalls based on the permissions being us= ed.<br> > <br> > I have implemented the same in my environment rules and have noticed a= <br> > massive performance difference with no difference in the events being<= br> > logged since we anyways filter eventually based on the permissions.<br= > > <br> > Let me know what you all think.<br> <br> I'm looking into this more. I see a 1 line change that I am testing.<br= > <br> -Steve<br> <br> > On Wed, Sep 6, 2023 at 2:58 PM Richard Guy Briggs <<a href=3D"mailt= o:[email protected]" target=3D"_blank">[email protected]</a>> wrote:<br> > > On 2023-09-06 10:56, Amjad Gabbar wrote:<br> > > > Hi,<br> > > > <br> > > > I have done some analysis and digging into how both the watc= h rules and<br> > > > syscall rules are translated.<br> > > > <br> > > > From my understanding, in terms of logging, both the below r= ules are<br> > > > similar. There is no difference in either of the rules.<br> > > > <br> > > > 1. -w /etc -p wa -k ETC_WATCH<br> > > <br> > > They are similar in this case.<br> > > -w behaves differently depending on the existance of the watched = entity<br> > > and the presence of a trailing "/".=C2=A0 This is why t= he form above is<br> > > deprecated.<br> > > <br> > > > 2. -a always,exit -F arch=3Db64 -S <all syscalls part of = the write and<br> > > > attr<br> > > > classes> -F dir=3D/etc=C2=A0 -F perm=3Dwa -k ETC_WATCH<br= > > > > <br> > > > The write and attr classes consist of syscalls in<br> > > > =E2=80=9Cinclude/asm-generic/audit_*.h=E2=80=9C.<br> > > > <br> > > >=C2=A0 The perm flag is needed in the second case for includi= ng open/openat<br> > > > <br> > > > syscalls which are not a part of the write and attr syscall = list.<br> > > > <br> > > > I'd like to verify if what I mentioned earlier is accura= te, and I have<br> > > > an<br> > > > additional point but depends on whether this is accurate.<br= > > > > <br> > > > Ali<br> > > <br> > > - RGB<br> > > <br> > > --<br> > > Richard Guy Briggs <<a href=3D"mailto:[email protected]" target= =3D"_blank">[email protected]</a>><br> > > Sr. S/W Engineer, Kernel Security, Base Operating Systems<br> > > Remote, Ottawa, Red Hat Canada<br> > > Upstream IRC: SunRaycer<br> > > Voice: +1.613.860 2354 SMS: +1.613.518.6570<br> <br> <br> <br> <br> </blockquote></div></div> --0000000000005d23af0605bf6c0f-- --===============0219415409905688062== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- Linux-audit mailing list [email protected] https://listman.redhat.com/mailman/listinfo/linux-audit --===============0219415409905688062==--