Re: [PATCH RFC,-next] audit: add syscall fastpath to skip audit for uncovered syscalls

On Wed, Jul 8, 2026 at 11:32=E2=80=AFAM Gaosheng Cui <[email protected]=
om> wrote:
>
> When audit rules are configured, syscalls not covered by any rule
> (e.g., futex, nanosleep, epoll_pwait) still incur full audit
> overhead.
>
> Add a bitmap fastpath: at syscall entry, audit_fastpath_skip()
> checks a precomputed bitmap; if the syscall is not covered, set
> dummy=3D1 so the exit path skips both filter traversal and context
> reset.
>
> The bitmap is the OR of:
>   - All EXIT rules' masks (not including watch/tree rules, ORed
>     under audit_filter_mutex during rebuild)
>   - audit_inode_syscalls[]: native syscalls that may trigger
>     __audit_inode()/__audit_getname(), built at init from the
>     file-operation audit classes plus audit_classify_syscall().
>
> Compat syscalls are excluded from the fastpath because native and
> compat syscall numbers share the same flat bitmap but belong to
> different namespaces.  in_compat_syscall() guards the fastpath
> so compat paths always take the original full audit processing.
> Accordingly, audit_inode_syscalls[] only includes native audit
> classes, not their _32 compat variants.
>
> The bitmap is read lock-free via READ_ONCE on syscall hot paths
> and written under audit_filter_mutex with WRITE_ONCE per word =E2=80=94
> the same no-guarantee-during-rule-change policy as audit_n_rules.
>
> Signed-off-by: Gaosheng Cui <[email protected]>
> ---
>  kernel/audit.h       |   6 ++
>  kernel/auditfilter.c | 140 +++++++++++++++++++++++++++++++++++++++++++
>  kernel/auditsc.c     |   3 +
>  3 files changed, 149 insertions(+)

I really don't like adding another set of filters to audit, have you
looked at improving the performance of the existing filter code?

--=20
paul-moore.com