Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Ankur Arora <ankur.a.arora@oracle.com>
To:     linux-audit@redhat.com
Cc:     paul@paul-moore.com, eparis@redhat.com,
        linux-kernel@vger.kernel.org, boris.ostrovsky@oracle.com,
        konrad.wilk@oracle.com
Subject: [PATCH 3/3] audit: unify audit_filter_{uring(),inode_name(),syscall()}
Date:   Tue, 27 Sep 2022 15:59:44 -0700
Message-Id: <20220927225944.2254360-4-ankur.a.arora@oracle.com>
In-Reply-To: <20220927225944.2254360-1-ankur.a.arora@oracle.com>
References: <20220927225944.2254360-1-ankur.a.arora@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?vRp7nV6mZNFToy0/CNRNisjauemq1ena0YKDCWhAnSCpQiSV1gQ6+nEmB6/i?=
 =?us-ascii?Q?Ey1RyK9QueWcYkSwjEllnksgyYoCZMOKZDs0i1U4eAYS/7warjUdP+91D9na?=
 =?us-ascii?Q?ZDhcTwBNS/uZYcdYbkneqQ1EMwUEaRCTk5Rnz1VLpAlfk7oTiYsYRxnvgIMA?=
 =?us-ascii?Q?00R9t48nABDgQJZOBSl9zNK0WKngQdoQjainJy3m1IZ79/NhAjJ0vD1ovt3Y?=
 =?us-ascii?Q?BDwSMLlad6Jtki/H1g7CzU+VFEJxmkaSQ9zAdPdKS2+al9IfkZuPOf++YS04?=
 =?us-ascii?Q?cJw5SoDB6zisACfja6haZ9jXI6/A6QAEtiU2zF25O7Hty70lKzAgyhL5VDpg?=
 =?us-ascii?Q?nAXLpKgacV2wGlhN3t0w6d32yzOBmIOgF50/Y3MvQKfkyJVul8WE/ynDkrU9?=
 =?us-ascii?Q?GfyIJqioeXFyBZwz4ToLC7YkSLpE3s7IUng0ZFq3F5MDZNX5DA4b5u/ncGsT?=
 =?us-ascii?Q?lUvYTE+oXTVKKQG333faBCCl70BJ9I0uk6iHpjgbxWXMxoJD2a38fSl0HSlh?=
 =?us-ascii?Q?2BLqjnB1Nkftwj93Ro6SC8Q7tTcl9rUBkEO316tKUqzmJvIWEupAdXP5Lb6J?=
 =?us-ascii?Q?t/LfMeixBks2ZXETl3flFwCczgbIv8uf10jN2EcnB7EQpZcUfJvKAaUcpVfY?=
 =?us-ascii?Q?p6ZiL9myEA/kz4vXIxM+US1GC6geBZPHkKrzICpDmjjOIb+EL5MplwsJtf+L?=
 =?us-ascii?Q?od/DffeGo2nzzYpcLKW7xysDlXIo895+aMWs5MIqEbeOvQI2IKtay6hyAeOf?=
 =?us-ascii?Q?qC9/svBjcCj7eL0DU+sDtNRH6IPAKWwTZD4CT1M9VrbvnDMFA+ogTlqp6/OR?=
 =?us-ascii?Q?OLmeb2Ud7yp6RSkw2AATQ5BJ1BNAfsW7WODJ6dUT0fc10SEWLvrf9A+c5Rfg?=
 =?us-ascii?Q?/6UmQUkYEr2vL6Pp/xN0oZduszCItapvcpSpzYCr03qXee2O8w+Fvwxyj6KQ?=
 =?us-ascii?Q?V2K1U1ZGlSeaIURpJEba929U0hsGMkLfT4QYnAFa32Ye1CCIOSEBtaCleRlX?=
 =?us-ascii?Q?sm+tECHh5UXK+HJqaBLjMEKqiaeUYrMXQ8av73CtbyyhOLUs9YU6pGkEOFG2?=
 =?us-ascii?Q?QklyC1MCtbM/F18lt+z3CV7PIY4m7c2OVwJt9/Ls6fUDXU6Pgs4lnktO5u+n?=
 =?us-ascii?Q?sRi0FXa7FCP+f1rCJO3cYxfIWo9pHW55OLhKkj/7eadRwTcIdQItRK6r4VW6?=
 =?us-ascii?Q?IlhGxZw2HziumKgkpkjO0CikOan1RHwSVccuoqBFb3CeI6SF3qSgTL9r6Jop?=
 =?us-ascii?Q?9TfW1HND6EPzl4XEaCv3Y6JsEnFeFUM0cp6X18An3rKTB/uUFpz/ZZdEWixZ?=
 =?us-ascii?Q?nu+s++d5Q3cCAAMjIyMweh7Waj9AUlocHQnsA+sp5F6XKwH1yZVppBoNTatq?=
 =?us-ascii?Q?aideaJAY7Ughe7eqq5gd6aHy7Mzf3ywOybwdwpCgCPswcTKXIavqfqUGuiWX?=
 =?us-ascii?Q?l5SLT+OP3Ot6xTHE9rggOTIkFMtFCM1Rq/KjNMty567QqT4cR/TaMu8pR13q?=
 =?us-ascii?Q?x7nK23AhkzDgsi8fQpeqMzyiGj+cmkKgt/HF03j7E7ckcAQAQPIGFKZ8UHZc?=
 =?us-ascii?Q?aUdqWeQ/8iFk3vjuQ8tISTKXySDgcxqv7tfzlcG4?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 57396e2b-a3f1-405c-a402-08daa0dbfe4b
X-MS-Exchange-CrossTenant-AuthSource: CO6PR10MB5409.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Sep 2022 22:59:55.3654
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: jjWAobYO+WhzXOyi1G5tva712tIOITRz609oWOxaoPu+hk4DV7LQ3tbikanKLeM8NYodJqej8AzljXGv6tSvYgUG9CAPUUjpXB5b67UFxgg=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR10MB6900
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.528,FMLib:17.11.122.1
 definitions=2022-09-27_11,2022-09-27_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 adultscore=0
 suspectscore=0 phishscore=0 mlxscore=0 mlxlogscore=999 spamscore=0
 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2209130000 definitions=main-2209270141
X-Proofpoint-ORIG-GUID: tqvi48CRmi8Ed9jN-S_2keNs323j4jeW
X-Proofpoint-GUID: tqvi48CRmi8Ed9jN-S_2keNs323j4jeW
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

audit_filter_uring(), audit_filter_inode_name() are substantially similar
to audit_filter_syscall(). Move the core logic to __audit_filter() which
can be parametrized for all three.

On a Skylakex system, getpid() latency (all results aggregated
across 12 boot cycles):

         Min     Mean    Median   Max      pstdev
         (ns)    (ns)    (ns)     (ns)

 -    173.11   182.51  179.65  202.09     (+- 4.34%)
 +    162.11   175.26  173.71  190.56     (+- 4.33%)

Performance counter stats for 'bin/getpid' (3 runs) go from:
    cycles               706.13  (  +-  4.13% )
    instructions        1654.70  (  +-   .06% )
    IPC                    2.35  (  +-  4.25% )
    branches             430.99  (  +-   .06% )
    branch-misses          0.50  (  +-  2.00% )
    L1-dcache-loads      440.02  (  +-   .07% )
    L1-dcache-load-misses  5.22  (  +- 82.75% )

 to:
    cycles               678.79  (  +-  4.22% )
    instructions        1657.79  (  +-   .05% )
    IPC                    2.45  (  +-  4.08% )
    branches             432.00  (  +-   .05% )
    branch-misses          0.38  (  +- 23.68% )
    L1-dcache-loads      444.96  (  +-   .03% )
    L1-dcache-load-misses  5.13  (  +- 73.09% )

(Both aggregated over 12 boot cycles.)

Unclear if the improvement is just run-to-run variation or because of
a slightly denser loop (the list parameter in the list_for_each_entry_rcu()
exit check now comes from a register rather than a constant as before.)

Signed-off-by: Ankur Arora <ankur.a.arora@oracle.com>
---
 kernel/auditsc.c | 86 +++++++++++++++++++++++++-----------------------
 1 file changed, 44 insertions(+), 42 deletions(-)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index bf26f47b5226..dd89a52988b0 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -805,6 +805,41 @@ static bool audit_in_mask(const struct audit_krule *rule, unsigned long val)
 	return rule->mask[word] & bit;
 }
 
+/**
+ * __audit_filter - common filter
+ *
+ * @tsk: associated task
+ * @ctx: audit context
+ * @list: audit filter list
+ * @op: current syscall/uring_op
+ * @name: name to be filtered (used by audit_filter_inode_name)
+ *
+ * return: 1 if we hit a filter, 0 if we don't
+ */
+static int __audit_filter(struct task_struct *tsk,
+			   struct audit_context *ctx,
+			   struct list_head *list,
+			   unsigned long op,
+			   struct audit_names *name)
+{
+	struct audit_entry *e;
+	enum audit_state state;
+
+	rcu_read_lock();
+	list_for_each_entry_rcu(e, list, list) {
+		if (unlikely(audit_in_mask(&e->rule, op))) {
+			if (audit_filter_rules(tsk, &e->rule, ctx, name,
+					       &state, false)) {
+				rcu_read_unlock();
+				ctx->current_state = state;
+				return 1;
+			}
+		}
+	}
+	rcu_read_unlock();
+	return 0;
+}
+
 /**
  * audit_filter_uring - apply filters to an io_uring operation
  * @tsk: associated task
@@ -813,24 +848,11 @@ static bool audit_in_mask(const struct audit_krule *rule, unsigned long val)
 static void audit_filter_uring(struct task_struct *tsk,
 			       struct audit_context *ctx)
 {
-	struct audit_entry *e;
-	enum audit_state state;
-
 	if (auditd_test_task(tsk))
 		return;
 
-	rcu_read_lock();
-	list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_URING_EXIT],
-				list) {
-		if (audit_in_mask(&e->rule, ctx->uring_op) &&
-		    audit_filter_rules(tsk, &e->rule, ctx, NULL, &state,
-				       false)) {
-			rcu_read_unlock();
-			ctx->current_state = state;
-			return;
-		}
-	}
-	rcu_read_unlock();
+	__audit_filter(tsk, ctx, &audit_filter_list[AUDIT_FILTER_URING_EXIT],
+			ctx->uring_op, NULL);
 }
 
 /* At syscall exit time, this filter is called if the audit_state is
@@ -841,26 +863,11 @@ static void audit_filter_uring(struct task_struct *tsk,
 static void audit_filter_syscall(struct task_struct *tsk,
 				 struct audit_context *ctx)
 {
-	struct audit_entry *e;
-	enum audit_state state;
-	unsigned long major = ctx->major;
-
 	if (auditd_test_task(tsk))
 		return;
 
-	rcu_read_lock();
-	list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_EXIT], list) {
-		if (unlikely(audit_in_mask(&e->rule, major))) {
-			if (audit_filter_rules(tsk, &e->rule, ctx, NULL,
-					       &state, false)) {
-				rcu_read_unlock();
-				ctx->current_state = state;
-				return;
-			}
-		}
-	}
-	rcu_read_unlock();
-	return;
+	__audit_filter(tsk, ctx, &audit_filter_list[AUDIT_FILTER_EXIT],
+			ctx->major, NULL);
 }
 
 /*
@@ -872,17 +879,12 @@ static int audit_filter_inode_name(struct task_struct *tsk,
 				   struct audit_context *ctx) {
 	int h = audit_hash_ino((u32)n->ino);
 	struct list_head *list = &audit_inode_hash[h];
-	struct audit_entry *e;
-	enum audit_state state;
 
-	list_for_each_entry_rcu(e, list, list) {
-		if (audit_in_mask(&e->rule, ctx->major) &&
-		    audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) {
-			ctx->current_state = state;
-			return 1;
-		}
-	}
-	return 0;
+	/*
+	 * We are called holding an rcu read lock. __audit_filter() will take
+	 * one as well.
+	 */
+	return __audit_filter(tsk, ctx, list, ctx->major, n);
 }
 
 /* At syscall exit time, this filter is called if any audit_names have been
-- 
2.31.1