<div dir="auto">Hi,</div><div dir="auto"><br></div><div dir="auto">> The perm fields select the right system calls </div><div dir="auto">> that should be reported on.</div><div dir="auto"><br></div><div dir="auto">That is accurate from a functional perspective. There is no change in the events logged. But there is a difference in performance. This is most evident for syscalls not part of the perm fields.</div><div dir="auto"><br></div><div dir="auto">Futex is a syscall that I see called fairly often in my system, which is not part of the perm fields.</div><div dir="auto">As an example, I selected the ospp rules file to measure performance via a synthetic test- <div><a href="https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules">https://github.com/linux-audit/audit-userspace/blob/master/rules/30-ospp-v42.rules</a></div><div dir="auto"><br></div><div dir="auto">stress-ng —futex 1 —futex-ops 1000000 </div><div dir="auto"><br></div><div dir="auto">If we look at the performance numbers for the file rules as is, the auditing percentage is about 14%.</div><div dir="auto"><br></div><div dir="auto">Now if we were to just add the specific syscalls that the perm fields filter on in the rules file, the auditing percentage would drop to around 2%.</div><div dir="auto"><br></div><div dir="auto">Again this synthetic test is just for demonstration purposes but helps explain the point. Basically for syscalls not part of the perm fields we filter them at a much later stage in the AUDIT_PERM case(due to -S all) whereas if we use specific syscalls within the rule itself, we would exit the processing in audit_filter_syscall itself for uninteresting syscalls, hence improving the performance.</div><div dir="auto"><br></div><div dir="auto">>I <span style="background-color:rgba(0,0,0,0);border-color:rgb(0,0,0) rgb(0,0,0) rgb(0,0,0) rgb(204,204,204);color:rgb(0,0,0)">see a 1 line change that I am testing.</span></div><div dir="auto"><span style="background-color:rgba(0,0,0,0);border-color:rgb(0,0,0) rgb(0,0,0) rgb(0,0,0) rgb(204,204,204);color:rgb(0,0,0)">Let me know if you need any help. I did have a partial PR ready for submission but wanted to get your opinions before submitting anything.</span></div><div dir="auto"><span style="background-color:rgba(0,0,0,0);border-color:rgb(0,0,0) rgb(0,0,0) rgb(0,0,0) rgb(204,204,204);color:rgb(0,0,0)"><br></span></div><div dir="auto"><span style="background-color:rgba(0,0,0,0);border-color:rgb(0,0,0) rgb(0,0,0) rgb(0,0,0) rgb(204,204,204);color:rgb(0,0,0)">Regards</span></div><div dir="auto"><span style="background-color:rgba(0,0,0,0);border-color:rgb(0,0,0) rgb(0,0,0) rgb(0,0,0) rgb(204,204,204);color:rgb(0,0,0)">Ali Adnan</span></div><div dir="auto"><br></div></div><div><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Sep 19, 2023 at 6:33 PM Steve Grubb <<a href="mailto:sgrubb@redhat.com">sgrubb@redhat.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;padding-left:1ex;border-left-color:rgb(204,204,204)">Hello,<br>
<br>
On Tuesday, September 12, 2023 5:20:54 PM EDT Amjad Gabbar wrote:<br>
> Based on this and some experiments I have been performing, I would suggest<br>
> changing how a lot of the FileSystem rules are written and illustrated.<br>
> Ex -<br>
> <a href="https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss" rel="noreferrer" target="_blank">https://github.com/linux-audit/audit-userspace/blob/master/rules/30-pci-dss</a><br>
> -v31.rules#L34-L35<br>
> <br>
> The rule in the repository is<br>
> -a always,exit -F path=/etc/sudoers -F perm=wa -F<br>
> key=10.2.2-priv-config-changes<br>
> <br>
> My suggestion is to instead change the rule based on the permissions<br>
> defined. The above rule would change to the following based on the kernel<br>
> being used.<br>
> -a always,exit -S <list of syscalls in audit_write.h and audit_read.h<br>
> +open,openat> -F path=/etc/sudoers -F perm=wa -F<br>
> key=10.2.2-priv-config-changes<br>
<br>
That should be exactly what the kernel does with the perm fields. The perm <br>
fields select the right system calls that should be reported on.<br>
<br>
> This is higher performance because we are limiting the syscalls instead of<br>
> making use of -S all which has more paths of evaluation for each and every<br>
> syscall.<br>
> <br>
> Same thing for watches. Watches are inherently -S all rules which are very<br>
> performance intensive.<br>
> <a href="https://github.com/linux-audit/audit-userspace/blob/1482cec74f2d9472f81dd4f" rel="noreferrer" target="_blank">https://github.com/linux-audit/audit-userspace/blob/1482cec74f2d9472f81dd4f</a><br>
> 0533484bd0c26decd/lib/libaudit.c#L805<br>
<br>
There should be no difference in performance between watches and syscall <br>
based file auditing.<br>
<br>
> Ideally we should limit the syscalls based on the permissions being used.<br>
> <br>
> I have implemented the same in my environment rules and have noticed a<br>
> massive performance difference with no difference in the events being<br>
> logged since we anyways filter eventually based on the permissions.<br>
> <br>
> Let me know what you all think.<br>
<br>
I'm looking into this more. I see a 1 line change that I am testing.<br>
<br>
-Steve<br>
<br>
> On Wed, Sep 6, 2023 at 2:58 PM Richard Guy Briggs <<a href="mailto:rgb@redhat.com" target="_blank">rgb@redhat.com</a>> wrote:<br>
> > On 2023-09-06 10:56, Amjad Gabbar wrote:<br>
> > > Hi,<br>
> > > <br>
> > > I have done some analysis and digging into how both the watch rules and<br>
> > > syscall rules are translated.<br>
> > > <br>
> > > From my understanding, in terms of logging, both the below rules are<br>
> > > similar. There is no difference in either of the rules.<br>
> > > <br>
> > > 1. -w /etc -p wa -k ETC_WATCH<br>
> > <br>
> > They are similar in this case.<br>
> > -w behaves differently depending on the existance of the watched entity<br>
> > and the presence of a trailing "/". This is why the form above is<br>
> > deprecated.<br>
> > <br>
> > > 2. -a always,exit -F arch=b64 -S <all syscalls part of the write and<br>
> > > attr<br>
> > > classes> -F dir=/etc -F perm=wa -k ETC_WATCH<br>
> > > <br>
> > > The write and attr classes consist of syscalls in<br>
> > > “include/asm-generic/audit_*.h“.<br>
> > > <br>
> > > The perm flag is needed in the second case for including open/openat<br>
> > > <br>
> > > syscalls which are not a part of the write and attr syscall list.<br>
> > > <br>
> > > I'd like to verify if what I mentioned earlier is accurate, and I have<br>
> > > an<br>
> > > additional point but depends on whether this is accurate.<br>
> > > <br>
> > > Ali<br>
> > <br>
> > - RGB<br>
> > <br>
> > --<br>
> > Richard Guy Briggs <<a href="mailto:rgb@redhat.com" target="_blank">rgb@redhat.com</a>><br>
> > Sr. S/W Engineer, Kernel Security, Base Operating Systems<br>
> > Remote, Ottawa, Red Hat Canada<br>
> > Upstream IRC: SunRaycer<br>
> > Voice: +1.613.860 2354 SMS: +1.613.518.6570<br>
<br>
<br>
<br>
<br>
</blockquote></div></div>