Sycall Rules vs Watch Rules

[Steve Grubb]

On Tuesday, September 19, 2023 8:26:04 PM EDT Amjad Gabbar wrote:
> > The perm fields select the right system calls
> > that should be reported on.
> 
> That is accurate from a functional perspective. There is no change in the
> events logged. But there is a difference in performance. This is most
> evident for syscalls not part of the perm fields.

<snip> 

> If we look at the performance numbers for the file rules as is, the
> auditing percentage is about 14%.
> 
> Now if we were to just add the specific syscalls that the perm fields
> filter on in the rules file, the auditing percentage would drop to around
> 2%.

I think I am mis-remembering something, or there was a change way back in the 
beginning. The plan was that we could optimize access by letting the kernel 
pick the relevant syscalls based on the permissions. User space would just 
define the permissions and the kernel would make it so.

But there were several redesigns of the file auditing. I looked back as far as 
the 3.1 kernel and it always follows lookup the syscall, if it's relevant, 
then check the rest of the fields in the rule. This eventually checks the set 
of syscalls selected by the perms.

The way that it should have worked is when perms is given, throw away any 
syscalls and set the mask based on the perms selected. That would have been 
optimal and it was what Al Viro and I talked about long ago. However, it went 
through several redesigns.

The problem now is that user space has no list of syscalls that match each 
permission. And then, there's no good way to sync based on mixing and 
matching kernels and user space. The kernel may have an updated syscall list 
user space doesn't know about and vice versa.

I think you are on to something important. But I am surprised my concept of 
how it works doesn't match the implementation. (Al Viro did the original 
implementation way back around 2006/7.) The best solution would be a kernel 
modification so that there are no mismatched lists. A suboptimal solution 
would be to maintain 2 lists and hope they don't change. Which by the way, I 
think the kernel lists are outdated again. (Syscalls keep getting added - 
quotactl_fd for example)

-Steve