Re: [PATCH] include/linux: Fix outdated comment on entry-common.h
From: Khalid Ali
Date: Sat Jun 14 2025 - 08:05:33 EST
> That's redundant as syscall_enter_audit() checks for a valid audit
> context already. Both are valid indicators and go in lockstep. So it
> might be arguable that evaluating the work bit is cheaper than the
> context check, but I doubt it's measurable.
This will also increase readability and make things more consistent. So i think
we should use SYSCALL_WORK_SYSCALL_AUDIT bit to check if we need to do auditing,
instead of checking audit context, on both entry and exit.
So should i do with another patch, what i am verifying is if we really agree with one point.
Thanks
Khalid Ali