Re: [PATCH v3] audit: free proctitle in context so it can be re-set by fork on exec_binprm
On Aug 18, 2026 Richard Guy Briggs <rgb(a)redhat.com> wrote:
Between the actual process startup (fork systemd) and the executable file
replacement (exec), systemd sets a temporary file name (executable file
name in parentheses). If an auditable system call occurs at this point,
the audit context will latch the temporary process name into the cache.
This name will not change again. The patch clears proctitle into the
audit cache when the exec call is made, allowing the new process name to
be latched.
Suggested-by: Roman Dolgikh <rmd4work(a)mail.ru>
Link: https://github.com/user-attachments/files/20751461/fix_audit_proctitle.txt
I did drop the link above from the commit as it is contained within the
link below.
Link: https://github.com/linux-audit/audit-kernel/issues/170
Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com>
Reviewed-by: Ricardo Robaina <rrobaina(a)redhat.com>
Reviewed-by: Bradley Morgan <include(a)grrlz.net>
---
Changelog:
v3: use previously assigned context
v2: simplified to call single use directly before need in audit_bimprm
---
kernel/auditsc.c | 2 ++
1 file changed, 2 insertions(+)
Merged into audit/dev-staging since we're currently in the middle of the
merge window, this will got to audit/dev once the window closes.
--
paul-moore.com