Original title: fixes clean proctitle in audit context on exec call
Between the actual process startup (fork systemd) and the executable file
replacement (exec), systemd sets a temporary file name (executable file
name in parentheses). If an auditable system call occurs at this point,
the audit context will latch the temporary process name into the cache.
This name will not change again. The patch clears proctitle into the
audit cache when the exec call is made, allowing the new process name to
be latched.
Suggested by Roman Dolgikh
https://github.com/rmd4ctf 2025-06-11
Link:
https://github.com/linux-audit/audit-kernel/issues/170.
Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com>