Re: [PATCH v3] audit: free proctitle in context so it can be re-set by fork on exec_binprm

On Aug 18, 2026 Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > > Between the actual process startup (fork systemd) and the executable file > replacement (exec), systemd sets a temporary file name (executable file > name in parentheses). If an auditable system call occurs at this point, > the audit context will latch the temporary process name into the cache. > This name will not change again. The patch clears proctitle into the > audit cache when the exec call is made, allowing the new process name to > be latched. > > Suggested-by: Roman Dolgikh <rmd4work(a)mail.ru&gt; > Link: https://github.com/user-attachments/files/20751461/fix_audit_proctitle.txt I did drop the link above from the commit as it is contained within the link below. > Link: https://github.com/linux-audit/audit-kernel/issues/170 > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > Reviewed-by: Ricardo Robaina <rrobaina(a)redhat.com&gt; > Reviewed-by: Bradley Morgan <include(a)grrlz.net&gt; > --- > Changelog: > v3: use previously assigned context > v2: simplified to call single use directly before need in audit_bimprm > --- > kernel/auditsc.c | 2 ++ > 1 file changed, 2 insertions(+) Merged into audit/dev-staging since we're currently in the middle of the merge window, this will got to audit/dev once the window closes.