Re: [PATCH v3] audit: free proctitle in context so it can be re-set by fork on exec_binprm

[Paul Moore]

On Aug 18, 2026 Richard Guy Briggs <rgb@xxxxxxxxxx> wrote:
> 
> Between the actual process startup (fork systemd) and the executable file
> replacement (exec), systemd sets a temporary file name (executable file
> name in parentheses). If an auditable system call occurs at this point,
> the audit context will latch the temporary process name into the cache.
> This name will not change again. The patch clears proctitle into the
> audit cache when the exec call is made, allowing the new process name to
> be latched.
> 
> Suggested-by: Roman Dolgikh <rmd4work@xxxxxxx>
> Link: https://github.com/user-attachments/files/20751461/fix_audit_proctitle.txt

I did drop the link above from the commit as it is contained within the
link below.

> Link: https://github.com/linux-audit/audit-kernel/issues/170
> Signed-off-by: Richard Guy Briggs <rgb@xxxxxxxxxx>
> Reviewed-by: Ricardo Robaina <rrobaina@xxxxxxxxxx>
> Reviewed-by: Bradley Morgan <include@xxxxxxxxx>
> ---
> Changelog:
> v3: use previously assigned context
> v2: simplified to call single use directly before need in audit_bimprm
> ---
>  kernel/auditsc.c | 2 ++
>  1 file changed, 2 insertions(+)

Merged into audit/dev-staging since we're currently in the middle of the
merge window, this will got to audit/dev once the window closes.

--
paul-moore.com