Re: [PATCH v3] audit: free proctitle in context so it can be re-set by fork on exec_binprm

[Richard Guy Briggs]

On 2026-08-24 18:07, Paul Moore wrote:
> On Aug 18, 2026 Richard Guy Briggs <rgb@xxxxxxxxxx> wrote:
> > 
> > Between the actual process startup (fork systemd) and the executable file
> > replacement (exec), systemd sets a temporary file name (executable file
> > name in parentheses). If an auditable system call occurs at this point,
> > the audit context will latch the temporary process name into the cache.
> > This name will not change again. The patch clears proctitle into the
> > audit cache when the exec call is made, allowing the new process name to
> > be latched.
> > 
> > Suggested-by: Roman Dolgikh <rmd4work@xxxxxxx>
> > Link: https://github.com/user-attachments/files/20751461/fix_audit_proctitle.txt
> 
> I did drop the link above from the commit as it is contained within the
> link below.
> 
> > Link: https://github.com/linux-audit/audit-kernel/issues/170
> > Signed-off-by: Richard Guy Briggs <rgb@xxxxxxxxxx>
> > Reviewed-by: Ricardo Robaina <rrobaina@xxxxxxxxxx>
> > Reviewed-by: Bradley Morgan <include@xxxxxxxxx>
> > ---
> > Changelog:
> > v3: use previously assigned context
> > v2: simplified to call single use directly before need in audit_bimprm
> > ---
> >  kernel/auditsc.c | 2 ++
> >  1 file changed, 2 insertions(+)
> 
> Merged into audit/dev-staging since we're currently in the middle of the
> merge window, this will got to audit/dev once the window closes.

Thank you!

> paul-moore.com

- RGB

--
Richard Guy Briggs <rgb@xxxxxxxxxx>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
Upstream IRC: SunRaycer
Voice: +1.613.860 2354 SMS: +1.613.518.6570