Re: [PATCH v3] audit: free proctitle in context so it can be re-set by fork on exec_binprm

[Paul Moore]

On Mon, Aug 24, 2026 at 6:07 PM Paul Moore <paul@xxxxxxxxxxxxxx> wrote:
> On Aug 18, 2026 Richard Guy Briggs <rgb@xxxxxxxxxx> wrote:
> >
> > Between the actual process startup (fork systemd) and the executable file
> > replacement (exec), systemd sets a temporary file name (executable file
> > name in parentheses). If an auditable system call occurs at this point,
> > the audit context will latch the temporary process name into the cache.
> > This name will not change again. The patch clears proctitle into the
> > audit cache when the exec call is made, allowing the new process name to
> > be latched.
> >
> > Suggested-by: Roman Dolgikh <rmd4work@xxxxxxx>
> > Link: https://github.com/user-attachments/files/20751461/fix_audit_proctitle.txt
>
> I did drop the link above from the commit as it is contained within the
> link below.
>
> > Link: https://github.com/linux-audit/audit-kernel/issues/170
> > Signed-off-by: Richard Guy Briggs <rgb@xxxxxxxxxx>
> > Reviewed-by: Ricardo Robaina <rrobaina@xxxxxxxxxx>
> > Reviewed-by: Bradley Morgan <include@xxxxxxxxx>
> > ---
> > Changelog:
> > v3: use previously assigned context
> > v2: simplified to call single use directly before need in audit_bimprm
> > ---
> >  kernel/auditsc.c | 2 ++
> >  1 file changed, 2 insertions(+)
>
> Merged into audit/dev-staging since we're currently in the middle of the
> merge window, this will got to audit/dev once the window closes.

... and now it's in audit/dev, thanks!

-- 
paul-moore.com