1. Patchew
  2. linux
  3. View series

[PATCH v3] audit: free proctitle in context so it can be re-set by fork on exec_binprm

Richard Guy Briggs posted 1 patch 1 month, 1 week ago 
kernel/auditsc.c | 2 ++
1 file changed, 2 insertions(+)
[PATCH v3] audit: free proctitle in context so it can be re-set by fork on exec_binprm
Posted by Richard Guy Briggs 1 month, 1 week ago 
Between the actual process startup (fork systemd) and the executable file
replacement (exec), systemd sets a temporary file name (executable file
name in parentheses). If an auditable system call occurs at this point,
the audit context will latch the temporary process name into the cache.
This name will not change again. The patch clears proctitle into the
audit cache when the exec call is made, allowing the new process name to
be latched.

Suggested-by: Roman Dolgikh <rmd4work@mail.ru>
Link: https://github.com/user-attachments/files/20751461/fix_audit_proctitle.txt
Link: https://github.com/linux-audit/audit-kernel/issues/170
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Reviewed-by: Ricardo Robaina <rrobaina@redhat.com>
---
 kernel/auditsc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 2b9ce0b52511..ee7e53d2cd52 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2601,6 +2601,8 @@ void __audit_bprm(struct linux_binprm *bprm)
 {
 	struct audit_context *context = audit_context();
 
+	/* clear proctitle in audit context to allow replacement */
+	audit_proctitle_free(context);
 	context->type = AUDIT_EXECVE;
 	context->execve.argc = bprm->argc;
 }
-- 
2.43.5
Re: [PATCH v3] audit: free proctitle in context so it can be re-set by fork on exec_binprm
Posted by Paul Moore 1 month ago 
On Aug 18, 2026 Richard Guy Briggs <rgb@redhat.com> wrote:
> 
> Between the actual process startup (fork systemd) and the executable file
> replacement (exec), systemd sets a temporary file name (executable file
> name in parentheses). If an auditable system call occurs at this point,
> the audit context will latch the temporary process name into the cache.
> This name will not change again. The patch clears proctitle into the
> audit cache when the exec call is made, allowing the new process name to
> be latched.
> 
> Suggested-by: Roman Dolgikh <rmd4work@mail.ru>
> Link: https://github.com/user-attachments/files/20751461/fix_audit_proctitle.txt

I did drop the link above from the commit as it is contained within the
link below.

> Link: https://github.com/linux-audit/audit-kernel/issues/170
> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> Reviewed-by: Ricardo Robaina <rrobaina@redhat.com>
> Reviewed-by: Bradley Morgan <include@grrlz.net>
> ---
> Changelog:
> v3: use previously assigned context
> v2: simplified to call single use directly before need in audit_bimprm
> ---
>  kernel/auditsc.c | 2 ++
>  1 file changed, 2 insertions(+)

Merged into audit/dev-staging since we're currently in the middle of the
merge window, this will got to audit/dev once the window closes.

--
paul-moore.com
Re: [PATCH v3] audit: free proctitle in context so it can be re-set by fork on exec_binprm
Posted by Paul Moore 4 weeks ago 
On Mon, Aug 24, 2026 at 6:07 PM Paul Moore <paul@paul-moore.com> wrote:
> On Aug 18, 2026 Richard Guy Briggs <rgb@redhat.com> wrote:
> >
> > Between the actual process startup (fork systemd) and the executable file
> > replacement (exec), systemd sets a temporary file name (executable file
> > name in parentheses). If an auditable system call occurs at this point,
> > the audit context will latch the temporary process name into the cache.
> > This name will not change again. The patch clears proctitle into the
> > audit cache when the exec call is made, allowing the new process name to
> > be latched.
> >
> > Suggested-by: Roman Dolgikh <rmd4work@mail.ru>
> > Link: https://github.com/user-attachments/files/20751461/fix_audit_proctitle.txt
>
> I did drop the link above from the commit as it is contained within the
> link below.
>
> > Link: https://github.com/linux-audit/audit-kernel/issues/170
> > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> > Reviewed-by: Ricardo Robaina <rrobaina@redhat.com>
> > Reviewed-by: Bradley Morgan <include@grrlz.net>
> > ---
> > Changelog:
> > v3: use previously assigned context
> > v2: simplified to call single use directly before need in audit_bimprm
> > ---
> >  kernel/auditsc.c | 2 ++
> >  1 file changed, 2 insertions(+)
>
> Merged into audit/dev-staging since we're currently in the middle of the
> merge window, this will got to audit/dev once the window closes.

... and now it's in audit/dev, thanks!

-- 
paul-moore.com
Re: [PATCH v3] audit: free proctitle in context so it can be re-set by fork on exec_binprm
Posted by Richard Guy Briggs 1 month ago 
On 2026-08-24 18:07, Paul Moore wrote:
> On Aug 18, 2026 Richard Guy Briggs <rgb@redhat.com> wrote:
> > 
> > Between the actual process startup (fork systemd) and the executable file
> > replacement (exec), systemd sets a temporary file name (executable file
> > name in parentheses). If an auditable system call occurs at this point,
> > the audit context will latch the temporary process name into the cache.
> > This name will not change again. The patch clears proctitle into the
> > audit cache when the exec call is made, allowing the new process name to
> > be latched.
> > 
> > Suggested-by: Roman Dolgikh <rmd4work@mail.ru>
> > Link: https://github.com/user-attachments/files/20751461/fix_audit_proctitle.txt
> 
> I did drop the link above from the commit as it is contained within the
> link below.
> 
> > Link: https://github.com/linux-audit/audit-kernel/issues/170
> > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> > Reviewed-by: Ricardo Robaina <rrobaina@redhat.com>
> > Reviewed-by: Bradley Morgan <include@grrlz.net>
> > ---
> > Changelog:
> > v3: use previously assigned context
> > v2: simplified to call single use directly before need in audit_bimprm
> > ---
> >  kernel/auditsc.c | 2 ++
> >  1 file changed, 2 insertions(+)
> 
> Merged into audit/dev-staging since we're currently in the middle of the
> merge window, this will got to audit/dev once the window closes.

Thank you!

> paul-moore.com

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
Upstream IRC: SunRaycer
Voice: +1.613.860 2354 SMS: +1.613.518.6570
Re: [PATCH v3] audit: free proctitle in context so it can be re-set by fork on exec_binprm
Posted by Bradley Morgan 1 month, 1 week ago 
On 18 August 2026 19:28:53 BST, Richard Guy Briggs <rgb@redhat.com> wrote:
>Between the actual process startup (fork systemd) and the executable file
>replacement (exec), systemd sets a temporary file name (executable file
>name in parentheses). If an auditable system call occurs at this point,
>the audit context will latch the temporary process name into the cache.
>This name will not change again. The patch clears proctitle into the
>audit cache when the exec call is made, allowing the new process name to
>be latched.
>
>Suggested-by: Roman Dolgikh <rmd4work@mail.ru>
>Link: https://github.com/user-attachments/files/20751461/fix_audit_proctitle.txt
>Link: https://github.com/linux-audit/audit-kernel/issues/170
>Signed-off-by: Richard Guy Briggs <rgb@redhat.com>

LGTM, cheers

Reviewed-by: Bradley Morgan <include@grrlz.net>



>Reviewed-by: Ricardo Robaina <rrobaina@redhat.com>
>---
> kernel/auditsc.c | 2 ++
> 1 file changed, 2 insertions(+)
>
>diff --git a/kernel/auditsc.c b/kernel/auditsc.c
>index 2b9ce0b52511..ee7e53d2cd52 100644
>--- a/kernel/auditsc.c
>+++ b/kernel/auditsc.c
>@@ -2601,6 +2601,8 @@ void __audit_bprm(struct linux_binprm *bprm)
> {
> 	struct audit_context *context = audit_context();
> 
>+	/* clear proctitle in audit context to allow replacement */
>+	audit_proctitle_free(context);
> 	context->type = AUDIT_EXECVE;
> 	context->execve.argc = bprm->argc;
> }
>

Thanks!

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.