Linus, Six audit patches for the Linux v7.4 merge window:
- Fix the accounting of audit filter rule additions and removals Tracking audit filter rules is important as their presence can trigger additional processing. Unfortunately, the existing code did not properly track the removal of filter rules, resulting in some cases where additional processing was done when none was required. This pull request not only corrects the accounting problems, but also provides a cleaner API for tracking audit filter rule additions and removals. - Add a FSOPEN record to log the filesystem name in the new mount API Close a long standing audit blindspot by capturing the filesystem name, e.g. "tmpfs", when calling fsopen(). - Split audit's storage of process and file capabilities Instead of a single structure that stores all possible capability information, create a dedicated audit file capabilities struct and convert the existing audit capabilities struct into a process capabilities struct. This saves 80 bytes from the per-task audit_context on 64-bit systems. - Ensure that the PROCTITLE record is reset on exec() This fixes a problem where systemd would set a temporary PROCTITLE string after forking a child process before calling exec(), effectively locking the PROCTITLE string to the temporary value. This pull request resets the PROCTITLE state on exec() so that newly executed processes can set their PROCTITLE correctly. - Add some missing unlikely() annotations to the audit wrapper functions - Clean up the audit netlink multicast skb length adjustment Paul -- The following changes since commit a90ee4305c4a5df72c11b31dacfdc76e00fcf78a: Linux 7.3-rc6 (2026-10-04 13:45:25 -0700) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git tags/audit-pr-20261016 for you to fetch changes up to 5d59024a6cc9aa9300da59fbf7e2c29f1f2393c6: audit: add FSOPEN record to log filesystem name (2026-10-04 07:33:18 -0400) ---------------------------------------------------------------- audit/stable-7.4 PR 20261016 ---------------------------------------------------------------- Christian Göttsche (1): audit: separate file and process capability storage Ricardo Robaina (3): audit: add missing unlikely hint to audit_dummy_context() wrappers audit: use copied skb length in kauditd_send_multicast_skb() audit: add FSOPEN record to log filesystem name Richard Guy Briggs (1): audit: free proctitle in context so it can be re-set by fork on exec_binprm Stanislav Kinsburskii (1): audit: Fix filter rule accounting after automatic removal fs/fsopen.c | 3 + include/linux/audit.h | 16 +++++- include/uapi/linux/audit.h | 1 kernel/audit.c | 2 kernel/audit.h | 20 ++++++-- kernel/audit_tree.c | 1 kernel/audit_watch.c | 2 kernel/auditfilter.c | 86 ++++++++++++++++++------------------- kernel/auditsc.c | 17 ++++++- 9 files changed, 93 insertions(+), 55 deletions(-) -- paul-moore.com
