On 2026-07-28 12:16, Paul Moore wrote: > On Jul 26, 2026 Richard Guy Briggs <[email protected]> wrote: > > Original title: fixes clean proctitle in audit context on exec call > > Please don't add stuff like that to the description, it's not > particularly helpful by itself. If you want to link this patch to > something outside of the git log, use the 'Link:' tag. > > > Between the actual process startup (fork systemd) and the executable file > > replacement (exec), systemd sets a temporary file name (executable file > > name in parentheses). If an auditable system call occurs at this point, > > the audit context will latch the temporary process name into the cache. > > This name will not change again. The patch clears proctitle into the > > audit cache when the exec call is made, allowing the new process name to > > be latched. > > > > Suggested by Roman Dolgikh https://github.com/rmd4ctf 2025-06-11 > > Considering that Roman lists an email on his public GH profile, it > would be better to use a traditional "Suggested-by:" tag, for example: > > Suggested-by: Roman Dolgikh <[email protected]> > > > Link: https://github.com/linux-audit/audit-kernel/issues/170. > > No trailing period please.
Ok, updated description on all counts. > > Signed-off-by: Richard Guy Briggs <[email protected]> > > Acked-by: Christian Brauner <[email protected]> > > --- > > fs/exec.c | 2 ++ > > include/linux/audit.h | 9 +++++++++ > > kernel/auditsc.c | 4 ++-- > > 3 files changed, 13 insertions(+), 2 deletions(-) > > > > diff --git a/fs/exec.c b/fs/exec.c > > index b92fe7db176c..bd51489dec23 100644 > > --- a/fs/exec.c > > +++ b/fs/exec.c > > @@ -1744,6 +1744,8 @@ static int exec_binprm(struct linux_binprm *bprm) > > fput(exec); > > } > > > > + /* clear proctitle in audit context to allow replacement */ > > + audit_proctitle_free(audit_context()); > > audit_bprm(bprm); > > Since this is the only place where audit_bprm() is called, is there > any reason why you simply didn't just move the free into __audit_bprm()? > > Doing so should shrink this patch considerably and would keep the audit > overhead to just a single !audit_dummy_context() check as it is now. Yes, that is fair at this point. > -- > paul-moore.com - RGB -- Richard Guy Briggs <[email protected]> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada Upstream IRC: SunRaycer Voice: +1.613.860 2354 SMS: +1.613.518.6570
