[GIT PULL] audit/audit-pr-20261016

[GIT PULL] audit/audit-pr-20261016

[Paul Moore]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 3125 bytes --]

Linus,

Six audit patches for the Linux v7.4 merge window:

- Fix the accounting of audit filter rule additions and removals

Tracking audit filter rules is important as their presence can trigger
additional processing.  Unfortunately, the existing code did not properly
track the removal of filter rules, resulting in some cases where
additional processing was done when none was required.  This pull
request not only corrects the accounting problems, but also provides
a cleaner API for tracking audit filter rule additions and removals.

- Add a FSOPEN record to log the filesystem name in the new mount API

Close a long standing audit blindspot by capturing the filesystem name,
e.g. "tmpfs", when calling fsopen().

- Split audit's storage of process and file capabilities

Instead of a single structure that stores all possible capability
information, create a dedicated audit file capabilities struct and
convert the existing audit capabilities struct into a process
capabilities struct.  This saves 80 bytes from the per-task
audit_context on 64-bit systems.

- Ensure that the PROCTITLE record is reset on exec()

This fixes a problem where systemd would set a temporary PROCTITLE string
after forking a child process before calling exec(), effectively locking
the PROCTITLE string to the temporary value.  This pull request resets
the PROCTITLE state on exec() so that newly executed processes can set
their PROCTITLE correctly.

- Add some missing unlikely() annotations to the audit wrapper functions

- Clean up the audit netlink multicast skb length adjustment

Paul

--
The following changes since commit a90ee4305c4a5df72c11b31dacfdc76e00fcf78a:

  Linux 7.3-rc6 (2026-10-04 13:45:25 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git
    tags/audit-pr-20261016

for you to fetch changes up to 5d59024a6cc9aa9300da59fbf7e2c29f1f2393c6:

  audit: add FSOPEN record to log filesystem name
    (2026-10-04 07:33:18 -0400)

----------------------------------------------------------------
audit/stable-7.4 PR 20261016
----------------------------------------------------------------

Christian Göttsche (1):
      audit: separate file and process capability storage

Ricardo Robaina (3):
      audit: add missing unlikely hint to audit_dummy_context() wrappers
      audit: use copied skb length in kauditd_send_multicast_skb()
      audit: add FSOPEN record to log filesystem name

Richard Guy Briggs (1):
      audit: free proctitle in context so it can be re-set by fork on
         exec_binprm

Stanislav Kinsburskii (1):
      audit: Fix filter rule accounting after automatic removal

 fs/fsopen.c                |    3 +
 include/linux/audit.h      |   16 +++++-
 include/uapi/linux/audit.h |    1 
 kernel/audit.c             |    2 
 kernel/audit.h             |   20 ++++++--
 kernel/audit_tree.c        |    1 
 kernel/audit_watch.c       |    2 
 kernel/auditfilter.c       |   86 ++++++++++++++++++-------------------
 kernel/auditsc.c           |   17 ++++++-
 9 files changed, 93 insertions(+), 55 deletions(-)

--
paul-moore.com