Re: [PATCH v1] audit: free proctitle in context so it can be set by fork

[Richard Guy Briggs <rgb@redhat.com>]

On 2026-07-28 12:16, Paul Moore wrote:
> On Jul 26, 2026 Richard Guy Briggs <rgb@redhat.com> wrote:
> > Original title: fixes clean proctitle in audit context on exec call
> 
> Please don't add stuff like that to the description, it's not
> particularly helpful by itself.  If you want to link this patch to
> something outside of the git log, use the 'Link:' tag.
> 
> > Between the actual process startup (fork systemd) and the executable file
> > replacement (exec), systemd sets a temporary file name (executable file
> > name in parentheses). If an auditable system call occurs at this point,
> > the audit context will latch the temporary process name into the cache.
> > This name will not change again. The patch clears proctitle into the
> > audit cache when the exec call is made, allowing the new process name to
> > be latched.
> > 
> > Suggested by Roman Dolgikh https://github.com/rmd4ctf 2025-06-11
> 
> Considering that Roman lists an email on his public GH profile, it
> would be better to use a traditional "Suggested-by:" tag, for example:
> 
> Suggested-by: Roman Dolgikh <rmd4work@mail.ru>
> 
> > Link: https://github.com/linux-audit/audit-kernel/issues/170.
> 
> No trailing period please.

Ok, updated description on all counts.

> > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> > Acked-by: Christian Brauner <brauner@kernel.org>
> > ---
> >  fs/exec.c             | 2 ++
> >  include/linux/audit.h | 9 +++++++++
> >  kernel/auditsc.c      | 4 ++--
> >  3 files changed, 13 insertions(+), 2 deletions(-)
> > 
> > diff --git a/fs/exec.c b/fs/exec.c
> > index b92fe7db176c..bd51489dec23 100644
> > --- a/fs/exec.c
> > +++ b/fs/exec.c
> > @@ -1744,6 +1744,8 @@ static int exec_binprm(struct linux_binprm *bprm)
> >  			fput(exec);
> >  	}
> >  
> > +	/* clear proctitle in audit context to allow replacement */
> > +	audit_proctitle_free(audit_context());
> >  	audit_bprm(bprm);
> 
> Since this is the only place where audit_bprm() is called, is there
> any reason why you simply didn't just move the free into __audit_bprm()?
> 
> Doing so should shrink this patch considerably and would keep the audit
> overhead to just a single !audit_dummy_context() check as it is now.

Yes, that is fair at this point.

> --
> paul-moore.com

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
Upstream IRC: SunRaycer
Voice: +1.613.860 2354 SMS: +1.613.518.6570