Re: [PATCH v1] audit: free proctitle in context so it can be set by fork

[Paul Moore <paul@paul-moore.com>]

On Jul 26, 2026 Richard Guy Briggs <rgb@redhat.com> wrote:
> 
> Original title: fixes clean proctitle in audit context on exec call

Please don't add stuff like that to the description, it's not
particularly helpful by itself.  If you want to link this patch to
something outside of the git log, use the 'Link:' tag.

> Between the actual process startup (fork systemd) and the executable file
> replacement (exec), systemd sets a temporary file name (executable file
> name in parentheses). If an auditable system call occurs at this point,
> the audit context will latch the temporary process name into the cache.
> This name will not change again. The patch clears proctitle into the
> audit cache when the exec call is made, allowing the new process name to
> be latched.
> 
> Suggested by Roman Dolgikh https://github.com/rmd4ctf 2025-06-11

Considering that Roman lists an email on his public GH profile, it
would be better to use a traditional "Suggested-by:" tag, for example:

Suggested-by: Roman Dolgikh <rmd4work@mail.ru>

> Link: https://github.com/linux-audit/audit-kernel/issues/170.

No trailing period please.

> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> Acked-by: Christian Brauner <brauner@kernel.org>
> ---
>  fs/exec.c             | 2 ++
>  include/linux/audit.h | 9 +++++++++
>  kernel/auditsc.c      | 4 ++--
>  3 files changed, 13 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/exec.c b/fs/exec.c
> index b92fe7db176c..bd51489dec23 100644
> --- a/fs/exec.c
> +++ b/fs/exec.c
> @@ -1744,6 +1744,8 @@ static int exec_binprm(struct linux_binprm *bprm)
>  			fput(exec);
>  	}
>  
> +	/* clear proctitle in audit context to allow replacement */
> +	audit_proctitle_free(audit_context());
>  	audit_bprm(bprm);

Since this is the only place where audit_bprm() is called, is there
any reason why you simply didn't just move the free into __audit_bprm()?

Doing so should shrink this patch considerably and would keep the audit
overhead to just a single !audit_dummy_context() check as it is now.

--
paul-moore.com