Re: [PATCH v2] audit: free proctitle in context so it can be re-set by fork on exec_binprm

[Richard Guy Briggs <rgb@redhat.com>]

On 2026-08-07 09:25, Ricardo Robaina wrote:
> On Thu, Aug 6, 2026 at 6:17 PM Richard Guy Briggs <rgb@redhat.com> wrote:
> >
> > Between the actual process startup (fork systemd) and the executable file
> > replacement (exec), systemd sets a temporary file name (executable file
> > name in parentheses). If an auditable system call occurs at this point,
> > the audit context will latch the temporary process name into the cache.
> > This name will not change again. The patch clears proctitle into the
> > audit cache when the exec call is made, allowing the new process name to
> > be latched.
> >
> > Suggested-by: Roman Dolgikh <rmd4work@mail.ru>
> > Link: https://github.com/user-attachments/files/20751461/fix_audit_proctitle.txt
> > Link: https://github.com/linux-audit/audit-kernel/issues/170
> > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> > ---
> > Changelog:
> > v2: simplified to call single use directly before need in audit_bimprm
> > ---
> >  kernel/auditsc.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> > index 6610e667c728..c12b5dfcb279 100644
> > --- a/kernel/auditsc.c
> > +++ b/kernel/auditsc.c
> > @@ -2601,6 +2601,8 @@ void __audit_bprm(struct linux_binprm *bprm)
> >  {
> >         struct audit_context *context = audit_context();
> >
> > +       /* clear proctitle in audit context to allow replacement */
> > +       audit_proctitle_free(audit_context());
> 
> Since we already got the context right above, it would probably be
> better to use the context var instead to avoid calling audit_context()
> again.

Yup, right you are.  Silly oversight.

> Otherwise looks good to me.
> 
> Reviewed-by: Ricardo Robaina <rrobaina@redhat.com>
> 
> >         context->type = AUDIT_EXECVE;
> >         context->execve.argc = bprm->argc;
> >  }
> > --
> > 2.43.5
> 
> -Ricardo

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
Upstream IRC: SunRaycer
Voice: +1.613.860 2354 SMS: +1.613.518.6570