Re: [PATCH v1] audit: free proctitle in context so it can be set by fork

Christian Brauner <[email protected]> Mon, 27 Jul 2026 11:41:00 +0200

Newsgroups	org.kernel.vger.audit,org.kernel.vger.linux-fsdevel,org.kernel.vger.linux-kernel
Message-ID	<20260727-freischaffend-anzapfen-checken-00706290941d@brauner>

> Original title: fixes clean proctitle in audit context on exec call
> 
> Between the actual process startup (fork systemd) and the executable file
> replacement (exec), systemd sets a temporary file name (executable file
> name in parentheses). If an auditable system call occurs at this point,
> the audit context will latch the temporary process name into the cache.
> This name will not change again. The patch clears proctitle into the
> audit cache when the exec call is made, allowing the new process name to
> be latched.
> 
> Suggested by Roman Dolgikh https://github.com/rmd4ctf 2025-06-11
> Link: https://github.com/linux-audit/audit-kernel/issues/170.
> Signed-off-by: Richard Guy Briggs <[email protected]>

Acked-by: Christian Brauner <[email protected]>

--