On Aug 18, 2026 Richard Guy Briggs <[email protected]> wrote: > > Between the actual process startup (fork systemd) and the executable file > replacement (exec), systemd sets a temporary file name (executable file > name in parentheses). If an auditable system call occurs at this point, > the audit context will latch the temporary process name into the cache. > This name will not change again. The patch clears proctitle into the > audit cache when the exec call is made, allowing the new process name to > be latched. > > Suggested-by: Roman Dolgikh <[email protected]> > Link: > https://github.com/user-attachments/files/20751461/fix_audit_proctitle.txt
I did drop the link above from the commit as it is contained within the link below. > Link: https://github.com/linux-audit/audit-kernel/issues/170 > Signed-off-by: Richard Guy Briggs <[email protected]> > Reviewed-by: Ricardo Robaina <[email protected]> > Reviewed-by: Bradley Morgan <[email protected]> > --- > Changelog: > v3: use previously assigned context > v2: simplified to call single use directly before need in audit_bimprm > --- > kernel/auditsc.c | 2 ++ > 1 file changed, 2 insertions(+) Merged into audit/dev-staging since we're currently in the middle of the merge window, this will got to audit/dev once the window closes. -- paul-moore.com
