On Mon, Aug 24, 2026 at 6:07 PM Paul Moore <[email protected]> wrote: > On Aug 18, 2026 Richard Guy Briggs <[email protected]> wrote: > > > > Between the actual process startup (fork systemd) and the executable file > > replacement (exec), systemd sets a temporary file name (executable file > > name in parentheses). If an auditable system call occurs at this point, > > the audit context will latch the temporary process name into the cache. > > This name will not change again. The patch clears proctitle into the > > audit cache when the exec call is made, allowing the new process name to > > be latched. > > > > Suggested-by: Roman Dolgikh <[email protected]> > > Link: > > https://github.com/user-attachments/files/20751461/fix_audit_proctitle.txt > > I did drop the link above from the commit as it is contained within the > link below. > > > Link: https://github.com/linux-audit/audit-kernel/issues/170 > > Signed-off-by: Richard Guy Briggs <[email protected]> > > Reviewed-by: Ricardo Robaina <[email protected]> > > Reviewed-by: Bradley Morgan <[email protected]> > > --- > > Changelog: > > v3: use previously assigned context > > v2: simplified to call single use directly before need in audit_bimprm > > --- > > kernel/auditsc.c | 2 ++ > > 1 file changed, 2 insertions(+) > > Merged into audit/dev-staging since we're currently in the middle of the > merge window, this will got to audit/dev once the window closes.
... and now it's in audit/dev, thanks! -- paul-moore.com
