github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

audit: free proctitle in context so it can be re-set by fork on exec_binprm

Browse Source 
Between the actual process startup (fork systemd) and the executable file
replacement (exec), systemd sets a temporary file name (executable file
name in parentheses). If an auditable system call occurs at this point,
the audit context will latch the temporary process name into the cache.
This name will not change again. The patch clears proctitle into the
audit cache when the exec call is made, allowing the new process name to
be latched.

Suggested-by: Roman Dolgikh <rmd4work@mail.ru>
Link: https://github.com/linux-audit/audit-kernel/issues/170
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Reviewed-by: Ricardo Robaina <rrobaina@redhat.com>
Reviewed-by: Bradley Morgan <include@grrlz.net>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Richard Guy Briggs 2026-08-18 14:31:39 -04:00 committed by Paul Moore
parent cee9395acd
commit b09cfc1618
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
kernel/auditsc.c
View File

@ -2601,6 +2601,8 @@ void __audit_bprm(struct linux_binprm *bprm)
{
struct audit_context *context = audit_context();
/* clear proctitle in audit context to allow replacement */
audit_proctitle_free(context);
context->type = AUDIT_EXECVE;
context->execve.argc = bprm->argc;
}