From b09cfc161840ad3544812ad17537b4dc0e40506e Mon Sep 17 00:00:00 2001 From: Richard Guy Briggs Date: Tue, 18 Aug 2026 14:31:39 -0400 Subject: [PATCH] audit: free proctitle in context so it can be re-set by fork on exec_binprm Between the actual process startup (fork systemd) and the executable file replacement (exec), systemd sets a temporary file name (executable file name in parentheses). If an auditable system call occurs at this point, the audit context will latch the temporary process name into the cache. This name will not change again. The patch clears proctitle into the audit cache when the exec call is made, allowing the new process name to be latched. Suggested-by: Roman Dolgikh Link: https://github.com/linux-audit/audit-kernel/issues/170 Signed-off-by: Richard Guy Briggs Reviewed-by: Ricardo Robaina Reviewed-by: Bradley Morgan Signed-off-by: Paul Moore --- kernel/auditsc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 2b9ce0b52511..ee7e53d2cd52 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -2601,6 +2601,8 @@ void __audit_bprm(struct linux_binprm *bprm) { struct audit_context *context = audit_context(); + /* clear proctitle in audit context to allow replacement */ + audit_proctitle_free(context); context->type = AUDIT_EXECVE; context->execve.argc = bprm->argc; }