-----BEGIN PGP SIGNATURE-----
iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmrSKRAUHHBhdWxAcGF1
bC1tb29yZS5jb20ACgkQ6iDy2pc3iXO2KhAAgumB+XfmotuGhd31F230xMHXBeoU
q5kJXOhpET1GCrtvl2sYXoYaiUQS2moxAksXq5rUWoJEQVM6/tebm48L7T1b6HZP
UVUyOADlap4m2GfCP3BikC/cs4RBg0BBMa1Hz4GVa+otlKH9hfDbeo2VvkhO3Wck
lITLAOV1hsr/ca5nAxRuO0654BnPQbnypkFJ9ev+Yzd586RgQxxqIUD0w819kNkz
387pc71L6AgUimod+8SLK4yWZpUdE0NzU8VWSIrNRzQGMH7AM9rYCjYj4o7jKxkb
GLl/ekfS2Z04aC8dNXB52DdPSdfb81zPV0CYuuCLK4hgQfH9y+PvpCIBSb+hxnHF
MPBQTH8sX8sGBRA7H337z+m67ZNsw+9D500OynxwxS5ElAux05NGrF+jepk/Hvye
zE1ID2bD8H0JhyWw1OACH1Zcpm4g4SBwjKJxFRjYyYStGuGhDokuawent2H27Mlz
KC5NRPj8I0QT+XTeoeBHqbVOoQdrzjiPbUdbebMFVFs8qOvgeYrCvz502Fe8Pooc
t+fXAgDeVc0n2NjxXZA/UNTRMhZDGlhaUUbuyO7Po/fvdksajyfIPTvUACD1jJKb
ZcZpya7rXtaQpLfp226fh2XJz9AHD7dgQKFM8mL7wD5MvSyw4P3Zu25fZEtGWB9C
hD96nNzHL6mbREo=
=N9iR
-----END PGP SIGNATURE-----
Merge tag 'audit-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit
Pull audit updates from Paul Moore:
- Fix the accounting of audit filter rule additions and removals
Tracking audit filter rules is important as their presence can
trigger additional processing. Unfortunately, the existing code did
not properly track the removal of filter rules, resulting in some
cases where additional processing was done when none was required.
This not only corrects the accounting problems, but also provides a
cleaner API for tracking audit filter rule additions and removals.
- Add a FSOPEN record to log the filesystem name in the new mount API
Close a long standing audit blindspot by capturing the filesystem
name, e.g. "tmpfs", when calling fsopen().
- Split audit's storage of process and file capabilities
Instead of a single structure that stores all possible capability
information, create a dedicated audit file capabilities struct and
convert the existing audit capabilities struct into a process
capabilities struct. This saves 80 bytes from the per-task
audit_context on 64-bit systems.
- Ensure that the PROCTITLE record is reset on exec()
This fixes a problem where systemd would set a temporary PROCTITLE
string after forking a child process before calling exec(),
effectively locking the PROCTITLE string to the temporary value. This
pull request resets the PROCTITLE state on exec() so that newly
executed processes can set their PROCTITLE correctly.
- Add some missing unlikely() annotations to the audit wrapper
functions
- Clean up the audit netlink multicast skb length adjustment
* tag 'audit-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
audit: add FSOPEN record to log filesystem name
audit: separate file and process capability storage
audit: Fix filter rule accounting after automatic removal
audit: use copied skb length in kauditd_send_multicast_skb()
audit: add missing unlikely hint to audit_dummy_context() wrappers
audit: free proctitle in context so it can be re-set by fork on exec_binprm
0d508d4709