Merge tag 'audit-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

Pull audit updates from Paul Moore:

 - Fix the accounting of audit filter rule additions and removals

   Tracking audit filter rules is important as their presence can
   trigger additional processing. Unfortunately, the existing code did
   not properly track the removal of filter rules, resulting in some
   cases where additional processing was done when none was required.

   This not only corrects the accounting problems, but also provides a
   cleaner API for tracking audit filter rule additions and removals.

 - Add a FSOPEN record to log the filesystem name in the new mount API

   Close a long standing audit blindspot by capturing the filesystem
   name, e.g. "tmpfs", when calling fsopen().

 - Split audit's storage of process and file capabilities

   Instead of a single structure that stores all possible capability
   information, create a dedicated audit file capabilities struct and
   convert the existing audit capabilities struct into a process
   capabilities struct. This saves 80 bytes from the per-task
   audit_context on 64-bit systems.

 - Ensure that the PROCTITLE record is reset on exec()

   This fixes a problem where systemd would set a temporary PROCTITLE
   string after forking a child process before calling exec(),
   effectively locking the PROCTITLE string to the temporary value. This
   pull request resets the PROCTITLE state on exec() so that newly
   executed processes can set their PROCTITLE correctly.

 - Add some missing unlikely() annotations to the audit wrapper
   functions

 - Clean up the audit netlink multicast skb length adjustment

* tag 'audit-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: add FSOPEN record to log filesystem name
  audit: separate file and process capability storage
  audit: Fix filter rule accounting after automatic removal
  audit: use copied skb length in kauditd_send_multicast_skb()
  audit: add missing unlikely hint to audit_dummy_context() wrappers
  audit: free proctitle in context so it can be re-set by fork on exec_binprm

1 files changed, 13 insertions, 3 deletions

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 45abb3722d30..767e349d4834 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -449,6 +449,7 @@ extern void __audit_tk_injoffset(struct timespec64 offset);
 extern void __audit_ntp_log(const struct audit_ntp_data *ad);
 extern void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries,
 			      enum audit_nfcfgop op, gfp_t gfp);
+extern void __audit_log_fsopen(const char *fs_name);
 
 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
 {
@@ -547,7 +548,7 @@ static inline void audit_openat2_how(struct open_how *how)
 
 static inline void audit_log_kern_module(const char *name)
 {
-	if (!audit_dummy_context())
+	if (unlikely(!audit_dummy_context()))
 		__audit_log_kern_module(name);
 }
 
@@ -563,7 +564,7 @@ static inline void audit_tk_injoffset(struct timespec64 offset)
 	if (offset.tv_sec == 0 && offset.tv_nsec == 0)
 		return;
 
-	if (!audit_dummy_context())
+	if (unlikely(!audit_dummy_context()))
 		__audit_tk_injoffset(offset);
 }
 
@@ -586,7 +587,7 @@ static inline void audit_ntp_set_new(struct audit_ntp_data *ad,
 
 static inline void audit_ntp_log(const struct audit_ntp_data *ad)
 {
-	if (!audit_dummy_context())
+	if (unlikely(!audit_dummy_context()))
 		__audit_ntp_log(ad);
 }
 
@@ -598,6 +599,12 @@ static inline void audit_log_nfcfg(const char *name, u8 af,
 		__audit_log_nfcfg(name, af, nentries, op, gfp);
 }
 
+static inline void audit_log_fsopen(const char *fs_name)
+{
+	if (!audit_dummy_context())
+		__audit_log_fsopen(fs_name);
+}
+
 extern int audit_n_rules;
 extern int audit_signals;
 #else /* CONFIG_AUDITSYSCALL */
@@ -730,6 +737,9 @@ static inline void audit_log_nfcfg(const char *name, u8 af,
 				   enum audit_nfcfgop op, gfp_t gfp)
 { }
 
+static inline void audit_log_fsopen(const char *fs_name)
+{ }
+
 #define audit_n_rules 0
 #define audit_signals 0
 #endif /* CONFIG_AUDITSYSCALL */