Merge tag 'audit-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

Pull audit updates from Paul Moore:

 - Fix the accounting of audit filter rule additions and removals

   Tracking audit filter rules is important as their presence can
   trigger additional processing. Unfortunately, the existing code did
   not properly track the removal of filter rules, resulting in some
   cases where additional processing was done when none was required.

   This not only corrects the accounting problems, but also provides a
   cleaner API for tracking audit filter rule additions and removals.

 - Add a FSOPEN record to log the filesystem name in the new mount API

   Close a long standing audit blindspot by capturing the filesystem
   name, e.g. "tmpfs", when calling fsopen().

 - Split audit's storage of process and file capabilities

   Instead of a single structure that stores all possible capability
   information, create a dedicated audit file capabilities struct and
   convert the existing audit capabilities struct into a process
   capabilities struct. This saves 80 bytes from the per-task
   audit_context on 64-bit systems.

 - Ensure that the PROCTITLE record is reset on exec()

   This fixes a problem where systemd would set a temporary PROCTITLE
   string after forking a child process before calling exec(),
   effectively locking the PROCTITLE string to the temporary value. This
   pull request resets the PROCTITLE state on exec() so that newly
   executed processes can set their PROCTITLE correctly.

 - Add some missing unlikely() annotations to the audit wrapper
   functions

 - Clean up the audit netlink multicast skb length adjustment

* tag 'audit-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: add FSOPEN record to log filesystem name
  audit: separate file and process capability storage
  audit: Fix filter rule accounting after automatic removal
  audit: use copied skb length in kauditd_send_multicast_skb()
  audit: add missing unlikely hint to audit_dummy_context() wrappers
  audit: free proctitle in context so it can be re-set by fork on exec_binprm

1 files changed, 1 insertions, 0 deletions

diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index e8f5ce677df7..abae0524746e 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -122,6 +122,7 @@
 #define AUDIT_OPENAT2		1337	/* Record showing openat2 how args */
 #define AUDIT_DM_CTRL		1338	/* Device Mapper target control */
 #define AUDIT_DM_EVENT		1339	/* Device Mapper events */
+#define AUDIT_FSOPEN		1340	/* Record showing fsopen fs_name arg */
 
 #define AUDIT_AVC		1400	/* SE Linux avc denial or grant */
 #define AUDIT_SELINUX_ERR	1401	/* Internal SE Linux Errors */