Merge tag 'audit-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit

Pull audit updates from Paul Moore:

 - Fix the accounting of audit filter rule additions and removals

   Tracking audit filter rules is important as their presence can
   trigger additional processing. Unfortunately, the existing code did
   not properly track the removal of filter rules, resulting in some
   cases where additional processing was done when none was required.

   This not only corrects the accounting problems, but also provides a
   cleaner API for tracking audit filter rule additions and removals.

 - Add a FSOPEN record to log the filesystem name in the new mount API

   Close a long standing audit blindspot by capturing the filesystem
   name, e.g. "tmpfs", when calling fsopen().

 - Split audit's storage of process and file capabilities

   Instead of a single structure that stores all possible capability
   information, create a dedicated audit file capabilities struct and
   convert the existing audit capabilities struct into a process
   capabilities struct. This saves 80 bytes from the per-task
   audit_context on 64-bit systems.

 - Ensure that the PROCTITLE record is reset on exec()

   This fixes a problem where systemd would set a temporary PROCTITLE
   string after forking a child process before calling exec(),
   effectively locking the PROCTITLE string to the temporary value. This
   pull request resets the PROCTITLE state on exec() so that newly
   executed processes can set their PROCTITLE correctly.

 - Add some missing unlikely() annotations to the audit wrapper
   functions

 - Clean up the audit netlink multicast skb length adjustment

* tag 'audit-pr-20261016' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: add FSOPEN record to log filesystem name
  audit: separate file and process capability storage
  audit: Fix filter rule accounting after automatic removal
  audit: use copied skb length in kauditd_send_multicast_skb()
  audit: add missing unlikely hint to audit_dummy_context() wrappers
  audit: free proctitle in context so it can be re-set by fork on exec_binprm

0 files changed, 0 insertions, 0 deletions