[rpms/audit] rawhide: Truncate comm instead of rejecting invalid length

[rpms/audit] rawhide: Truncate comm instead of rejecting invalid length

[Steve Grubb]

A new commit has been pushed.

Repo   : rpms/audit
Branch : rawhide
Commit : 190b8f9acc4a680ce6720bf390567e853a9aec75
Author : Steve Grubb <sgrubb@redhat.com>
Date   : 2026-07-24T14:09:04-04:00
Stats  : +125/-1 in 3 file(s)
URL    : https://src.fedoraproject.org/rpms/audit/c/190b8f9acc4a680ce6720bf390567e853a9aec75?branch=rawhide

Log:
Truncate comm instead of rejecting invalid length

---
diff --git a/audit-2.0-comm.patch b/audit-2.0-comm.patch
new file mode 100644
index 0000000..aad4a45
--- /dev/null
+++ b/audit-2.0-comm.patch
@@ -0,0 +1,92 @@
+commit d7ea98263ebdb974b383a4057856a5ec339776fc
+Author: Sergio Correia <scorreia@redhat.com>
+Date:   Fri Jul 24 06:32:19 2026 -0300
+
+    libaudit: truncate overlong comm values instead of rejecting them
+    
+    Commit 81c09ebb ("libaudit: enforce kernel comm length limit") added
+    a strict 15-byte limit to audit_log_user_comm_message(), rejecting
+    caller-supplied comm strings longer than TASK_COMM_LEN with EINVAL.
+    
+    While /proc/self/comm is indeed limited to 15 content bytes, callers
+    such as systemd-update-utmp (19 bytes) have always passed their full
+    program name as the comm parameter. The EINVAL rejection broke
+    systemd-update-utmp.service on boot across Fedora 43, 44, and
+    Rawhide after the audit-4.2 update.
+    
+    Truncate overlong caller-supplied comm values to 15 bytes and emit
+    a LOG_WARNING instead of failing the call entirely. Update the man
+    page and regression test to reflect truncation semantics.
+    
+    Assisted-by: Claude Opus 4.6
+    Signed-off-by: Sergio Correia <scorreia@redhat.com>
+
+diff --git a/docs/audit_log_user_comm_message.3 b/docs/audit_log_user_comm_message.3
+index 24a27234..17bd4d1d 100644
+--- a/docs/audit_log_user_comm_message.3
++++ b/docs/audit_log_user_comm_message.3
+@@ -33,7 +33,8 @@ The kernel task command name is limited to 15 bytes because
+ .B TASK_COMM_LEN
+ is 16 bytes including the terminating null byte. A non-NULL
+ .I comm
+-value longer than 15 bytes is malformed and is rejected.
++value longer than 15 bytes is truncated to 15 bytes and a warning
++is logged.
+ 
+ .SH "RETURN VALUE"
+ 
+@@ -42,11 +43,6 @@ It returns the sequence number which is > 0 on success or <= 0 on error.
+ .SH "ERRORS"
+ 
+ This function returns \-1 on failure. Examine errno for more info.
+-.TP
+-.B EINVAL
+-The
+-.I comm
+-value is longer than the kernel task command name limit of 15 bytes.
+ 
+ .SH "SEE ALSO"
+ 
+diff --git a/lib/audit_logging.c b/lib/audit_logging.c
+index c812ddd3..189b1787 100644
+--- a/lib/audit_logging.c
++++ b/lib/audit_logging.c
+@@ -231,8 +231,10 @@ static char *_get_commname(const char *comm, char *commname, unsigned int size)
+ 
+ 	len = strnlen(comm, AUDIT_COMM_LEN);
+ 	if (len == AUDIT_COMM_LEN) {
+-		errno = EINVAL;
+-		return NULL;
++		audit_msg(LOG_WARNING,
++			"comm value truncated to %d bytes",
++			AUDIT_COMM_LEN - 1);
++		len = AUDIT_COMM_LEN - 1;
+ 	}
+ 	if (audit_value_needs_encoding(comm, len))
+ 		audit_encode_value(commname, comm, len);
+diff --git a/lib/test/lookup_test.c b/lib/test/lookup_test.c
+index c81465be..712d6a67 100644
+--- a/lib/test/lookup_test.c
++++ b/lib/test/lookup_test.c
+@@ -482,7 +482,7 @@ test_audit_logging_encoding(void)
+ }
+ 
+ /*
+- * Test audit logging task command length validation.
++ * Test that an overlong comm value is truncated rather than rejected.
+  * Input variables: none. Return codes: none, aborts on failure.
+  */
+ static void
+@@ -498,8 +498,10 @@ test_audit_logging_comm_length(void)
+ 	errno = 0;
+ 	rc = audit_log_user_comm_message(0, AUDIT_USER, "test", comm,
+ 					 NULL, NULL, "", 1);
+-	assert(rc == -1);
+-	assert(errno == EINVAL);
++	/* Overlong comm is truncated, not rejected. The call itself
++	 * may still fail (fd 0 is not an audit socket) but NOT with
++	 * EINVAL from comm validation. */
++	assert(errno != EINVAL);
+ }
+ 
+ int

diff --git a/audit-2.0-tmp.patch b/audit-2.0-tmp.patch
new file mode 100644
index 0000000..58c3b00
--- /dev/null
+++ b/audit-2.0-tmp.patch
@@ -0,0 +1,25 @@
+commit 168a906643722f80e6cf0ffe610cfce62229df92
+Author: Sergio Correia <scorreia@redhat.com>
+Date:   Fri Jul 24 07:23:00 2026 -0300
+
+    init.d: create /run/audit via tmpfiles
+    
+    auditd 4.2 stores its PID file under /run/audit/, but the
+    tmpfiles config does not provision this directory. On systems
+    with SELinux enforcing, auditd_t is denied creating directories
+    under /run (target context var_run_t), so auditd fails to start.
+    
+    Let systemd-tmpfiles create /run/audit before auditd starts,
+    matching the After=systemd-tmpfiles-setup.service dependency
+    already declared in the service unit.
+    
+    Assisted-by: Claude Opus 4.6
+    Signed-off-by: Sergio Correia <scorreia@redhat.com>
+
+diff --git a/init.d/audit-tmpfiles.conf b/init.d/audit-tmpfiles.conf
+index 5512a535..3f0823a0 100644
+--- a/init.d/audit-tmpfiles.conf
++++ b/init.d/audit-tmpfiles.conf
+@@ -1 +1,2 @@
++d /run/audit 0700 root root - -
+ d /var/log/audit 0700 root root - -

diff --git a/audit.spec b/audit.spec
index df1c02d..9ff07ac 100644
--- a/audit.spec
+++ b/audit.spec
@@ -1,11 +1,13 @@
 Summary: User space tools for kernel auditing
 Name: audit
 Version: 4.2
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: GPL-2.0-or-later AND LGPL-2.0-or-later
 URL: https://github.com/linux-audit/audit-userspace/
 Source0: audit-userspace-%{version}.tar.gz
 Source1: https://www.gnu.org/licenses/lgpl-2.1.txt
+Patch1: audit-2.0-tmp.patch
+Patch2: audit-2.0-comm.patch
 BuildRequires: make gcc
 BuildRequires: autoconf automake libtool
 BuildRequires: kernel-headers >= 5.0
@@ -98,6 +100,8 @@ The audit rules package contains the rules and utilities to load audit rules.
 %prep
 %setup -q -n %{name}-userspace-%{version}
 cp %{SOURCE1} .
+%patch 1 -p1
+%patch 2 -p1
 
 %build
 autoreconf -fv --install
@@ -301,6 +305,9 @@ fi
 %attr(750,root,root) %{_sbindir}/audispd-zos-remote
 
 %changelog
+* Fri Jul 24 2026 Steve Grubb <sgrubb@redhat.com> 4.2-2
+- Truncate comm instead of rejecting invalid length
+
 * Thu Jul 23 2026 Steve Grubb <sgrubb@redhat.com> 4.2-1
 - New upstream release