syscall - "comm" field truncated

[Lev Stipakov]

Hello,

Sometimes audit of "execve" syscall generates events with truncated 
"comm" values, for example:

type=SYSCALL msg=audit(1459950426.152:1097081): arch=c000003e syscall=59 
success=yes exit=0 a0=35bae3e a1=1bc0cf0 a2=2b09280 a3=58c items=2 
ppid=2183 pid=26566 auid=4294967295 uid=1001 gid=1001 euid=1001
suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=(none) 
ses=4294967295 comm="gnome-calculato" exe="/usr/bin/gnome-calculator"

Why "comm" is "gnome-calculato" and not "/usr/bin/gnome-calculator" ?

Same for Firefiox:

type=SYSCALL msg=audit(1459950158.667:1092149): arch=c000003e syscall=59 
success=yes exit=0 a0=7f913ed1ddf0 a1=7f9144819be0 a2=7f9173f14400 
a3=786f666572696600 items=2 ppid=26165 pid=26247 auid=4294967295
  uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 
fsgid=1001 tty=(none) ses=4294967295 comm="plugin-containe" 
exe="/usr/lib/firefox/plugin-container"

comm is "plugin-containe" and not "plugin-container".

Audit version is 2.4.2-1ubuntu1.

-Lev