FreeBSD/sys/security/audit/audit_worker.c
/*
 * audit_rotate_vnode() is called by a user or kernel thread to configure or
 * de-configure auditing on a vnode.  The arguments are the replacement
 * credential (referenced) and vnode (referenced and opened) to substitute
 * for the current credential and vnode, if any.  If either is set to NULL,
 * both should be NULL, and this is used to indicate that audit is being
 * disabled.  Any previous cred/vnode will be closed and freed.  We re-enable
 * generating rotation requests to auditd.
 */
audit_rotate_vnode() is called by a user or kernel thread to configure or
de-configure auditing on a vnode.  The arguments are the replacement
credential (referenced) and vnode (referenced and opened) to substitute
for the current credential and vnode, if any.  If either is set to NULL,
both should be NULL, and this is used to indicate that audit is being
disabled.  Any previous cred/vnode will be closed and freed.  We re-enable
generating rotation requests to auditd.
audit_rotate_vnode () is called by a user or kernel thread to configure or de - configure auditing on a vnode . The arguments are the replacement credential ( referenced ) and vnode ( referenced and opened ) to substitute for the current credential and vnode if any . If either is set to NULL both should be NULL and this is used to indicate that audit is being disabled . Any previous cred / vnode will be closed and freed . We re - enable generating rotation requests to auditd .
void
audit_rotate_vnode(struct ucred *cred, struct vnode *vp)
{
	struct ucred *old_audit_cred;
	struct vnode *old_audit_vp;
	struct vattr vattr;
	KASSERT((cred != NULL && vp != NULL) || (cred == NULL && vp == NULL),
	    ("audit_rotate_vnode: cred %p vp %p", cred, vp));
	if (vp != NULL) {
		vn_lock(vp, LK_SHARED | LK_RETRY);
		if (VOP_GETATTR(vp, &vattr, cred) != 0)
			vattr.va_size = 0;
		VOP_UNLOCK(vp, 0);
	} else {
		vattr.va_size = 0;
	}
	AUDIT_WORKER_LOCK();
	old_audit_cred = audit_cred;
	old_audit_vp = audit_vp;
	audit_cred = cred;
	audit_vp = vp;
	audit_size = vattr.va_size;
	audit_file_rotate_wait = 0;
	audit_enabled = (audit_vp != NULL);
	AUDIT_WORKER_UNLOCK();
	if (old_audit_vp != NULL) {
		vn_close(old_audit_vp, AUDIT_CLOSE_FLAGS, old_audit_cred,
		    curthread);
		crfree(old_audit_cred);
	}
}
void audit_rotate_vnode ( struct ucred * cred , struct vnode * vp ) { struct ucred * old_audit_cred ; struct vnode * old_audit_vp ; struct vattr vattr ; KASSERT ( ( cred != NULL && vp != NULL ) || ( cred == NULL && vp == NULL ) , ( " " , cred , vp ) ) ; if ( vp != NULL ) { vn_lock ( vp , LK_SHARED | LK_RETRY ) ; if ( VOP_GETATTR ( vp , & vattr , cred ) != 0 ) vattr . va_size = 0 ; VOP_UNLOCK ( vp , 0 ) ; } else { vattr . va_size = 0 ; } AUDIT_WORKER_LOCK ( ) ; old_audit_cred = audit_cred ; old_audit_vp = audit_vp ; audit_cred = cred ; audit_vp = vp ; audit_size = vattr . va_size ; audit_file_rotate_wait = 0 ; audit_enabled = ( audit_vp != NULL ) ; AUDIT_WORKER_UNLOCK ( ) ; if ( old_audit_vp != NULL ) { vn_close ( old_audit_vp , AUDIT_CLOSE_FLAGS , old_audit_cred , curthread ) ; crfree ( old_audit_cred ) ; } }
audit_rotate_vnode() is called by a user or kernel thread to configure or
 de-configure auditing on a vnode.
audit_rotate_vnode () is called by a user or kernel thread to configure or de - configure auditing on a vnode .
/*
	 * Rotate the vnode/cred, and clear the rotate flag so that we will
	 * send a rotate trigger if the new file fills.
	 */ /*
	 * If there was an old vnode/credential, close and free.
	 */