FreeBSD/sys/security/audit/audit_arg.c
/*
 * The close() system call uses it's own audit call to capture the path/vnode
 * information because those pieces are not easily obtained within the system
 * call itself.
 */
The close() system call uses it's own audit call to capture the path/vnode
information because those pieces are not easily obtained within the system
call itself.
The close () system call uses it ' s own audit call to capture the path / vnode information because those pieces are not easily obtained within the system call itself .
void
audit_sysclose(struct thread *td, int fd)
{
	cap_rights_t rights;
	struct kaudit_record *ar;
	struct vnode *vp;
	struct file *fp;
	KASSERT(td != NULL, ("audit_sysclose: td == NULL"));
	ar = currecord();
	if (ar == NULL)
		return;
	audit_arg_fd(fd);
	if (getvnode(td, fd, cap_rights_init(&rights), &fp) != 0)
		return;
	vp = fp->f_vnode;
	vn_lock(vp, LK_SHARED | LK_RETRY);
	audit_arg_vnode1(vp);
	VOP_UNLOCK(vp, 0);
	fdrop(fp, td);
}
void audit_sysclose ( struct thread * td , int fd ) { cap_rights_t rights ; struct kaudit_record * ar ; struct vnode * vp ; struct file * fp ; KASSERT ( td != NULL , ( " " ) ) ; ar = currecord ( ) ; if ( ar == NULL ) return ; audit_arg_fd ( fd ) ; if ( getvnode ( td , fd , cap_rights_init ( & rights ) , & fp ) != 0 ) return ; vp = fp -> f_vnode ; vn_lock ( vp , LK_SHARED | LK_RETRY ) ; audit_arg_vnode1 ( vp ) ; VOP_UNLOCK ( vp , 0 ) ; fdrop ( fp , td ) ; }
The close() system call uses it's own audit call to capture the path/vnode
 information because those pieces are not easily obtained within the system
 call itself.
The close () system call uses it ' s own audit call to capture the path / vnode information because those pieces are not easily obtained within the system call itself .