FreeBSD/sys/security/audit/audit.c
/*
 * audit_syscall_exit() is called from the return of every system call, or in
 * the event of exit1(), during the execution of exit1().  It is responsible
 * for committing the audit record, if any, along with return condition.
 */
audit_syscall_exit() is called from the return of every system call, or in
the event of exit1(), during the execution of exit1().  It is responsible
for committing the audit record, if any, along with return condition.
audit_syscall_exit () is called from the return of every system call or in the event of exit1 () during the execution of exit1 () . It is responsible for committing the audit record if any along with return condition .
void
audit_syscall_exit(int error, struct thread *td)
{
	int retval;
	if (error)
		retval = -1;
	else
		retval = td->td_retval[0];
	audit_commit(td->td_ar, error, retval);
	td->td_ar = NULL;
	td->td_pflags &= ~TDP_AUDITREC;
}
void audit_syscall_exit ( int error , struct thread * td ) { int retval ; if ( error ) retval = -1 ; else retval = td -> td_retval [ 0 ] ; audit_commit ( td -> td_ar , error , retval ) ; td -> td_ar = NULL ; td -> td_pflags &= ~ TDP_AUDITREC ; }
audit_syscall_exit() is called from the return of every system call, or in
 the event of exit1(), during the execution of exit1().
audit_syscall_exit () is called from the return of every system call or in the event of exit1 () during the execution of exit1 () .
/*
	 * Commit the audit record as desired; once we pass the record into
	 * audit_commit(), the memory is owned by the audit subsystem.  The
	 * return value from the system call is stored on the user thread.
	 * If there was an error, the return value is set to -1, imitating
	 * the behavior of the cerror routine.
	 */