From 583450efd7303a5af0aed1b66486e4ebefbd7152 Mon Sep 17 00:00:00 2001
From: "Christian S.J. Peron" <csjp@FreeBSD.org>
Date: Sun, 31 Jan 2010 22:31:01 +0000
Subject: [PATCH] Make sure we convert audit records that were produced as the
 result of the closefrom(2) syscall.

---
 sys/security/audit/audit_bsm.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/sys/security/audit/audit_bsm.c b/sys/security/audit/audit_bsm.c
index b1a9931e2111..faa458353187 100644
--- a/sys/security/audit/audit_bsm.c
+++ b/sys/security/audit/audit_bsm.c
@@ -842,6 +842,13 @@ kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
 		UPATH1_VNODE1_TOKENS;
 		break;
 
+	case AUE_CLOSEFROM:
+		if (ARG_IS_VALID(kar, ARG_FD)) {
+			tok = au_to_arg32(1, "fd", ar->ar_arg_fd);
+			kau_write(rec, tok);
+		}
+		break;
+
 	case AUE_CORE:
 		if (ARG_IS_VALID(kar, ARG_SIGNUM)) {
 			tok = au_to_arg32(1, "signal", ar->ar_arg_signum);