From 7d8ab8bafb970268cb5058369880da3dcfb37131 Mon Sep 17 00:00:00 2001
From: Robert Watson <rwatson@FreeBSD.org>
Date: Tue, 6 May 2008 00:32:23 +0000
Subject: [PATCH] When testing whether to enter the audit argument gathering
 code, rather than checking whether audit is enabled globally, instead check
 whether the current thread has an audit record.  This avoids entering the
 audit code to collect argument data if auditing is enabled but the current
 system call is not of interest to audit.

MFC after:	1 week
Sponsored by:	Apple, Inc.
---
 sys/security/audit/audit.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/security/audit/audit.h b/sys/security/audit/audit.h
index 5b2f686082e6..f44800ad72c8 100644
--- a/sys/security/audit/audit.h
+++ b/sys/security/audit/audit.h
@@ -186,7 +186,7 @@ void	 audit_thread_free(struct thread *td);
  * audit_enabled flag before performing the actual call.
  */
 #define	AUDIT_ARG(op, args...)	do {					\
-	if (audit_enabled)						\
+	if (td->td_ar != NULL)						\
 		audit_arg_ ## op (args);				\
 } while (0)