From 00c28d9678f9eb36f1d4de9a58f5f09893e7b896 Mon Sep 17 00:00:00 2001 From: Robert Watson Date: Sun, 5 Feb 2006 21:08:25 +0000 Subject: [PATCH] On process exit, audit the return value of the process, and commit the record immediately, as this system call never returns. Obtained from: TrustedBSD Project --- sys/kern/kern_exit.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c index 05bd39c083c0..3ff340926d6b 100644 --- a/sys/kern/kern_exit.c +++ b/sys/kern/kern_exit.c @@ -183,6 +183,17 @@ exit1(struct thread *td, int rv) PROC_UNLOCK(p); +#ifdef AUDIT + /* + * The Sun BSM exit token contains two components: an exit status as + * passed to exit(), and a return value to indicate what sort of exit + * it was. The exit status is WEXITSTATUS(rv), but it's not clear + * what the return value is. + */ + AUDIT_ARG(exit, WEXITSTATUS(rv), 0); + AUDIT_SYSCALL_EXIT(0, td); +#endif + /* Are we a task leader? */ if (p == p->p_leader) { mtx_lock(&ppeers_lock);