svn commit: r189889 - in stable/7/sys: . contrib/pf dev/ath/ath_hal dev/cxgb security/audit

[Robert Watson]

Author: rwatson
Date: Mon Mar 16 17:15:02 2009
New Revision: 189889
URL: http://svn.freebsd.org/changeset/base/189889

Log:
  Merge r186822 from head to stable/7:
  
    In AUDIT_SYSCALL_EXIT(), invoke audit_syscall_exit() only if an audit
    record is active on the current thread--historically we may always
    have wanted to enter the audit code if auditing was enabled, but now
    we just commit the audit record so don't need to enter if there isn't
    one.
  
    Obtained from:	TrustedBSD Project
    Sponsored by:		Apple, Inc.

Modified:
  stable/7/sys/   (props changed)
  stable/7/sys/contrib/pf/   (props changed)
  stable/7/sys/dev/ath/ath_hal/   (props changed)
  stable/7/sys/dev/cxgb/   (props changed)
  stable/7/sys/security/audit/audit.h

Modified: stable/7/sys/security/audit/audit.h
==============================================================================
--- stable/7/sys/security/audit/audit.h	Mon Mar 16 17:08:10 2009	(r189888)
+++ stable/7/sys/security/audit/audit.h	Mon Mar 16 17:15:02 2009	(r189889)
@@ -198,11 +198,11 @@ void	 audit_thread_free(struct thread *t
 
 /*
  * Wrap the audit_syscall_exit() function so that it is called only when
- * auditing is enabled, or we have a audit record on the thread.  It is
- * possible that an audit record was begun before auditing was turned off.
+ * we have a audit record on the thread.  Audit records can persist after
+ * auditing is disabled, so we don't just check audit_enabled here.
  */
 #define	AUDIT_SYSCALL_EXIT(error, td)	do {				\
-	if (audit_enabled || (td->td_ar != NULL))			\
+	if (td->td_ar != NULL)						\
 		audit_syscall_exit(error, td);				\
 } while (0)