--- sys/kern/subr_syscall.c.orig +++ sys/kern/subr_syscall.c @@ -141,9 +141,8 @@ sy_thr_static = (se->sy_thrcnt & SY_THR_STATIC) != 0; - if (__predict_false(SYSTRACE_ENABLED() || - AUDIT_SYSCALL_ENTER(sa->code, td) || - !sy_thr_static)) { + if (__predict_false(AUDIT_SYSCALL_ENABLED() || + SYSTRACE_ENABLED() || !sy_thr_static)) { if (!sy_thr_static) { error = syscall_thread_enter(td, &se); sy_thr_static = (se->sy_thrcnt & SY_THR_STATIC) != 0; @@ -158,6 +157,9 @@ if (__predict_false(se->sy_entry != 0)) (*systrace_probe_func)(sa, SYSTRACE_ENTRY, 0); #endif + + AUDIT_SYSCALL_ENTER(sa->code, td); + error = (se->sy_call)(td, sa->args); /* Save the latest error return value. */ if (__predict_false((td->td_pflags & TDP_NERRNO) != 0)) --- sys/security/audit/audit.h.orig +++ sys/security/audit/audit.h @@ -389,9 +389,11 @@ audit_arg_vnode2((vp)); \ } while (0) +#define AUDIT_SYSCALL_ENABLED() audit_syscalls_enabled + #define AUDIT_SYSCALL_ENTER(code, td) ({ \ bool _audit_entered = false; \ - if (__predict_false(audit_syscalls_enabled)) { \ + if (audit_syscalls_enabled) { \ audit_syscall_enter(code, td); \ _audit_entered = true; \ } \ @@ -468,6 +470,7 @@ #define AUDITING_TD(td) 0 +#define AUDIT_SYSCALL_ENABLED() 0 #define AUDIT_SYSCALL_ENTER(code, td) 0 #define AUDIT_SYSCALL_EXIT(error, td)