HomeFreeBSD

audit: Fix short-circuiting in syscallenter()

Description

audit: Fix short-circuiting in syscallenter()

syscallenter() has a slow path to handle syscall auditing and dtrace
syscall tracing. It uses AUDIT_SYSCALL_ENTER() to check whether to take
the slow path, but this macro also has side effects: it writes the audit
log entry. When systrace (dtrace syscall tracing) is enabled, this
would get short-circuited, and we end up not writing audit log entries.

Introduce a pure macro to check whether auditing is enabled, use it in
syscallenter() instead of AUDIT_SYSCALL_ENTER().

Reviewed by: kib
Reported by: Joe Duin <jd@firexfly.com>
Fixes: 2f7292437d0c ("Merge audit and systrace checks")
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D48448

Details

Provenance
markjAuthored on Tue, Jan 14, 2:19 PM
Reviewer
rG2f7292437d0c: Merge audit and systrace checks
Differential Revision
D48448: audit: Fix short-circuiting in syscallenter()
Parents
rG0cd9513a5ba5: pkg: retire backwards compatibility bootstrap support
Branches
Unknown
Tags
Unknown