On process exit, audit the return value of the process, and commit the

record immediately, as this system call never returns.

Obtained from:	TrustedBSD Project

1 files changed, 11 insertions, 0 deletions

diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c
index 05bd39c..3ff3409 100644
--- a/sys/kern/kern_exit.c
+++ b/sys/kern/kern_exit.c
@@ -183,6 +183,17 @@ retry:
 
 	PROC_UNLOCK(p);
 
+#ifdef AUDIT
+	/*
+	 * The Sun BSM exit token contains two components: an exit status as
+	 * passed to exit(), and a return value to indicate what sort of exit
+	 * it was.  The exit status is WEXITSTATUS(rv), but it's not clear
+	 * what the return value is.
+	 */
+	AUDIT_ARG(exit, WEXITSTATUS(rv), 0);
+	AUDIT_SYSCALL_EXIT(0, td);
+#endif
+
 	/* Are we a task leader? */
 	if (p == p->p_leader) {
 		mtx_lock(&ppeers_lock);