Function audit_sysclose

freebsd/security/audit/audit_arg.c:997–1017

* The close() system call uses it's own audit call to capture the path/vnode * information because those pieces are not easily obtained within the system * call itself. */

 * call itself.
 */
void
audit_sysclose(struct thread *td, int fd, struct file *fp)
{
	struct kaudit_record *ar;
	struct vnode *vp;

	KASSERT(td != NULL, ("audit_sysclose: td == NULL"));

	ar = currecord();
	if (ar == NULL)
		return;

	audit_arg_fd(fd);

	vp = fp->f_vnode;
	if (vp == NULL)
		return;
	vn_lock(vp, LK_SHARED | LK_RETRY);
	audit_arg_vnode1(vp);
	VOP_UNLOCK(vp);
}