From 0df4264748b7c04d9f8975e586fc5d444f69256e Mon Sep 17 00:00:00 2001
From: Robert Watson <rwatson@FreeBSD.org>
Date: Sun, 10 Jul 2016 11:49:10 +0000
Subject: [PATCH] When mmap(2) is used with a vnode, capture vnode attributes
 in the audit trail.  This was not required for Common Criteria auditing
 (which requires only that the intent to read or write be audited at the time
 of open(2)), but is useful for contemporary live analysis and forensics.

MFC after:	3 days
Sponsored by:	DARPA, AFRL
---
 sys/vm/vm_mmap.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sys/vm/vm_mmap.c b/sys/vm/vm_mmap.c
index 16ee7606b8b..1fd97d1f5aa 100644
--- a/sys/vm/vm_mmap.c
+++ b/sys/vm/vm_mmap.c
@@ -1245,6 +1245,7 @@ vm_mmap_vnode(struct thread *td, vm_size_t objsize,
 		locktype = LK_SHARED;
 	if ((error = vget(vp, locktype, td)) != 0)
 		return (error);
+	AUDIT_ARG_VNODE1(vp);
 	foff = *foffp;
 	flags = *flagsp;
 	obj = vp->v_object;