Index: contrib/openbsm/etc/audit_event =================================================================== --- contrib/openbsm/etc/audit_event +++ contrib/openbsm/etc/audit_event @@ -614,6 +614,7 @@ 43261:AUE_LGETUUID:lgetuuid(2):ip 43262:AUE_EXECVEAT:execveat(2):pc,ex 43263:AUE_SHMRENAME:shm_rename(2):ip +43265:AUE_CLOSERANGE:close_range(2):cl # # Solaris userspace events. # Index: sys/kern/kern_descrip.c =================================================================== --- sys/kern/kern_descrip.c +++ sys/kern/kern_descrip.c @@ -1366,6 +1366,8 @@ sys_close_range(struct thread *td, struct close_range_args *uap) { + AUDIT_ARG_FD(uap->lowfd); + AUDIT_ARG_FD(uap->highfd); /* No flags currently defined */ if (uap->flags != 0) return (EINVAL); Index: sys/security/audit/audit_bsm.c =================================================================== --- sys/security/audit/audit_bsm.c +++ sys/security/audit/audit_bsm.c @@ -942,6 +942,15 @@ } break; + case AUE_CLOSERANGE: + if (ARG_IS_VALID(kar, ARG_FD)) { + tok = au_to_arg32(1, "fd", ar->ar_arg_fd); + kau_write(rec, tok); + tok = au_to_arg32(2, "fd", ar->ar_arg_fd); + kau_write(rec, tok); + } + break; + case AUE_CORE: if (ARG_IS_VALID(kar, ARG_SIGNUM)) { tok = au_to_arg32(1, "signal", ar->ar_arg_signum);