audit: Fix short-circuiting in syscallenter()

[markj]

Summary

syscallenter() has a slow path to handle syscall auditing and dtrace
syscall tracing. It uses AUDIT_SYSCALL_ENTER() to check whether to take
the slow path, but this macro also has side effects: it writes the audit
log entry. When systrace (dtrace syscall tracing) is enabled, this
would get short-circuited, and we end up not writing audit log entries.

Introduce a pure macro to check whether auditing is enabled, use it in
syscallenter() instead of AUDIT_SYSCALL_ENTER().

MFC after: 3 days
Reported by: Joe Duin <[e-mail]>
Fixes: 2f7292437d0c ("Merge audit and systrace checks")
Sponsored by: The FreeBSD Foundation

[kib]

sys/security/audit/audit.h

392

I do not see a value in defining such single-use obfuscating macro. Why not use the var directly in the if condition, same as sy_thr_static?

[markj]

Handle the "nooptions AUDIT" case too.

[markj]

sys/security/audit/audit.h

392

It's my bug. The reason to use a macro is to avoid adding ifdefs, since audit support can be compiled out of the kernel.