From 8b14aeee4bd9e8e28589a83897919f45066ad00f Mon Sep 17 00:00:00 2001
From: Robert Watson <rwatson@FreeBSD.org>
Date: Sun, 8 Feb 2009 14:24:35 +0000
Subject: [PATCH] Audit AUE_MAC_EXECVE; currently just the standard AUE_EXECVE
 arguments and not the label.

Obtained from:	TrustedBSD Project
Sponsored by:	Apple, Inc.
MFC after:	1 week
---
 sys/security/audit/audit_bsm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sys/security/audit/audit_bsm.c b/sys/security/audit/audit_bsm.c
index c4acf16f399b..33269619bd9d 100644
--- a/sys/security/audit/audit_bsm.c
+++ b/sys/security/audit/audit_bsm.c
@@ -791,6 +791,7 @@ kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau)
 		/* FALLTHROUGH */
 
 	case AUE_EXECVE:
+	case AUE_MAC_EXECVE:
 		if (ARG_IS_VALID(kar, ARG_ARGV)) {
 			tok = au_to_exec_args(ar->ar_arg_argv,
 			    ar->ar_arg_argc);