audit vs. ptrace races.

On most architectures we use the ptrace hooks for syscall tracing to also call audit_syscall_entry() and audit_syscall_exit(). But we do so _before_ calling ptrace_notify(), during which we stop the process and let the debugger poke at it, potentially _changing_ the arguments to the syscall. So AFAICT we can log the syscall's arguments before they're changed, and then it can go on to do something entirely different to what we said it was going to do. We need to switch the order round, I think. There is also a potential race condition where the argument is actually a pointer to userspace memory -- for auditing purposes we _must_ use the copy which we get from userspace at the time we perform the syscall, not copy it in from userspace in audit_syscall_entry(). I don't think we currently have problems with this -- both the IPC code and getname() are doing this correctly -- but it's worth pointing out to avoid mistakes in future. -- dwmw2