[deliverable/linux.git] / security / tomoyo / audit.c

/*
 * security/tomoyo/audit.c
 *
 * Pathname restriction functions.
 *
 * Copyright (C) 2005-2010  NTT DATA CORPORATION
 */

#include "common.h"
#include <linux/slab.h>

/**
 * tomoyo_filetype - Get string representation of file type.
 *
 * @mode: Mode value for stat().
 *
 * Returns file type string.
 */
static inline const char *tomoyo_filetype(const mode_t mode)
{
	switch (mode & S_IFMT) {
	case S_IFREG:
	case 0:
		return tomoyo_condition_keyword[TOMOYO_TYPE_IS_FILE];
	case S_IFDIR:
		return tomoyo_condition_keyword[TOMOYO_TYPE_IS_DIRECTORY];
	case S_IFLNK:
		return tomoyo_condition_keyword[TOMOYO_TYPE_IS_SYMLINK];
	case S_IFIFO:
		return tomoyo_condition_keyword[TOMOYO_TYPE_IS_FIFO];
	case S_IFSOCK:
		return tomoyo_condition_keyword[TOMOYO_TYPE_IS_SOCKET];
	case S_IFBLK:
		return tomoyo_condition_keyword[TOMOYO_TYPE_IS_BLOCK_DEV];
	case S_IFCHR:
		return tomoyo_condition_keyword[TOMOYO_TYPE_IS_CHAR_DEV];
	}
	return "unknown"; /* This should not happen. */
}

/**
 * tomoyo_print_header - Get header line of audit log.
 *
 * @r: Pointer to "struct tomoyo_request_info".
 *
 * Returns string representation.
 *
 * This function uses kmalloc(), so caller must kfree() if this function
 * didn't return NULL.
 */
static char *tomoyo_print_header(struct tomoyo_request_info *r)
{
	struct tomoyo_time stamp;
	const pid_t gpid = task_pid_nr(current);
	struct tomoyo_obj_info *obj = r->obj;
	static const int tomoyo_buffer_len = 4096;
	char *buffer = kmalloc(tomoyo_buffer_len, GFP_NOFS);
	int pos;
	u8 i;
	if (!buffer)
		return NULL;
	{
		struct timeval tv;
		do_gettimeofday(&tv);
		tomoyo_convert_time(tv.tv_sec, &stamp);
	}
	pos = snprintf(buffer, tomoyo_buffer_len - 1,
		       "#%04u/%02u/%02u %02u:%02u:%02u# profile=%u mode=%s "
		       "granted=%s (global-pid=%u) task={ pid=%u ppid=%u "
		       "uid=%u gid=%u euid=%u egid=%u suid=%u sgid=%u "
		       "fsuid=%u fsgid=%u }", stamp.year, stamp.month,
		       stamp.day, stamp.hour, stamp.min, stamp.sec, r->profile,
		       tomoyo_mode[r->mode], tomoyo_yesno(r->granted), gpid,
		       tomoyo_sys_getpid(), tomoyo_sys_getppid(),
		       current_uid(), current_gid(), current_euid(),
		       current_egid(), current_suid(), current_sgid(),
		       current_fsuid(), current_fsgid());
	if (!obj)
		goto no_obj_info;
	if (!obj->validate_done) {
		tomoyo_get_attributes(obj);
		obj->validate_done = true;
	}
	for (i = 0; i < TOMOYO_MAX_PATH_STAT; i++) {
		struct tomoyo_mini_stat *stat;
		unsigned int dev;
		mode_t mode;
		if (!obj->stat_valid[i])
			continue;
		stat = &obj->stat[i];
		dev = stat->dev;
		mode = stat->mode;
		if (i & 1) {
			pos += snprintf(buffer + pos,
					tomoyo_buffer_len - 1 - pos,
					" path%u.parent={ uid=%u gid=%u "
					"ino=%lu perm=0%o }", (i >> 1) + 1,
					stat->uid, stat->gid, (unsigned long)
					stat->ino, stat->mode & S_IALLUGO);
			continue;
		}
		pos += snprintf(buffer + pos, tomoyo_buffer_len - 1 - pos,
				" path%u={ uid=%u gid=%u ino=%lu major=%u"
				" minor=%u perm=0%o type=%s", (i >> 1) + 1,
				stat->uid, stat->gid, (unsigned long)
				stat->ino, MAJOR(dev), MINOR(dev),
				mode & S_IALLUGO, tomoyo_filetype(mode));
		if (S_ISCHR(mode) || S_ISBLK(mode)) {
			dev = stat->rdev;
			pos += snprintf(buffer + pos,
					tomoyo_buffer_len - 1 - pos,
					" dev_major=%u dev_minor=%u",
					MAJOR(dev), MINOR(dev));
		}
		pos += snprintf(buffer + pos, tomoyo_buffer_len - 1 - pos,
				" }");
	}
no_obj_info:
	if (pos < tomoyo_buffer_len - 1)
		return buffer;
	kfree(buffer);
	return NULL;
}

/**
 * tomoyo_init_log - Allocate buffer for audit logs.
 *
 * @r:    Pointer to "struct tomoyo_request_info".
 * @len:  Buffer size needed for @fmt and @args.
 * @fmt:  The printf()'s format string.
 * @args: va_list structure for @fmt.
 *
 * Returns pointer to allocated memory.
 *
 * This function uses kzalloc(), so caller must kfree() if this function
 * didn't return NULL.
 */
char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt,
		      va_list args)
{
	char *buf = NULL;
	const char *header = NULL;
	char *realpath = NULL;
	const char *symlink = NULL;
	int pos;
	const char *domainname = r->domain->domainname->name;
	header = tomoyo_print_header(r);
	if (!header)
		return NULL;
	/* +10 is for '\n' etc. and '\0'. */
	len += strlen(domainname) + strlen(header) + 10;
	if (r->ee) {
		struct file *file = r->ee->bprm->file;
		realpath = tomoyo_realpath_from_path(&file->f_path);
		if (!realpath)
			goto out;
		/* +80 is for " exec={ realpath=\"%s\" }" */
		len += strlen(realpath) + 80;
	} else if (r->obj && r->obj->symlink_target) {
		symlink = r->obj->symlink_target->name;
		/* +18 is for " symlink.target=\"%s\"" */
		len += 18 + strlen(symlink);
	}
	len = tomoyo_round2(len);
	buf = kzalloc(len, GFP_NOFS);
	if (!buf)
		goto out;
	len--;
	pos = snprintf(buf, len, "%s", header);
	if (realpath) {
		pos += snprintf(buf + pos, len - pos,
				" exec={ realpath=\"%s\" }", realpath);
	} else if (symlink)
		pos += snprintf(buf + pos, len - pos, " symlink.target=\"%s\"",
				symlink);
	pos += snprintf(buf + pos, len - pos, "\n%s\n", domainname);
	vsnprintf(buf + pos, len - pos, fmt, args);
out:
	kfree(realpath);
	kfree(header);
	return buf;
}

/* Wait queue for /sys/kernel/security/tomoyo/audit. */
static DECLARE_WAIT_QUEUE_HEAD(tomoyo_log_wait);

/* Structure for audit log. */
struct tomoyo_log {
	struct list_head list;
	char *log;
	int size;
};

/* The list for "struct tomoyo_log". */
static LIST_HEAD(tomoyo_log);

/* Lock for "struct list_head tomoyo_log". */
static DEFINE_SPINLOCK(tomoyo_log_lock);

/* Length of "stuct list_head tomoyo_log". */
static unsigned int tomoyo_log_count;

/**
 * tomoyo_get_audit - Get audit mode.
 *
 * @ns:          Pointer to "struct tomoyo_policy_namespace".
 * @profile:     Profile number.
 * @index:       Index number of functionality.
 * @is_granted:  True if granted log, false otherwise.
 *
 * Returns true if this request should be audited, false otherwise.
 */
static bool tomoyo_get_audit(const struct tomoyo_policy_namespace *ns,
			     const u8 profile, const u8 index,
			     const bool is_granted)
{
	u8 mode;
	const u8 category = tomoyo_index2category[index] +
		TOMOYO_MAX_MAC_INDEX;
	struct tomoyo_profile *p;
	if (!tomoyo_policy_loaded)
		return false;
	p = tomoyo_profile(ns, profile);
	if (tomoyo_log_count >= p->pref[TOMOYO_PREF_MAX_AUDIT_LOG])
		return false;
	mode = p->config[index];
	if (mode == TOMOYO_CONFIG_USE_DEFAULT)
		mode = p->config[category];
	if (mode == TOMOYO_CONFIG_USE_DEFAULT)
		mode = p->default_config;
	if (is_granted)
		return mode & TOMOYO_CONFIG_WANT_GRANT_LOG;
	return mode & TOMOYO_CONFIG_WANT_REJECT_LOG;
}

/**
 * tomoyo_write_log2 - Write an audit log.
 *
 * @r:    Pointer to "struct tomoyo_request_info".
 * @len:  Buffer size needed for @fmt and @args.
 * @fmt:  The printf()'s format string.
 * @args: va_list structure for @fmt.
 *
 * Returns nothing.
 */
void tomoyo_write_log2(struct tomoyo_request_info *r, int len, const char *fmt,
		       va_list args)
{
	char *buf;
	struct tomoyo_log *entry;
	bool quota_exceeded = false;
	if (!tomoyo_get_audit(r->domain->ns, r->profile, r->type, r->granted))
		goto out;
	buf = tomoyo_init_log(r, len, fmt, args);
	if (!buf)
		goto out;
	entry = kzalloc(sizeof(*entry), GFP_NOFS);
	if (!entry) {
		kfree(buf);
		goto out;
	}
	entry->log = buf;
	len = tomoyo_round2(strlen(buf) + 1);
	/*
	 * The entry->size is used for memory quota checks.
	 * Don't go beyond strlen(entry->log).
	 */
	entry->size = len + tomoyo_round2(sizeof(*entry));
	spin_lock(&tomoyo_log_lock);
	if (tomoyo_memory_quota[TOMOYO_MEMORY_AUDIT] &&
	    tomoyo_memory_used[TOMOYO_MEMORY_AUDIT] + entry->size >=
	    tomoyo_memory_quota[TOMOYO_MEMORY_AUDIT]) {
		quota_exceeded = true;
	} else {
		tomoyo_memory_used[TOMOYO_MEMORY_AUDIT] += entry->size;
		list_add_tail(&entry->list, &tomoyo_log);
		tomoyo_log_count++;
	}
	spin_unlock(&tomoyo_log_lock);
	if (quota_exceeded) {
		kfree(buf);
		kfree(entry);
		goto out;
	}
	wake_up(&tomoyo_log_wait);
out:
	return;
}

/**
 * tomoyo_write_log - Write an audit log.
 *
 * @r:   Pointer to "struct tomoyo_request_info".
 * @fmt: The printf()'s format string, followed by parameters.
 *
 * Returns nothing.
 */
void tomoyo_write_log(struct tomoyo_request_info *r, const char *fmt, ...)
{
	va_list args;
	int len;
	va_start(args, fmt);
	len = vsnprintf((char *) &len, 1, fmt, args) + 1;
	va_end(args);
	va_start(args, fmt);
	tomoyo_write_log2(r, len, fmt, args);
	va_end(args);
}

/**
 * tomoyo_read_log - Read an audit log.
 *
 * @head: Pointer to "struct tomoyo_io_buffer".
 *
 * Returns nothing.
 */
void tomoyo_read_log(struct tomoyo_io_buffer *head)
{
	struct tomoyo_log *ptr = NULL;
	if (head->r.w_pos)
		return;
	kfree(head->read_buf);
	head->read_buf = NULL;
	spin_lock(&tomoyo_log_lock);
	if (!list_empty(&tomoyo_log)) {
		ptr = list_entry(tomoyo_log.next, typeof(*ptr), list);
		list_del(&ptr->list);
		tomoyo_log_count--;
		tomoyo_memory_used[TOMOYO_MEMORY_AUDIT] -= ptr->size;
	}
	spin_unlock(&tomoyo_log_lock);
	if (ptr) {
		head->read_buf = ptr->log;
		head->r.w[head->r.w_pos++] = head->read_buf;
		kfree(ptr);
	}
}

/**
 * tomoyo_poll_log - Wait for an audit log.
 *
 * @file: Pointer to "struct file".
 * @wait: Pointer to "poll_table".
 *
 * Returns POLLIN | POLLRDNORM when ready to read an audit log.
 */
int tomoyo_poll_log(struct file *file, poll_table *wait)
{
	if (tomoyo_log_count)
		return POLLIN | POLLRDNORM;
	poll_wait(file, &tomoyo_log_wait, wait);
	if (tomoyo_log_count)
		return POLLIN | POLLRDNORM;
	return 0;
}
Commit	Line	Data
eadd99cc TH	1	/*
	2	* security/tomoyo/audit.c
	3	*
	4	* Pathname restriction functions.
	5	*
	6	* Copyright (C) 2005-2010 NTT DATA CORPORATION
	7	*/
	8
	9	#include "common.h"
	10	#include <linux/slab.h>
	11
8761afd4 TH	12	/**
	13	* tomoyo_filetype - Get string representation of file type.
	14	*
	15	* @mode: Mode value for stat().
	16	*
	17	* Returns file type string.
	18	*/
	19	static inline const char *tomoyo_filetype(const mode_t mode)
	20	{
	21	switch (mode & S_IFMT) {
	22	case S_IFREG:
	23	case 0:
	24	return tomoyo_condition_keyword[TOMOYO_TYPE_IS_FILE];
	25	case S_IFDIR:
	26	return tomoyo_condition_keyword[TOMOYO_TYPE_IS_DIRECTORY];
	27	case S_IFLNK:
	28	return tomoyo_condition_keyword[TOMOYO_TYPE_IS_SYMLINK];
	29	case S_IFIFO:
	30	return tomoyo_condition_keyword[TOMOYO_TYPE_IS_FIFO];
	31	case S_IFSOCK:
	32	return tomoyo_condition_keyword[TOMOYO_TYPE_IS_SOCKET];
	33	case S_IFBLK:
	34	return tomoyo_condition_keyword[TOMOYO_TYPE_IS_BLOCK_DEV];
	35	case S_IFCHR:
	36	return tomoyo_condition_keyword[TOMOYO_TYPE_IS_CHAR_DEV];
	37	}
	38	return "unknown"; /* This should not happen. */
	39	}
	40
eadd99cc TH	41	/**
	42	* tomoyo_print_header - Get header line of audit log.
	43	*
	44	* @r: Pointer to "struct tomoyo_request_info".
	45	*
	46	* Returns string representation.
	47	*
	48	* This function uses kmalloc(), so caller must kfree() if this function
	49	* didn't return NULL.
	50	*/
	51	static char tomoyo_print_header(struct tomoyo_request_info r)
	52	{
	53	struct tomoyo_time stamp;
	54	const pid_t gpid = task_pid_nr(current);
8761afd4	55	struct tomoyo_obj_info *obj = r->obj;
eadd99cc TH	56	static const int tomoyo_buffer_len = 4096;
eadd99cc TH	57	char *buffer = kmalloc(tomoyo_buffer_len, GFP_NOFS);
2066a361	58	int pos;
8761afd4	59	u8 i;
eadd99cc TH	60	if (!buffer)
	61	return NULL;
	62	{
	63	struct timeval tv;
	64	do_gettimeofday(&tv);
	65	tomoyo_convert_time(tv.tv_sec, &stamp);
	66	}
2066a361 TH	67	pos = snprintf(buffer, tomoyo_buffer_len - 1,
	68	"#%04u/%02u/%02u %02u:%02u:%02u# profile=%u mode=%s "
	69	"granted=%s (global-pid=%u) task={ pid=%u ppid=%u "
	70	"uid=%u gid=%u euid=%u egid=%u suid=%u sgid=%u "
	71	"fsuid=%u fsgid=%u }", stamp.year, stamp.month,
	72	stamp.day, stamp.hour, stamp.min, stamp.sec, r->profile,
	73	tomoyo_mode[r->mode], tomoyo_yesno(r->granted), gpid,
	74	tomoyo_sys_getpid(), tomoyo_sys_getppid(),
	75	current_uid(), current_gid(), current_euid(),
	76	current_egid(), current_suid(), current_sgid(),
	77	current_fsuid(), current_fsgid());
8761afd4 TH	78	if (!obj)
	79	goto no_obj_info;
	80	if (!obj->validate_done) {
	81	tomoyo_get_attributes(obj);
	82	obj->validate_done = true;
	83	}
	84	for (i = 0; i < TOMOYO_MAX_PATH_STAT; i++) {
	85	struct tomoyo_mini_stat *stat;
	86	unsigned int dev;
	87	mode_t mode;
	88	if (!obj->stat_valid[i])
	89	continue;
	90	stat = &obj->stat[i];
	91	dev = stat->dev;
	92	mode = stat->mode;
	93	if (i & 1) {
	94	pos += snprintf(buffer + pos,
	95	tomoyo_buffer_len - 1 - pos,
	96	" path%u.parent={ uid=%u gid=%u "
	97	"ino=%lu perm=0%o }", (i >> 1) + 1,
	98	stat->uid, stat->gid, (unsigned long)
	99	stat->ino, stat->mode & S_IALLUGO);
	100	continue;
	101	}
	102	pos += snprintf(buffer + pos, tomoyo_buffer_len - 1 - pos,
	103	" path%u={ uid=%u gid=%u ino=%lu major=%u"
	104	" minor=%u perm=0%o type=%s", (i >> 1) + 1,
	105	stat->uid, stat->gid, (unsigned long)
	106	stat->ino, MAJOR(dev), MINOR(dev),
	107	mode & S_IALLUGO, tomoyo_filetype(mode));
	108	if (S_ISCHR(mode) \|\| S_ISBLK(mode)) {
	109	dev = stat->rdev;
	110	pos += snprintf(buffer + pos,
	111	tomoyo_buffer_len - 1 - pos,
	112	" dev_major=%u dev_minor=%u",
	113	MAJOR(dev), MINOR(dev));
	114	}
	115	pos += snprintf(buffer + pos, tomoyo_buffer_len - 1 - pos,
	116	" }");
	117	}
	118	no_obj_info:
2066a361 TH	119	if (pos < tomoyo_buffer_len - 1)
	120	return buffer;
	121	kfree(buffer);
	122	return NULL;
eadd99cc TH	123	}
	124
	125	/**
	126	* tomoyo_init_log - Allocate buffer for audit logs.
	127	*
	128	* @r: Pointer to "struct tomoyo_request_info".
	129	* @len: Buffer size needed for @fmt and @args.
	130	* @fmt: The printf()'s format string.
	131	* @args: va_list structure for @fmt.
	132	*
	133	* Returns pointer to allocated memory.
	134	*
	135	* This function uses kzalloc(), so caller must kfree() if this function
	136	* didn't return NULL.
	137	*/
	138	char tomoyo_init_log(struct tomoyo_request_info r, int len, const char *fmt,
	139	va_list args)
	140	{
	141	char *buf = NULL;
	142	const char *header = NULL;
2ca9bf45 TH	143	char *realpath = NULL;
2ca9bf45 TH	144	const char *symlink = NULL;
eadd99cc	145	int pos;
ea504819	146	const char *domainname = r->domain->domainname->name;
eadd99cc TH	147	header = tomoyo_print_header(r);
	148	if (!header)
	149	return NULL;
	150	/* +10 is for '\n' etc. and '\0'. */
	151	len += strlen(domainname) + strlen(header) + 10;
2ca9bf45 TH	152	if (r->ee) {
	153	struct file *file = r->ee->bprm->file;
	154	realpath = tomoyo_realpath_from_path(&file->f_path);
	155	if (!realpath)
	156	goto out;
	157	/* +80 is for " exec={ realpath=\"%s\" }" */
	158	len += strlen(realpath) + 80;
	159	} else if (r->obj && r->obj->symlink_target) {
	160	symlink = r->obj->symlink_target->name;
	161	/* +18 is for " symlink.target=\"%s\"" */
	162	len += 18 + strlen(symlink);
	163	}
eadd99cc TH	164	len = tomoyo_round2(len);
	165	buf = kzalloc(len, GFP_NOFS);
	166	if (!buf)
	167	goto out;
	168	len--;
	169	pos = snprintf(buf, len, "%s", header);
2ca9bf45 TH	170	if (realpath) {
	171	pos += snprintf(buf + pos, len - pos,
	172	" exec={ realpath=\"%s\" }", realpath);
	173	} else if (symlink)
	174	pos += snprintf(buf + pos, len - pos, " symlink.target=\"%s\"",
	175	symlink);
eadd99cc TH	176	pos += snprintf(buf + pos, len - pos, "\n%s\n", domainname);
	177	vsnprintf(buf + pos, len - pos, fmt, args);
	178	out:
2ca9bf45	179	kfree(realpath);
eadd99cc TH	180	kfree(header);
	181	return buf;
	182	}
	183
	184	/* Wait queue for /sys/kernel/security/tomoyo/audit. */
	185	static DECLARE_WAIT_QUEUE_HEAD(tomoyo_log_wait);
	186
	187	/* Structure for audit log. */
	188	struct tomoyo_log {
	189	struct list_head list;
	190	char *log;
	191	int size;
	192	};
	193
	194	/* The list for "struct tomoyo_log". */
	195	static LIST_HEAD(tomoyo_log);
	196
	197	/* Lock for "struct list_head tomoyo_log". */
	198	static DEFINE_SPINLOCK(tomoyo_log_lock);
	199
	200	/* Length of "stuct list_head tomoyo_log". */
	201	static unsigned int tomoyo_log_count;
	202
	203	/**
	204	* tomoyo_get_audit - Get audit mode.
	205	*
bd03a3e4	206	* @ns: Pointer to "struct tomoyo_policy_namespace".
eadd99cc TH	207	* @profile: Profile number.
	208	* @index: Index number of functionality.
	209	* @is_granted: True if granted log, false otherwise.
	210	*
	211	* Returns true if this request should be audited, false otherwise.
	212	*/
bd03a3e4 TH	213	static bool tomoyo_get_audit(const struct tomoyo_policy_namespace *ns,
bd03a3e4 TH	214	const u8 profile, const u8 index,
eadd99cc TH	215	const bool is_granted)
	216	{
	217	u8 mode;
2c47ab93 TH	218	const u8 category = tomoyo_index2category[index] +
2c47ab93 TH	219	TOMOYO_MAX_MAC_INDEX;
eadd99cc TH	220	struct tomoyo_profile *p;
	221	if (!tomoyo_policy_loaded)
	222	return false;
bd03a3e4	223	p = tomoyo_profile(ns, profile);
eadd99cc TH	224	if (tomoyo_log_count >= p->pref[TOMOYO_PREF_MAX_AUDIT_LOG])
	225	return false;
	226	mode = p->config[index];
	227	if (mode == TOMOYO_CONFIG_USE_DEFAULT)
	228	mode = p->config[category];
	229	if (mode == TOMOYO_CONFIG_USE_DEFAULT)
	230	mode = p->default_config;
	231	if (is_granted)
	232	return mode & TOMOYO_CONFIG_WANT_GRANT_LOG;
	233	return mode & TOMOYO_CONFIG_WANT_REJECT_LOG;
	234	}
	235
	236	/**
	237	* tomoyo_write_log2 - Write an audit log.
	238	*
	239	* @r: Pointer to "struct tomoyo_request_info".
	240	* @len: Buffer size needed for @fmt and @args.
	241	* @fmt: The printf()'s format string.
	242	* @args: va_list structure for @fmt.
	243	*
	244	* Returns nothing.
	245	*/
	246	void tomoyo_write_log2(struct tomoyo_request_info r, int len, const char fmt,
	247	va_list args)
	248	{
	249	char *buf;
	250	struct tomoyo_log *entry;
	251	bool quota_exceeded = false;
bd03a3e4	252	if (!tomoyo_get_audit(r->domain->ns, r->profile, r->type, r->granted))
eadd99cc TH	253	goto out;
	254	buf = tomoyo_init_log(r, len, fmt, args);
	255	if (!buf)
	256	goto out;
	257	entry = kzalloc(sizeof(*entry), GFP_NOFS);
	258	if (!entry) {
	259	kfree(buf);
	260	goto out;
	261	}
	262	entry->log = buf;
	263	len = tomoyo_round2(strlen(buf) + 1);
	264	/*
	265	* The entry->size is used for memory quota checks.
	266	* Don't go beyond strlen(entry->log).
	267	*/
	268	entry->size = len + tomoyo_round2(sizeof(*entry));
	269	spin_lock(&tomoyo_log_lock);
	270	if (tomoyo_memory_quota[TOMOYO_MEMORY_AUDIT] &&
	271	tomoyo_memory_used[TOMOYO_MEMORY_AUDIT] + entry->size >=
	272	tomoyo_memory_quota[TOMOYO_MEMORY_AUDIT]) {
	273	quota_exceeded = true;
	274	} else {
	275	tomoyo_memory_used[TOMOYO_MEMORY_AUDIT] += entry->size;
	276	list_add_tail(&entry->list, &tomoyo_log);
	277	tomoyo_log_count++;
	278	}
	279	spin_unlock(&tomoyo_log_lock);
	280	if (quota_exceeded) {
	281	kfree(buf);
	282	kfree(entry);
	283	goto out;
	284	}
	285	wake_up(&tomoyo_log_wait);
	286	out:
	287	return;
	288	}
	289
	290	/**
	291	* tomoyo_write_log - Write an audit log.
	292	*
	293	* @r: Pointer to "struct tomoyo_request_info".
	294	* @fmt: The printf()'s format string, followed by parameters.
	295	*
	296	* Returns nothing.
	297	*/
	298	void tomoyo_write_log(struct tomoyo_request_info r, const char fmt, ...)
	299	{
	300	va_list args;
	301	int len;
	302	va_start(args, fmt);
	303	len = vsnprintf((char *) &len, 1, fmt, args) + 1;
	304	va_end(args);
	305	va_start(args, fmt);
	306	tomoyo_write_log2(r, len, fmt, args);
	307	va_end(args);
	308	}
	309
	310	/**
	311	* tomoyo_read_log - Read an audit log.
	312	*
	313	* @head: Pointer to "struct tomoyo_io_buffer".
	314	*
	315	* Returns nothing.
	316	*/
317	void tomoyo_read_log(struct tomoyo_io_buffer *head)
318	{
319	struct tomoyo_log *ptr = NULL;
320	if (head->r.w_pos)
321	return;
322	kfree(head->read_buf);
323	head->read_buf = NULL;
324	spin_lock(&tomoyo_log_lock);
325	if (!list_empty(&tomoyo_log)) {
326	ptr = list_entry(tomoyo_log.next, typeof(*ptr), list);
327	list_del(&ptr->list);
328	tomoyo_log_count--;
329	tomoyo_memory_used[TOMOYO_MEMORY_AUDIT] -= ptr->size;
330	}
331	spin_unlock(&tomoyo_log_lock);
332	if (ptr) {
333	head->read_buf = ptr->log;
334	head->r.w[head->r.w_pos++] = head->read_buf;
335	kfree(ptr);
336	}
337	}
338
339	/**
340	* tomoyo_poll_log - Wait for an audit log.
341	*
342	* @file: Pointer to "struct file".
343	* @wait: Pointer to "poll_table".
344	*
345	* Returns POLLIN \| POLLRDNORM when ready to read an audit log.
346	*/
347	int tomoyo_poll_log(struct file file, poll_table wait)
348	{
349	if (tomoyo_log_count)
350	return POLLIN \| POLLRDNORM;
351	poll_wait(file, &tomoyo_log_wait, wait);
352	if (tomoyo_log_count)
353	return POLLIN \| POLLRDNORM;
354	return 0;
355	}