From mboxrd@z Thu Jan  1 00:00:00 1970
From: Oliver Neukum <oneukum@suse.com>
Subject: Re: [RFC] Create an audit record of USB specific details
Date: Tue, 05 Apr 2016 19:02:48 +0200
Message-ID: <1459875768.2892.1.camel@suse.com>
References: <1459742562-22803-1-git-send-email-wmail@redhat.com>
	 <1459752519.24025.5.camel@suse.com> <87bn5pzuh1.fsf@nemi.mork.no>
	 <CALJHwhR5FQaa6v=ZPyLRZ8L+OrucXqEiwe6QE43HybM2keErYg@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Return-path: <linux-kernel-owner@vger.kernel.org>
In-Reply-To: <CALJHwhR5FQaa6v=ZPyLRZ8L+OrucXqEiwe6QE43HybM2keErYg@mail.gmail.com>
Sender: linux-kernel-owner@vger.kernel.org
To: Wade Mealing <wmealing@redhat.com>
Cc: bjorn@mork.no, linux-audit@redhat.com, linux-kernel@vger.kernel.org, linux-usb <linux-usb@vger.kernel.org>
List-Id: linux-audit@redhat.com

On Tue, 2016-04-05 at 18:40 +1000, Wade Mealing wrote:
> Consider the following scenario.  Currently we have device drivers
> that emit text via a printk request which is eventually picked up by
> syslog like implementation (not the audit subsystem).

We also have UEVENTs. The crucial question is why udevd feeding
back events to the audit subsystem is inferior to the kernel
itself generating audit events.

	Regards
		Oliver