From mboxrd@z Thu Jan 1 00:00:00 1970 From: Greg KH Subject: Re: EXT :Re: [RFC] Create an audit record of USB specific details Date: Tue, 5 Apr 2016 09:46:32 -0400 Message-ID: <20160405134632.GC31313@kroah.com> References: <1459742562-22803-1-git-send-email-wmail@redhat.com> <1459752519.24025.5.camel@suse.com> <87bn5pzuh1.fsf@nemi.mork.no> <889498a2eca043d5af1fe23ffb574284@XCGVAG30.northgrum.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <889498a2eca043d5af1fe23ffb574284@XCGVAG30.northgrum.com> Sender: linux-kernel-owner@vger.kernel.org To: "Boyce, Kevin P (AS)" Cc: Wade Mealing , =?iso-8859-1?Q?Bj=F8rn?= Mork , Oliver Neukum , "linux-kernel@vger.kernel.org" , linux-usb , "linux-audit@redhat.com" List-Id: linux-audit@redhat.com On Tue, Apr 05, 2016 at 11:49:14AM +0000, Boyce, Kevin P (AS) wrote: > Wade, > > Wouldn't this imply that every time the system is booted and the PCI > bus for example is enumerated and all of the devices are created that > all of those activities generate audit events? > That sounds less than desiriable. Does this imply that the audit > subsystem should maintain a "baseline" of hardware that is always > present on the system? If you do, what happens when your PCI devices renumber themselves the next time you boot (hint, PCI numbering is not static.) > Couldn't you audit a directory under /proc/usb? There is no "/proc/usb/" :) > Correct me if I am wrong, but doesn't audititing of the syscall mknod > create an event when devices are "added" to the system? The kernel calls mknod itself on devtmpfs, userspace doesn't do that anymore (hasn't for a long time). Do you get those audit events today? thanks, greg k-h