From mboxrd@z Thu Jan 1 00:00:00 1970 From: Greg KH Subject: Re: [RFC] Create an audit record of USB specific details Date: Mon, 4 Apr 2016 14:53:02 -0700 Message-ID: <20160404215302.GC26580@kroah.com> References: <1459742562-22803-1-git-send-email-wmail@redhat.com> <20160404125626.GB6197@kroah.com> <8028201.ZHuhRfiKWv@x2> <20160404214843.GA26580@kroah.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <20160404214843.GA26580-U8xfFu+wG4EAvxtiuMwx3w@public.gmane.org> Sender: linux-usb-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Steve Grubb Cc: linux-audit-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, wmealing , linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-usb-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: linux-audit@redhat.com On Mon, Apr 04, 2016 at 02:48:43PM -0700, Greg KH wrote: > On Mon, Apr 04, 2016 at 05:33:10PM -0400, Steve Grubb wrote: > > On Monday, April 04, 2016 05:56:26 AM Greg KH wrote: > > > On Mon, Apr 04, 2016 at 12:02:42AM -0400, wmealing wrote: > > > > From: Wade Mealing > > > > > > > > Gday, > > > > > > > > I'm looking to create an audit trail for when devices are added or removed > > > > from the system. > > > > > > Then please do it in userspace, as I suggested before, that way you > > > catch all types of devices, not just USB ones. > > > > > > Also I don't think you realize that USB interfaces are what are bound to > > > drivers, not USB devices, so that is going to mess with any attempted > > > audit trails here. How are you going to distinguish between the 5 > > > different devices that just got plugged in that all have 0000/0000 as > > > vid/pid for them because they are "cheap" devices from China, yet do > > > totally different things because they are different _types_ of devices? > > > > This sounds like vid/pid should be captured in the event. > > The code did that, the point is, vid/pid means nothing in the real > world. So why are you going to audit anything based on it? :) Oh wait, it's worse, it is logging strings, which are even more unreliable than vid/pid values. It's pretty obvious this has not been tested on any large batch of real-world devices, or thought through as to why any of this is even needed at all. So why is this being added? Who needs/wants this? What are their requirements here? From what I recall, the author is just messing around with the USB subsystem and audit as something fun to do, which is great, but don't expect it to be mergable :) thanks, greg k-h -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html