From mboxrd@z Thu Jan 1 00:00:00 1970 From: Greg KH Subject: Re: [RFC] Create an audit record of USB specific details Date: Mon, 4 Apr 2016 19:47:04 -0700 Message-ID: <20160405024704.GD13306@kroah.com> References: <1459742562-22803-1-git-send-email-wmail@redhat.com> <4430946.BXbQgWNMDe@x2> <20160404215422.GA26969@kroah.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-usb-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Wade Mealing Cc: Steve Grubb , linux-audit-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, linux-usb , linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: linux-audit@redhat.com On Tue, Apr 05, 2016 at 11:54:07AM +1000, Wade Mealing wrote: > That is a good question, maybe I've been lucky in the devices that I = have > been testing with. Most of them seem to be ascii, my assumption was = that > shouldn't be a problem. The same encoding function used by the pat= h > audit_log_d_path, definitely audits UTF8 named files: >=20 > # ausearch -i -f /tmp/test/=EA=B6=8C=EC=84=B1=EC=A3=BC.txt Please look at the USB spec to see the encoding that USB strings are in= =2E They are in UTF-16LE, but we do some manipulation of them in the call t= o usb_string() to make them semi-readable by the kernel. But, as we aren't doing anything important with these, except printing them out for people to lovingly gaze at, that's just fine. But if you need to do policy decisions based on them, well, you better use the "real" version of the string, otherwise you could run into major problems. But again, please step back, what are the requirements here that you ar= e doing this work for? If it's just for fun, wonderful, but please say s= o when you post the patches so we don't take them seriously. Well, I'm not taking them seriously now as obviously they will not work= , so I guess all is fine :) thanks, greg k-h -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html