Re: [RFC] Create an audit record of USB specific details

[Greg KH <greg@kroah.com>]

On Tue, Apr 05, 2016 at 11:54:07AM +1000, Wade Mealing wrote:
> That is a good question, maybe I've been lucky in the devices that I have
> been testing with.  Most of them seem to be ascii, my assumption was that
> shouldn't be a problem.  The same encoding   function used by the path
> audit_log_d_path, definitely audits UTF8 named files:
> 
> # ausearch -i -f /tmp/test/권성주.txt

Please look at the USB spec to see the encoding that USB strings are in.
They are in UTF-16LE, but we do some manipulation of them in the call to
usb_string() to make them semi-readable by the kernel.

But, as we aren't doing anything important with these, except printing
them out for people to lovingly gaze at, that's just fine.  But if you
need to do policy decisions based on them, well, you better use the
"real" version of the string, otherwise you could run into major
problems.

But again, please step back, what are the requirements here that you are
doing this work for?  If it's just for fun, wonderful, but please say so
when you post the patches so we don't take them seriously.

Well, I'm not taking them seriously now as obviously they will not work,
so I guess all is fine :)

thanks,

greg k-h