Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1370916

Re: [RFC] Create an audit record of USB specific details

From Steve Grubb <sgrubb@redhat.com>
Newsgroups linux.kernel
Subject Re: [RFC] Create an audit record of USB specific details
Date 2016-04-04 23:40 +0200
Message-ID <rkko3-VB-15@gated-at.bofh.it> (permalink)
References <rk3ZU-5Sj-1@gated-at.bofh.it> <rkcgN-388-1@gated-at.bofh.it>
Organization Red Hat

Show all headers | View raw

On Monday, April 04, 2016 05:56:26 AM Greg KH wrote:
> On Mon, Apr 04, 2016 at 12:02:42AM -0400, wmealing wrote:
> > From: Wade Mealing <wmealing@redhat.com>
> > 
> > Gday,
> > 
> > I'm looking to create an audit trail for when devices are added or removed
> > from the system.
> 
> Then please do it in userspace, as I suggested before, that way you
> catch all types of devices, not just USB ones.
> 
> Also I don't think you realize that USB interfaces are what are bound to
> drivers, not USB devices, so that is going to mess with any attempted
> audit trails here.  How are you going to distinguish between the 5
> different devices that just got plugged in that all have 0000/0000 as
> vid/pid for them because they are "cheap" devices from China, yet do
> totally different things because they are different _types_ of devices?

This sounds like vid/pid should be captured in the event.

 
> Again, do this in userspace please, that is where it belongs.

There is one issue that may need some clarification. The audit system has to do 
everything possible to make sure that an event is captured and logged. Does 
the uevent netlink protocol ever drop events because the user space queue is 
full? If the uevent interface drops events, then its not audit quality in 
terms of doing everything possible to prevent the loss of a record. If this 
were to happen, how would user space find out when a uevent gets dropped? I may 
have to panic the machine if that happens depending on the configured policy. 
So, we need to know when it happens. If on the otherhand it doesn't ever drop 
events, then it might be usable.

-Steve

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC] Create an audit record of USB specific details  wmealing <wmealing@redhat.com> - 2016-04-04 06:10 +0200
  Re: [RFC] Create an audit record of USB specific details Oliver Neukum <oneukum@suse.com> - 2016-04-04 08:50 +0200
    Re: [RFC] Create an audit record of USB specific details Bjørn Mork <bjorn@mork.no> - 2016-04-04 09:50 +0200
      Re: [RFC] Create an audit record of USB specific details Wade Mealing <wmealing@redhat.com> - 2016-04-05 10:50 +0200
        RE: EXT :Re: [RFC] Create an audit record of USB specific details "Boyce, Kevin P (AS)" <Kevin.Boyce@ngc.com> - 2016-04-05 14:10 +0200
          Re: EXT :Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 15:50 +0200
            RE: EXT :Re: [RFC] Create an audit record of USB specific details "Boyce, Kevin P (AS)" <Kevin.Boyce@ngc.com> - 2016-04-05 16:00 +0200
              Re: EXT :Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 17:40 +0200
        Re: [RFC] Create an audit record of USB specific details Alan Stern <stern@rowland.harvard.edu> - 2016-04-05 16:50 +0200
          Re: [RFC] Create an audit record of USB specific details Wade Mealing <wmealing@redhat.com> - 2016-04-06 00:20 +0200
        Re: [RFC] Create an audit record of USB specific details Oliver Neukum <oneukum@suse.com> - 2016-04-05 19:10 +0200
          Re: [RFC] Create an audit record of USB specific details Steve Grubb <sgrubb@redhat.com> - 2016-04-05 21:40 +0200
            Re: [RFC] Create an audit record of USB specific details Greg KH <greg@kroah.com> - 2016-04-06 00:20 +0200
  Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-04 15:00 +0200
    Re: [RFC] Create an audit record of USB specific details Steve Grubb <sgrubb@redhat.com> - 2016-04-04 23:40 +0200
      Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 00:20 +0200
        Re: [RFC] Create an audit record of USB specific details Burn Alting <burn@swtf.dyndns.org> - 2016-04-05 15:10 +0200
          Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 15:50 +0200
            RE: EXT :Re: [RFC] Create an audit record of USB specific details "Boyce, Kevin P (AS)" <Kevin.Boyce@ngc.com> - 2016-04-05 16:30 +0200
              RE: EXT :Re: [RFC] Create an audit record of USB specific details Burn Alting <burn@swtf.dyndns.org> - 2016-04-05 16:40 +0200
                RE: EXT :Re: [RFC] Create an audit record of USB specific details "Boyce, Kevin P (AS)" <Kevin.Boyce@ngc.com> - 2016-04-05 16:50 +0200
                RE: EXT :Re: [RFC] Create an audit record of USB specific details Burn Alting <burn@swtf.dyndns.org> - 2016-04-06 00:50 +0200
            Re: [RFC] Create an audit record of USB specific details Burn Alting <burn@swtf.dyndns.org> - 2016-04-05 16:40 +0200
      Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 00:20 +0200
    Re: [RFC] Create an audit record of USB specific details Paul Moore <paul@paul-moore.com> - 2016-04-04 23:40 +0200
      Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 00:20 +0200
        Re: [RFC] Create an audit record of USB specific details Paul Moore <paul@paul-moore.com> - 2016-04-05 05:00 +0200
          Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 05:40 +0200
            Re: [RFC] Create an audit record of USB specific details Paul Moore <paul@paul-moore.com> - 2016-04-05 17:00 +0200
  Re: [RFC] Create an audit record of USB specific details Steve Grubb <sgrubb@redhat.com> - 2016-04-04 23:40 +0200
    Re: [RFC] Create an audit record of USB specific details Greg KH <greg@kroah.com> - 2016-04-05 00:20 +0200
      Re: [RFC] Create an audit record of USB specific details Wade Mealing <wmealing@redhat.com> - 2016-04-05 04:00 +0200
        Re: [RFC] Create an audit record of USB specific details Greg KH <greg@kroah.com> - 2016-04-05 04:50 +0200
        Re: [RFC] Create an audit record of USB specific details Greg KH <greg@kroah.com> - 2016-04-05 04:50 +0200
    Re: [RFC] Create an audit record of USB specific details Burn Alting <burn@swtf.dyndns.org> - 2016-04-05 00:20 +0200

csiph-web