Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1370915

Re: [RFC] Create an audit record of USB specific details

From Steve Grubb <sgrubb@redhat.com>
Newsgroups linux.kernel
Subject Re: [RFC] Create an audit record of USB specific details
Date 2016-04-04 23:40 +0200
Message-ID <rkko3-VB-17@gated-at.bofh.it> (permalink)
References <rk3ZU-5Sj-1@gated-at.bofh.it>
Organization Red Hat

Show all headers | View raw

On Monday, April 04, 2016 12:02:42 AM wmealing wrote:
> I'm looking to create an audit trail for when devices are added or removed
> from the system.
> 
> The audit subsystem is a logging subsystem in kernel space that can be
> used to create advanced filters on generated events.  It has partnered
> userspace utilities ausearch, auditd, aureport, auditctl which work
> exclusively on audit records.
> 
> These tools are able to set filters to "trigger" on specific in-kernel
> events specified by privileged users.  While the userspace tools can create
> audit events these are not able to be handled intelligently
> (decoded,filtered or ignored) as kernel generated audit events are.
> 
> I have this working at the moment with the USB subsystem (as an example).
> Its been suggested that I use systemd-udev however this means that the audit
> tools (ausearch) will not be able to index these records.
> 
> Here is an example of picking out the AUDIT_DEVICE record type for example.
> 
> > # ausearch -l -i -ts today -m AUDIT_DEVICE
> > ----
> > type=AUDIT_DEVICE msg=audit(31/03/16 16:37:15.642:2) : action=add
> > manufacturer=Linux 4.4.0-ktest ehci_hcd product=EHCI Host Controller
> > serial=0000:00:06.7 major=189 minor=0 bus="usb"

About this event's format...we can't have any spaces in the value side of the 
name=value fields unless its encoded as an untrusted string. You can replace 
spaces with an underscore or dash for readability. So, manufacturer and 
product would need this treatment.

-Steve

> Admittedly this is only the USB device type at the moment, but I'd like to
> break this out into other bus types at some time in the future, gotta start
> somewhere.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC] Create an audit record of USB specific details  wmealing <wmealing@redhat.com> - 2016-04-04 06:10 +0200
  Re: [RFC] Create an audit record of USB specific details Oliver Neukum <oneukum@suse.com> - 2016-04-04 08:50 +0200
    Re: [RFC] Create an audit record of USB specific details Bjørn Mork <bjorn@mork.no> - 2016-04-04 09:50 +0200
      Re: [RFC] Create an audit record of USB specific details Wade Mealing <wmealing@redhat.com> - 2016-04-05 10:50 +0200
        RE: EXT :Re: [RFC] Create an audit record of USB specific details "Boyce, Kevin P (AS)" <Kevin.Boyce@ngc.com> - 2016-04-05 14:10 +0200
          Re: EXT :Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 15:50 +0200
            RE: EXT :Re: [RFC] Create an audit record of USB specific details "Boyce, Kevin P (AS)" <Kevin.Boyce@ngc.com> - 2016-04-05 16:00 +0200
              Re: EXT :Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 17:40 +0200
        Re: [RFC] Create an audit record of USB specific details Alan Stern <stern@rowland.harvard.edu> - 2016-04-05 16:50 +0200
          Re: [RFC] Create an audit record of USB specific details Wade Mealing <wmealing@redhat.com> - 2016-04-06 00:20 +0200
        Re: [RFC] Create an audit record of USB specific details Oliver Neukum <oneukum@suse.com> - 2016-04-05 19:10 +0200
          Re: [RFC] Create an audit record of USB specific details Steve Grubb <sgrubb@redhat.com> - 2016-04-05 21:40 +0200
            Re: [RFC] Create an audit record of USB specific details Greg KH <greg@kroah.com> - 2016-04-06 00:20 +0200
  Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-04 15:00 +0200
    Re: [RFC] Create an audit record of USB specific details Steve Grubb <sgrubb@redhat.com> - 2016-04-04 23:40 +0200
      Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 00:20 +0200
        Re: [RFC] Create an audit record of USB specific details Burn Alting <burn@swtf.dyndns.org> - 2016-04-05 15:10 +0200
          Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 15:50 +0200
            RE: EXT :Re: [RFC] Create an audit record of USB specific details "Boyce, Kevin P (AS)" <Kevin.Boyce@ngc.com> - 2016-04-05 16:30 +0200
              RE: EXT :Re: [RFC] Create an audit record of USB specific details Burn Alting <burn@swtf.dyndns.org> - 2016-04-05 16:40 +0200
                RE: EXT :Re: [RFC] Create an audit record of USB specific details "Boyce, Kevin P (AS)" <Kevin.Boyce@ngc.com> - 2016-04-05 16:50 +0200
                RE: EXT :Re: [RFC] Create an audit record of USB specific details Burn Alting <burn@swtf.dyndns.org> - 2016-04-06 00:50 +0200
            Re: [RFC] Create an audit record of USB specific details Burn Alting <burn@swtf.dyndns.org> - 2016-04-05 16:40 +0200
      Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 00:20 +0200
    Re: [RFC] Create an audit record of USB specific details Paul Moore <paul@paul-moore.com> - 2016-04-04 23:40 +0200
      Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 00:20 +0200
        Re: [RFC] Create an audit record of USB specific details Paul Moore <paul@paul-moore.com> - 2016-04-05 05:00 +0200
          Re: [RFC] Create an audit record of USB specific details Greg KH <gregkh@linuxfoundation.org> - 2016-04-05 05:40 +0200
            Re: [RFC] Create an audit record of USB specific details Paul Moore <paul@paul-moore.com> - 2016-04-05 17:00 +0200
  Re: [RFC] Create an audit record of USB specific details Steve Grubb <sgrubb@redhat.com> - 2016-04-04 23:40 +0200
    Re: [RFC] Create an audit record of USB specific details Greg KH <greg@kroah.com> - 2016-04-05 00:20 +0200
      Re: [RFC] Create an audit record of USB specific details Wade Mealing <wmealing@redhat.com> - 2016-04-05 04:00 +0200
        Re: [RFC] Create an audit record of USB specific details Greg KH <greg@kroah.com> - 2016-04-05 04:50 +0200
        Re: [RFC] Create an audit record of USB specific details Greg KH <greg@kroah.com> - 2016-04-05 04:50 +0200
    Re: [RFC] Create an audit record of USB specific details Burn Alting <burn@swtf.dyndns.org> - 2016-04-05 00:20 +0200

csiph-web