linux-kernel - Re: [RFC] Create an audit record of USB specific details

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 05 Apr 2016 19:02:48 +0200
From:	Oliver Neukum <oneukum@...e.com>
To:	Wade Mealing <wmealing@...hat.com>
Cc:	bjorn@...k.no, linux-audit@...hat.com,
	linux-kernel@...r.kernel.org, linux-usb <linux-usb@...r.kernel.org>
Subject: Re: [RFC] Create an audit record of USB specific details

On Tue, 2016-04-05 at 18:40 +1000, Wade Mealing wrote:
> Consider the following scenario.  Currently we have device drivers
> that emit text via a printk request which is eventually picked up by
> syslog like implementation (not the audit subsystem).

We also have UEVENTs. The crucial question is why udevd feeding
back events to the audit subsystem is inferior to the kernel
itself generating audit events.

	Regards
		Oliver