linux-kernel - Re: [RFC] Create an audit record of USB specific details

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALJHwhQBKJDhKo6NERTY+L676raUAgq7jSMYEnpB9WAwN-v7nQ@mail.gmail.com>
Date:	Wed, 6 Apr 2016 08:17:56 +1000
From:	Wade Mealing <wmealing@...hat.com>
To:	Alan Stern <stern@...land.harvard.edu>
Cc:	Bjørn Mork <bjorn@...k.no>,
	Oliver Neukum <oneukum@...e.com>, linux-audit@...hat.com,
	linux-kernel@...r.kernel.org, linux-usb <linux-usb@...r.kernel.org>
Subject: Re: [RFC] Create an audit record of USB specific details

O
>
> If you want a place in the kernel to add audit records for all devices
> added to or removed from the system, the right place to do it is in
> drivers/base/core.c, the device_add() and device_del() routines.
> That's where the ADD and REMOVE uevents are created.
>
> Alan Stern

I agree with you on this.  The device_add and device_del functions
use notification chains
similar to how the USB subsystem can notify subscribers that new
devices have been added.

This was my initial implementation, USB already uses notification
chains for its device add/remove.

Thanks,

Wade Mealing.