Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757037AbcDEBzM (ORCPT ); Mon, 4 Apr 2016 21:55:12 -0400 Received: from mail-wm0-f48.google.com ([74.125.82.48]:38283 "EHLO mail-wm0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754943AbcDEBzJ convert rfc822-to-8bit (ORCPT ); Mon, 4 Apr 2016 21:55:09 -0400 MIME-Version: 1.0 In-Reply-To: References: <1459742562-22803-1-git-send-email-wmail@redhat.com> <4430946.BXbQgWNMDe@x2> <20160404215422.GA26969@kroah.com> Date: Tue, 5 Apr 2016 11:54:07 +1000 Message-ID: Subject: Re: [RFC] Create an audit record of USB specific details From: Wade Mealing To: Greg KH Cc: Steve Grubb , linux-audit@redhat.com, linux-usb , linux-kernel@vger.kernel.org Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3727 Lines: 94 That is a good question, maybe I've been lucky in the devices that I have been testing with. Most of them seem to be ascii, my assumption was that shouldn't be a problem. The same encoding function used by the path audit_log_d_path, definitely audits UTF8 named files: # ausearch -i -f /tmp/test/권성주.txt type=PATH msg=audit(04/04/16 21:05:00.521:1638) : item=0 name=/tmp/권성주.txt inode=627534 dev=fd:00 mode=file,664 ouid=wmealing ogid=wmealing rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 objtype=NORMAL # ausearch -f /tmp/test/권성주.txt type=PATH msg=audit(1459818300.521:1638): item=0 name=2F746D702FEAB68CEC84B1ECA3BC2E747874 inode=627534 dev=fd:00 mode=0100664 ouid=1000 ogid=1000 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 objtype=NORMAL Thanks, Wade Mealing. On Tue, Apr 5, 2016 at 11:51 AM, Wade Mealing wrote: > That is a good question, maybe I've been lucky in the devices that I have > been testing with. Most of them seem to be ascii, my assumption was that > shouldn't be a problem. The same encoding function used by the path > audit_log_d_path, definitely audits UTF8 named files: > > # ausearch -i -f /tmp/test/권성주.txt > > type=PATH msg=audit(04/04/16 21:05:00.521:1638) : item=0 name=/tmp/권성주.txt > inode=627534 dev=fd:00 mode=file,664 ouid=wmealing ogid=wmealing rdev=00:00 > obj=unconfined_u:object_r:user_tmp_t:s0 objtype=NORMAL > > # ausearch -f /tmp/test/권성주.txt > > type=PATH msg=audit(1459818300.521:1638): item=0 > name=2F746D702FEAB68CEC84B1ECA3BC2E747874 inode=627534 dev=fd:00 > mode=0100664 ouid=1000 ogid=1000 rdev=00:00 > obj=unconfined_u:object_r:user_tmp_t:s0 objtype=NORMAL > > Thanks, > > Wade Mealing. > > On Tue, Apr 5, 2016 at 7:54 AM, Greg KH wrote: >> >> On Mon, Apr 04, 2016 at 05:37:01PM -0400, Steve Grubb wrote: >> > On Monday, April 04, 2016 12:02:42 AM wmealing wrote: >> > > I'm looking to create an audit trail for when devices are added or >> > > removed >> > > from the system. >> > > >> > > The audit subsystem is a logging subsystem in kernel space that can be >> > > used to create advanced filters on generated events. It has partnered >> > > userspace utilities ausearch, auditd, aureport, auditctl which work >> > > exclusively on audit records. >> > > >> > > These tools are able to set filters to "trigger" on specific in-kernel >> > > events specified by privileged users. While the userspace tools can >> > > create >> > > audit events these are not able to be handled intelligently >> > > (decoded,filtered or ignored) as kernel generated audit events are. >> > > >> > > I have this working at the moment with the USB subsystem (as an >> > > example). >> > > Its been suggested that I use systemd-udev however this means that the >> > > audit >> > > tools (ausearch) will not be able to index these records. >> > > >> > > Here is an example of picking out the AUDIT_DEVICE record type for >> > > example. >> > > >> > > > # ausearch -l -i -ts today -m AUDIT_DEVICE >> > > > ---- >> > > > type=AUDIT_DEVICE msg=audit(31/03/16 16:37:15.642:2) : action=add >> > > > manufacturer=Linux 4.4.0-ktest ehci_hcd product=EHCI Host Controller >> > > > serial=0000:00:06.7 major=189 minor=0 bus="usb" >> > >> > About this event's format...we can't have any spaces in the value side >> > of the >> > name=value fields unless its encoded as an untrusted string. You can >> > replace >> > spaces with an underscore or dash for readability. So, manufacturer and >> > product would need this treatment. >> >> What is the character encoding that audit messages can accept? Does it >> match up with the character encoding that USB strings are in? >> >> thanks, >> >> greg k-h > >