Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756676AbcDECrR (ORCPT ); Mon, 4 Apr 2016 22:47:17 -0400 Received: from out5-smtp.messagingengine.com ([66.111.4.29]:38974 "EHLO out5-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753718AbcDECrP (ORCPT ); Mon, 4 Apr 2016 22:47:15 -0400 X-Sasl-enc: GiRphzI4vGzEPGg6pmM5ROjrXHneE2d5U+Jrh9/U0Eem 1459824433 Date: Mon, 4 Apr 2016 19:47:04 -0700 From: Greg KH To: Wade Mealing Cc: Steve Grubb , linux-audit@redhat.com, linux-usb , linux-kernel@vger.kernel.org Subject: Re: [RFC] Create an audit record of USB specific details Message-ID: <20160405024704.GD13306@kroah.com> References: <1459742562-22803-1-git-send-email-wmail@redhat.com> <4430946.BXbQgWNMDe@x2> <20160404215422.GA26969@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.6.0 (2016-04-01) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1202 Lines: 28 On Tue, Apr 05, 2016 at 11:54:07AM +1000, Wade Mealing wrote: > That is a good question, maybe I've been lucky in the devices that I have > been testing with. Most of them seem to be ascii, my assumption was that > shouldn't be a problem. The same encoding function used by the path > audit_log_d_path, definitely audits UTF8 named files: > > # ausearch -i -f /tmp/test/권성주.txt Please look at the USB spec to see the encoding that USB strings are in. They are in UTF-16LE, but we do some manipulation of them in the call to usb_string() to make them semi-readable by the kernel. But, as we aren't doing anything important with these, except printing them out for people to lovingly gaze at, that's just fine. But if you need to do policy decisions based on them, well, you better use the "real" version of the string, otherwise you could run into major problems. But again, please step back, what are the requirements here that you are doing this work for? If it's just for fun, wonderful, but please say so when you post the patches so we don't take them seriously. Well, I'm not taking them seriously now as obviously they will not work, so I guess all is fine :) thanks, greg k-h