Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758973AbcDENyP (ORCPT ); Tue, 5 Apr 2016 09:54:15 -0400 Received: from xspv0103.northgrum.com ([134.223.120.78]:40778 "EHLO xspv0103.northgrum.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753907AbcDENyO convert rfc822-to-8bit (ORCPT ); Tue, 5 Apr 2016 09:54:14 -0400 From: "Boyce, Kevin P (AS)" To: Greg KH CC: Wade Mealing , =?iso-8859-1?Q?Bj=F8rn_Mork?= , Oliver Neukum , "linux-kernel@vger.kernel.org" , linux-usb , "linux-audit@redhat.com" Subject: RE: EXT :Re: [RFC] Create an audit record of USB specific details Thread-Topic: EXT :Re: [RFC] Create an audit record of USB specific details Thread-Index: AQHRjnajr8CMeRZg9kWDTC+7Q34XI597ZGmA///fn3CAAHX8AP//rOgA Date: Tue, 5 Apr 2016 13:52:40 +0000 Message-ID: <6bdd24ee68e64e4e91fa160940d357ed@XCGVAG30.northgrum.com> References: <1459742562-22803-1-git-send-email-wmail@redhat.com> <1459752519.24025.5.camel@suse.com> <87bn5pzuh1.fsf@nemi.mork.no> <889498a2eca043d5af1fe23ffb574284@XCGVAG30.northgrum.com> <20160405134632.GC31313@kroah.com> In-Reply-To: <20160405134632.GC31313@kroah.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [134.223.82.114] Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7BIT MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 379 Lines: 11 Greg, > There is no "/proc/usb/" :) Sorry, maybe /sys/bus/usb/devices was what I was looking for... > The kernel calls mknod itself on devtmpfs, userspace doesn't do that anymore (hasn't for a long time). Do you get those audit events today? I'm not auditing those events myself. Just proposing ideas that might produce the sort of information Wade was looking for. kevin