Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759258AbcDEPgF (ORCPT ); Tue, 5 Apr 2016 11:36:05 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:36124 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758631AbcDEPgC (ORCPT ); Tue, 5 Apr 2016 11:36:02 -0400 Date: Tue, 5 Apr 2016 11:35:59 -0400 From: Greg KH To: "Boyce, Kevin P (AS)" Cc: Wade Mealing , =?iso-8859-1?Q?Bj=F8rn?= Mork , Oliver Neukum , "linux-kernel@vger.kernel.org" , linux-usb , "linux-audit@redhat.com" Subject: Re: EXT :Re: [RFC] Create an audit record of USB specific details Message-ID: <20160405153559.GB2647@kroah.com> References: <1459742562-22803-1-git-send-email-wmail@redhat.com> <1459752519.24025.5.camel@suse.com> <87bn5pzuh1.fsf@nemi.mork.no> <889498a2eca043d5af1fe23ffb574284@XCGVAG30.northgrum.com> <20160405134632.GC31313@kroah.com> <6bdd24ee68e64e4e91fa160940d357ed@XCGVAG30.northgrum.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6bdd24ee68e64e4e91fa160940d357ed@XCGVAG30.northgrum.com> User-Agent: Mutt/1.6.0 (2016-04-01) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 675 Lines: 19 On Tue, Apr 05, 2016 at 01:52:40PM +0000, Boyce, Kevin P (AS) wrote: > Greg, > > > There is no "/proc/usb/" :) > > Sorry, maybe /sys/bus/usb/devices was what I was looking for... > > > The kernel calls mknod itself on devtmpfs, userspace doesn't do that anymore (hasn't for a long time). Do you get those audit events today? > > I'm not auditing those events myself. Just proposing ideas that might > produce the sort of information Wade was looking for. Ok, but watch out, lots of USB devices don't have a device node, they get accessed directly by userspace applications, using the kernel as a "raw" pass-through. It's not an easy problem, good luck all! greg k-h