Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758390AbcDERCw (ORCPT ); Tue, 5 Apr 2016 13:02:52 -0400 Received: from mx2.suse.de ([195.135.220.15]:36652 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756430AbcDERCv (ORCPT ); Tue, 5 Apr 2016 13:02:51 -0400 Message-ID: <1459875768.2892.1.camel@suse.com> Subject: Re: [RFC] Create an audit record of USB specific details From: Oliver Neukum To: Wade Mealing Cc: bjorn@mork.no, linux-audit@redhat.com, linux-kernel@vger.kernel.org, linux-usb Date: Tue, 05 Apr 2016 19:02:48 +0200 In-Reply-To: References: <1459742562-22803-1-git-send-email-wmail@redhat.com> <1459752519.24025.5.camel@suse.com> <87bn5pzuh1.fsf@nemi.mork.no> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.12.11 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 429 Lines: 12 On Tue, 2016-04-05 at 18:40 +1000, Wade Mealing wrote: > Consider the following scenario. Currently we have device drivers > that emit text via a printk request which is eventually picked up by > syslog like implementation (not the audit subsystem). We also have UEVENTs. The crucial question is why udevd feeding back events to the audit subsystem is inferior to the kernel itself generating audit events. Regards Oliver