Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933856AbcDEWSB (ORCPT ); Tue, 5 Apr 2016 18:18:01 -0400 Received: from mail-wm0-f48.google.com ([74.125.82.48]:36516 "EHLO mail-wm0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933837AbcDEWR7 (ORCPT ); Tue, 5 Apr 2016 18:17:59 -0400 MIME-Version: 1.0 In-Reply-To: References: Date: Wed, 6 Apr 2016 08:17:56 +1000 Message-ID: Subject: Re: [RFC] Create an audit record of USB specific details From: Wade Mealing To: Alan Stern Cc: =?UTF-8?Q?Bj=C3=B8rn_Mork?= , Oliver Neukum , linux-audit@redhat.com, linux-kernel@vger.kernel.org, linux-usb Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 591 Lines: 20 O > > If you want a place in the kernel to add audit records for all devices > added to or removed from the system, the right place to do it is in > drivers/base/core.c, the device_add() and device_del() routines. > That's where the ADD and REMOVE uevents are created. > > Alan Stern I agree with you on this. The device_add and device_del functions use notification chains similar to how the USB subsystem can notify subscribers that new devices have been added. This was my initial implementation, USB already uses notification chains for its device add/remove. Thanks, Wade Mealing.