search

linux-audit / audit-kernel

GitHub mirror of the Linux Kernel's audit repository
https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git
Other
141 stars 37 forks source link

RFE: audit device attach/detach events #1

Open pcmoore opened 8 years ago

pcmoore commented 8 years ago

Hook the audit system into the Linux Kernel's device layer to capture and record device attach and detach events, also hook significant upper layers to capture notable metadata about the device, e.g. serial #, device and vendor IDs, etc.

The-Mule commented 7 years ago

Thanks for "Functional Testing and Verification" section in Feature Page Paul. USB disks are good examples of removable devices to trigger new events. Are there any other examples? Does it even make sense to try something else than USB disks (from what I see, events are generated from a layer which is transparent to any removable device - iow testing usb disks should be sufficient IMHO)?

pcmoore commented 7 years ago

Thanks for "Functional Testing and Verification" section in Feature Page Paul. USB disks are good examples of removable devices to trigger new events. Are there any other examples?

USB devices in general are probably the easiest to test due the hotplug nature of the bus. Besides USB storage devices, I think USB HID devices (e.g. keyboard, mouse, etc.) would be easy to test and a common case. UVC devices (e.g. webcams) would be another easy thing to test.

Does it even make sense to try something else than USB disks (from what I see, events are generated from a layer which is transparent to any removable device - iow testing usb disks should be sufficient IMHO)?

USB is likely to be the most important, but you are correct, this should catch any device, regardless of the underlying bus.

pcmoore commented 7 years ago

@wmealing it has been a while since we spoke about this, but if I remember correctly you were planning on continuing work on this, any progress you can report?

rgbriggs commented 4 years ago

Fedora rawhide issue tracker: https://bugzilla.redhat.com/show_bug.cgi?id=1210949

Upstream threads:

Other resources: