Re: [RFC] Create an audit record of USB specific details

From: Wade Mealing
Date: Tue Apr 05 2016 - 18:18:04 EST


O
>
> If you want a place in the kernel to add audit records for all devices
> added to or removed from the system, the right place to do it is in
> drivers/base/core.c, the device_add() and device_del() routines.
> That's where the ADD and REMOVE uevents are created.
>
> Alan Stern

I agree with you on this. The device_add and device_del functions
use notification chains
similar to how the USB subsystem can notify subscribers that new
devices have been added.

This was my initial implementation, USB already uses notification
chains for its device add/remove.

Thanks,

Wade Mealing.