This BZ to track development of efforts to audit low level device attach/detach events; I anticipate the effort to be sub-divided into the following tasks: #1 Hook the device layer to trigger audit record generation for device attach and detach events #2 Develop a kernel audit API for device drivers to log driver/device specific metadata #3 Instrument the USB drivers to leverage the metadata logging API, other drivers can be instrumented as time permits #4 Update the audit userspace as needed to support the new audit record types
This is being tracked upstream via the following GitHub issue and feature page: * https://github.com/linux-audit/audit-kernel/issues/1 * https://github.com/linux-audit/audit-kernel/wiki/RFE-Device-Auditing