Re: [RFC] Create an audit record of USB specific details
O
If you want a place in the kernel to add audit records for all devices
added to or removed from the system, the right place to do it is in
drivers/base/core.c, the device_add() and device_del() routines.
That's where the ADD and REMOVE uevents are created.
Alan Stern
I agree with you on this. The device_add and device_del functions
use notification chains
similar to how the USB subsystem can notify subscribers that new
devices have been added.
This was my initial implementation, USB already uses notification
chains for its device add/remove.
Thanks,
Wade Mealing.