Skip to content

Extend audit detail via new key attribute in rule language. Add support for auditing implicit policy matches.#692

Open
aje220 wants to merge 2 commits intoUSBGuard:mainfrom
aje220:feature/keys
Open

Extend audit detail via new key attribute in rule language. Add support for auditing implicit policy matches.#692
aje220 wants to merge 2 commits intoUSBGuard:mainfrom
aje220:feature/keys

Conversation

@aje220
Copy link
Copy Markdown

@aje220 aje220 commented Mar 30, 2026

Hello all

New features in this pull request:

  • A new rule language option that allows policy events to display the matched rule in audit logs
  • A new option in usbguard-daemon.conf that enables differentiation between implicit and explicit policy rule events (in audit logs)

By extending the rule language to allow an optional key, you can more easily audit systems to see which policy events are triggered by which rule.

Furthermore, if no rule exists at all, you can enable the new RuleSourceLogging option inside usbguard-daemon.conf, and differentiate between implicit and explicit policy rules.

Thank you
Alex

@aje220 aje220 changed the title A Extend audit detail via new key attribute in rule language. Add support for auditing implicit policy matches. Mar 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants