linux-kernel - RE: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforonaccess scanning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2629CC4E1D22A64593B02C43E855530304AE4ADC@USILMS12.ca.com>
Date:	Tue, 5 Aug 2008 17:23:39 -0400
From:	"Press, Jonathan" <Jonathan.Press@...com>
To:	"Greg KH" <greg@...ah.com>
Cc:	"Theodore Tso" <tytso@....edu>,
	"Arjan van de Ven" <arjan@...radead.org>,
	"Eric Paris" <eparis@...hat.com>, <linux-kernel@...r.kernel.org>,
	<malware-list@...ts.printk.net>,
	<linux-security-module@...r.kernel.org>
Subject: RE: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforonaccess scanning

-----Original Message-----
From: Greg KH [mailto:greg@...ah.com] 
Sent: Tuesday, August 05, 2008 5:15 PM
To: Press, Jonathan
Cc: Theodore Tso; Arjan van de Ven; Eric Paris;
linux-kernel@...r.kernel.org; malware-list@...ts.printk.net;
linux-security-module@...r.kernel.org
Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to
alinuxinterfaceforonaccess scanning

On Tue, Aug 05, 2008 at 04:37:42PM -0400, Press, Jonathan wrote:
> 
> [JON PRESS]  I don't get the connection between what I said and your
> point about not needing blocking open() interface.  If I ftp into a
> Linux machine and GET an infected file, you want FTP to go right ahead
> and read it and send it to me over the wire?

Shouldn't that be the issue of the FTP server itself not serving up
"invalid" files, and not the kernel?  Why not just hook in it, I'm
pretty sure they already provide this kind of interface, right?

[JON PRESS]  So how would that work?  The FTP server would have code
that called into someone's AV SDK (maybe CA's, maybe not) and scanned
the file before sending.  OK.  What about all the thousands of other
applications that might access a file and send it somewhere, or copy it
somewhere.  They should all do the same thing, right?  How do we make
that happen?  That's the whole point of centralizing the control (the
notification, blocking and waiting -- not the actual scanning, of
course) in the kernel.  The scan becomes unavoidable -- and that is the
definition (OK, a definition) of true security.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/