linux-kernel - Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforonaccess scanning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 5 Aug 2008 14:42:08 -0700
From:	Arjan van de Ven <arjan@...radead.org>
To:	"Press, Jonathan" <Jonathan.Press@...com>
Cc:	"Greg KH" <greg@...ah.com>, "Theodore Tso" <tytso@....edu>,
	"Eric Paris" <eparis@...hat.com>, <linux-kernel@...r.kernel.org>,
	<malware-list@...ts.printk.net>,
	<linux-security-module@...r.kernel.org>
Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to
 alinuxinterfaceforonaccess scanning

On Tue, 5 Aug 2008 17:23:39 -0400
"Press, Jonathan" <Jonathan.Press@...com> wrote:

> -----Original Message-----
> From: Greg KH [mailto:greg@...ah.com] 
> Sent: Tuesday, August 05, 2008 5:15 PM
> To: Press, Jonathan
> Cc: Theodore Tso; Arjan van de Ven; Eric Paris;
> linux-kernel@...r.kernel.org; malware-list@...ts.printk.net;
> linux-security-module@...r.kernel.org
> Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to
> alinuxinterfaceforonaccess scanning
> 
> On Tue, Aug 05, 2008 at 04:37:42PM -0400, Press, Jonathan wrote:
> > 
> > [JON PRESS]  I don't get the connection between what I said and your
> > point about not needing blocking open() interface.  If I ftp into a
> > Linux machine and GET an infected file, you want FTP to go right
> > ahead and read it and send it to me over the wire?
> 
> Shouldn't that be the issue of the FTP server itself not serving up
> "invalid" files, and not the kernel?  Why not just hook in it, I'm
> pretty sure they already provide this kind of interface, right?
> 
> 
> [JON PRESS]  So how would that work?  

the admin (or distro) decides he wants all files opened by the FTP
server scanned, so he starts the FTP server with the LD_PRELOAD set.



-- 
If you want to reach me at my work email, use arjan@...ux.intel.com
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/