linux-kernel - Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforonaccess scanning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080805214517.GI28946@ZenIV.linux.org.uk>
Date:	Tue, 5 Aug 2008 22:45:17 +0100
From:	Al Viro <viro@...IV.linux.org.uk>
To:	"Press, Jonathan" <Jonathan.Press@...com>
Cc:	Greg KH <greg@...ah.com>, Theodore Tso <tytso@....edu>,
	Arjan van de Ven <arjan@...radead.org>,
	Eric Paris <eparis@...hat.com>, linux-kernel@...r.kernel.org,
	malware-list@...ts.printk.net,
	linux-security-module@...r.kernel.org
Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to
	alinuxinterfaceforonaccess scanning

On Tue, Aug 05, 2008 at 05:23:39PM -0400, Press, Jonathan wrote:

> [JON PRESS]  So how would that work?  The FTP server would have code
> that called into someone's AV SDK (maybe CA's, maybe not) and scanned
> the file before sending.  OK.  What about all the thousands of other
> applications that might access a file and send it somewhere, or copy it
> somewhere.  They should all do the same thing, right?  How do we make
> that happen?  That's the whole point of centralizing the control (the
> notification, blocking and waiting -- not the actual scanning, of
> course) in the kernel.  The scan becomes unavoidable -- and that is the
> definition (OK, a definition) of true security.

Give me a break...  There's nothing to stop you from doing that as
a stackable fs, cachefs-based filesystem, fuse-based filesystem,
CODA with trimmed-down server that does scan-on-commit, et sodding cetera.

Again, do you or do you not expect the malware to be active on scanning
host?  Yes or no, please.

These two variants are so fundamentally different that discussion without
clearly indicating which variant you are currently talking about is absolutely
pointless.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/