linux-kernel - Re: [RFC 0/5] [TALPA] Intro to a linux interface for on access scanning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 4 Aug 2008 20:46:11 -0700
From:	Greg KH <greg@...ah.com>
To:	Cliffe <cliffe@...net>
Cc:	Casey Schaufler <casey@...aufler-ca.com>,
	Eric Paris <eparis@...hat.com>, malware-list@...ts.printk.net,
	linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org
Subject: Re: [RFC 0/5] [TALPA] Intro to a linux interface for on access
	scanning

On Tue, Aug 05, 2008 at 11:01:59AM +0800, Cliffe wrote:
> If we had stackable LSMs then the required functionality could simply be 
> built into the LSM interface. Then the anti-malware would simply stack 
> itself with other LSMs.

Could it really?  How would such an interface work?

Remember, the big issue here isn't the kernel "hooks", but the fact that
a lot of people are yet to be convinced that something like this needs
to be within the kernel itself.

Perhaps we should dig up the proposals for the filesystem-notify type
patches, something like that might be all the majority of the virus
people need, as they want to just scan things for Windows viruses, not
Linux ones, and to do so "lazily" might be sufficient.

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/