linux-kernel - Re: [malware-list] [RFC 0/5] [TALPA] Intro toalinuxinterfaceforonaccess scanning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080805204600.03ceca31@bree.surriel.com>
Date:	Tue, 5 Aug 2008 20:46:00 -0400
From:	Rik van Riel <riel@...hat.com>
To:	Eric Paris <eparis@...hat.com>
Cc:	Greg KH <greg@...ah.com>, Al Viro <viro@...IV.linux.org.uk>,
	"Press, Jonathan" <Jonathan.Press@...com>,
	Theodore Tso <tytso@....edu>,
	Arjan van de Ven <arjan@...radead.org>,
	linux-kernel@...r.kernel.org, malware-list@...ts.printk.net,
	linux-security-module@...r.kernel.org
Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro
 toalinuxinterfaceforonaccess scanning

On Tue, 05 Aug 2008 20:25:29 -0400
Eric Paris <eparis@...hat.com> wrote:

> I don't think its hiding, I'm attempting to bring these companies who
> just don't understand how to work in public

That's not my worry.

My real worry is that the anti-virus companies have been working
with an enforcement policy that has been evolving slowly from the
DOS days, while today's threat model has changed considerably.

I do not see how the proposed hooks would close off a system
sufficiently to claim anything approaching security.

The way forward is to:
1) define a threat model
2) figure out what infrastructure is needed for protection
3) come up with interfaces that also help other software
   (eg. file range inotify to help disk indexing software)

Trying to shoe-horn the DOS anti-virus security model into a
multi-user operating system with networking may not be sufficient
protection for today's world.  Eg. it does not protect against
script virusses fetched off web sites and executed directly in
a browser, office suite or any gnome-vfs enabled program. This
is a major vulnerability in modern systems.

What problem are we really trying to solve?

Which problems are out of scope?

What infrastructure can solve the problem, while being useful 
for other things too?

-- 
All rights reversed.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/