linux-kernel - Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interfaceforon access scanning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LRH.1.10.0808061023230.7716@tundra.namei.org>
Date:	Wed, 6 Aug 2008 10:53:06 +1000 (EST)
From:	jmorris@...ei.org
To:	Rik van Riel <riel@...hat.com>
cc:	"Press, Jonathan" <Jonathan.Press@...com>,
	Arjan van de Ven <arjan@...radead.org>,
	Eric Paris <eparis@...hat.com>, Greg KH <greg@...ah.com>,
	linux-kernel@...r.kernel.org, malware-list@...ts.printk.net,
	linux-security-module@...r.kernel.org
Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interfaceforon
 access scanning

On Tue, 5 Aug 2008, Rik van Riel wrote:

> What exactly are the threat models you want to protect against?
> 
> Once we have the answer to that question, we can figure out
> whether the current patch set addresses the threat model or
> whether alternate approaches are needed.

Alas, we've been here before.

http://article.gmane.org/gmane.linux.kernel/608634

  On Thu, 29 Nov 2007, Al Viro wrote:

  > Incidentally, I would really love to see the threat profile we are 
  > talking about.  

  Exactly.

  Please come up with a set of requirements that can be reviewed by the 
  core kernel folk, and perhaps then focus on how to meet those requirements
  once they have been accepted.

To be very clear, so we don't waste any _more_ time and effort on this: 

The anti-malware folk need to first provide a clearly understandable and 
complete description of the problem including a characterization of the 
threat.

The next step is to propose a design which addresses the problem, and to 
clearly and completely demonstrate how it does so.

Only then will it be possible to conduct an informed discussion on the 
underlying case for malware scanning and its possible implementation.

- James
-- 
James Morris
<jmorris@...ei.org>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/