linux-kernel - Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interface for on access scanning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080806210202.GA9413@mit.edu>
Date:	Wed, 6 Aug 2008 17:02:02 -0400
From:	Theodore Tso <tytso@....edu>
To:	Eric Paris <eparis@...hat.com>
Cc:	Greg KH <greg@...ah.com>, Alan Cox <alan@...rguk.ukuu.org.uk>,
	malware-list@...ts.printk.net, linux-kernel@...r.kernel.org
Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interface
	for on access scanning

On Wed, Aug 06, 2008 at 02:49:57PM -0400, Eric Paris wrote:
> 
> This simple thread shows what I believe to be clear and compelling
> evidence of the need for an in kernel solution.  Lets just consider that
> we are a high input, high output, NFS file server with other OS's
> mounting this NFS share RW.
> 
> Our goal is to stop, or at least reduce the throughput (I clearly
> document and accept the open to read race, and until we get a working
> revoke I don't see that changing) of malware across the NFS server.
> This data will not be attacking the NFS server.  We wish to slow and
> hopefully halt the spread of this data with minimal impact to the NFS
> server.

In this scenario, are you positing that you are worried about Windows
malware, or Linux malware?  What OS are the clients running?  I will
note that Windows has such a sucky NFS implementation that nearly all
Widows clients will be running CIFS/SMB, not NFS --- so the right
solution there is to integrate the virus checking with Samba ---
especially since the one AV vendor has already admitted the actual
virus signature checking has to be done in userspace.

For Linux clients, one question that immediately rises is the
end-to-end argument.  Wouldn't be far better to run whatever security
solution on the client?  After all, a Virus checking on an NFS server
isn't going to help the user if they accidentally track in the virus
on a USB stick.  (Especially if it is an infected Macro virus in an
office document.)  

							- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/