linux-kernel - Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interface for on access scanning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080807113047.5cf7fe54@lxorguk.ukuu.org.uk>
Date:	Thu, 7 Aug 2008 11:30:47 +0100
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	James Morris <jmorris@...ei.org>
Cc:	David Wagner <daw@...berkeley.edu>, linux-kernel@...r.kernel.org
Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interface for
 on access scanning

> In any case, the above relates to Windows desktops -- we are yet to see 
> a rationale for adding AV support to the Linux kernel.

s/we/you/

Clearly some people do see a rationale. At least some parts of it also
seem to make sense for picking up stuff in transit and for catching stuff
'in flight' between systems that might be more vulnerable.

It does appear possible to create a meaningful set of functionality for a
subset of the problem space - assuming no local compromise.

	- open for write causes some kind of state transition (even
SELinux label change)
	- last close notifies a userspace tool of some form (be it an
indexer or a scanner or whatever)
	- tool may or may not take some kind of action such as
relabelling.

At that point you can use selinux rules to say things like 'samba cannot
access content in 'change-in-progress' state.

Whether you allow opens to block for a scan really comes down to a risk
tradeoff. The "safe" approach is 'sorry someone has it open for writing
go away'. The lax approach is "yeah whatever, we may be unlucky if
something passes across our file server at the right moment" (allowing
anyone to read change-in-progress files) and somewhere in between is the
"wait a moment while I scan it" case, which reduces the time window of
attack considerably with a very high chance of detection if the attacker
gets it wrong).

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/