linux-kernel - Re: TALPA - a threat model? well sorta.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 15 Aug 2008 12:07:48 +0200
From:	Helge Hafting <helge.hafting@...el.hist.no>
To:	Eric Paris <eparis@...hat.com>
CC:	Arjan van de Ven <arjan@...radead.org>,
	linux-kernel@...r.kernel.org, malware-list@...ts.printk.net,
	andi@...stfloor.org, riel@...hat.com, greg@...ah.com,
	tytso@....edu, viro@...IV.linux.org.uk, alan@...rguk.ukuu.org.uk,
	peterz@...radead.org, hch@...radead.org
Subject: Re: TALPA - a threat model?  well sorta.

It seems to me that this "scan on file open" business is the
wrong way to do things - because it reduces performance.

If you scan on file open, then your security sw is too late and
getting in the way.

It is better to scan in advance. Most machines has lots of idle time.
Use that time to scan in advance, and mark the files as "clean".

A "clean" file can be opened without further checking anytime - giving
normal high performance.  A file that gets written to becomes "dirty"
until checked again. Some mechanism for making a clean copy of a
clean file might help avoid excessive "dirtying".

"Scan on open" might still be useful for cases when the system
haven't kept up with writing, but please don't aim to have
this be the _primary_ mode of scanning. A file server
where most of the stuff is pre-scanned will likely perform much better
than  one scanning everything on open.

Helge Hafting
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/