[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20080815120225.118d81da@lxorguk.ukuu.org.uk>
Date: Fri, 15 Aug 2008 12:02:25 +0100
From: Alan Cox <alan@...rguk.ukuu.org.uk>
To: rmeijer@...all.nl
Cc: capibara@...all.nl, david@...g.hm,
"Eric Paris" <eparis@...hat.com>, "Theodore Tso" <tytso@....edu>,
"Rik van Riel" <riel@...hat.com>, davecb@....com,
linux-security-module@...r.kernel.org,
"Adrian Bunk" <bunk@...nel.org>,
"Mihai Don??u" <mdontu@...defender.com>,
linux-kernel@...r.kernel.org, malware-list@...ts.printk.net,
"Pavel Machek" <pavel@...e.cz>,
"Arjan van de Ven" <arjan@...radead.org>
Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon
access scanning
> The package manager approach is interesting in that it marks 'trusted',
> and is thus permissive rather than restrictive. Maybe it would be possible
> to extend on this and simply define a set of currently unprivileged access
> as privileged for untrusted applications. That way you could allow
> untrusted software to run without risk, even if that untrusted software
> turns out to be malware. That is, it may be possible to solve the malware
> problem in a much more fundamental way here by just allowing malware to
> run without the need to know if it is malware, just by running untrusted
> software with reduced privileges.
>
Its called SELinux and SELinux can already do this sort of stuff,
including things like "only rpm may create files you are permitted to
execute"
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists