linux-kernel - Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon access scanning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080816102846.37b104a7@lxorguk.ukuu.org.uk>
Date:	Sat, 16 Aug 2008 10:28:46 +0100
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	david@...g.hm
Cc:	Arjan van de Ven <arjan@...radead.org>,
	Peter Dolding <oiaohm@...il.com>, rmeijer@...all.nl,
	capibara@...all.nl, Eric Paris <eparis@...hat.com>,
	Theodore Tso <tytso@....edu>, Rik van Riel <riel@...hat.com>,
	davecb@....com, linux-security-module@...r.kernel.org,
	Adrian Bunk <bunk@...nel.org>,
	Mihai Don??u <mdontu@...defender.com>,
	linux-kernel@...r.kernel.org, malware-list@...ts.printk.net,
	Pavel Machek <pavel@...e.cz>
Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon
 access scanning

> I really think that we need to avoid trying to have a single 'known good' 
> flag/generationnrwith the inode.

I don't think we should have anything in the inode. We don't want to
bloat inode objects for this cornercase.

> if you store generation numbers for individual apps (in posix attributes 
> to pick something that could be available across a variety of 
> filesystems), you push this policy decision into userspace (where it

Agreed
 
> 1. define a tag namespace associated with the file that is reserved for 
> this purpose for example "scanned-by-*"

What controls somewhat writing such a tag on media remotely ? Locally you
can do this (although you are way too specialized in design - an LSM hook
for controlling tag setting or a general tag reservation sysfs interface
is more flexible than thinking just about scanners.

> 2. have an kernel option that will clear out this namespace whenever a 
> file is dirtied

That will generate enormous amounts of load if not carefully handled.

> 3. have a kernel mechanism to say "set this namespace tag if this other 
> namespace tag is set" (this allows a scanner to set a 'scanning' tag when 
> it starts and only set the 'blessed' tag if the file was not dirtied while 

User space problem. Set flags 'dirty', then set bit 'scanning'
clear 'dirty' then clear 'scanning' when finished. If the dirty flag got
set while you were scanning it will still be set now you've cleared you
scanning flag. Your access policy depends upon your level of paranoia (eg
"dirty|scanning == BAD")

> programs can set the "scanned-by-*" flags on that the 'libmalware' library 

We've already proved libmalware doesn't make sense

> L. the fact that knfsd would not use this can be worked around by running 
> FUSE (which would do the checks) and then exporting the result via knfsdw

Not if you want to get any work done.

> what did I over complicate in this design? or is it the minimum feature 
> set needed?
> 
> are any of the features I list impossible to implement?

Go write it and see, provide benchmarks ?  I don't see from this how you
handled shared mmap ?


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/