linux-kernel - Re: [malware-list] scanner interface proposal was: [TALPA] Intro to a linux interface for on access scanning (fwd)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20080818103126.3461C2FE848@pmx1.sophos.com>
Date:	Mon, 18 Aug 2008 11:30:23 +0100
From:	tvrtko.ursulin@...hos.com
To:	david@...g.hm
Cc:	Alan Cox <alan@...rguk.ukuu.org.uk>,
	Arjan van de Ven <arjan@...radead.org>,
	Adrian Bunk <bunk@...nel.org>, capibara@...all.nl,
	Casey Schaufler <casey@...aufler-ca.com>, davecb@....com,
	Eric Paris <eparis@...hat.com>,
	linux-kernel <linux-kernel@...r.kernel.org>,
	linux-security-module@...r.kernel.org,
	malware-list@...ts.printk.net,
	malware-list-bounces@...sg.printk.net,
	Mihai Don??u <mdontu@...defender.com>,
	Peter Dolding <oiaohm@...il.com>, Pavel Machek <pavel@...e.cz>,
	Rik van Riel <riel@...hat.com>, rmeijer@...all.nl,
	Theodore Tso <tytso@....edu>
Subject: Re: [malware-list] scanner interface proposal was: [TALPA] Intro to a linux
 interface for on access scanning (fwd)

David Lang wrote on 18/08/2008 02:25:44:

> what is not covered by this design that is covered by the threat model 
being 
> proposed?
> 
> what did I over complicate in this design? or is it the minimum feature 
set 
> needed?
> 
> are any of the features I list impossible to implement?

One more thing - this proposal does not work where there are no extended 
attributes (whether at all or they are disabled at mount time). I think 
that is a serious flaw or at least disadvantage compared to the posted 
implementation.

--
Tvrtko A. Ursulin
Senior Software Engineer, Sophos

"Views and opinions expressed in this email are strictly those of the 
author.
 The contents has not been reviewed or approved by Sophos."
 

Sophos Plc, The Pentagon, Abingdon Science Park, Abingdon,
OX14 3YP, United Kingdom.

Company Reg No 2096520. VAT Reg No GB 348 3873 20.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/