[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20080818122003.4ACC02FE864@pmx1.sophos.com>
Date: Mon, 18 Aug 2008 13:18:58 +0100
From: tvrtko.ursulin@...hos.com
To: david@...g.hm
Cc: Alan Cox <alan@...rguk.ukuu.org.uk>,
Arjan van de Ven <arjan@...radead.org>,
Adrian Bunk <bunk@...nel.org>, capibara@...all.nl,
Casey Schaufler <casey@...aufler-ca.com>, davecb@....com,
Eric Paris <eparis@...hat.com>,
linux-kernel <linux-kernel@...r.kernel.org>,
linux-security-module@...r.kernel.org,
malware-list@...ts.printk.net,
malware-list-bounces@...sg.printk.net,
Mihai Don??u <mdontu@...defender.com>,
Peter Dolding <oiaohm@...il.com>, Pavel Machek <pavel@...e.cz>,
Rik van Riel <riel@...hat.com>, rmeijer@...all.nl,
Theodore Tso <tytso@....edu>
Subject: Re: [malware-list] scanner interface proposal was: [TALPA] Intro to a linux
interface for on access scanning (fwd)
david@...g.hm wrote on 18/08/2008 12:44:12:
> On Mon, 18 Aug 2008, tvrtko.ursulin@...hos.com wrote:
>
> > David Lang wrote on 18/08/2008 02:25:44:
> >
> >> what is not covered by this design that is covered by the threat
model
> > being
> >> proposed?
> >>
> >> what did I over complicate in this design? or is it the minimum
feature
> > set
> >> needed?
> >>
> >> are any of the features I list impossible to implement?
> >
> > One more thing - this proposal does not work where there are no
extended
> > attributes (whether at all or they are disabled at mount time). I
think
> > that is a serious flaw or at least disadvantage compared to the posted
> > implementation.
>
> good point. I should have listed that.
>
> I don't see it as a serious flaw, people who care about this feature can
> just pick an appropriate filesystem to use.
You mostly cannot pick not use vfat, isofs and udf.
> but if extended attributes are not found a strict implementation could
> fall back to scanning on every file access (the extended attributes are
> being used to cache the results of the scans)
Performance impact may or may not be acceptable but I dislike the concept
of core security interface which is not really core.
--
Tvrtko A. Ursulin
Senior Software Engineer, Sophos
"Views and opinions expressed in this email are strictly those of the
author.
The contents has not been reviewed or approved by Sophos."
Sophos Plc, The Pentagon, Abingdon Science Park, Abingdon,
OX14 3YP, United Kingdom.
Company Reg No 2096520. VAT Reg No GB 348 3873 20.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists