linux-kernel - Re: [malware-list] scanner interface proposal was: [TALPA] Intro to a linux interface for on access scanning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.1.10.0808181107320.15109@asgard.lang.hm>
Date:	Mon, 18 Aug 2008 11:09:31 -0700 (PDT)
From:	david@...g.hm
To:	Eric Paris <eparis@...hat.com>
cc:	tvrtko.ursulin@...hos.com, Theodore Tso <tytso@....edu>,
	davecb@....com, Adrian Bunk <bunk@...nel.org>,
	linux-kernel <linux-kernel@...r.kernel.org>,
	malware-list@...ts.printk.net,
	Casey Schaufler <casey@...aufler-ca.com>,
	Alan Cox <alan@...rguk.ukuu.org.uk>,
	Arjan van de Ven <arjan@...radead.org>
Subject: Re: [malware-list] scanner interface proposal was:	[TALPA]	Intro	to
 a linux interface for on access scanning

On Mon, 18 Aug 2008, Eric Paris wrote:

> On Mon, 2008-08-18 at 10:29 -0700, david@...g.hm wrote:
>> On Mon, 18 Aug 2008, Eric Paris wrote:
>>
>>> ******************************
>>>
>>> Great, how to build this interface.  THIS IS WHAT I ACTUALLY CARE ABOUT
>>>
>>> The communication with userspace has a very specific need.  The scanning
>>> process needs to get 'something' that will give it access to the
>>> original file/inode/data being worked on.  My previous patch set does
>>> this with a special securityfs file.  Scanners would block on 'read.'
>>> This block was waiting for something to be scanned and when available a
>>> dentry_open() was called in the context of the scanner for the inode in
>>> question.  This means that the fd in the scanner had to be the same data
>>> as the fd in the original process.
>>
>> having scanners access a file blocking on read won't work for multiple
>> scanners (unless you are going to create multiple files for them to read)
>
> WHAT?

if you have multiple things reading from a pipe only one will get any one 
message, right?

David Lang
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/