Messages in this thread | | | Date | Thu, 14 Aug 2008 20:41:34 -0700 | From | Arjan van de Ven <> | Subject | Re: [malware-list] TALPA - a threat model? well sorta. |
| |
On Thu, 14 Aug 2008 22:04:00 -0400 Theodore Tso <tytso@mit.edu> wrote:
> On Thu, Aug 14, 2008 at 06:44:33PM -0700, david@lang.hm wrote: > > could you do something like defining a namespace inside posix > > attributes and then setting up a mechanism in the kernel to alert > > if the attributes change (with the entire namespace getting cleared > > if the file gets dirtied)? > > According to Eric Paris the clean/dirty state is only stored in > memory. We could use the extended attribute interface as a way of not > defining a new system call, or some other interface, but I'm not sure > it's such a great match given that the extended attributes interface > are designed for persistent data. > > I agree that doesn't actually work very well for the tracker use case, > where you the clean/dirty bit to be persistent (in case the tracker is > disabled due to the fact you are running on battery, for example, and > then you reboot). >
but we need a "give me all dirty files" solution, not a "is this file dirty" solution.
I do not want a virus scanner to constantly have to poll the whole fs for dirty files ;-)
-- If you want to reach me at my work email, use arjan@linux.intel.com For development, discussion and tips for power savings, visit http://www.lesswatts.org
| |