Messages in this thread | | | Date | Mon, 18 Aug 2008 18:53:32 +0100 | From | Alan Cox <> | Subject | Re: [malware-list] scanner interface proposal was: [TALPA] Intro to a linux interface for on access scanning |
| |
> I suspect we're saying "on close" when what's really meant is > "opened for write". In the latter case, the notification would tell > the user-space program to watch for changes, possibly by something as > simple as doing a stat now and another when it gets around to
Or more precisely perhaps "on the file becoming dirty". A program that opens for write, computes for an hour and writes out doesn't want to load events down until it begins writing.
I agree "on close" is inaccurate for the scanner cases and that is why we've been talking about events + a close time event.
> deciding if it should scan the file. I see lots of room for > user-space alternatives for change detection, depending on how much > state it keeps. Rsync-like, perhaps?
Agreed.
| |