lkml.org 
[lkml]   [2008]   [Aug]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRE: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interfaceforon access scanning
    Date
    From
    You're right...I am not talking about blocking at all -- which may be a
    further indication that I am missing the specific point of this thread.

    But be that as it may... I don't want to have to use more than one
    interface to get all the events I am interested in. I want to register
    as a client and listen, and get everything I need from the same place.


    Also, it seems to me that for my purposes, close is discrete enough. It
    tells me that there is now something out there that should be looked at.


    Jon



    -----Original Message-----
    From: Arjan van de Ven [mailto:arjan@infradead.org]
    Sent: Tuesday, August 05, 2008 2:28 PM
    To: Press, Jonathan
    Cc: Eric Paris; Greg KH; linux-kernel@vger.kernel.org;
    malware-list@lists.printk.net; linux-security-module@vger.kernel.org
    Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux
    interfaceforon access scanning

    On Tue, 5 Aug 2008 14:04:26 -0400
    "Press, Jonathan" <Jonathan.Press@ca.com> wrote:

    >
    > However, I want to point out that scanning on close is still an
    > integral part of AV protection, even if intercepting opens and execs
    > theoretically catches everything.


    but close is... very limited in value. Open is a discrete event
    traditionally associated withh permission checks.
    Close... not so. (And if you mmap memory, you can then close the file
    and still write to it via the mmap)

    Lets ask it differently: what will you do if you find something nasty?
    You can't fail the close... so why block for it?
    And if you don't block for it... all you would need is an asynchronous
    notification... something like... inotify



    \
     
     \ /
      Last update: 2008-08-05 20:37    [W:3.811 / U:0.172 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site