Messages in this thread | | | Date | Tue, 5 Aug 2008 21:12:43 +0100 | From | Alan Cox <> | Subject | Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interfaceforon access scanning |
| |
> > Scripts > > get either opened or exec'd... > > (ignoring stdin-fed scripts right now.. but that's a problem regardless)
Don't forget pty/tty pairs, ioctls to type chars etc
> > Attempts to screen content > > can you explain?
One common use for scanning is to scan content not looking for executable stuff but for things like malformed image files and the like. It's also useful for indexing and in those cases you don't really want ld.so in the way.
> > Exec occuring after ld.so is compromised > > this is post-compromise scenario; if you have enough root rights to do > that then it's game over.
You still want to know if you spot this. And the root rights thing assumes no selinux. For a large case of uses I would agree however.
Alan
| |