Messages in this thread | | | Subject | RE: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon access scanning | Date | Tue, 5 Aug 2008 16:37:42 -0400 | From | "Press, Jonathan" <> |
| |
-----Original Message----- From: Theodore Tso [mailto:tytso@mit.edu] Sent: Tuesday, August 05, 2008 2:55 PM To: Press, Jonathan Cc: Greg KH; Arjan van de Ven; Eric Paris; linux-kernel@vger.kernel.org; malware-list@lists.printk.net; linux-security-module@vger.kernel.org Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon access scanning
On Tue, Aug 05, 2008 at 02:38:23PM -0400, Press, Jonathan wrote: > Is your point that Linux and Unix machines are less vulnerable to > viruses? If so, that's not relevant to my point at all. A Unix machine > can be a carrier, passing infections on to other vulnerable platforms > (guess which one). An enterprise security system sees the entire > enterprise as an integrated whole -- not just individual machines with > their own separate attributes and no impact on each other at all.
Sure, but if that's the case, you don't need to have a blocking open() interface. Having inotify tell your application that a file descriptor that had been opened for writing has been closed (IN_CLOSE_WRITE) should be quite sufficient.
[JON PRESS] I don't get the connection between what I said and your point about not needing blocking open() interface. If I ftp into a Linux machine and GET an infected file, you want FTP to go right ahead and read it and send it to me over the wire?
| |