Messages in this thread | | | Subject | RE: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforonaccess scanning | Date | Tue, 5 Aug 2008 17:23:39 -0400 | From | "Press, Jonathan" <> |
| |
-----Original Message----- From: Greg KH [mailto:greg@kroah.com] Sent: Tuesday, August 05, 2008 5:15 PM To: Press, Jonathan Cc: Theodore Tso; Arjan van de Ven; Eric Paris; linux-kernel@vger.kernel.org; malware-list@lists.printk.net; linux-security-module@vger.kernel.org Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforonaccess scanning
On Tue, Aug 05, 2008 at 04:37:42PM -0400, Press, Jonathan wrote: > > [JON PRESS] I don't get the connection between what I said and your > point about not needing blocking open() interface. If I ftp into a > Linux machine and GET an infected file, you want FTP to go right ahead > and read it and send it to me over the wire?
Shouldn't that be the issue of the FTP server itself not serving up "invalid" files, and not the kernel? Why not just hook in it, I'm pretty sure they already provide this kind of interface, right?
[JON PRESS] So how would that work? The FTP server would have code that called into someone's AV SDK (maybe CA's, maybe not) and scanned the file before sending. OK. What about all the thousands of other applications that might access a file and send it somewhere, or copy it somewhere. They should all do the same thing, right? How do we make that happen? That's the whole point of centralizing the control (the notification, blocking and waiting -- not the actual scanning, of course) in the kernel. The scan becomes unavoidable -- and that is the definition (OK, a definition) of true security.
| |