lkml.org 
[lkml]   [2008]   [Aug]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforonaccess scanning
    On Tue, 5 Aug 2008 17:23:39 -0400
    "Press, Jonathan" <Jonathan.Press@ca.com> wrote:

    > -----Original Message-----
    > From: Greg KH [mailto:greg@kroah.com]
    > Sent: Tuesday, August 05, 2008 5:15 PM
    > To: Press, Jonathan
    > Cc: Theodore Tso; Arjan van de Ven; Eric Paris;
    > linux-kernel@vger.kernel.org; malware-list@lists.printk.net;
    > linux-security-module@vger.kernel.org
    > Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to
    > alinuxinterfaceforonaccess scanning
    >
    > On Tue, Aug 05, 2008 at 04:37:42PM -0400, Press, Jonathan wrote:
    > >
    > > [JON PRESS] I don't get the connection between what I said and your
    > > point about not needing blocking open() interface. If I ftp into a
    > > Linux machine and GET an infected file, you want FTP to go right
    > > ahead and read it and send it to me over the wire?
    >
    > Shouldn't that be the issue of the FTP server itself not serving up
    > "invalid" files, and not the kernel? Why not just hook in it, I'm
    > pretty sure they already provide this kind of interface, right?
    >
    >
    > [JON PRESS] So how would that work?

    the admin (or distro) decides he wants all files opened by the FTP
    server scanned, so he starts the FTP server with the LD_PRELOAD set.



    --
    If you want to reach me at my work email, use arjan@linux.intel.com
    For development, discussion and tips for power savings,
    visit http://www.lesswatts.org


    \
     
     \ /
      Last update: 2008-08-05 23:45    [W:2.868 / U:0.120 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site