Messages in this thread | | | Date | Tue, 5 Aug 2008 14:42:08 -0700 | From | Arjan van de Ven <> | Subject | Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforonaccess scanning |
| |
On Tue, 5 Aug 2008 17:23:39 -0400 "Press, Jonathan" <Jonathan.Press@ca.com> wrote:
> -----Original Message----- > From: Greg KH [mailto:greg@kroah.com] > Sent: Tuesday, August 05, 2008 5:15 PM > To: Press, Jonathan > Cc: Theodore Tso; Arjan van de Ven; Eric Paris; > linux-kernel@vger.kernel.org; malware-list@lists.printk.net; > linux-security-module@vger.kernel.org > Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to > alinuxinterfaceforonaccess scanning > > On Tue, Aug 05, 2008 at 04:37:42PM -0400, Press, Jonathan wrote: > > > > [JON PRESS] I don't get the connection between what I said and your > > point about not needing blocking open() interface. If I ftp into a > > Linux machine and GET an infected file, you want FTP to go right > > ahead and read it and send it to me over the wire? > > Shouldn't that be the issue of the FTP server itself not serving up > "invalid" files, and not the kernel? Why not just hook in it, I'm > pretty sure they already provide this kind of interface, right? > > > [JON PRESS] So how would that work?
the admin (or distro) decides he wants all files opened by the FTP server scanned, so he starts the FTP server with the LD_PRELOAD set.
-- If you want to reach me at my work email, use arjan@linux.intel.com For development, discussion and tips for power savings, visit http://www.lesswatts.org
| |