Messages in this thread | | | Subject | Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interfaceforon access scanning | From | Eric Paris <> | Date | Tue, 05 Aug 2008 21:55:19 -0400 |
| |
On Tue, 2008-08-05 at 20:30 -0400, Rik van Riel wrote: > On Tue, 05 Aug 2008 14:39:34 -0400 > Eric Paris <eparis@redhat.com> wrote: > > On Tue, 2008-08-05 at 11:27 -0700, Arjan van de Ven wrote: > > > > but close is... very limited in value. Open is a discrete event > > > traditionally associated withh permission checks. > > > Close... not so. (And if you mmap memory, you can then close the file > > > and still write to it via the mmap) > > > > Thankfully my implementation will invalidate that close time check and > > caching result. It does the invalidating the same place we update mtime > > and my understanding is that mmap has been updating mtime for quite a > > while now. > > Then isn't the close time check superfluous, since you do the > checks at change time already?
In the patches I posted, "checks" are done at open and close if the result is not already in the cache. Every write invalidates the cache and thus the next open/close will do a "check."
So the longer a process keeps a file open the longer it is susceptible to "unclean" data existing in that file.
| |