But Pavel is raising a good question. In Eric's proposed threat
model, he claimed the only thing that he was trying to solve was
"scanning". Just file scanning. That implies no root privileges, but
it also implied that he wasn't worried about malware running with user
privileges, either. Presumbly, that would be caught and stopped by
the file scanner before the malware had a chance to run; that is the
execve(2) system call would also be blocked until the executable was
scanned.
So if that is the threat model, then the only thing libmalware.so
doesn't solve is knfsd access, and it should be evaluated on that
basis. If the threat model *does* include malware which is **not**
caught by the AV scanner, and is running with user privileges, then
there are a whole host of other attacks that we have to worry about.
So let's be real clear, up front, what the threat model is, and avoid
changing the model around to rule out solutions that don't fit the
initially preconceived one. That's how you get to the TSA
confiscating water bottles in airport security lines.
No, I'm not claiming to protect against running processes. I'll leave
that for SELinux.
I haven't seen this supposed libmalware.so so take anything I say with a
grain of sand. But I take it that the solutions to the problems are
'don't do that.'
aka malware is allowed to flow freely across linux nfs servers. Great,
I'm sure corperate IT organizations are going to love knowing there
isn't a darn thing they can do to protect their nfs server from being
storage grounds other than hope they can control all of the border.
And I still don't get this 'mmap problem' that I don't solve that
libmalware magically solves. What? don't use mmap? I certainly hope
not.
Are we seriously considering that the right thing to do is to try to
push malware scanning to every project on sourceforge? At least putting
a solution inside glibc wasn't completely insane, I just think for
numerous reasons we've seen on list for the last 2 weeks not a better
idea. In any case, having an application have to make special calls to
handle 'untrusted' data is basically like turning the keys to the castle
over on every exploit. No, I might not make promises about subverted
applications, but that doesn't mean I have to just open all the doors.
And anything that requires explicit application help is just that. Talk
about theater.