Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon access scanning

[Alan Cox]

> The package manager approach is interesting in that it marks 'trusted',
> and is thus permissive rather than restrictive. Maybe it would be possible
> to extend on this and simply define a set of currently unprivileged access
> as privileged for untrusted applications. That way you could allow
> untrusted software to run without risk, even if that untrusted software
> turns out to be malware. That is, it may be possible to solve the malware
> problem in a much more fundamental way here by just allowing malware to
> run without the need to know if it is malware, just by running untrusted
> software with reduced privileges.
> 

Its called SELinux and SELinux can already do this sort of stuff,
including things like "only rpm may create files you are permitted to
execute"
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/