Re: [malware-list] scanner interface proposal was: [TALPA] Intro toa linux interface for on access scanning
From: Alan Cox
Date: Mon Aug 18 2008 - 12:33:17 EST
> On async notification we fire a message to everything that registered
> 'simultaneously.' On blocking we fire a message to everything in
> priority order and block until we get a response. That response should
> be of the form ALLOW/DENY and should include "mark result"/"don't mark
> result."
No can do - you get stuck with recursive events with the virus checker
trying to stop the indexer from indexing a worm.
> read -> we have the ALLOW/mark result bit in core set so just allow.
Don't think we need this - SELinux can do that bit
> mtime update -> clear ALLOW/"mark result" bit in core, send async
> notification to userspace
Why via the kernel ?
> The communication with userspace has a very specific need. The scanning
> process needs to get 'something' that will give it access to the
> original file/inode/data being worked on. My previous patch set does
file handle. Really you need to give the handle of the object because it
may not have a name or a meaningful inode number
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/