Re: [malware-list] scanner interface proposal was: [TALPA] Intro toa linux interface for on access scanning

[david]

On Mon, 18 Aug 2008, Eric Paris wrote:

> On Mon, 2008-08-18 at 14:35 -0400, Jan Harkes wrote:
>
> > The devil is in the details, and besides everyone trying to heap other
> > things on, one thing that keeps getting brought up, and seemingly keeps
> > getting ignored is the fact that there already is a perfectly reasonable
> > interface to pass file system events (open, close, read, write, etc) to
> > userspace applications in the form of FUSE which has already in some
> > ways solved issues wrt. subtle deadlocks that can happen when you bounce
> > from an in-kernel context to a userspace application.
>
> Can you help me write/prototype something that will work for every
> regular file anywhere on the system including the kernel binary
> in /boot, the glibc libraries in /lib/ld-linux.so, /sbin/ldconfig and
> every file on every USB stick you put into the machine?  When all of
> these are on separate partitions?  Every file under / needs to be
> exported to the scanner.  I'm very willing to believe fuse is the way to
> go for an HSM, but I don't see how to get every single file on the
> system through the FUSE based scanner.
>
> Yes propagation is an important use of file scanning (maybe the
> biggest), but we clearly can't secure every part of the border, and I
> don't know how to use fuse to do it all rather than just pieces and
> parts.
>
> You're absolutely right about this thread droning on.  But I've got code
> that solves the problems.  If someone else shows me better code rather
> than talk I'm all for it!

the issue is that the kernel developers are not that interested in 
creating one-off interfaces for anti-virus scanners. If the interfaces are 
more general and able to be used for a wider variety of problems they are 
much more interested in having them implemented.

unfortunantly you went off and developed a bunch of code before talking to 
people about what the appropriate interfaces would look like, (this is a 
common problem, see the 'how to participate in the kernel' document at 
http://ldn.linuxfoundation.org/book/how-participate-linux-community)

David Lang
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/