Messages in this thread | | | Date | Sun, 2 Dec 2007 22:56:34 +0100 | From | Pavel Machek <> | Subject | Re: Out of tree module using LSM |
| |
On Sun 2007-12-02 16:09:55, Valdis.Kletnieks@vt.edu wrote: > On Sun, 02 Dec 2007 21:22:40 +0100, Pavel Machek said: > > Well, if you only want to detect viruses _sometimes_, you can just > > LD_PRELOAD your scanner. > > And for some use cases, that probably *is* the best answer..
I'd say so.
> > I guess the A/V people should describe what they are trying to do, as > > in > > > > "forbidden sequences of bits should never hit disk" or "forbidden > > sequences of bits should be never read from disk" or something... > > We probably want to hear related usages as well - what *besides* A/V would be > interested? Indexing services?
Well... I'd really like to know what A/V people are trying to do.
Indexing services are really different, and doable with recursive m-time Jan is preparing...
> Software that tries to limit the > distribution > of sensitive info off the machine - for instance, imagine a rule that said > "Data that comes from a file that contains SSNs or the string 'Corporate > Secret' data isn't allowed to leave the computer" and a Perl-like 'taint' > concept. I'm not saying its *doable*, but it's certainly a goal that somebody > would like to achieve...
That sounds like a task for SELinux, no? Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
| |