Messages in this thread | | | Date | Wed, 23 Jul 2008 09:09:40 -0700 | From | "Ray Lee" <> | Subject | Re: request for comment: generic kernel interface for malware vendors |
| |
On Sun, Jul 20, 2008 at 9:18 PM, Eric Paris <eparis@redhat.com> wrote: > 1 - ****hooks, basics, infrastructure > 2 - configuration generic stuff for the other patches > 3 - ****results caching > 4 - exclusions based on the operation or filetype > 5 - per process exclusions > 6 - filesystem type exclusions > 7 - patch exclusions, don't scan when accessed through certain path > 8 - patch inclusions, only scanning selected things > 9 - ****userspace vetting, the big stuff > 10 - operating when userspace is broken
If, along the way, you can also address the needs provided by the fschange patches (system-wide inotify, in essence, without having to register individual watches), that'd be gravy. I haven't looked at either the patches above or the fsnotify ones, so I can't speak to whatever overlap they may have, except that it certainly seems like the anti-malware stuff would be a superset.
http://stefan.buettcher.org/cs/fschange/index.html
~r.
| |