lkml.org 
[lkml]   [2008]   [Jul]   [23]   [last100]   RSS Feed
Views: [more markup]   [less markup]   [headers]   [forward]  
 
Messages in this thread
/
DateWed, 23 Jul 2008 09:09:40 -0700
From"Ray Lee" <>
SubjectRe: request for comment: generic kernel interface for malware vendors
On Sun, Jul 20, 2008 at 9:18 PM, Eric Paris <eparis@redhat.com> wrote:
> 1 - ****hooks, basics, infrastructure
> 2 - configuration generic stuff for the other patches
> 3 - ****results caching
> 4 - exclusions based on the operation or filetype
> 5 - per process exclusions
> 6 - filesystem type exclusions
> 7 - patch exclusions, don't scan when accessed through certain path
> 8 - patch inclusions, only scanning selected things
> 9 - ****userspace vetting, the big stuff
> 10 - operating when userspace is broken

If, along the way, you can also address the needs provided by the
fschange patches (system-wide inotify, in essence, without having to
register individual watches), that'd be gravy. I haven't looked at
either the patches above or the fsnotify ones, so I can't speak to
whatever overlap they may have, except that it certainly seems like
the anti-malware stuff would be a superset.

   http://stefan.buettcher.org/cs/fschange/index.html

~r.


\
 
 \ /
  Last update: 2008-07-23 18:13    [W:0.420 / U:0.540 seconds]
©2003-2008 Jasper Spaans