lkml.org 
[lkml]   [2008]   [Aug]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRE: [malware-list] TALPA - a threat model? well sorta.
Date
From
> -----Original Message-----
> From: malware-list-bounces@dmesg.printk.net [mailto:malware-list-
> bounces@dmesg.printk.net] On Behalf Of Alan Cox
> Sent: Wednesday, August 13, 2008 3:59 PM
> To: Eric Paris
> Cc: peterz@infradead.org; linux-kernel@vger.kernel.org; malware-
> list@lists.printk.net; hch@infradead.org; andi@firstfloor.org;
> viro@ZenIV.linux.org.uk; arjan@infradead.org
> Subject: Re: [malware-list] TALPA - a threat model? well sorta.
>
> > > I don't think you need to be blocking if you passed up a file
handle ?
> >
> > Without blocking and waiting how do you deny access? Maybe I needed
> > another thing they do. "They do file scanning and deny access to
bad
> > files."
>
> Denying access is easy enough - chmod it or set an SELinux label on
it.

I may be missing something about your suggestion, but I don't see how
this would work. Who does the chmod?

Here's a sequence:

- Application opens file
- AV scanner notified in some way without blocking
- Application reads file into memory
- AV scanner determines file is infected.
- AV scanner chmod's file -- oops, too late.
- Application sends file over the wire to another machine with a more
vulnerable OS

How would this be prevented?


Jon Press


\
 
 \ /
  Last update: 2008-08-13 23:27    [from the cache]
©2003-2011 Jasper Spaans