Messages in this thread | | | Subject | RE: [malware-list] TALPA - a threat model? well sorta. | Date | Wed, 13 Aug 2008 17:24:28 -0400 | From | "Press, Jonathan" <> |
| |
> -----Original Message----- > From: malware-list-bounces@dmesg.printk.net [mailto:malware-list- > bounces@dmesg.printk.net] On Behalf Of Alan Cox > Sent: Wednesday, August 13, 2008 3:59 PM > To: Eric Paris > Cc: peterz@infradead.org; linux-kernel@vger.kernel.org; malware- > list@lists.printk.net; hch@infradead.org; andi@firstfloor.org; > viro@ZenIV.linux.org.uk; arjan@infradead.org > Subject: Re: [malware-list] TALPA - a threat model? well sorta. > > > > I don't think you need to be blocking if you passed up a file handle ? > > > > Without blocking and waiting how do you deny access? Maybe I needed > > another thing they do. "They do file scanning and deny access to bad > > files." > > Denying access is easy enough - chmod it or set an SELinux label on it.
I may be missing something about your suggestion, but I don't see how this would work. Who does the chmod?
Here's a sequence:
- Application opens file - AV scanner notified in some way without blocking - Application reads file into memory - AV scanner determines file is infected. - AV scanner chmod's file -- oops, too late. - Application sends file over the wire to another machine with a more vulnerable OS
How would this be prevented?
Jon Press
| |