lkml.org 
[lkml]   [2008]   [Aug]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRE: [malware-list] TALPA - a threat model? well sorta.
    Date
    From
    > -----Original Message-----
    > From: malware-list-bounces@dmesg.printk.net [mailto:malware-list-
    > bounces@dmesg.printk.net] On Behalf Of Alan Cox
    > Sent: Wednesday, August 13, 2008 3:59 PM
    > To: Eric Paris
    > Cc: peterz@infradead.org; linux-kernel@vger.kernel.org; malware-
    > list@lists.printk.net; hch@infradead.org; andi@firstfloor.org;
    > viro@ZenIV.linux.org.uk; arjan@infradead.org
    > Subject: Re: [malware-list] TALPA - a threat model? well sorta.
    >
    > > > I don't think you need to be blocking if you passed up a file
    handle ?
    > >
    > > Without blocking and waiting how do you deny access? Maybe I needed
    > > another thing they do. "They do file scanning and deny access to
    bad
    > > files."
    >
    > Denying access is easy enough - chmod it or set an SELinux label on
    it.

    I may be missing something about your suggestion, but I don't see how
    this would work. Who does the chmod?

    Here's a sequence:

    - Application opens file
    - AV scanner notified in some way without blocking
    - Application reads file into memory
    - AV scanner determines file is infected.
    - AV scanner chmod's file -- oops, too late.
    - Application sends file over the wire to another machine with a more
    vulnerable OS

    How would this be prevented?


    Jon Press


    \
     
     \ /
      Last update: 2008-08-13 23:27    [W:0.024 / U:59.040 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site