Messages in this thread | | | Subject | Re: TALPA - a threat model? well sorta. | From | Peter Zijlstra <> | Date | Fri, 15 Aug 2008 12:37:25 +0200 |
| |
On Fri, 2008-08-15 at 12:07 +0200, Helge Hafting wrote: > It seems to me that this "scan on file open" business is the > wrong way to do things - because it reduces performance. > > If you scan on file open, then your security sw is too late and > getting in the way. > > It is better to scan in advance. Most machines has lots of idle time. > Use that time to scan in advance, and mark the files as "clean". > > A "clean" file can be opened without further checking anytime - giving > normal high performance. A file that gets written to becomes "dirty" > until checked again. Some mechanism for making a clean copy of a > clean file might help avoid excessive "dirtying". > > "Scan on open" might still be useful for cases when the system > haven't kept up with writing, but please don't aim to have > this be the _primary_ mode of scanning. A file server > where most of the stuff is pre-scanned will likely perform much better > than one scanning everything on open.
This is the source of all that scan on write/close rambling I've seen go past the last couple of days..
So I'd not worry about this particular aspect
| |