lkml.org 
[lkml]   [2008]   [Aug]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: TALPA - a threat model? well sorta.
    From
    Date
    On Fri, 2008-08-15 at 12:07 +0200, Helge Hafting wrote:
    > It seems to me that this "scan on file open" business is the
    > wrong way to do things - because it reduces performance.
    >
    > If you scan on file open, then your security sw is too late and
    > getting in the way.
    >
    > It is better to scan in advance. Most machines has lots of idle time.
    > Use that time to scan in advance, and mark the files as "clean".
    >
    > A "clean" file can be opened without further checking anytime - giving
    > normal high performance. A file that gets written to becomes "dirty"
    > until checked again. Some mechanism for making a clean copy of a
    > clean file might help avoid excessive "dirtying".
    >
    > "Scan on open" might still be useful for cases when the system
    > haven't kept up with writing, but please don't aim to have
    > this be the _primary_ mode of scanning. A file server
    > where most of the stuff is pre-scanned will likely perform much better
    > than one scanning everything on open.

    This is the source of all that scan on write/close rambling I've seen go
    past the last couple of days..

    So I'd not worry about this particular aspect



    \
     
     \ /
      Last update: 2008-08-15 12:39    [W:5.561 / U:0.404 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site