lkml.org 
[lkml]   [2008]   [Aug]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon access scanning
    On Mon, Aug 18, 2008 at 7:17 AM, David Collier-Brown <davecb@sun.com> wrote:
    > Peter Dolding wrote:
    >>
    >> Currently if we have a unknown infection on a windows partition that
    >> is been shared by linux the scanner on Linux cannot see that the
    >> windows permissions has been screwed with. OS with badly damaged
    >> permissions is a sign of 1 of three things. ...
    >
    > It's more likely that the files will reside on Linux/Unix under
    > Samba, and so the permissions that Samba implements will be the ones
    > that the virus is trying to mess up. These are implemented in
    > terms of the usual permission bits, plus extended attributes/ACLs.
    > Linux systems mounting Windows filesystems are somewhat unusual (;-))
    >
    More desktop use of Linux more cases of ntfs and fat mounted under
    Linux. Funny enough linux mounting windows file systems is 100
    percent normal for most Ubuntu users so there are a lot of them out
    there doing it. I am future looking there are other filesystems
    coming with there own issues as well.

    Same issue with samba no common store for extra permissions exist so
    on file systems that don't support there permissions storage it goes
    back into there tdb storage.

    Basically scanning everything to detect issues currently nicely
    complex. We have a huge permissions mess. Some permissions are
    processed by the file system drivers. Some are processed by vfs then
    others processed and stored by individual applications. So no where
    in Linux can you see all the permissions being applied to a single
    file to be sure there is not a secuirty risk somewhere. Samba or
    equal allowing access to remove a virus signature from the black list
    or added something that should not be allowed to the white list would
    be major problems.

    Posix has not helped US here at all. No where in posix does it
    provide anything to clean up this mess. Does solarias have a solution
    I know BSD and Linux does not. I think all posix OS's have a mess in
    this section.

    Peter Dolding


    \
     
     \ /
      Last update: 2008-08-18 03:37    [W:0.446 / U:29.548 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site