lkml.org 
[lkml]   [2008]   [Aug]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [malware-list] scanner interface proposal was: [TALPA] Intro to a linux interface for on access scanning
    > Huh? I was never advocating re-scan after each modification and I even 
    > explicitly said it does not make sense for AV not only for performance but
    > because it will be useless most of the time. I thought sending out
    > modified notification on close makes sense because it is a natural point,
    > unless someone is trying to subvert which is out of scope. Other have
    > suggested time delay and lumping up.

    You need a bit more than close I imagine, otherwise I can simply keep the
    file open forever. There are lots of cases where that would be natural
    behaviour - eg if I was to attack some kind of web forum and insert a
    windows worm into the forum which was database backed the file would
    probably never be closed. That seems to be one of the more common attack
    vectors nowdays.

    >
    > Also, just to double-check, you don't think AV scanning would read the
    > whole file on every write?

    So you need the system to accumulate some kind of complete in memory set
    of 'dirty' range lists on all I/O ? That is going to have pretty bad
    performance impacts and serialization.


    \
     
     \ /
      Last update: 2008-08-18 17:53    [from the cache]
    ©2003-2014 Jasper Spaans. hosted at Digital Ocean