Messages in this thread | | | Date | Mon, 18 Aug 2008 16:31:48 +0100 | From | Alan Cox <> | Subject | Re: [malware-list] scanner interface proposal was: [TALPA] Intro to a linux interface for on access scanning |
| |
> Huh? I was never advocating re-scan after each modification and I even > explicitly said it does not make sense for AV not only for performance but > because it will be useless most of the time. I thought sending out > modified notification on close makes sense because it is a natural point, > unless someone is trying to subvert which is out of scope. Other have > suggested time delay and lumping up.
You need a bit more than close I imagine, otherwise I can simply keep the file open forever. There are lots of cases where that would be natural behaviour - eg if I was to attack some kind of web forum and insert a windows worm into the forum which was database backed the file would probably never be closed. That seems to be one of the more common attack vectors nowdays.
> > Also, just to double-check, you don't think AV scanning would read the > whole file on every write?
So you need the system to accumulate some kind of complete in memory set of 'dirty' range lists on all I/O ? That is going to have pretty bad performance impacts and serialization.
| |