Messages in this thread | | | Date | Mon, 18 Aug 2008 10:38:54 -0700 (PDT) | From | david@lang ... | Subject | Re: [malware-list] scanner interface proposal was: [TALPA] Intro to a linux interface for on access scanning |
| |
On Mon, 18 Aug 2008, Eric Paris wrote:
> On Mon, 2008-08-18 at 17:15 +0100, Alan Cox wrote: >>> read -> we have the ALLOW/mark result bit in core set so just allow. >> >> Don't think we need this - SELinux can do that bit >> >>> mtime update -> clear ALLOW/"mark result" bit in core, send async >>> notification to userspace >> >> Why via the kernel ? > > the single in core allow/deny bit is so that the vast majority of > operations are completely free. Say we scan/index /lib/ld-linux.so.2 > once. Do you really want every single read/mmap operation from then on > to have to block waiting for the userspace caches of you HSM, your AV > scanner, and you indexer? If all three tell the kernel they don't need > to see it again and that information is easy and free to maintain, lets > do it.
this is why the proposal caches the results of all the scanners with the file (in the xattrs), rather then having each scanner store it's own scan results
David Lang
| |