Messages in this thread | | | Subject | Re: [malware-list] scanner interface proposal was: [TALPA] Intro to a linux interface for on access scanning | From | Eric Paris <> | Date | Mon, 18 Aug 2008 14:46:16 -0400 |
| |
On Mon, 2008-08-18 at 14:35 -0400, Jan Harkes wrote:
> The devil is in the details, and besides everyone trying to heap other > things on, one thing that keeps getting brought up, and seemingly keeps > getting ignored is the fact that there already is a perfectly reasonable > interface to pass file system events (open, close, read, write, etc) to > userspace applications in the form of FUSE which has already in some > ways solved issues wrt. subtle deadlocks that can happen when you bounce > from an in-kernel context to a userspace application.
Can you help me write/prototype something that will work for every regular file anywhere on the system including the kernel binary in /boot, the glibc libraries in /lib/ld-linux.so, /sbin/ldconfig and every file on every USB stick you put into the machine? When all of these are on separate partitions? Every file under / needs to be exported to the scanner. I'm very willing to believe fuse is the way to go for an HSM, but I don't see how to get every single file on the system through the FUSE based scanner.
Yes propagation is an important use of file scanning (maybe the biggest), but we clearly can't secure every part of the border, and I don't know how to use fuse to do it all rather than just pieces and parts.
You're absolutely right about this thread droning on. But I've got code that solves the problems. If someone else shows me better code rather than talk I'm all for it!
-Eric
| |