Messages in this thread | | | Date | Tue, 5 Aug 2008 11:27:47 -0700 | From | Arjan van de Ven <> | Subject | Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interfaceforon access scanning |
| |
On Tue, 5 Aug 2008 14:04:26 -0400 "Press, Jonathan" <Jonathan.Press@ca.com> wrote:
> > However, I want to point out that scanning on close is still an > integral part of AV protection, even if intercepting opens and execs > theoretically catches everything.
but close is... very limited in value. Open is a discrete event traditionally associated withh permission checks. Close... not so. (And if you mmap memory, you can then close the file and still write to it via the mmap)
Lets ask it differently: what will you do if you find something nasty? You can't fail the close... so why block for it? And if you don't block for it... all you would need is an asynchronous notification... something like... inotify
| |