lkml.org 
[lkml]   [2008]   [Aug]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interfaceforon access scanning
    > > However, I want to point out that scanning on close is still an integral
    > > part of AV protection, even if intercepting opens and execs
    > > theoretically catches everything.
    >
    > Great, then put a hook in glibc and catch all closes and then kick off
    > your scanning.

    kill -9
    deferred close via mmap
    etc etc etc

    You can't just armwave it into glibc, that doesn't hold water. You also
    have shared state between processes (index on last close of a handle
    shared by several threads or processes).

    Same problem you have in the indexing business (which also wants the
    close hook) - aside from all the practical issues that LD_PRELOAD tends
    to turn up.

    I'm not actually interested in the AV stuff, but content indexing I do
    care about and we do need a way to get notification up to user space.

    Alan


    \
     
     \ /
      Last update: 2008-08-05 22:39    [W:4.752 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site