Messages in this thread | | | Subject | Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interface foron access scanning | From | Andi Kleen <> | Date | Wed, 06 Aug 2008 04:46:05 +0200 |
| |
"Press, Jonathan" <Jonathan.Press@ca.com> writes: > > Also... I was one of the people who brought up the idea of a process > exclusion when the requirements list was being developed. I intended it > as a way that an AV application could exclude specific OTHER processes > by name (as selected by the AV user)
There's no fixed process name in Linux that cannot be easily faked:
Use process name -- every process can change that by writing to its own environment. Use comm name -- there's a prctl to change that and there can be collisions Use path name of binary -- breaks with chroot and name spaces. Also existing binaries can be subverted. Use inode of binary -- can be faked with fuse and breaks when the binaries is copied ... Use dev, inode -- breaks when copying binary and when running on network file systems without a device node
-Andi
| |