lkml.org 
[lkml]   [2007]   [Nov]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Out of tree module using LSM
    On Wed, Nov 28, 2007 at 06:30:40PM +0000, Al Viro wrote:
    > On Wed, Nov 28, 2007 at 01:15:05PM -0500, Valdis.Kletnieks@vt.edu wrote:
    > > (Note that the concept has interesting implications in the other direction as
    > > well - rather than stopping you from reading a file that has malware, you could
    > > in theory write an anti-export package that would let you write onto external
    > > memory or outbound e-mail, but prevent the write if it was corporate-sensitive
    > > data, or whatever.
    >
    > You _can_ _not_ do that. If shared mapping gets dirtied, you have no way to
    > intercept that. At all. Especially since the page stays mapped while it is
    > written out, so the next modification can come when hardware had already
    > started outbound DMA and there's no way to abort it, no matter what your
    > external scanner would do.
    >
    > Folks, really, that doesn't work. At all. You can intercept all system
    > calls you want and it will not be enough to prevent the "bad" contents
    > from hitting the disk.
    >
    > And if we are talking about the situation when files are written to in
    > controlled way (i.e. we are not concerned with malware running on the box
    > in question and just want to stop it from passing through mailsewer, etc.),
    > then there's no damn need to play with LSM - just have e.g. coda with its
    > commit-on-close and run the scanner on commit. End of story. Mind you,
    > in such setups one would be much better off just having the mail server run
    > the tests explicitly in the userland, along with the rest of anti-spam, etc.
    > filters.

    I've repeated the above statements so many times to a number of the
    anti-virus companies, and other people that really should know better,
    that I'm really sick of it. For some reason, they keep trying to do
    things like this in the kernel, despite it being trivial to do in
    userspace properly.

    In the end, I even got one company to agree that it should be done in
    userspace (McAfee), but they ignored this and went off to update their
    kernel code again :(

    Just because other operating systems require you to do things like this
    within the kernel, doesn't mean that you have to do the same thing on
    Linux...

    so sad,

    greg k-h
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-11-29 01:43    [W:0.055 / U:30.704 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site