lkml.org 
[lkml]   [2007]   [Nov]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Out of tree module using LSM
    On Nov 29, 2007 9:03 AM, Greg KH <greg@kroah.com> wrote:
    > On Thu, Nov 29, 2007 at 05:53:33PM +0100, Jan Engelhardt wrote:
    > >
    > > On Nov 29 2007 08:47, Greg KH wrote:
    > > >On Thu, Nov 29, 2007 at 11:36:12AM -0500, Jon Masters wrote:
    > > >> On Wed, 2007-11-28 at 17:07 -0800, Greg KH wrote:
    > > >>
    > > >> > The easiest way is as Al described above, just have the userspace
    > > >> > program that wrote the file to disk, check it then.
    > > >>
    > > >> But the problem is that this isn't just Samba, this is a countless
    > > >> myriad of different applications. And if one of them doesn't support
    > > >> on-access scanning, then the whole solution isn't worth using.
    > > >
    > > >Ok, which specific applications do they care about? Last time I asked
    > > >it was still limited to a very small handful, all of which would be
    > > >trivial to add such a hook to.
    > > >
    > > Well, think bash, syscalls. While you can add a plugin to samba "easily",
    > > it seems overkill to do the same for rm, mv, cp, bash.
    >
    > Again, these are not things that these companies care about.

    Perhaps if you looked at this outside of a file-server scenario, the
    problem would be clearer? Anti-malware companies want to check
    anything written to disk on a system, either at write time or blocking
    the open/mmap. That means proactively protecting email programs with
    known vulnerabilities that have yet to be patched, web browsers
    writing and reading their caches, an Apache instance running WebDAV,
    the list goes on. And these are on desktop systems, with no attached
    file/network server.

    Yes, each and every one of these programs could have a malware
    scanning engine slapped inside of them. But that proves what? That's
    like saying each an every program on a system should have the SELinux
    policies built into them, and yet we have that in-kernel instead.
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-11-29 18:39    [W:2.276 / U:0.164 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site