lkml.org 
[lkml]   [2008]   [Jul]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: request for comment: generic kernel interface for malware vendors
    Eric Paris wrote:
    > First I'd like to thank Sophos who stepped up and originally wrote a lot
    > of this code. They might not recognize it since I've gotten my hands on
    > it, but they were nice enough to get the ball rolling by giving me some
    > GPL code which addressed near every request people on the malware list
    > had.
    >
    > At the moment all of the code (over)uses the name talpa. I expect this
    > group of people to come up with a new name for this interface, but since
    > that's how the patches started and I couldn't come up with anything I
    > love the patches still say talpa. So if nothing else, lets come up with
    > suggestions. For a little bit I plan to carry these as purely out of
    > tree patches but can move development somewhere like a git tree as they
    > settle down. Feel free to send me comments/patches in an manner you see
    > fit. I'm here to help.
    >
    > This is a request for comment. This is a first stab and I'm here to
    > address all of the concerns that people have. Please don't hold back,
    > I've got thick skin. BUT, I don't want to hear 'this is how we have
    > been doing it, do it that way.' I want to hear how this won't work for
    > your needs (and WHY) or how we can do it better.
    >
    > you can find the patches at:
    > http://people.redhat.com/~eparis/talpa
    >
    > (1, 3, and 9 are by FAR the most interesting)
    >
    > FOR NOW it comes with no documentation. This is just a code dump since
    > I'm just in a rush. I fly out for OLS in 5 hours. Speaking of OLS, I'm
    > going to be there. If you are going to be there and want to talk about
    > these patches, other patches, your needs, or really anything let me
    > know.
    >
    > So what's at that web site? There are 10 patches against Linus's git
    > tree.
    >
    > 1 - ****hooks, basics, infrastructure
    > 2 - configuration generic stuff for the other patches
    > 3 - ****results caching
    > 4 - exclusions based on the operation or filetype
    > 5 - per process exclusions
    > 6 - filesystem type exclusions
    > 7 - patch exclusions, don't scan when accessed through certain path
    > 8 - patch inclusions, only scanning selected things
    > 9 - ****userspace vetting, the big stuff
    > 10 - operating when userspace is broken
    >
    > patch 8 i'm not a fan of. I really don't like path name security and
    > while path exclusions means we might scan more than we should
    > considering how unreliable and useless path names are path inclusions
    > means we might miss things. I always find missing things to be rather
    > unacceptable. Unless someone feels strongly I plan to drop patch 8
    > altogether (I also haven't reviewed it at all since I got it from
    > Sophos)
    >
    > After (or maybe during) this next week I'll try to explain how all of
    > this works but for now this is just a code dump. 1, 3 and 9 are by FAR
    > the most interesting patches. Patch 9 includes an example userspace
    > client that denies access to the file /root/denyme if it contains
    > exactly the string "bad."
    >
    > I am trying to get something (that works) out there as soon as I can, so
    > please, don't take what you see as set in stone. Give me comments.
    > What should I have done better? Both in terms of what I'm doing and
    > what you need?
    >

    I'm a newbie here, so don't take me too serious. But I don't see why
    that needs a kernel interface, at least from the example on the
    Documentation directory (patch 9). Seems to me you could just use file
    permission to deny or allow the access for a certain file. The only
    thing that would be a little trickier from user-space is to know when a
    given file is read. So, talpa should do only that or you could take
    advantage of preload like trickle does for bandwidth shapping.


    \
     
     \ /
      Last update: 2008-07-21 19:47    [W:0.027 / U:30.540 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site