Messages in this thread | | | Subject | RE: [malware-list] TALPA - a threat model? well sorta. | Date | Thu, 14 Aug 2008 08:03:40 -0400 | From | "Press, Jonathan" <> |
| |
> -----Original Message----- > From: malware-list-bounces@dmesg.printk.net [mailto:malware-list- > bounces@dmesg.printk.net] On Behalf Of tvrtko.ursulin@sophos.com > Sent: Thursday, August 14, 2008 5:31 AM > To: Theodore Tso > Cc: peterz@infradead.org; linux-kernel@vger.kernel.org; malware- > list@lists.printk.net; hch@infradead.org; viro@ZenIV.linux.org.uk; > andi@firstfloor.org; malware-list-bounces@dmesg.printk.net; > alan@lxorguk.ukuu.org.uk; Arjan van de Ven > Subject: Re: [malware-list] TALPA - a threat model? well sorta.
> Hm, maybe by implementing a facility with which a client can register it's > interface usage intent? Something like: > > register(I_HAVE_NO_INTEREST_IN_CONTENT); > register(I_WANT_TO_EXAMINE_CONTENT); > > All former ones would run first because they only want to have the > opportunity to block and do something unrelated to file content (like > HSMs), and later group would be ran last since they want to examine the > content. > > Ordering inside those two groups is not important because I don't see how > a model other than restrictive can make sense with content security > scanning.
I'm not sure I understand why "interest in content" means not blocking, and vice versa. However, I think this is a good idea if made more explicit, i.e.:
> register(BLOCK); > register(DON'T_BLOCK);
Jon Press
| |