Messages in this thread | | | Subject | Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforonaccess scanning | From | douglas.leeder@sophos ... | Date | Fri, 15 Aug 2008 14:22:27 +0100 |
| |
malware-list-bounces@dmesg.printk.net wrote on 2008-08-15 14:16:21:
> On Fri, Aug 15, 2008 at 08:57:48AM -0400, Press, Jonathan wrote: > > That may just be a question of terminology. If the bits are construed > > not as clean/dirty/infected, but as "I care about this file" vs. "I > > don't care about this file" then the rubber gloves come off. > > Sure, as long as we're very clear about the semantics of the bits. If > the bits are not persistent, but which get dropped if the inode is > every evicted from memory, and it's considered OK, or even desirable, > to rescan the file when it is brought back into memory, that may be > acceptable to the rubber gloves folks (make people go through lots > superflous of security scans, even when they are transfering betewen > flights --- security is always more important than passengers' > convenience!), but perhaps not to other applications such as file > indexers, who would view rescanning files that have already been > scanned, and not have been modified, as a waste of time, battery, CPU > and disk bandwidth, etc. > > As I understand it, the TALPA proposal had non-persistent > clean/dirty/infected bits. > > - Ted
Yes the current proposal has temporary markers in the in-memory representation if inodes.
This is a problem for current anti-malware scanning, as virus data updates come every few hours (at which point the entire clean/infected state has to be cleared), so the loss after a reboot is limited.
-- Douglas Leeder
Sophos Plc, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, United Kingdom.
Company Reg No 2096520. VAT Reg No GB 348 3873 20.
| |