[lkml]   [2008]   [Aug]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: TALPA - a threat model? well sorta.

    > Now this to me we have a few basic building blocks:
    > 1) We need an efficient mechanism to notify userspace of files that get
    > dirtied. Virus scanners will subscribe to this for the async dirty
    > scanning; indexing agents also will subscribe to this.


    > I think few people will disagree about this.
    > Open questions now are
    > 4) do we have the kernel kick off an async scan in open() or do we have
    > glibc do this
    > 5) do we have the kernel do the sync scan on read/mmap/.. or do we have
    > glibc do this

    How does it work? Memory can still change after mmap; scanning at the
    mmap time is _NOT_ enough.

    You could do 'when app attempts to dirty memory, synchronously unmap
    it from all apps that have it mapped' and then do sync scan on
    pagefault time; but that sounds impractical.
    (cesky, pictures)

     \ /
      Last update: 2008-08-18 13:03    [W:0.022 / U:43.316 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site