lkml.org 
[lkml]   [2008]   [Aug]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: TALPA - a threat model? well sorta.
    Hi!

    > Now this to me we have a few basic building blocks:
    > 1) We need an efficient mechanism to notify userspace of files that get
    > dirtied. Virus scanners will subscribe to this for the async dirty
    > scanning; indexing agents also will subscribe to this.

    ACK.

    > I think few people will disagree about this.
    >
    > Open questions now are
    > 4) do we have the kernel kick off an async scan in open() or do we have
    > glibc do this
    > 5) do we have the kernel do the sync scan on read/mmap/.. or do we have
    > glibc do this


    How does it work? Memory can still change after mmap; scanning at the
    mmap time is _NOT_ enough.

    You could do 'when app attempts to dirty memory, synchronously unmap
    it from all apps that have it mapped' and then do sync scan on
    pagefault time; but that sounds impractical.
    Pavel
    --
    (english) http://www.livejournal.com/~pavelmachek
    (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html


    \
     
     \ /
      Last update: 2008-08-18 13:03    [W:0.042 / U:66.720 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site