[lkml]   [2008]   [Aug]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: TALPA - a threat model? well sorta.
On Fri, 15 Aug 2008, Pavel Machek wrote:

>> Now this to me we have a few basic building blocks:
>> 1) We need an efficient mechanism to notify userspace of files that get
>> dirtied. Virus scanners will subscribe to this for the async dirty
>> scanning; indexing agents also will subscribe to this.
> ACK.
>> I think few people will disagree about this.
>> Open questions now are
>> 4) do we have the kernel kick off an async scan in open() or do we have
>> glibc do this
>> 5) do we have the kernel do the sync scan on read/mmap/.. or do we have
>> glibc do this
> How does it work? Memory can still change after mmap; scanning at the
> mmap time is _NOT_ enough.
> You could do 'when app attempts to dirty memory, synchronously unmap
> it from all apps that have it mapped' and then do sync scan on
> pagefault time; but that sounds impractical.

what is the threat you are trying to defend against?

for some threats you are right, for others the scan at mmap time is

David Lang

 \ /
  Last update: 2008-08-18 14:25    [W:0.177 / U:4.720 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site