[lkml]   [2008]   [Aug]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [malware-list] scanner interface proposal was: [TALPA] Intro to a linux interface for on access scanning
On Mon, 18 Aug 2008, David Collier-Brown wrote:

> tvrtko.ursulin wrote:
>>> Huh? I was never advocating re-scan after each modification and I even
>>> explicitly said it does not make sense for AV not only for performance but
>>> because it will be useless most of the time. I thought sending out
>>> modified notification on close makes sense because it is a natural point,
>>> unless someone is trying to subvert which is out of scope. Other have
>>> suggested time delay and lumping up.
> Alan Cox wrote:
>> You need a bit more than close I imagine, otherwise I can simply keep the
>> file open forever. There are lots of cases where that would be natural
>> behaviour - eg if I was to attack some kind of web forum and insert a
>> windows worm into the forum which was database backed the file would
>> probably never be closed. That seems to be one of the more common attack
>> vectors nowdays.
> I suspect we're saying "on close" when what's really meant is
> "opened for write". In the latter case, the notification would tell
> the user-space program to watch for changes, possibly by something as
> simple as doing a stat now and another when it gets around to deciding if it
> should scan the file. I see lots of room for
> user-space alternatives for change detection, depending on how much
> state it keeps. Rsync-like, perhaps?

trying to have every scanner program monitor every file that any program
opens for write by doing periodic stat commands on it sounds like a very
inefficiant process (and unless they then get notified on close as well,
how do they know when to stop monitoring?)

getting a notification on the transition from scanned -> dirty is much
less of a load (yes, it does leave open the possiblilty of a file getting
scanned multiple times as it keeps getting dirtied, but that's a policy
question of how aggressive the scanner is set to be in scanning files)

David Lang

 \ /
  Last update: 2008-08-18 20:17    [W:0.404 / U:3.860 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site