Messages in this thread | | | Date | Tue, 5 Aug 2008 12:25:03 +0100 | From | Alan Cox <> | Subject | Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interface for on access scanning |
| |
> Again, do it all in userspace (caching, and scanning). I still really > don't see the need to do this in the kernel becides it being "the way > people have always done it."
We don't have notifiers for file segment changes that are scalable that far. We don't have mechanisms for delaying an open for a scan.
There are various bits of this you can't just do in user space. This doesn't just hurt virus scanners btw its also bad news for indexing disk content.
| |