[lkml]   [2008]   [Aug]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interfaceforon access scanning
    > And this can be done from userland with the preload: the "workaround"
    > from the preload assumes you've already executed malicious code, which
    > is outside of your protection scope.
    > What am I missing?

    Attempts to screen content
    Exec occuring after is compromised

    Is there anything however that cannot be done with SELinux if you added
    the ability to block an open and kick it upwards (including the open of
    an exec binary)

    It seems you would then get a transition from a label of 'trusted' to
    'untrusted_unverified' and an open of untrusted_unverified can (depending
    on the SELinux rule) then block, trap upwards and continue according to a
    userspace response.

    At that point all the questions like 'what do I want to scan for' become
    SELinux questions and we already have all the technology to do stuff like
    'only scan for samba' or 'only scan for httpd and cgi' and do it

    The cache then becomes the labels which are already part of the fs and
    our existing labelling and context management.


     \ /
      Last update: 2008-08-05 19:49    [W:0.019 / U:8.328 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site