Cc: <tvrtko.ursulin@...>, <alan@...>, <andi@...>, Arjan van de Ven <arjan@...>, <hch@...>, <linux-kernel@...>, <malware-list@...>, <malware-list-bounces@...>, <peterz@...>, <viro@...>
On Thu, Aug 14, 2008 at 09:48:33AM -0400, Eric Paris wrote:
"Infected" just means to instantly return an error when the file is
opened or if an already opened file descriptor is read or mmap'ed,
right? If file is already mmaped(), what's the plan? Send a kill -9
to the process, even if it ends up kill off an emacs or openoffice
process?
If a userspace database knows that inode X, i_version Y was checked a
day ago, and inode X still has i_version Y, even if that inode has
been evicted from memory, the contents will be the same absent root
messing about with direct access to the block device. If there was an
intervening boot, the someone could remove the disk, edit the disk
block directly -- but that person could also add a backdoor to the
kernel while they were at it.
If your threat model is, "we do file scanning; that's it", then having
an external database which uses the inode number and i_version as a
tuple makes a lot of sense --- for filesystems where i_version is
getting bumped on every disk write, which is needed to support NFSv4
cache support, anyway.
- Ted
--
