Cc: Christoph Hellwig <hch@...>, Eric Paris <eparis@...>, <tvrtko.ursulin@...>, <alan@...>, <andi@...>, Arjan van de Ven <arjan@...>, <linux-kernel@...>, <malware-list@...>, <malware-list-bounces@...>, <peterz@...>, <viro@...>
could you do something like defining a namespace inside posix attributes
and then setting up a mechanism in the kernel to alert if the attributes
change (with the entire namespace getting cleared if the file gets
dirtied)?
this would have the advantage of storing the clean/dirty state in a known
location on the filesystem (you would need to enable posix attributes, but
that should be an acceptable limit), and would allow multiple scanners
(virii, indexing, etc) to do their own thing at their own schedule when
things get dirtied.
the userspace library calls that open the files would be able to take care
of the issue of deciding which of the configured scanners on a system
should be called for each attribute that's not set on a file.
This would seem to require minimal kernel support
1. reserve a attribute namespace
2. clear that namespace if the file is dirtied
3. provide a notification mechanism for programs to subscribe to that
lists all files where the namespace was not already empty when the file
was dirtied.
everything else can be userspace.
David Lang
--
