Re: TALPA - a threat model? well sorta.

view
thread

!MAILaRCHIVE_VOTE_RePLACE

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

To: Helge Hafting <helge.hafting@...>

Cc: Eric Paris <eparis@...>, Arjan van de Ven <arjan@...>, <linux-kernel@...>, <malware-list@...>, <andi@...>, <riel@...>, <greg@...>, <tytso@...>, <viro@...>, <alan@...>, <hch@...>

Subject: Re: TALPA - a threat model? well sorta.

Date: Friday, August 15, 2008 - 6:37 am

On Fri, 2008-08-15 at 12:07 +0200, Helge Hafting wrote:
quoted text> It seems to me that this "scan on file open" business is the
> wrong way to do things - because it reduces performance.
> 
> If you scan on file open, then your security sw is too late and
> getting in the way.
> 
> It is better to scan in advance. Most machines has lots of idle time.
> Use that time to scan in advance, and mark the files as "clean".
> 
> A "clean" file can be opened without further checking anytime - giving
> normal high performance.  A file that gets written to becomes "dirty"
> until checked again. Some mechanism for making a clean copy of a
> clean file might help avoid excessive "dirtying".
> 
> "Scan on open" might still be useful for cases when the system
> haven't kept up with writing, but please don't aim to have
> this be the _primary_ mode of scanning. A file server
> where most of the stuff is pre-scanned will likely perform much better
> than  one scanning everything on open.

This is the source of all that scan on write/close rambling I've seen go
past the last couple of days..

So I'd not worry about this particular aspect

--
unsubscribe noticeTo unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

Messages in current thread:

TALPA - a threat model? well sorta., Eric Paris, (Wed Aug 13, 12:36 pm)

Re: TALPA - a threat model? well sorta., 7v5w7go9ub0o, (Wed Aug 13, 8:14 pm)

Re: TALPA - a threat model? well sorta., 7v5w7go9ub0o, (Wed Aug 13, 10:25 pm)

Re: TALPA - a threat model? well sorta., Andi Kleen, (Wed Aug 13, 2:17 pm)

Re: TALPA - a threat model? well sorta., Mihai , (Wed Aug 13, 8:18 pm)

RE: [malware-list] TALPA - a threat model? well sorta., Press, Jonathan, (Thu Aug 14, 7:58 am)

Re: [malware-list] TALPA - a threat model? well sorta., Mihai , (Thu Aug 14, 8:34 am)

Re: TALPA - a threat model? well sorta., Eric Paris, (Wed Aug 13, 2:40 pm)

Re: TALPA - a threat model? well sorta., H. Peter Anvin, (Wed Aug 13, 2:21 pm)

Re: TALPA - a threat model? well sorta., Arjan van de Ven, (Wed Aug 13, 2:24 pm)

Re: TALPA - a threat model? well sorta., Arjan van de Ven, (Wed Aug 13, 1:39 pm)

Re: TALPA - a threat model? well sorta., Pavel Machek, (Fri Aug 15, 12:06 pm)

Re: TALPA - a threat model? well sorta., , (Mon Aug 18, 8:21 am)

Re: TALPA - a threat model? well sorta., Pavel Machek, (Mon Aug 18, 9:30 am)

Re: TALPA - a threat model? well sorta., , (Mon Aug 18, 8:03 pm)

Re: TALPA - a threat model? well sorta., , (Thu Aug 14, 9:31 pm)

Re: TALPA - a threat model? well sorta., Eric Paris, (Wed Aug 13, 2:57 pm)

Re: [malware-list] TALPA - a threat model? well sorta., , (Thu Aug 14, 5:46 am)

Re: [malware-list] TALPA - a threat model? well sorta., , (Thu Aug 14, 9:37 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Arjan van de Ven, (Thu Aug 14, 9:46 am)

Re: TALPA - a threat model? well sorta., Arjan van de Ven, (Wed Aug 13, 5:39 pm)

Re: TALPA - a threat model? well sorta., Eric Paris, (Thu Aug 14, 10:12 am)

Re: TALPA - a threat model? well sorta., Helge Hafting, (Fri Aug 15, 6:07 am)

Re: TALPA - a threat model? well sorta., , (Fri Aug 15, 6:44 am)

Re: TALPA - a threat model? well sorta., Peter Zijlstra, (Fri Aug 15, 6:37 am)

RE: [malware-list] TALPA - a threat model? well sorta., Press, Jonathan, (Fri Aug 15, 9:10 am)

Re: [malware-list] TALPA - a threat model? well sorta., Helge Hafting, (Mon Aug 18, 6:02 am)

RE: [malware-list] TALPA - a threat model? well sorta., , (Fri Aug 15, 12:25 pm)

RE: [malware-list] TALPA - a threat model? well sorta., Press, Jonathan, (Fri Aug 15, 12:30 pm)

RE: [malware-list] TALPA - a threat model? well sorta., , (Fri Aug 15, 1:33 pm)

RE: [malware-list] TALPA - a threat model? well sorta., Press, Jonathan, (Fri Aug 15, 1:40 pm)

RE: [malware-list] TALPA - a threat model? well sorta., , (Fri Aug 15, 1:47 pm)

RE: [malware-list] TALPA - a threat model? well sorta., Press, Jonathan, (Fri Aug 15, 2:17 pm)

RE: [malware-list] TALPA - a threat model? well sorta., , (Fri Aug 15, 4:08 pm)

Re: [malware-list] TALPA - a threat model? well sorta., , (Fri Aug 15, 2:06 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Theodore Tso, (Fri Aug 15, 4:17 pm)

Re: [malware-list] TALPA - a threat model? well sorta., , (Fri Aug 15, 4:05 pm)

Re: [malware-list] TALPA - a threat model? well sorta., , (Fri Aug 15, 9:18 am)

Re: [malware-list] TALPA - a threat model? well sorta., Theodore Tso, (Fri Aug 15, 1:04 pm)

RE: [malware-list] TALPA - a threat model? well sorta., Press, Jonathan, (Fri Aug 15, 2:09 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Helge Hafting, (Mon Aug 18, 6:09 am)

Re: [malware-list] TALPA - a threat model? well sorta., , (Mon Aug 18, 6:25 am)

Re: [malware-list] TALPA - a threat model? well sorta., Peter Zijlstra, (Mon Aug 18, 6:14 am)

Re: [malware-list] TALPA - a threat model? well sorta., , (Mon Aug 18, 6:24 am)

Re: TALPA - a threat model? well sorta., Arjan van de Ven, (Thu Aug 14, 11:57 am)

Re: TALPA - a threat model? well sorta., Theodore Tso, (Wed Aug 13, 2:15 pm)

Re: TALPA - a threat model? well sorta., Eric Paris, (Wed Aug 13, 3:02 pm)

Re: TALPA - a threat model? well sorta., Theodore Tso, (Wed Aug 13, 3:29 pm)

Re: [malware-list] TALPA - a threat model? well sorta., , (Thu Aug 14, 5:30 am)

Re: [malware-list] TALPA - a threat model? well sorta., Theodore Tso, (Thu Aug 14, 9:24 am)

Re: [malware-list] TALPA - a threat model? well sorta., Eric Paris, (Thu Aug 14, 9:48 am)

Re: [malware-list] TALPA - a threat model? well sorta., Theodore Tso, (Thu Aug 14, 11:50 am)

Re: [malware-list] TALPA - a threat model? well sorta., Pavel Machek, (Fri Aug 15, 10:37 am)

Re: [malware-list] TALPA - a threat model? well sorta., Eric Paris, (Thu Aug 14, 1:29 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Theodore Tso, (Thu Aug 14, 3:17 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Christoph Hellwig, (Thu Aug 14, 3:34 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Theodore Tso, (Thu Aug 14, 3:41 pm)

Re: [malware-list] TALPA - a threat model? well sorta., , (Thu Aug 14, 9:44 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Theodore Tso, (Thu Aug 14, 10:04 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Alan Cox, (Fri Aug 15, 4:51 am)

Re: [malware-list] TALPA - a threat model? well sorta., , (Fri Aug 15, 12:48 am)

Re: [malware-list] TALPA - a threat model? well sorta., Arjan van de Ven, (Thu Aug 14, 11:41 pm)

Re: [malware-list] TALPA - a threat model? well sorta., , (Fri Aug 15, 1:05 am)

Re: [malware-list] TALPA - a threat model? well sorta., , (Fri Aug 15, 1:36 am)

Re: [malware-list] TALPA - a threat model? well sorta., Johannes Weiner, (Fri Aug 15, 1:12 am)

Re: [malware-list] TALPA - a threat model? well sorta., , (Fri Aug 15, 1:28 am)

Re: [malware-list] TALPA - a threat model? well sorta., Christoph Hellwig, (Thu Aug 14, 4:20 pm)

Re: [malware-list] TALPA - a threat model? well sorta., J. Bruce Fields, (Thu Aug 14, 5:21 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Theodore Tso, (Thu Aug 14, 7:34 pm)

Re: [malware-list] TALPA - a threat model? well sorta., J. Bruce Fields, (Tue Aug 19, 5:43 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Eric Paris, (Thu Aug 14, 3:20 pm)

RE: [malware-list] TALPA - a threat model? well sorta., Press, Jonathan, (Thu Aug 14, 8:03 am)

RE: [malware-list] TALPA - a threat model? well sorta., , (Thu Aug 14, 8:27 am)

Re: [malware-list] TALPA - a threat model? well sorta., Pavel Machek, (Fri Aug 15, 10:31 am)

RE: [malware-list] TALPA - a threat model? well sorta., Press, Jonathan, (Wed Aug 13, 5:15 pm)

Re: TALPA - a threat model? well sorta., Arjan van de Ven, (Wed Aug 13, 2:21 pm)

Re: TALPA - a threat model? well sorta., , (Thu Aug 14, 5:18 am)

Re: TALPA - a threat model? well sorta., Greg KH, (Wed Aug 13, 12:57 pm)

Re: TALPA - a threat model? well sorta., Alan Cox, (Wed Aug 13, 12:24 pm)

Re: TALPA - a threat model? well sorta., Arnd Bergmann, (Thu Aug 14, 9:00 am)

Re: TALPA - a threat model? well sorta., Christoph Hellwig, (Wed Aug 13, 1:07 pm)

Re: TALPA - a threat model? well sorta., Eric Paris, (Wed Aug 13, 12:47 pm)

Re: TALPA - a threat model? well sorta., Alan Cox, (Wed Aug 13, 12:37 pm)

Re: TALPA - a threat model? well sorta., Eric Paris, (Wed Aug 13, 1:00 pm)

Re: TALPA - a threat model? well sorta., Alan Cox, (Wed Aug 13, 3:59 pm)

RE: [malware-list] TALPA - a threat model? well sorta., Press, Jonathan, (Wed Aug 13, 5:24 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Rik van Riel, (Wed Aug 13, 5:35 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Jan Harkes, (Fri Aug 15, 4:16 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Arjan van de Ven, (Fri Aug 15, 6:05 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Eric Paris, (Sun Aug 17, 7:19 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Alan Cox, (Mon Aug 18, 11:33 am)

Re: [malware-list] TALPA - a threat model? well sorta., Rik van Riel, (Mon Aug 18, 12:43 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Arjan van de Ven, (Sun Aug 17, 7:26 pm)

Re: [malware-list] TALPA - a threat model? well sorta., David Collier-Brown, (Sun Aug 17, 5:11 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Alan Cox, (Wed Aug 13, 5:23 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Eric Paris, (Thu Aug 14, 11:25 pm)

Re: [malware-list] TALPA - a threat model? well sorta., Alan Cox, (Wed Aug 13, 5:13 pm)

Navigation

Popular discussions


linux-kernel:
Greg Kroah-Hartman	[PATCH 008/196] Chinese: add translation of volatile-considered-harmful.txt
Tarkan Erimer	Re: Dual-Licensing Linux Kernel with GPL V2 and GPL V3
Greg KH	Re: [Patch v2] Make PCI extended config space (MMCONFIG) a driver opt-in
Andrew Morton	-mm merge plans for 2.6.23
git:

linux-netdev:
Gerrit Renker	[PATCH 27/37] dccp: Integration of dynamic feature activation - part 2 (server side)
Herbert Xu	Re: [PATCH] pkt_sched: Destroy gen estimators under rtnl_lock().
David Miller	[GIT]: Networking
Rémi Denis-Courmont	[PATCH 01/14] Phonet global definitions
openbsd-misc:

Colocation donated by: