Cc: Alan Cox <alan@...>, <capibara@...>, <david@...>, Eric Paris <eparis@...>, Theodore Tso <tytso@...>, Rik van Riel <riel@...>, <davecb@...>, <linux-security-module@...>, Adrian Bunk <bunk@...>, Mihai Don??u <mdontu@...>, <linux-kernel@...>, <malware-list@...>, Pavel Machek <pavel@...>, Arjan van de Ven <arjan@...>
On Fri, Aug 15, 2008 at 10:22 PM, Rob Meijer <capibara@xs4all.nl> wrote:
They way I look at this. Most users complain that creating profiles
for applications is too complex.
Lets look for where a system that deals with the same kind of issue.
Its in the firewall with ipset http://ipset.netfilter.org/.
You have a set of rules to do things assigned in the firewall. With
secuirty this would be the LSM. User gets to choose from a predefined
list for applications without profiles.
Lets look at some basics here. Firefox and most internet applications
don't need to edit everything in the user account. If some link
could be designed into LSM for user to once off approve actions
outside filesystem permissions from the grouping. Malware reading and
writing stuff would be a lot harder.
Major problem everyone keeps on missing. TALPA is only operating with
part of the full information about the file. When file systems go
from native file system to inodes currently the permissions on the
native file system are translated to what linux supports and any that
don't fit is disregarded. Due to that difference each file system
has its own cache and holes on the file system where viruses could
hide data for other OS's on the system. So TALPA might save Linux
only to see another OS on the system infected. Worst case is if the
other OS infected could come back and alter Linux disabling the virus
scanner and reinfecting Linux.
TALPA from its current location is partly blind same with most other
anti-virus and malware scanner running on linux. Unfortunately to
remove this blindness is rework the file system interface layer.
Single cache for all file system drivers with TALPA embeded where it
can scan everything about a file so when its clean its truly clean.
Also for desktop users being able to see the permissions on there
removable media to make sure they are correct would be a god send.
This is a flaw that people from most other OS's would not think about.
Since Linux is one of the rare places it exists. LIM and HIDS are
also effected by this blindness. A hids scanning file systems under
Linux can report that everything is fine when the damage is
permissions that Linux is not translating. We have a black hole of
thrown away data that cannot be simply scanned.
Long term performance also comes into play. Current system we have a
few too many caches to ever think about making the file system cache
lock less. Its blinding and a future bottle neck.
Suppose this defect has been there so long people are thinking of it as normal.
Peter Dolding
--
