Cc: Press, Jonathan <Jonathan.Press@...>, <alan@...>, <andi@...>, Arjan van de Ven <arjan@...>, <hch@...>, Helge Hafting <helge.hafting@...>, <linux-kernel@...>, <malware-list@...>, Peter Zijlstra <peterz@...>, <viro@...>
Let's go back to the threat model. The Threat Model which Eric Paris
has suggested is that we are only trying to solve the Scanning
Problem. Just Scanning.
That implies if the malware has been written to the disk, we will
catch it once AV catching is turned on and the user attempts to run or
otherwise access the file with the bad content. However, if the
malware starts running, then regardless of whether the malware is
running with user privileges, or manages to get root privileges via
some buffer overflow that wasn't caught via
LSM/SELinux/AppAmor/whatever, this is out of scope of Eric's proposal.
Are we agreed on that? There may be other components of the solution
such as LSM, SELinux, etc., that will very likely be useful in
protecting the system once the malware starts running. But I thought
Eric's proposal proposed excluding that from the Threat Model for the
purposes of the interface we are trying to solve. If that's not true,
let's deal with it now.
That's not a problem given the scanning model proposed by Eric; when
you insert removable media, it will get scanned when it is first
accessed.
- Ted
--
