Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interfaceforon access scanning

!MAILaRCHIVE_VOTE_RePLACE
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
To: Arjan van de Ven <arjan@...>
Cc: Press, Jonathan <Jonathan.Press@...>, Greg KH <greg@...>, <linux-kernel@...>, <malware-list@...>, <linux-security-module@...>
Date: Tuesday, August 5, 2008 - 2:39 pm

On Tue, 2008-08-05 at 11:27 -0700, Arjan van de Ven wrote:

Thankfully my implementation will invalidate that close time check and
caching result.  It does the invalidating the same place we update mtime
and my understanding is that mmap has been updating mtime for quite a
while now.  So again, it might not be perfect, but that situation should
get caught the next time around.  I see close time checking as more of a
performance win and as a way to help close some of the length bad
information could exist than anything since its done in a non-blocking
path.

I think we all agree that open is the most interesting time for scanning
operations, but as Jonathan points out there is some value (even if not
perfect value) in looking at closes as well.


I actually already have an async non-blocking close notification built
in.  Instead of waiting for a userspace response we just queue the close
notification and move along.  When userspace gets around to it scanning
and allow/deny caching can then take place at a later time.

-Eric

--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

Messages in current thread:
Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interf..., Eric Paris, (Tue Aug 5, 2:39 pm)
Sidebar to [malware-list] [RFC 0/5] [TALPA] Intro to a linux..., David Collier-Brown, (Wed Aug 6, 7:40 am)
Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linuxinterfa..., David Collier-Brown, (Mon Aug 11, 12:11 pm)
Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linuxinterfa..., Arjan van de Ven, (Wed Aug 13, 10:28 am)
Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interf..., David Collier-Brown, (Wed Aug 6, 7:31 am)