Cc: Greg KH <greg@...>, Al Viro <viro@...>, Press, Jonathan <Jonathan.Press@...>, Theodore Tso <tytso@...>, Arjan van de Ven <arjan@...>, <linux-kernel@...>, <malware-list@...>, <linux-security-module@...>
On Tue, 05 Aug 2008 20:25:29 -0400
Eric Paris <eparis@redhat.com> wrote:
That's not my worry.
My real worry is that the anti-virus companies have been working
with an enforcement policy that has been evolving slowly from the
DOS days, while today's threat model has changed considerably.
I do not see how the proposed hooks would close off a system
sufficiently to claim anything approaching security.
The way forward is to:
1) define a threat model
2) figure out what infrastructure is needed for protection
3) come up with interfaces that also help other software
(eg. file range inotify to help disk indexing software)
Trying to shoe-horn the DOS anti-virus security model into a
multi-user operating system with networking may not be sufficient
protection for today's world. Eg. it does not protect against
script virusses fetched off web sites and executed directly in
a browser, office suite or any gnome-vfs enabled program. This
is a major vulnerability in modern systems.
What problem are we really trying to solve?
Which problems are out of scope?
What infrastructure can solve the problem, while being useful
for other things too?
--
All rights reversed.
--
