RE: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforonaccess scanning

[Press, Jonathan]

-----Original Message-----
From: Greg KH [mailto:greg@xxxxxxxxx] 
Sent: Tuesday, August 05, 2008 5:15 PM
To: Press, Jonathan
Cc: Theodore Tso; Arjan van de Ven; Eric Paris;
linux-kernel@xxxxxxxxxxxxxxx; malware-list@xxxxxxxxxxxxxxxx;
linux-security-module@xxxxxxxxxxxxxxx
Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to
alinuxinterfaceforonaccess scanning

On Tue, Aug 05, 2008 at 04:37:42PM -0400, Press, Jonathan wrote:
> 
> [JON PRESS]  I don't get the connection between what I said and your
> point about not needing blocking open() interface.  If I ftp into a
> Linux machine and GET an infected file, you want FTP to go right ahead
> and read it and send it to me over the wire?

Shouldn't that be the issue of the FTP server itself not serving up
"invalid" files, and not the kernel?  Why not just hook in it, I'm
pretty sure they already provide this kind of interface, right?


[JON PRESS]  So how would that work?  The FTP server would have code
that called into someone's AV SDK (maybe CA's, maybe not) and scanned
the file before sending.  OK.  What about all the thousands of other
applications that might access a file and send it somewhere, or copy it
somewhere.  They should all do the same thing, right?  How do we make
that happen?  That's the whole point of centralizing the control (the
notification, blocking and waiting -- not the actual scanning, of
course) in the kernel.  The scan becomes unavoidable -- and that is the
definition (OK, a definition) of true security.


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/