Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interface foron access scanning

[Alan Cox]

> In any case, the above relates to Windows desktops -- we are yet to see 
> a rationale for adding AV support to the Linux kernel.

s/we/you/

Clearly some people do see a rationale. At least some parts of it also
seem to make sense for picking up stuff in transit and for catching stuff
'in flight' between systems that might be more vulnerable.

It does appear possible to create a meaningful set of functionality for a
subset of the problem space - assuming no local compromise.

	- open for write causes some kind of state transition (even
SELinux label change)
	- last close notifies a userspace tool of some form (be it an
indexer or a scanner or whatever)
	- tool may or may not take some kind of action such as
relabelling.

At that point you can use selinux rules to say things like 'samba cannot
access content in 'change-in-progress' state.

Whether you allow opens to block for a scan really comes down to a risk
tradeoff. The "safe" approach is 'sorry someone has it open for writing
go away'. The lax approach is "yeah whatever, we may be unlucky if
something passes across our file server at the right moment" (allowing
anyone to read change-in-progress files) and somewhere in between is the
"wait a moment while I scan it" case, which reduces the time window of
attack considerably with a very high chance of detection if the attacker
gets it wrong).



Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/