Alan Cox <alan@xxxxxxxxxxxxxxxxxxx> wrote on 18/08/2008 16:31:48:
Huh? I was never advocating re-scan after each modification and I even
butexplicitly said it does not make sense for AV not only for performancepoint,because it will be useless most of the time. I thought sending out
modified notification on close makes sense because it is a natural
theunless someone is trying to subvert which is out of scope. Other have
suggested time delay and lumping up.
You need a bit more than close I imagine, otherwise I can simply keepfile open forever. There are lots of cases where that would be natural
behaviour - eg if I was to attack some kind of web forum and insert a
windows worm into the forum which was database backed the file would
probably never be closed. That seems to be one of the more common attack
vectors nowdays.
Yes, I agree that modification notifications are needed in some cases.
Also, just to double-check, you don't think AV scanning would read the
whole file on every write?
So you need the system to accumulate some kind of complete in memory set
of 'dirty' range lists on all I/O ? That is going to have pretty bad
performance impacts and serialization.
No, I was just saying scanning is pretty smart, it's not some brute force
method of scan all data that is there. It has a file type detection and
what and how to scan is determined by that. If a file does not resemble
any file type I don't think it gets scanned. For example take couple of
gigabytes of zeros and try to scan that with some products. I don't think
they will try to read the whole file.