Re: Out of tree module using LSM

[Greg KH <greg@kroah.com>]

On Wed, Nov 28, 2007 at 06:30:40PM +0000, Al Viro wrote:
> On Wed, Nov 28, 2007 at 01:15:05PM -0500, Valdis.Kletnieks@vt.edu wrote:
> > (Note that the concept has interesting implications in the other direction as
> > well - rather than stopping you from reading a file that has malware, you could
> > in theory write an anti-export package that would let you write onto external
> > memory or outbound e-mail, but prevent the write if it was corporate-sensitive
> > data, or whatever.
> 
> You _can_ _not_ do that.  If shared mapping gets dirtied, you have no way to
> intercept that.  At all.  Especially since the page stays mapped while it is
> written out, so the next modification can come when hardware had already
> started outbound DMA and there's no way to abort it, no matter what your
> external scanner would do.
> 
> Folks, really, that doesn't work.  At all.  You can intercept all system
> calls you want and it will not be enough to prevent the "bad" contents
> from hitting the disk.
> 
> And if we are talking about the situation when files are written to in
> controlled way (i.e. we are not concerned with malware running on the box
> in question and just want to stop it from passing through mailsewer, etc.),
> then there's no damn need to play with LSM - just have e.g. coda with its
> commit-on-close and run the scanner on commit.  End of story.  Mind you,
> in such setups one would be much better off just having the mail server run
> the tests explicitly in the userland, along with the rest of anti-spam, etc.
> filters.

I've repeated the above statements so many times to a number of the
anti-virus companies, and other people that really should know better,
that I'm really sick of it.  For some reason, they keep trying to do
things like this in the kernel, despite it being trivial to do in
userspace properly.

In the end, I even got one company to agree that it should be done in
userspace (McAfee), but they ignored this and went off to update their
kernel code again :(

Just because other operating systems require you to do things like this
within the kernel, doesn't mean that you have to do the same thing on
Linux...

so sad,

greg k-h