Re: Out of tree module using LSM

From: Christoph Hellwig <hch@infradead.org>
To: Jan Engelhardt <jengelh@computergmbh.de>
Cc: Greg KH <greg@kroah.com>, Jon Masters <jonathan@jonmasters.org>,
	Valdis.Kletnieks@vt.edu, Christoph Hellwig <hch@infradead.org>,
	Al Viro <viro@ftp.linux.org.uk>,
	Casey Schaufler <casey@schaufler-ca.com>,
	"Tvrtko A. Ursulin" <tvrtko.ursulin@sophos.com>,
	linux-kernel@vger.kernel.org
Subject: Re: Out of tree module using LSM
Date: Thu, 29 Nov 2007 16:57:31 +0000	[thread overview]
Message-ID: <20071129165731.GA30719@infradead.org> (raw)
In-Reply-To: <Pine.LNX.4.64.0711291752550.13075@fbirervta.pbzchgretzou.qr>

On Thu, Nov 29, 2007 at 05:53:33PM +0100, Jan Engelhardt wrote:
> >> But the problem is that this isn't just Samba, this is a countless
> >> myriad of different applications. And if one of them doesn't support
> >> on-access scanning, then the whole solution isn't worth using.
> >
> >Ok, which specific applications do they care about?  Last time I asked
> >it was still limited to a very small handful, all of which would be
> >trivial to add such a hook to.
> >
> Well, think bash, syscalls. While you can add a plugin to samba "easily",
> it seems overkill to do the same for rm, mv, cp, bash.

Can we please stop this useless discussion?  Trying to check the content
of files to see whether they might be malicious is inherently braindead,
and no amounts of plugins in random places will fix this.