Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interface for on access scanning

[Alan Cox <alan@lxorguk.ukuu.org.uk>]

> No, I want a sane security policy in kernelsapce that doesn't look
> at the content because doing security by content properly is equivalent
> to solving the halting problem.  I couldn't give a rats a** about
> windows viruses as they can't actually cause any harm on a Linux
> machine.

Go on then.. post patches.

I think your are being incredibly naïve. Our memory debugging is not 100%
solid but work by heuristic. Our lock analysis doesn't solve the halting
problem but is extremely useful and so on.

> Well, data can change all the time, as can the path name.  This whole
> content scanning thing doesn't make any sense at all.

Phone numbers change all the time, shall we burn all the phone books ?

> So make this opt-in and in userspace.  Just LD_PRELOAD some monster lib
> doing all the horrible things you propose and use it wherever you want.

Rather tricky as the needed hooks don't exist and you need to get ahead
of even ld.so as well as protect suid apps. You've clearly not even
thought about the problem space before sounding off because there are
more elegant ways of tackling it even if you want to push it at
userspace, and ones that aren't implausible like LD_PRELOAD.

If you'd applied even 30 seconds thought you would at least be pointing
people at FUSE or a stacking fs.

Alan