Re: [malware-list] [RFC 0/5] [TALPA] Intro to a linux interface for on access scanning

[tvrtko.ursulin@sophos.com]

Greg KH wrote on 05/08/2008 21:15:35:

> > > > Perf win, why bothering looking for malware in /proc when it can't
> > > > exist?  It doesn't take longer it just takes time having to do
> > > > 
> > > > userspace -> kernel -> userspace -> kernel -> userspace
> > > > 
> > > > just to cat /proc/mounts, all of this could probably be alliviated 
if we
> > > > cached access on non block backed files but then we have to come 
up with
> > > > a way to exclude only nfs/cifs.  I'd rather list the FSs that 
don't need
> > > > scanning every time than those that do....
> > > 
> > > How long does this whole process take?  Seriously is it worth the 
added
> > > kernel code for something that is not measurable?
> > 
> > Is it worth having 2 context switches for every open when none are
> > needed?  I plan to get numbers on that.
> 
> Compared to the real time it takes in the "virus engine"?  I bet it's
> totally lost in the noise.  Those things are huge beasts with thousands
> to hundreds of thousands of context switches.

No, because we are talking about a case here where we don't want to do any 
scanning. We want to detect if it is procfs (for example) as quickly as 
possible and don't do anything. Same goes for any other filesystem where 
it is not possible to store arbitrary user data.
 
> > > > In kernel caching is clearly a huge perf win.
> > > 
> > > Why?  If the cache is also in userspace, it should be the same, 
right?
> > 
> > In kernel cache has 0 context switches for every open.  Userspace
> > caching has 2.  Every open has to block, switch to the context of the
> > userspace client/cache, get that decisions, and then switch back to 
the
> > original process.
> 
> Again, compared to what?  If you in userspace are doing big complex
> things, such an overhead is trivial.

Again similar thing as above - In case of a cache we are not doing complex 
things.

So I think you can't argue that because scanning is slow everything else 
has to go to userspace. On a typical running system scanning is 
exceptional and everything else benefits from being in the fast path.

Tvrtko


Sophos Plc, The Pentagon, Abingdon Science Park, Abingdon,
OX14 3YP, United Kingdom.

Company Reg No 2096520. VAT Reg No GB 348 3873 20.