Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon access scanning

From: Alan Cox <alan@lxorguk.ukuu.org.uk>
To: rmeijer@xs4all.nl
Cc: capibara@xs4all.nl, david@lang.hm,
	"Eric Paris" <eparis@redhat.com>, "Theodore Tso" <tytso@mit.edu>,
	"Rik van Riel" <riel@redhat.com>,
	davecb@sun.com, linux-security-module@vger.kernel.org,
	"Adrian Bunk" <bunk@kernel.org>,
	"Mihai Don??u" <mdontu@bitdefender.com>,
	linux-kernel@vger.kernel.org, malware-list@lists.printk.net,
	"Pavel Machek" <pavel@suse.cz>,
	"Arjan van de Ven" <arjan@infradead.org>
Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to	alinuxinterfaceforon access scanning
Date: Fri, 15 Aug 2008 12:02:25 +0100	[thread overview]
Message-ID: <20080815120225.118d81da@lxorguk.ukuu.org.uk> (raw)
In-Reply-To: <8676.82.95.100.23.1218795012.squirrel@webmail.xs4all.nl>

> The package manager approach is interesting in that it marks 'trusted',
> and is thus permissive rather than restrictive. Maybe it would be possible
> to extend on this and simply define a set of currently unprivileged access
> as privileged for untrusted applications. That way you could allow
> untrusted software to run without risk, even if that untrusted software
> turns out to be malware. That is, it may be possible to solve the malware
> problem in a much more fundamental way here by just allowing malware to
> run without the need to know if it is malware, just by running untrusted
> software with reduced privileges.
> 

Its called SELinux and SELinux can already do this sort of stuff,
including things like "only rpm may create files you are permitted to
execute"