Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon access scanning

["Rob Meijer" <capibara@xs4all.nl>]

On Fri, August 15, 2008 07:38, david@lang.hm wrote:
> On Thu, 14 Aug 2008, david@lang.hm wrote:
>
>> On Thu, 14 Aug 2008, david@lang.hm wrote:
>>
>>> again, libmalware.so is not referring to any specific body of code,
>>> it's
>>> referring to the concept that the handling of open/mmap/read/etc and
>>> scanning is done via a userspace library rather then by the kernel. if
>>> everyone can agree on that concept then hashing out the details of
>>> _which_
>>> library it gets put in is a smaller detail.
>>
>> one reason to layer scanners is that you could have one that just checks
>> to
>> see if the file was deployed from a OS package, if it was (and still has
>> the
>> same hash as the package manager thinks it should have) it sets a flag
>> that
>> other scanners could look for (if they see it they can skip scanning the
>> file)
>
> actually, instead of trying to have one scanner trust the results of
> another, a better approach would be for libmalware to look for the package
> manager approval and if it finds that it could skip asking the other
> scanners to look at it.

The package manager approach is interesting in that it marks 'trusted',
and is thus permissive rather than restrictive. Maybe it would be possible
to extend on this and simply define a set of currently unprivileged access
as privileged for untrusted applications. That way you could allow
untrusted software to run without risk, even if that untrusted software
turns out to be malware. That is, it may be possible to solve the malware
problem in a much more fundamental way here by just allowing malware to
run without the need to know if it is malware, just by running untrusted
software with reduced privileges.

Rob