From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752834AbYHRBp2 (ORCPT ); Sun, 17 Aug 2008 21:45:28 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751155AbYHRBpP (ORCPT ); Sun, 17 Aug 2008 21:45:15 -0400 Received: from mail.lang.hm ([64.81.33.126]:47189 "EHLO bifrost.lang.hm" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750858AbYHRBpO (ORCPT ); Sun, 17 Aug 2008 21:45:14 -0400 Date: Sun, 17 Aug 2008 18:44:57 -0700 (PDT) From: david@lang.hm X-X-Sender: dlang@asgard.lang.hm To: Peter Dolding cc: davecb@sun.com, rmeijer@xs4all.nl, Alan Cox , capibara@xs4all.nl, Eric Paris , Theodore Tso , Rik van Riel , linux-security-module@vger.kernel.org, Adrian Bunk , Mihai Don??u , linux-kernel@vger.kernel.org, malware-list@lists.printk.net, Pavel Machek , Arjan van de Ven Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon access scanning In-Reply-To: Message-ID: References: <18129.82.95.100.23.1218802937.squirrel@webmail.xs4all.nl> <48A89551.9050107@sun.com> User-Agent: Alpine 1.10 (DEB 962 2008-03-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 18 Aug 2008, Peter Dolding wrote: > On Mon, Aug 18, 2008 at 7:17 AM, David Collier-Brown wrote: >> Peter Dolding wrote: >>> >>> Currently if we have a unknown infection on a windows partition that >>> is been shared by linux the scanner on Linux cannot see that the >>> windows permissions has been screwed with. OS with badly damaged >>> permissions is a sign of 1 of three things. ... >> >> It's more likely that the files will reside on Linux/Unix under >> Samba, and so the permissions that Samba implements will be the ones >> that the virus is trying to mess up. These are implemented in >> terms of the usual permission bits, plus extended attributes/ACLs. >> Linux systems mounting Windows filesystems are somewhat unusual (;-)) >> > More desktop use of Linux more cases of ntfs and fat mounted under > Linux. Funny enough linux mounting windows file systems is 100 > percent normal for most Ubuntu users so there are a lot of them out > there doing it. I am future looking there are other filesystems > coming with there own issues as well. but what you are missing is that when they are mounted under linux it doesn't matter what hidden things the other OS may access, all that matters is what Linux sees. If Linux doesn't see something it can't serve it out to those other OSs. those 'hidden things' would only matter if you were trying to use linux to scan a drive and bless it for another system to then mount locally. If we aren't trying to defend against that (and I don't hear anyone other then you saying we should) then we don't need to worry about such things. If we were trying to make the drive safe for all other OSs to mount directly, then mearly seeing everything isn't enough, you would have to be able to fully duplicate how the other OS interprets the things you are seeing, and know all vunerabilities that arise from all possible interpretations. I don't think that's possible (and I don't think it would be possible even if the source for all those other OSs were available) David Lang