Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon access scanning

From: "Peter Dolding" <oiaohm@gmail.com>
To: davecb@sun.com
Cc: david@lang.hm, rmeijer@xs4all.nl,
	"Alan Cox" <alan@lxorguk.ukuu.org.uk>,
	capibara@xs4all.nl, "Eric Paris" <eparis@redhat.com>,
	"Theodore Tso" <tytso@mit.edu>, "Rik van Riel" <riel@redhat.com>,
	linux-security-module@vger.kernel.org,
	"Adrian Bunk" <bunk@kernel.org>,
	"Mihai Don??u" <mdontu@bitdefender.com>,
	linux-kernel@vger.kernel.org, malware-list@lists.printk.net,
	"Pavel Machek" <pavel@suse.cz>,
	"Arjan van de Ven" <arjan@infradead.org>
Subject: Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon access scanning
Date: Mon, 18 Aug 2008 11:33:50 +1000	[thread overview]
Message-ID: <e7d8f83e0808171833j3aeda564j43ea4262ec2cea57@mail.gmail.com> (raw)
In-Reply-To: <48A89551.9050107@sun.com>

On Mon, Aug 18, 2008 at 7:17 AM, David Collier-Brown <davecb@sun.com> wrote:
> Peter Dolding wrote:
>>
>> Currently if we have a unknown infection on a  windows partition that
>> is been shared by linux the scanner on Linux cannot see that the
>> windows permissions has been screwed with.   OS with badly damaged
>> permissions is a sign of 1 of three things.  ...
>
> It's more likely that the files will reside on Linux/Unix under
> Samba, and so the permissions that Samba implements will be the ones
> that the virus is trying to mess up.  These are implemented in
> terms of the usual permission bits, plus extended attributes/ACLs.
> Linux systems mounting Windows filesystems are somewhat unusual (;-))
>
More desktop use of Linux more cases of ntfs and fat mounted under
Linux.  Funny enough linux mounting windows file systems is 100
percent normal for most Ubuntu users so there are a lot of them out
there doing it.   I am future looking there are other filesystems
coming with there own issues as well.

Same issue with samba no common store for extra permissions exist so
on file systems that don't support there permissions storage it goes
back into there tdb storage.

Basically scanning everything to detect issues currently nicely
complex.  We have a huge permissions mess.  Some permissions are
processed by the file system drivers.  Some are processed by vfs then
others processed and stored by individual applications.   So no where
in Linux can you see all the permissions being applied to a single
file to be sure there is not a secuirty risk somewhere.  Samba or
equal allowing access to remove a virus signature from the black list
or added something that should not be allowed to the white list would
be major problems.

Posix has not helped US here at all.   No where in posix does it
provide anything to clean up this mess.  Does solarias have a solution
I know BSD and Linux does not.   I think all posix OS's have a mess in
this section.

Peter Dolding