Re: Out of tree module using LSM

On Thu, Nov 29, 2007 at 09:35:56AM -0800, Ray Lee wrote:
On Nov 29, 2007 9:03 AM, Greg KH <greg@xxxxxxxxx> wrote:
On Thu, Nov 29, 2007 at 05:53:33PM +0100, Jan Engelhardt wrote:

On Nov 29 2007 08:47, Greg KH wrote:
On Thu, Nov 29, 2007 at 11:36:12AM -0500, Jon Masters wrote:
On Wed, 2007-11-28 at 17:07 -0800, Greg KH wrote:

The easiest way is as Al described above, just have the userspace
program that wrote the file to disk, check it then.

But the problem is that this isn't just Samba, this is a countless
myriad of different applications. And if one of them doesn't support
on-access scanning, then the whole solution isn't worth using.

Ok, which specific applications do they care about? Last time I asked
it was still limited to a very small handful, all of which would be
trivial to add such a hook to.

Well, think bash, syscalls. While you can add a plugin to samba "easily",
it seems overkill to do the same for rm, mv, cp, bash.

Again, these are not things that these companies care about.

Perhaps if you looked at this outside of a file-server scenario, the
problem would be clearer? Anti-malware companies want to check
anything written to disk on a system, either at write time or blocking
the open/mmap. That means proactively protecting email programs with
known vulnerabilities that have yet to be patched, web browsers
writing and reading their caches, an Apache instance running WebDAV,
the list goes on. And these are on desktop systems, with no attached
file/network server.

Ok, if they want to check on every open/mmap then just hook in glibc to
do this. Especially as they want to run userspace code at this point in
time.

Again, let's wait for some code to show up before discussing this
further.

thanks,

greg k-h
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Relevant Pages

  • Re: Disklabe oddity
    ... On Sun, 2003-09-21 at 02:46, Greg 'groggy' Lehey wrote: ... >> partition was created by FreeBSD on its own. ... >> back on the disk. ... I wasn't planning to put the swap on the fs, ...
    (freebsd-questions)
  • Re: Whats the deal with PAGEIOLATCH_SH?
    ... In addition to what Greg suggests are you monitoring the Checkpoint Pages ... Checkpoints can really hose a disk with low ... About 20 minutes into the query everything goes bad. ... > I'll work on getting the real execution plan, ...
    (microsoft.public.sqlserver.programming)
  • Re: Copy and swap hard drive
    ... > I have used the copy drive feature it to make an exact copy of the ... > If I have the old drive in Disk 0 Windows boots perfectly. ... Greg do you have a WindowsXP CD? ...
    (microsoft.public.windowsxp.general)
  • Re: Out of tree module using LSM
    ... anything written to disk on a system, either at write time or blocking ... the open/mmap. ...
    (Linux-Kernel)
  • Re: Lost Hard Drive
    ... Greg, physically check the drive connections both power and ribbon cable. ... "Greg Kauffman" wrote in message ... > I have two hard drives in my computer they where ... > Disk Management, and the disk shows up as a basic disk ...
    (microsoft.public.windowsxp.hardware)