Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforon access scanning

On Mon, 18 Aug 2008, Pavel Machek wrote:

Hi!

And I still don't get this 'mmap problem' that I don't solve that
libmalware magically solves. What? don't use mmap? I certainly hope
not.

Don't use mmap, it is as simple as that. AFAICS mmap(MAP_SHARED) --
which is basically shared memory -- is fundamentally incompatible with
reliable virus scanning.

...or do you have a reasonable solution for mmap?


mmap has a few different problems

1. intercepting reads and writes to take action at that time

2. the fact that two programs can use it as an inter-process communication mechanism.

if you are worried about the IPC aspects, all you can do is forbid it, along with shared memory, pipes, network connections, etc. none of these provide you with a 'final result' that can be scanned, and as others have pointed out there are too many ways to do things that get assembled by the far side to try and catch all malware in them.

as for intercepting reads and writes. the approach I outlined addresses this by having the kernel mark thefile as dirty if any writes happen, and checking the file status at the time of doing the mmap instead of trying to do it when the file is accessed after the mmap.

David Lang
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Relevant Pages

  • Re: sharing memory with non-children
    ... >>> are two main types of shared memory available on most systems. ... >>> is mmap(). ... It maps the target file with MAP_SHARED only because ... that file rather than space on a paging device. ...
    (comp.unix.programmer)
  • Re: shared memory pointer
    ... I think I want to stay away from mmap because it uses the disk to ... strip charts in this python project to view my data. ... I have about 200 shared memory segments that the simulation creates. ...
    (comp.lang.python)
  • Re: [RFC v1][PATCH]page_fault retry with NOPAGE_RETRY
    ... threads Real time: ... mmap is never going to be pretty because it is always going to involve ... Distributing tasks will be a bit more tricky, since it would need to use ... the shared memory I believe. ...
    (Linux-Kernel)
  • Re: using mmap on large (> 2 Gig) files
    ... while mmap is just a memory access. ... either another python process or another external program. ... spinlock primitives, other types of synchronization mechanisms are provided by ... I do see value in providing a shared memory based spinlock ...
    (comp.lang.python)
  • Re: Design question for memory access by processes
    ... > to the OP to decide if the copy is a needless waste in the context of ... > overhead of even mmap() may cost the OP more. ... The shared memory is paged out to swap space rather than using the ...
    (comp.unix.programmer)