Re: [malware-list] [RFC 0/5] [TALPA] Intro to alinuxinterfaceforonaccess scanning

[Al Viro <viro@ZenIV.linux.org.uk>]

On Tue, Aug 05, 2008 at 05:23:39PM -0400, Press, Jonathan wrote:

> [JON PRESS]  So how would that work?  The FTP server would have code
> that called into someone's AV SDK (maybe CA's, maybe not) and scanned
> the file before sending.  OK.  What about all the thousands of other
> applications that might access a file and send it somewhere, or copy it
> somewhere.  They should all do the same thing, right?  How do we make
> that happen?  That's the whole point of centralizing the control (the
> notification, blocking and waiting -- not the actual scanning, of
> course) in the kernel.  The scan becomes unavoidable -- and that is the
> definition (OK, a definition) of true security.

Give me a break...  There's nothing to stop you from doing that as
a stackable fs, cachefs-based filesystem, fuse-based filesystem,
CODA with trimmed-down server that does scan-on-commit, et sodding cetera.

Again, do you or do you not expect the malware to be active on scanning
host?  Yes or no, please.

These two variants are so fundamentally different that discussion without
clearly indicating which variant you are currently talking about is absolutely
pointless.