Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934377AbXK2Xff (ORCPT ); Thu, 29 Nov 2007 18:35:35 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1762220AbXK2XfU (ORCPT ); Thu, 29 Nov 2007 18:35:20 -0500 Received: from dallas.jonmasters.org ([72.29.103.172]:50838 "EHLO dallas.jonmasters.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1761190AbXK2XfT (ORCPT ); Thu, 29 Nov 2007 18:35:19 -0500 Subject: Re: Out of tree module using LSM From: Jon Masters To: Alan Cox Cc: Ray Lee , tvrtko.ursulin@sophos.com, Al Viro , Casey Schaufler , Christoph Hellwig , linux-kernel@vger.kernel.org, Valdis.Kletnieks@vt.edu In-Reply-To: <20071129214527.1d62056c@the-village.bc.nu> References: <20071128183040.GW8181@ftp.linux.org.uk> <20071129173601.34273083@the-village.bc.nu> <2c0942db0711291040j4ce48acagb753b64c4b8c1357@mail.gmail.com> <1196362612.6473.98.camel@perihelion> <2c0942db0711291111t16a4eb49h6b1e83ddf7bb4cf9@mail.gmail.com> <1196365551.6473.103.camel@perihelion> <20071129214527.1d62056c@the-village.bc.nu> Content-Type: text/plain Organization: World Organi[sz]ation Of Broken Dreams Date: Thu, 29 Nov 2007 18:34:33 -0500 Message-Id: <1196379273.6473.121.camel@perihelion> Mime-Version: 1.0 X-Mailer: Evolution 2.12.0 (2.12.0-3.fc8) Content-Transfer-Encoding: 7bit X-SA-Do-Not-Run: Yes X-SA-Exim-Connect-IP: 74.92.29.237 X-SA-Exim-Mail-From: jonathan@jonmasters.org X-SA-Exim-Scanned: No (on dallas.jonmasters.org); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1177 Lines: 27 On Thu, 2007-11-29 at 21:45 +0000, Alan Cox wrote: > > Jargon File in all its glory. And if you still think you could look for > > patterns, how about executable code that self-modifies in random ways > > but when executed as a whole actually has the functionality of fetchmail > > embedded within it? How would you guard against that? > > Thats a problem for whoever writes the ESR detection tool and to what > level it works. The question for the kernel is how do we provide a > mechanism to allow (to some extent at least) this kind of tool to run. Right. I'm just saying reading a single page out of context (no pun intended) is not going to be very useful. They need to scan the entire file, which means that there are limited ways this is practical - it's not practical to do that on every write into a shared mapping, hence a solution that scans on open, etc. is probably the best there is. (I know you know this) Jon. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/