Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755397AbYHOKIA (ORCPT ); Fri, 15 Aug 2008 06:08:00 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752852AbYHOKHw (ORCPT ); Fri, 15 Aug 2008 06:07:52 -0400 Received: from embla.aitel.hist.no ([158.38.50.22]:34890 "EHLO embla.aitel.hist.no" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752716AbYHOKHw (ORCPT ); Fri, 15 Aug 2008 06:07:52 -0400 Message-ID: <48A55574.9070508@aitel.hist.no> Date: Fri, 15 Aug 2008 12:07:48 +0200 From: Helge Hafting User-Agent: Mozilla-Thunderbird 2.0.0.14 (X11/20080509) MIME-Version: 1.0 To: Eric Paris CC: Arjan van de Ven , linux-kernel@vger.kernel.org, malware-list@lists.printk.net, andi@firstfloor.org, riel@redhat.com, greg@kroah.com, tytso@mit.edu, viro@ZenIV.linux.org.uk, alan@lxorguk.ukuu.org.uk, peterz@infradead.org, hch@infradead.org Subject: Re: TALPA - a threat model? well sorta. References: <1218645375.3540.71.camel@localhost.localdomain> <20080813103951.1e3e5827@infradead.org> <1218653864.3540.109.camel@localhost.localdomain> <20080813143908.38796217@infradead.org> <1218723133.3540.137.camel@localhost.localdomain> In-Reply-To: <1218723133.3540.137.camel@localhost.localdomain> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1143 Lines: 26 It seems to me that this "scan on file open" business is the wrong way to do things - because it reduces performance. If you scan on file open, then your security sw is too late and getting in the way. It is better to scan in advance. Most machines has lots of idle time. Use that time to scan in advance, and mark the files as "clean". A "clean" file can be opened without further checking anytime - giving normal high performance. A file that gets written to becomes "dirty" until checked again. Some mechanism for making a clean copy of a clean file might help avoid excessive "dirtying". "Scan on open" might still be useful for cases when the system haven't kept up with writing, but please don't aim to have this be the _primary_ mode of scanning. A file server where most of the stuff is pre-scanned will likely perform much better than one scanning everything on open. Helge Hafting -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/