Re: [malware-list] request for comment: generic kernel interface for malware vendors

[tvrtko.ursulin@sophos.com]

malware-list-bounces@dmesg.printk.net wrote on 29/07/2008 05:50:58:

> On Mon, 2008-07-28 at 20:39 -0700, Greg KH wrote:
> > On Mon, Jul 21, 2008 at 12:18:07AM -0400, Eric Paris wrote:
> > > 
> > > This is a request for comment.  This is a first stab and I'm here to
> > > address all of the concerns that people have.  Please don't hold 
back,
> > > I've got thick skin.  BUT, I don't want to hear 'this is how we have
> > > been doing it, do it that way.'  I want to hear how this won't work 
for
> > > your needs (and WHY) or how we can do it better.
> > > 
> > > you can find the patches at:
> > > http://people.redhat.com/~eparis/talpa
> 
> Ouch. Adds a bunch of hooks outside of LSM - what's the plan here wrt.
> LSM, because LKML folks are going to ask :)

What is the plan with LSM is also a question? Is it gonna stay or be 
removed? Stacking looks like it will never happen and so it really doesn't 
cut it for this kind of use. Although it has hooks at the right places 
(I'm pretty sure but haven't looked in a while) for this first iteration. 

Tvrtko

P.S. How much is a bunch? I think there are just two hooks in this 
prototype.


Sophos Plc, The Pentagon, Abingdon Science Park, Abingdon,
OX14 3YP, United Kingdom.

Company Reg No 2096520. VAT Reg No GB 348 3873 20.