Re: [malware-list] scanner interface proposal was: [TALPA] Intro to a linux interface for on access scanning

[Alan Cox <alan@lxorguk.ukuu.org.uk>]

> On async notification we fire a message to everything that registered
> 'simultaneously.' On blocking we fire a message to everything in
> priority order and block until we get a response.  That response should
> be of the form ALLOW/DENY and should include "mark result"/"don't mark
> result."

No can do - you get stuck with recursive events with the virus checker
trying to stop the indexer from indexing a worm.

> read -> we have the ALLOW/mark result bit in core set so just allow.

Don't think we need this - SELinux can do that bit

> mtime update -> clear ALLOW/"mark result" bit in core, send async
> notification to userspace

Why via the kernel ?

> The communication with userspace has a very specific need.  The scanning
> process needs to get 'something' that will give it access to the
> original file/inode/data being worked on.  My previous patch set does

file handle. Really you need to give the handle of the object because it
may not have a name or a meaningful inode number