Language Selection

English French German Italian Portuguese Spanish

Kernel space: Virus scanning API spawns security debate

Filed under
Linux

The TALPA malware scanning API was covered in LWN in December, 2007. Several months later, TALPA is back - in the form of a patch set posted by a Red Hat employee. The resulting discussion has certainly not been what the TALPA developers would have hoped for; it is, instead, a good example of how a potentially useful idea can be set back by poor execution and presentation to the kernel community.

The idea behind TALPA is simple: various companies in the virus-scanning business would like a hook into the kernel which allows them to check for malware and prevent its spread. So the patch adds a hook into the VFS code which intercepts every file open operation. A series of filters can be attached to this intercept, with the most important one being a mechanism which makes the file being opened available to a user-space process as a read-only file descriptor. That process can scan the file and tell the kernel whether the open operation should be allowed to proceed or not. In this way, the scanning process can prevent any sort of access to files which are deemed to contain bits with evil intentions.

There are a few other details, of course. A caching mechanism prevents rescanning of unchanged files, increasing performance considerably.

More here




More in Tux Machines

Leftovers: OSS

Development News

  • GCC 7 Moves Onto Only Regression/Doc Fixes, But Will Accept RISC-V & HSA's BRIG
    The GNU Compiler Collection (GCC) is entering its "stage four" development for GCC 7 with the stable GCC 7.1 release expected in March or April. Richard Biener announced today that GCC 7 is under stage four, meaning only regression and documentation fixes will be permitted until the GCC 7.1.0 stable release happens (yep, as per their peculiar versioning system, GCC 7.1 is the first stable release in the GCC 7 series).
  • 5 ways to expand your project's contributor base
    So many free and open source software projects were started to solve a problem, and people began to contribute to them because they too wanted a fix to what they encountered. End users of the project find it useful for their needs, and the project grows. And that shared purpose and focus attracts people to a project's community.
  • Weblate 2.10.1
    This is first security bugfix release for Weblate. This has to come at some point, fortunately the issue is not really severe. But Weblate got it's first CVE ID today, so it's time to address it in a bugfix release.

Intel Kabylake: Windows 10 vs. Linux OpenGL Performance

For those curious about the current Kabylake graphics performance between Windows 10 and Linux, here are some OpenGL benchmark results under each operating system. Windows 10 Pro x64 was tested and the Linux distributions for comparison were Ubuntu 16.10, Clear Linux, Antergos, Fedora 25 Xfce, and openSUSE Tumbleweed. Read more

Google's open-source Tilt Brush: Now you can create 3D movies in VR