headers
Jonathan Dumke | 23 Sep 2008 20:08
Picon

Re: 2.6.27 kernels


> On Thu, 28 Aug 2008 19:47:57 +0300
> Sami Tikka <sami.tikka <at> f-secure.com> wrote:
> 
>> Frantisek Hrbata kirjoitti 28.8.2008 kello 18.34:
>>
[...]
>>> scanning besides logs or some other output?
>> Probably not. I just asked because F-Secure AV software has always had  
>> settings for scan-on-open, scan-on-exec and scan-on-close. Scan-on- 
>> close is nice-to-have and I have never heard anyone using just one of  
>> scan-on-open or scan-on-exec.
> 
> AVG has also options for scanOnOpen, scanOnExec and scanOnCloseModified.
> I think that is because dazuko provides such events :). Question is if
> it is necessary to notify user-space scanner which event triggered the
> scanning at all.
> 
> -FH 

In my opinion the scanOnExec option is a completly different to
scanOnOpen, example of my understanding folloes here:
sample cmd: vim ascript.sh
scanOnExec should scan the vim, cause it is execited
scanOnOpen should scan the script, cause it's opend or may be it scans
both vim and the edited file.

Just a nother thing. Because the kernel and its interfaces are still in
progress, I think it should be a good idea to encapsulate the needed
api-calls by a dazuko-framework-library.
(Continue reading)

Permalink | Reply | 1 comment |
headers
Frantisek Hrbata | 24 Sep 2008 13:35
Favicon

Re: Re: 2.6.27 kernels

On Tue, 23 Sep 2008 20:08:16 +0200
Jonathan Dumke <jds <at> jonathan-dumke.de> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> > On Thu, 28 Aug 2008 19:47:57 +0300
> > Sami Tikka <sami.tikka <at> f-secure.com> wrote:
> >
> >> Frantisek Hrbata kirjoitti 28.8.2008 kello 18.34:
> >>
> [...]
> >>> scanning besides logs or some other output?
> >> Probably not. I just asked because F-Secure AV software has always
> >> had settings for scan-on-open, scan-on-exec and scan-on-close.
> >> Scan-on- close is nice-to-have and I have never heard anyone using
> >> just one of scan-on-open or scan-on-exec.
> >
> > AVG has also options for scanOnOpen, scanOnExec and
> > scanOnCloseModified. I think that is because dazuko provides such
> > events :). Question is if it is necessary to notify user-space
> > scanner which event triggered the scanning at all.
> >
> > -FH
> 
> In my opinion the scanOnExec option is a completly different to
> scanOnOpen, example of my understanding folloes here:
> sample cmd: vim ascript.sh
> scanOnExec should scan the vim, cause it is execited
(Continue reading)

Permalink | Reply | 0 comments |
headers
John Ogness | 24 Sep 2008 23:02

DazukoFS 3.0.0-rc1 posted

Hi,

I am very happy (and excited) to announce that DazukoFS 3.0.0-rc1 has
been posted. I have spent the past month working on a complete rewrite
of the file access logic as well as the userspace interface. Many of
the ideas for the rewrite were inspired from the various discussions
that took place on the malware-list.

I will be writing an article for the Dazuko website that will go into
details about the changes (what they are and why they were made) and
discuss some very interesting benchmarks that were taken. But until I
find time for the article, I wanted to post a very brief set of
answers about DazukoFS.

1. Is DazukoFS compatible with Dazuko?

No. DazukoFS uses different devices and a new device protocol. The way
that DazukoFS interacts with userspace applications is also
different. (The userspace application receives a read-only, open file
descriptor to the file being accessed, rather than a filename.)

2. Is it possible to run Dazuko and DazukoFS at the same time?

Yes. Dazuko and DazukoFS are two totally different sets of code. There
is not a single line of code that is shared between them. DazukoFS is
a complete rewrite, focussing on security and performance, with no
considerations for backwards compatibility. This means that both
Dazuko and DazukoFS can run side by side without getting in each
other's way.
(Continue reading)

Permalink | Reply | 2 comments |
headers
John Ogness | 26 Sep 2008 09:10

DazukoFS 3.0.0-rc1 crash

Hi,

Today I experienced a crash in the DazukoFS group-management code. I
have not yet looked into it. I just wanted to report it.

John Ogness

Sep 26 08:36:05 localhost kernel: Oops: Exception in kernel mode, sig: 5 [#1]
Sep 26 08:36:05 localhost kernel: PowerMac
Sep 26 08:36:05 localhost kernel: Modules linked in: dazukofs [last unloaded: cfg80211]
Sep 26 08:36:05 localhost kernel: NIP: f2090a78 LR: f2090a60 CTR: c0049154
Sep 26 08:36:05 localhost kernel: REGS: eaecfd80 TRAP: 0700   Not tainted  (2.6.26.5)
Sep 26 08:36:05 localhost kernel: MSR: 00029032 <EE,ME,IR,DR>  CR: 22000428  XER: 20000000
Sep 26 08:36:05 localhost kernel: TASK = eae93300[3543] 'showfiles' THREAD: eaece000
Sep 26 08:36:05 localhost kernel: GPR00: 00000001 eaecfe30 eae93300 e11f65b0 00000003 00000000
eae93334 00000000 
Sep 26 08:36:05 localhost kernel: GPR08: 00000000 00000001 ee9988e0 f2094f68 00000000 1001a144
00000000 10030000 
Sep 26 08:36:05 localhost kernel: GPR16: 10030000 10030000 10030000 10030000 eaecfe98 eaecfe9c
eaecfea0 eae9d674 
Sep 26 08:36:05 localhost kernel: GPR24: f2090000 eae9d690 eae9d6a4 eaecfe38 eaf204e0 f2094f68
eaf253c0 eae9d660 
Sep 26 08:36:05 localhost kernel: NIP [f2090a78] dazukofs_get_event+0x25c/0x42c [dazukofs]
Sep 26 08:36:05 localhost kernel: LR [f2090a60] dazukofs_get_event+0x244/0x42c [dazukofs]
Sep 26 08:36:05 localhost kernel: Call Trace:
Sep 26 08:36:05 localhost kernel: [eaecfe30] [f2090a60] dazukofs_get_event+0x244/0x42c [dazukofs] (unreliable)
Sep 26 08:36:05 localhost kernel: [eaecfe90] [f208f77c] dazukofs_group_read+0x80/0x14c [dazukofs]
Sep 26 08:36:05 localhost kernel: [eaecfef0] [c0084a10] vfs_read+0xc4/0x16c
Sep 26 08:36:05 localhost kernel: [eaecff10] [c0084eac] sys_read+0x4c/0x90
Sep 26 08:36:05 localhost kernel: [eaecff40] [c00138b4] ret_from_syscall+0x0/0x38
(Continue reading)

Permalink | Reply | 0 comments |
headers
jim burns | 29 Sep 2008 00:22

Re: DazukoFS 3.0.0-rc1 posted - nullfs problems on openSuSE 11.0

On Wed September 24 2008 5:02:55 pm John Ogness wrote:
> I am very happy (and excited) to announce that DazukoFS 3.0.0-rc1 has
> been posted. I have spent the past month working on a complete rewrite
> of the file access logic as well as the userspace interface. Many of
> the ideas for the rewrite were inspired from the various discussions
> that took place on the malware-list.
>
> I will be writing an article for the Dazuko website that will go into
> details about the changes (what they are and why they were made) and
> discuss some very interesting benchmarks that were taken. But until I
> find time for the article, I wanted to post a very brief set of
> answers about DazukoFS.
>
>
> 1. Is DazukoFS compatible with Dazuko?
>
> No. DazukoFS uses different devices and a new device protocol. The way
> that DazukoFS interacts with userspace applications is also
> different. (The userspace application receives a read-only, open file
> descriptor to the file being accessed, rather than a filename.)

1) Do you know if avira will come out with an antivir that works with 
dazukofs?

2) SuSE has a dazuko .src.rpm based on redirfs-0.2 and dazuko 2.3.4.4 
(presumably 2.3.5-pre1, to support redirfs), hence it's a little out of date, 
plus building it against the current 2.6.25.16 kernel works, but the modules 
don't load, with unknown symbol errors. The .src.rpm was originally designed 
against 2.6.25.5.
(Continue reading)

Permalink | Reply | 1 comment |

Gmane