On Thu, Nov 05, 2020 at 10:21:40AM +0100, Magnus Hagander wrote: > The problem with AVs generally doesn't come from them opening files in > non-share mode (I've, surprisingly enough, seen backup software that > causes that problem for example). It might happen on scheduled scans > for example, but the bigger problem with AV software has always been > their filter driver software which intercepts both the open/close and > the read/write calls an application makes and "does it's magic" on > them before handing the actual call up to the operating system. It's > completely independent of how the file is opened.
This one is a bit new to me. I certainly saw my share of stat() or open() calls failing on ENOPERM because of file handles taken exclusively by external scanners around here or even with customer-related issues, and I did not expect that such dark magic could be involved in a write. It would indeed not be surprising to see a PANIC depending on what gets done. -- Michael
signature.asc
Description: PGP signature
