How would people feel about adding some sort of caching feature to the clamuko thread in order to cache the results of previous scans? This could dramatically speed things up for on-access scanning of often-used files..
Of course, the cache entry would have to be invalidated if the file is ever opened for writing to avoid exploits.
(Ideally it would be invalidated when the actual writes happen but the write events don't work in current versions of dazuko on linux 2.6 kernels).
The cache could be useful for files that are often opened readonly...
Would such a patch be welcomed?
I searched the mailing list archives and could find no previous inquiries into this particular performance enhancement so at least it's not a moot point...
-Calin
_______________________________________________ http://lurker.clamav.net/list/clamav-devel.html
