squalou
commented
1 year ago Hi, I came to the same result 2 hours ago and was about to open an issue here.
I found this since :
https://gist.github.com/johnfedoruk/19820540dc096380784c8cf0b7ef333b
with an interesting part
No matter what I did, I could not get the clamd.conf VirusEvent directive to work.
Reading the source, it becomes clear that the issue is with line 83 of the code as of version v0.100 (and >removed completely in the latest stable versions)
/* TODO : FIXME? virusaction forks. This could be extraordinarily problematic, lead to deadlocks,
* or at the very least lead to extreme memory consumption. Leaving disabled for now.*/
//virusaction(fname, virname, tharg->opts);It would be great if we could have an official statement about this.
I'm thinking about a dirty workaround : monitoring the log file.
Consider this script : /etc/clamav/clamonacc-log-notifier.sh (make it chmod +x)
#!/bin/bash
while IFS= read LINE;do
if [[ $LINE == *"FOUND"* ]];then
export CLAM_VIRUSEVENT_FILENAME=$(echo $LINE | cut -d : -f 1)
SIG=$(echo $LINE | cut -d : -f 2)
export CLAM_VIRUSEVENT_VIRUSNAME=${SIG/ FOUND//}
/etc/clamav/virus-event.bash
fi
doneand create a small service somehow that runs this
then this script : /etc/clamav/clamonacc-log-monitor.sh (make it chmod +x)
#!/bin/bash
tail -F -n 0 /var/log/clamav/clamonacc.log | /etc/clamav/clamonacc-log-notifier.sh-F takes care of log rotation, -n 0 avoid spam from history.
Now a service file /etc/systemd/system/clamav-clamonacc-notifier.service
[Unit]
Description=ClamAV On-Access Notifier
Requires=clamav-clamonacc.service
After=clamav-daemon.service syslog.target network.target
[Service]
Type=simple
User=root
ExecStart=/etc/clamav/clamonacc-log-monitor.sh
Restart=always
[Install]
WantedBy=multi-user.targetthen
systemctl daemon-reload
systemctl enable clamav-clamonacc-notifier.
systemctl start clamav-clamonacc-notifier.and for reference
/etc/clamav/virus-event.bash
#!/bin/bash
PATH=/usr/bin
ALERT="Signature detected by clamav: $CLAM_VIRUSEVENT_VIRUSNAME in $CLAM_VIRUSEVENT_FILENAME"
# Send an alert to all graphical users.
for ADDRESS in /run/user/*; do
USERID=${ADDRESS#/run/user/}
/usr/bin/sudo -u "#$USERID" DBUS_SESSION_BUS_ADDRESS="unix:path=$ADDRESS/bus" PATH=${PATH} \
/usr/bin/notify-send -i dialog-warning "Virus found!" "$ALERT"
doneSeems to work.
Not nice but works.
On the other hand I discovered /etc/clamav/virusevent.d so I wonder if something's cooking in the future,
official guidance would be great.
spiarh
micahsnyder
alchemist18
Schnoogemetzger
hinricht
Describe the bug
Hi *, I've been scratching my head for a few hours with trying to make
VirusEventwork without success, it seems the command is never executed even though a file is actually detected. I haven't seen anything helpful in the logs.I've also tried to run as root with the same results.
How to reproduce the problem
Config:
When scanning with
clamdscan, the eicar file is correctly detected but the VirusEvent/usr/bin/touch /tmp/TOTOis never triggered. I originally tried with a script that has the right permission0755and the script was also not executed.This is the outputs in the logs.
Any idea where should I look at ? Thanks!