Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Regex or Wildcards cannot be used in the OnAccessExcludePath directive #1074

Closed
Meloknight89 opened this issue Oct 25, 2023 · 8 comments · Fixed by #1314
Closed

Regex or Wildcards cannot be used in the OnAccessExcludePath directive #1074

Meloknight89 opened this issue Oct 25, 2023 · 8 comments · Fixed by #1314
Labels
clamonacc 🥺feature request

Comments

@Meloknight89
Copy link

Describe the bug

Hello everyone, I'm encountering an issue with ClamAV's on-access scanning configuration on my Linux 4.18.0-516.el8.x86_64 system, running ClamAV version 0.103.10. I've defined the on-access watch path as /home and attempted to exclude the /home/*/.thunderbird path using the OnAccessExcludePath directive. However, it appears that the OnAccessExcludePath directive is only having effect, when an absolute path is defined. However, this method does not support the use of wildcards or regex, which makes it less flexible for my use case as I have multiple dynamic user directories to exclude.

Here are some details about my setup:

ClamAV Version: 0.103.10
Supported Optional Features: MEMPOOL, IPv6, AUTOIT_EA06, BZIP2, LIBXML2, PCRE2, ICONV, JSON
Platform: Linux 4.18.0-516.el8.x86_64, OS: linux-gnu, ARCH: x86_64, CPU: x86_64
zlib Version: 1.2.11 (1.2.11), Compile Flags: a9

Config file: clamd.d/scan.conf

AlertExceedsMax disabled
PreludeEnable disabled
PreludeAnalyzerName disabled
LogFile = "/var/log/clamd/clamd.log"
LogFileUnlock disabled
LogFileMaxSize = "20971520"
LogTime = "yes"
LogClean = "yes"
LogSyslog = "yes"
LogFacility = "LOG_LOCAL6"
LogVerbose disabled
LogRotate = "yes"
ExtendedDetectionInfo = "yes"
PidFile disabled
TemporaryDirectory disabled
DatabaseDirectory = "/var/lib/clamav"
OfficialDatabaseOnly disabled
LocalSocket = "/run/clamd.scan/clamd.sock"
LocalSocketGroup = "root"
LocalSocketMode = "660"
FixStaleSocket = "yes"
TCPSocket disabled
TCPAddr disabled
MaxConnectionQueueLength = "200"
StreamMaxLength = "26214400"
StreamMinPort = "1024"
StreamMaxPort = "2048"
MaxThreads = "16"
ReadTimeout = "120"
CommandReadTimeout = "30"
SendBufTimeout = "500"
MaxQueue = "100"
IdleTimeout = "30"
ExcludePath disabled
MaxDirectoryRecursion = "15"
FollowDirectorySymlinks disabled
FollowFileSymlinks disabled
CrossFilesystems = "yes"
SelfCheck = "600"
ConcurrentDatabaseReload disabled
DisableCache disabled
VirusEvent = "/usr/local/sbin/clamd_virus_event.sh %v"
ExitOnOOM disabled
AllowAllMatchScan = "yes"
Foreground disabled
Debug disabled
LeaveTemporaryFiles disabled
User disabled
Bytecode = "yes"
BytecodeSecurity = "TrustSigned"
BytecodeTimeout = "10000"
BytecodeUnsigned disabled
BytecodeMode = "Auto"
DetectPUA disabled
ExcludePUA disabled
IncludePUA disabled
ScanPE = "yes"
ScanELF = "yes"
ScanMail = "yes"
ScanPartialMessages disabled
PhishingSignatures = "yes"
PhishingScanURLs = "yes"
HeuristicAlerts = "yes"
HeuristicScanPrecedence disabled
StructuredDataDetection disabled
StructuredMinCreditCardCount = "3"
StructuredMinSSNCount = "3"
StructuredSSNFormatNormal = "yes"
StructuredSSNFormatStripped disabled
ScanHTML = "yes"
ScanOLE2 = "yes"
AlertBrokenExecutables disabled
AlertBrokenMedia disabled
AlertEncrypted disabled
StructuredCCOnly disabled
AlertEncryptedArchive disabled
AlertEncryptedDoc disabled
AlertOLE2Macros disabled
AlertPhishingSSLMismatch disabled
AlertPhishingCloak disabled
AlertPartitionIntersection disabled
ScanPDF = "yes"
ScanSWF = "yes"
ScanXMLDOCS = "yes"
ScanHWP3 = "yes"
ScanArchive = "yes"
ForceToDisk disabled
MaxScanTime disabled
MaxScanSize = "104857600"
MaxFileSize = "26214400"
MaxRecursion = "17"
MaxFiles = "10000"
MaxEmbeddedPE = "10485760"
MaxHTMLNormalize = "10485760"
MaxHTMLNoTags = "2097152"
MaxScriptNormalize = "5242880"
MaxZipTypeRcg = "1048576"
MaxPartitions = "50"
MaxIconsPE = "100"
MaxRecHWP3 = "16"
PCREMatchLimit = "100000"
PCRERecMatchLimit = "2000"
PCREMaxFileSize = "26214400"
OnAccessMountPath disabled
OnAccessIncludePath = "/home"
OnAccessExcludePath = "/home/*/.thunderbird"
OnAccessExcludeRootUID disabled
OnAccessExcludeUID disabled
OnAccessExcludeUname = "root"
OnAccessMaxFileSize = "5242880"
OnAccessDisableDDD disabled
OnAccessPrevention = "yes"
OnAccessExtraScanning disabled
OnAccessCurlTimeout = "5000"
OnAccessMaxThreads = "5"
OnAccessRetryAttempts disabled
OnAccessDenyOnError disabled
DevACOnly disabled
DevACDepth disabled
DevPerformance disabled
DevLiblog disabled
DisableCertCheck disabled
AlgorithmicDetection = "yes"
BlockMax disabled
PhishingAlwaysBlockSSLMismatch disabled
PhishingAlwaysBlockCloak disabled
PartitionIntersection disabled
OLE2BlockMacros disabled
ArchiveBlockEncrypted disabled

Has anyone else experienced this issue? Is there a workaround to allow wildcards or regex in directory path exclusions for on-access scanning in ClamAV? Any insights or suggestions would be greatly appreciated!

How to reproduce the problem

  1. Create exclude list file and add "/home/*/.thunderbird".
  2. Run: clamonacc --foreground --fdpass --config-file=/etc/clamd.d/scan.conf --exclude-list=/etc/clamd.d/exclude_list --verbose
  3. Observe the verbose output

image
@rsundriyal
Copy link
Contributor

@Meloknight89
Thanks for sharing the feedback. Seems like a good functionality to add.

If anyone from the ClamAV Dev Community would like to work on this feature request, we will be happy to review and merge it.

@b1tg
Copy link
Contributor

b1tg commented Jan 4, 2024

@rsundriyal I'd like to try this. Could you please specify the types of wildcards we should support? Are we limited to patterns like /home/*/.thunderbird, or should we also consider variations such as /home/*/*/abc, /home/.ab*, and so on?

@micahsnyder
Copy link
Contributor

@b1tg Thanks for volunteering to help. There is a similarly named ExcludePath option for clamd.conf that does support regexes. I think it would be appropriate to have OnAccessExcludePath do it the same way.

The code for ExcludePath is here:

clamav/common/clamdcom.c

Lines 154 to 163 in 23dfe8f

if ((opt = optget(clamdopts, "ExcludePath"))->enabled) {
while (opt) {
if (match_regex(path, opt->strarg) == 1) {
logg("*%s: Excluded\n", path);
status = 1;
goto done;
}
opt = opt->nextarg;
}
}

@Meloknight89
Copy link
Author

@b1tg @micahsnyder Thank you for taking this on and for providing the code for the ExcludePath. Do you have an approximate timeline for when this will be included in the latest release?

@micahsnyder
Copy link
Contributor

@Meloknight89 Sorry I can't promise we'll work on it. Too many other things to do. I would be happy to review a PR if someone else wants to work on it though.

If anyone does work on it, I think it would be helpful to have clamonacc (and clamdscan) check the ExcludePath option as well. For clamonacc, that would be in the same location as OnAccessExcludePath is checked.

@b1tg
Copy link
Contributor

b1tg commented Jul 22, 2024

Working on it, will send out a PR this week.

@b1tg b1tg mentioned this issue Jul 22, 2024
Merged
@b1tg
Copy link
Contributor

b1tg commented Aug 8, 2024

Hi @micahsnyder , any update for the PR review progress?

@micahsnyder
Copy link
Contributor

I noticed this issue also duplicates #178

@micahsnyder micahsnyder mentioned this issue Sep 26, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
clamonacc 🥺feature request
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add regex support for OnAccessExcludePath b1tg/clamav
4 participants
@rsundriyal @micahsnyder @b1tg @Meloknight89