More options for exclusions

[wschlich]

Hi!

Currently, skyldav can only be configured to exclude certain paths, mountpoints or filesystems from scanning completely.

Running skyldav on my laptop every day slows it down horribly, as each and every file is being scanned on every read access (cache doesn't help, as results are invalidated on every clamav update)

Therefore, I have a suggestion to add functionality and configuration options for scanning files only:

• that was opened for write was closed (FAN_CLOSE_WRITE) or that was modified (FAN_MODIFY)
• that are being executed through known execution system calls (seems fanotify is not directly able to do that?)

It would be nice to be able to apply these scan filters on a per-directory, per-filesystem and per-mountpoint basis, like this:

/etc/skyldav.rules:
--8<--
/ wx
/home/*/Download rwx
/var/tmp rwx
/tmp rwx
/srv rwx
--8<--
The rule for / should be inherited for every path beneath it which does not have specific rules.

What are your thoughts?

Cheers,
Wolfram

[xypron]

The fanotify API does not allow to identify that a file is opened for execution.

Would it help to have a customizing flag such that clamav updates should not invalidate the cache? Instead a maximum age could be used.

[wschlich]

Hmm. That lack of support for execution detection in the fanotify API is really a bummer :(

What about implementing the r+w filters using the FAN_CLOSE_WRITE / FAN_MODIFY options, so we could (at least) include/exclude read + write accesses of certain paths or path regexes ?

[wschlich]

Hmm. Seems there was a discussion about fanotify + FMODE_EXEC:

[Patch 1/1] fsnotify,fanotify: adding flag for execution
https://lkml.org/lkml/2011/3/24/202

Unfortunately, that did not lead to a final conclusion...

[xypron]

Hello Wolfram (@wschlich)

We already have EXCLUDE_PATH in /etc/skyldav.conf.

So what do you really espect to be different in the r/w-filters you suggest?
What I have understood is that you do not want to have files rescanned when clamav loads a new definition set.

Best regards

Heinrich Schuchardt

[wschlich]

Hey Heinrich!

Not really :) In the end, I'd like to have a usable computer with Skyld AV running and scanning the important things.

Technically, I'd like to be able to specify on a per-path(-regex) basis which files to scan on read or close-on-write/close-on-modified (and on execution, although that's currently unfortunately not possible with fanotify).

Cheers,
Wolfram

[xypron]

Hello Wolfram,

in version 0.6 I added configuration flag CLEAN_CACHE_ON_UPDATE. Does this solve you original problem.

Best regards

Heinrich