OnAccessIncludePath Patch

The following patch allows a whole mount point to be scanned.
i.e.
set "OnAccessIncludePath /" and your whole drive will be scanned, kind of
like real time scanning.

--- clamav-0.98.5.orig/clamd/fan.c    2014-11-13 17:30:35.000000000 -0500
+++ clamav-0.98.5/clamd/fan.c    2014-12-20 03:35:56.295882036 -0500
@@ -94,7 +94,14 @@
     short int scan;
     int sizelimit = 0, extinfo;
     STATBUF sb;
-        uint64_t fan_mask = FAN_ACCESS | FAN_EVENT_ON_CHILD;
+        uint64_t fan_mask =
+        (FAN_ACCESS |         /* File accessed */
+        FAN_MODIFY |         /* File modified */
+        FAN_CLOSE_WRITE |    /* Writtable file closed */
+        FAN_CLOSE_NOWRITE |  /* Unwrittable file closed */
+        FAN_OPEN |           /* File was opened */
+        FAN_ONDIR |          /* We want to be reported of events in the
directory */
+        FAN_EVENT_ON_CHILD); /* We want to be reported of events in files
of the directory */
     int fan_fd;
         fd_set rfds;
     char buf[4096];
@@ -132,7 +139,7 @@

     if((pt = optget(tharg->opts, "OnAccessIncludePath"))->enabled) {
     while(pt) {
-        if(fanotify_mark(fan_fd, FAN_MARK_ADD, fan_mask, fan_fd,
pt->strarg) != 0) {
+        if(fanotify_mark(fan_fd, FAN_MARK_ADD|FAN_MARK_MOUNT, fan_mask,
fan_fd, pt->strarg) != 0) {
         logg("!ScanOnAccess: Can't include path '%s'\n", pt->strarg);
         return NULL;
         } else
_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net

http://www.clamav.net/contact.html#ml