Re: Question regarding clamonacc: Blocking file writes/copy operations in watched directories

> The Requirement:=A0My project requires strict prevention of malicious
> files entering the monitored directory.  Specifically, I need
> clamonacc=A0to block the copy operation itself=A0or immediately
> quarantine/remove the file upon the close_write=A0event, rather than
> waiting for a subsequent read/open access to trigger the scan.

Does this confg option
     OnAccessExtraScanning BOOL
        Toggles extra scanning and notifications when a file or directory
        is created or moved.
        Requires the  DDD system to kick-off extra scans.
        Default: no
help ?

------------------

More generally, I can understand your desire.

However, what happens if a file is placed in the monitored directory
and *then* the database is updated to recognise that file as malware ?
You now have a bad file in the directory, so you need to rescan it
when you read/open it even if it was scanned when it was written.

Have you considered putting *incoming* files into a quarantine directory,
scanning them and then 'mv'ing them into the special safe directory ?

[ There are also practical problems with scanning a file as it is written.
   To be sure that the file does not have harmful content, you would need
   to scan it for *every* file system write command - even for EICAR
   if you write every character separately, it is not going to trigger
   until (nearly?) every character has been written.
   Is it safe to wait until the file is closed to scan it ?
   If so a system crash could leave the malware accessible on reboot.
   If not, scanning during/after every write system call would be very
   slow, if feasible.                                                  ]

> - Question:=A0Is there a specific configuration in clamd.conf=A0(such
> as specific OnAccess=A0settings) that I might be missing to enforce
> blocking during the write/copy phase?


-- =

Andrew C. Aitchison                      Kendal, UK
                    [email protected]
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat