Re: Regexps for "OnAccess*cludePath"?
"Valerie Snyder \(valsnyde\) via clamav-users" <[email protected]> Tue, 14 Jul 2026 16:53:12 +0000
| Newsgroups | gmane.comp.security.virus.clamav.user |
|---|---|
| Message-ID | <IA4PR11MB9323BF960C812A5BE99AF2ACDEF92@IA4PR11MB9323.namprd11.prod.outlook.com> |
--===============3060227972529336697== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_IA4PR11MB9323BF960C812A5BE99AF2ACDEF92IA4PR11MB9323namp_" --_000_IA4PR11MB9323BF960C812A5BE99AF2ACDEF92IA4PR11MB9323namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Rainer, The pull request you linked was merged prior to 1.5, but it only includes r= egex support for OnAccessExcludePath and not OnAccessIncludePath. It was m= entioned in the release notes for 1.5.0 but I suppose I neglected to update= the sample configs and online documentation to reflect the change. We should correct that. Sadly, I do not know of a way to solve the exact problem you're describing,= though I do see the value. I'm absolutely open to an additional change to = make OnAccessIncludePath be a regex as well, or else adding a second option= for each, that is explicitly a regex, and deprecating the originals. Swapp= ing OnAccessExcludePath to be a regex directly was a risky maneuver conside= ring strings like ".cache" change meaning, and should really be "\.cache". Anyways, I'm sorry this is probably not the response you were hoping for. Respectfully, Val Valerie Snyder (she/they) ClamAV Development Talos Cisco Systems, Inc. ________________________________ From: clamav-users <[email protected]> on behalf of Dr = Rainer Woitok via clamav-users <[email protected]> Sent: Monday, July 13, 2026 3:57 PM To: [email protected] <[email protected]> Cc: Dr Rainer Woitok <[email protected]> Subject: [clamav-users] Regexps for "OnAccess*cludePath"? Greetings, do the values for configuration variables "OnAccess*cludePath" really have to be absolute paths? Searching the Internet I find https://github.com/Cisco-Talos/clamav/issues/1074 https://github.com/Cisco-Talos/clamav/issues/178 https://github.com/Cisco-Talos/clamav/pull/1314 which all suggest that allowing regexps was at least discussed in 2024. But neither the documentation at https://docs.clamav.net/manual/OnAccess.html nor my local Clamav 1.5.2 file "/etc/clamav/clamd.conf.sample" contains any indication that regular expressions are supported (in contrast to configuration variable "ExcludePath"). Have these pull requests been a- bandoned? And if yes why? I hesitate to configure OnAccessIncludePath /home because I'm afraid this could cause massive delays. I would rather only specify files which really are retrieved from the Internet, as in OnAccessIncludePath /home/.+/Downloads OnAccessIncludePath /home/.+/.cache/mozilla/firefox/.+/cache2/entries Is there a way to achieve this? Sincerely, Rainer _______________________________________________ Manage your clamav-users mailing list subscription / unsubscribe: https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/Cisco-Talos/clamav-documentation https://docs.clamav.net/#mailing-lists-and-chat --_000_IA4PR11MB9323BF960C812A5BE99AF2ACDEF92IA4PR11MB9323namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo= ttom:0;} </style> </head> <body dir=3D"ltr"> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> Hi Rainer,</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> The pull request you linked was merged prior to 1.5, but it only includes r= egex support for OnAccessExcludePath and not OnAccessIncludePath. It = was mentioned in the release notes for 1.5.0 but I suppose I neglected to u= pdate the sample configs and online documentation to reflect the change. </div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> We should correct that.</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> Sadly, I do not know of a way to solve the exact problem you're describing,= though I do see the value. I'm absolutely open to an additional change to = make OnAccessIncludePath be a regex as well, or else adding a second option= for each, that is explicitly a regex, and deprecating the originals. Swapping OnAccessExcludePath to be a= regex directly was a risky maneuver considering strings like ".cache&= quot; change meaning, and should really be "\.cache". = </div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> Anyways, I'm sorry this is probably not the response you were hoping for.&n= bsp;</div> <div id=3D"Signature" class=3D"elementToProof"> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" style=3D"font-family: Calibri, Arial, Helveti= ca, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> Respectfully,</div> <div class=3D"elementToProof" style=3D"font-family: Calibri, Arial, Helveti= ca, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> Val</div> <div class=3D"elementToProof" style=3D"font-family: Calibri, Arial, Helveti= ca, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> <span style=3D"font-family: Helvetica; font-size: 12px;">Valerie Snyder (sh= e/they)</span><br> <span style=3D"font-family: Helvetica; font-size: 12px;">ClamAV Development= </span><br> <span style=3D"font-family: Helvetica; font-size: 12px;">Talos</span><br> <span style=3D"font-family: Helvetica; font-size: 12px;">Cisco Systems, Inc= .</span><br> </div> </div> <div id=3D"appendonsend"></div> <hr style=3D"display:inline-block;width:98%" tabindex=3D"-1"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st= yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> clamav-users <clam= [email protected]> on behalf of Dr Rainer Woitok via cla= mav-users <[email protected]><br> <b>Sent:</b> Monday, July 13, 2026 3:57 PM<br> <b>To:</b> [email protected] <[email protected]&= gt;<br> <b>Cc:</b> Dr Rainer Woitok <[email protected]><br> <b>Subject:</b> [clamav-users] Regexps for "OnAccess*cludePath"?<= /font> <div> </div> </div> <div class=3D"BodyFragment"><font size=3D"2"><span style=3D"font-size:11pt;= "> <div class=3D"PlainText">Greetings,<br> <br> do the values for configuration variables "OnAccess*cludeP= ath" really<br> have to be absolute paths? Searching the Internet I find<br> <br> <a href=3D"https://github.com/Cisco-Talos/clamav/issues/1074">= https://github.com/Cisco-Talos/clamav/issues/1074</a><br> <a href=3D"https://github.com/Cisco-Talos/clamav/issues/178">h= ttps://github.com/Cisco-Talos/clamav/issues/178</a><br> <a href=3D"https://github.com/Cisco-Talos/clamav/pull/1314">ht= tps://github.com/Cisco-Talos/clamav/pull/1314</a><br> <br> which all suggest that allowing regexps was at least discussed in 202= 4.<br> But neither the documentation at<br> <br> <a href=3D"https://docs.clamav.net/manual/OnAccess.html">https= ://docs.clamav.net/manual/OnAccess.html</a><br> <br> nor my local Clamav 1.5.2 file "/etc/clamav/clamd.conf.sample&qu= ot; contains<br> any indication that regular expressions are supported (in= contrast to<br> configuration variable "ExcludePath"). Have these pull requ= ests been a-<br> bandoned? And if yes why?<br> <br> I hesitate to configure<br> <br> OnAccessIncludePath /home<br> <br> because I'm afraid this could cause massive delays. I would rather on= ly<br> specify files which really are retrieved from the Internet, as in<br> <br> OnAccessIncludePath /home/.+/Downloads<br> OnAccessIncludePath /home/.+/.cache/mozilla/firefox/.+/cache2/= entries<br> <br> Is there a way to achieve this?<br> <br> Sincerely,<br> Rainer<br> _______________________________________________<br> <br> Manage your clamav-users mailing list subscription / unsubscribe:<br> <a href=3D"https://lists.clamav.net/mailman/listinfo/clamav-users">https://= lists.clamav.net/mailman/listinfo/clamav-users</a><br> <br> <br> Help us build a comprehensive ClamAV guide:<br> <a href=3D"https://github.com/Cisco-Talos/clamav-documentation">https://git= hub.com/Cisco-Talos/clamav-documentation</a><br> <br> <a href=3D"https://docs.clamav.net/#mailing-lists-and-chat">https://docs.cl= amav.net/#mailing-lists-and-chat</a><br> </div> </span></font></div> </body> </html> --_000_IA4PR11MB9323BF960C812A5BE99AF2ACDEF92IA4PR11MB9323namp_-- --===============3060227972529336697== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Manage your clamav-users mailing list subscription / unsubscribe: https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/Cisco-Talos/clamav-documentation https://docs.clamav.net/#mailing-lists-and-chat --===============3060227972529336697==--