Re: Regexps for "OnAccess*cludePath"?

"Valerie Snyder \(valsnyde\) via clamav-users" <[email protected]> Wed, 15 Jul 2026 17:48:55 +0000
Newsgroups gmane.comp.security.virus.clamav.user
Message-ID <IA4PR11MB9323AFFFA56751DBC91192D8DEF82@IA4PR11MB9323.namprd11.prod.outlook.com>
--===============0477048757222349196==
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_IA4PR11MB9323AFFFA56751DBC91192D8DEF82IA4PR11MB9323namp_"

--_000_IA4PR11MB9323AFFFA56751DBC91192D8DEF82IA4PR11MB9323namp_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Rainer,

I don't think that implementing regex support for inclusions is a big ask o=
r much different than the process for exclusions. I agree with your recomme=
ndations as well.

Respectfully,
Val

Valerie Snyder (she/they)
ClamAV Development
Talos
Cisco Systems, Inc.
________________________________
From: Dr Rainer Woitok <[email protected]>
Sent: Wednesday, July 15, 2026 12:41 PM
To: Valerie Snyder (valsnyde) <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re: [clamav-users] Regexps for "OnAccess*cludePath"?

Valerie,

On Tuesday, 2026-07-14 16:53:12 +0000, you wrote:

> ...
> The pull request you linked was merged prior to 1.5, but it only includes=
 regex
> support for OnAccessExcludePath and not OnAccessIncludePath.

Hm,  is implementing regex support  really THAT different for exclusions
and inclusions?  Isn't it just: a file will be checked, if it is matched
by at least one include regex and by none of the exclude regexps?

> ...
>                                                                  Swapping
> OnAccessExcludePath to be a regex directly was a risky maneuver consideri=
ng
> strings like ".cache" change meaning, and should really be "\.cache".

Yes,  but I think everybody could live with options "OnAccess*cludePath"
and "OnAccess*cludeRegex"  and then for consistency's sake  perhaps even
"ExcludePath" and "ExcludeRegex", where you have the same problem.

> Anyways, I'm sorry this is probably not the response you were hoping for.

Never mind, its a want-have rather than a must-have :-)

Sincerely,
  Rainer

--_000_IA4PR11MB9323AFFFA56751DBC91192D8DEF82IA4PR11MB9323namp_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
Rainer,</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
I don't think that implementing regex support for inclusions is a big ask o=
r much different than the process for exclusions. I agree with your recomme=
ndations as well.&nbsp;</div>
<div id=3D"Signature" class=3D"elementToProof">
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Calibri, Arial, Helveti=
ca, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Respectfully,</div>
<div class=3D"elementToProof" style=3D"font-family: Calibri, Arial, Helveti=
ca, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Val</div>
<div class=3D"elementToProof" style=3D"font-family: Calibri, Arial, Helveti=
ca, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
<span style=3D"font-family: Helvetica; font-size: 12px;">Valerie Snyder (sh=
e/they)</span><br>
<span style=3D"font-family: Helvetica; font-size: 12px;">ClamAV Development=
</span><br>
<span style=3D"font-family: Helvetica; font-size: 12px;">Talos</span><br>
<span style=3D"font-family: Helvetica; font-size: 12px;">Cisco Systems, Inc=
.</span><br>
</div>
</div>
<div id=3D"appendonsend"></div>
<hr style=3D"display:inline-block;width:98%" tabindex=3D"-1">
<div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st=
yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> Dr Rainer Woitok &lt;=
[email protected]&gt;<br>
<b>Sent:</b> Wednesday, July 15, 2026 12:41 PM<br>
<b>To:</b> Valerie Snyder (valsnyde) &lt;[email protected]&gt;<br>
<b>Cc:</b> [email protected] &lt;[email protected]&=
gt;<br>
<b>Subject:</b> Re: [clamav-users] Regexps for &quot;OnAccess*cludePath&quo=
t;?</font>
<div>&nbsp;</div>
</div>
<div class=3D"BodyFragment"><font size=3D"2"><span style=3D"font-size:11pt;=
">
<div class=3D"PlainText">Valerie,<br>
<br>
On Tuesday, 2026-07-14 16:53:12 +0000, you wrote:<br>
<br>
&gt; ...<br>
&gt; The pull request you linked was merged prior to 1.5, but it only inclu=
des regex<br>
&gt; support for OnAccessExcludePath and not OnAccessIncludePath.<br>
<br>
Hm,&nbsp; is implementing regex support&nbsp; really THAT different for exc=
lusions<br>
and inclusions?&nbsp; Isn't it just: a file will be checked, if it is match=
ed<br>
by at least one include regex and by none of the exclude regexps?<br>
<br>
&gt; ...<br>
&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp; Swapping<br>
&gt; OnAccessExcludePath to be a regex directly was a risky maneuver consid=
ering<br>
&gt; strings like &quot;.cache&quot; change meaning, and should really be &=
quot;\.cache&quot;.<br>
<br>
Yes,&nbsp; but I think everybody could live with options &quot;OnAccess*clu=
dePath&quot;<br>
and &quot;OnAccess*cludeRegex&quot;&nbsp; and then for consistency's sake&n=
bsp; perhaps even<br>
&quot;ExcludePath&quot; and &quot;ExcludeRegex&quot;, where you have the sa=
me problem.<br>
<br>
&gt; Anyways, I'm sorry this is probably not the response you were hoping f=
or.<br>
<br>
Never mind, its a want-have rather than a must-have :-)<br>
<br>
Sincerely,<br>
&nbsp; Rainer<br>
</div>
</span></font></div>
</body>
</html>

--_000_IA4PR11MB9323AFFFA56751DBC91192D8DEF82IA4PR11MB9323namp_--

--===============0477048757222349196==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

--===============0477048757222349196==--