Warning: Sophie might ignore subdirectories under certain circumstances

Dirk Kraemer <[email protected]> Thu, 22 Jul 2004 16:06:50 +0200
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
Hi all!

We noticed following problem with sophie:

   OS: SuSE Linux 9.0, 9.1
   Sophie Version: sophie-3.04rc2
   Filesystem: ReiserFS

Within above environment, if we do a

   $ mkdir -p /tmp/dir1/dir2/dir3
   $ stat /tmp/dir1/dir2

we get a '0' for number of allocated
blocks for /tmp/dir1/dir2:

   File: »/tmp/dir1/dir2«
   Size: 72              Blocks: 0          IO Block: 4096   ...
   ...

But that number seems to be used by sophie
to decide if a subdirectory has to be scanned.
Within sophie_scandir.c we find at line 86:

    if (filestat.st_blocks > 0)
       if ((sophie_scandir(path)) > 0) {
            closedir(dirpt);
            return(1); /* virus found */
       }

So if this values is 0, sophie does not recursively
scan subdirectories, does not find any viruses within.

This effect does not occur when using ext2, ext3 with
SuSE or any of ext2,ext3,reiserfs with Debian Sarge.
So maybe check yourself if your system might have
the same problem.

If you comment out the (filestat.st_blocks > 0)
check, sophie scans subdirectories again. However,
does someone know into which problems we might run
now?

Regards

Dirk