Re: Warning: Sophie might ignore subdirectories under certain circumstances

"L. Jankok" <[email protected]> Thu, 22 Jul 2004 18:08:23 +0200
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
is sophie still worth using now it is not being
mantained anymore ?.

On  0, Dirk Kraemer <[email protected]> wrote:
:Hi all!
:
:We noticed following problem with sophie:
:
:  OS: SuSE Linux 9.0, 9.1
:  Sophie Version: sophie-3.04rc2
:  Filesystem: ReiserFS
:
:Within above environment, if we do a
:
:  $ mkdir -p /tmp/dir1/dir2/dir3
:  $ stat /tmp/dir1/dir2
:
:we get a '0' for number of allocated
:blocks for /tmp/dir1/dir2:
:
:  File: »/tmp/dir1/dir2«
:  Size: 72              Blocks: 0          IO Block: 4096   ...
:  ...
:
:But that number seems to be used by sophie
:to decide if a subdirectory has to be scanned.
:Within sophie_scandir.c we find at line 86:
:
:   if (filestat.st_blocks > 0)
:      if ((sophie_scandir(path)) > 0) {
:           closedir(dirpt);
:           return(1); /* virus found */
:      }
:
:So if this values is 0, sophie does not recursively
:scan subdirectories, does not find any viruses within.
:
:This effect does not occur when using ext2, ext3 with
:SuSE or any of ext2,ext3,reiserfs with Debian Sarge.
:So maybe check yourself if your system might have
:the same problem.
:
:If you comment out the (filestat.st_blocks > 0)
:check, sophie scans subdirectories again. However,
:does someone know into which problems we might run
:now?
:
:Regards
:
:Dirk
:
:_______________________________________________
:vtools mailing list
:[email protected]
:http://www.vanja.com/list/listinfo.cgi/vtools