If the module sends an INSTREAM request to the daemon, instead of a SCAN request, it can support remote instances of the daemon (and solve some file permission problems at the same time). There's a TODO for this in clamav.inc. Patch forthcoming.

CommentFileSizeAuthor
#1 1571596-1.instream.patch2.64 KBksenzee

Comments

ksenzee’s picture

ksenzee
she/her
commented
Status: Active » Needs review
StatusFileSize
new 1571596-1.instream.patch2.64 KB
manarth’s picture

manarth commented
Status: Needs review » Fixed

Committed to 7.x-1.x dev. Thanks!

manarth’s picture

manarth commented
Status: Fixed » Patch (to be ported)

Thinking about it, this should probably be back-ported to 6.x at some point too.

andyzhang’s picture

andyzhang commented

I am using 7.x-1.0-alpha2 and it seems the permission issue is still there.

andyzhang’s picture

andyzhang commented

After some digging I found that the permission issue I talked about in #4 is caused by an ubuntu setting.

In my Ubuntu server I set the clamd's TemporaryDirectory to /var/tmp. In order to get the INSTREAM running correctly, I need to add the following lines to the /etc/apparmor.d/usr.sbin.clamd

/var/tmp/ rw,
/var/tmp/** krw,

Without the above setting I always get the following error in the /var/log/syslog

 kernel: [1816799.083576] type=1400 audit(1347260627.516:70): apparmor="DENIED" operation="mknod" parent=1 profile="/usr/sbin/clamd" name="/var/tmp/clamav-7495a4ef6aeb300f55e6a9aec3283ffe" pid=1113 comm="clamd" requested_mask="c" denied_mask="c" fsuid=106 ouid=106

Although I fixed my Ubuntu server issue, I don't know how to make an equivalent changes to the RedHat 6 server. Does anyone know how to do that? Thanks

rooby’s picture

rooby commented
Version: 7.x-1.0-alpha1 » 7.x-1.0-alpha2

Seems like this needs some docs as per #4 & #5.

srees’s picture

srees commented
Issue summary: View changes

I had issues as well on 6.x with the daemon getting permission denied since php/apache insists on 0600 perms for the tmp directory on file uploads, and unless I wanted to run clam as www-data...well, I couldn't access the file to scan it. I initially made a successful patch that saved the current file perms, chmod'd it to 660 (added clamav to www-data group), then restored the file perms after the scan. However, I figured INSTREAM was probably the better way to go...

I wanted to comment that the patch provided works perfectly when transplanted to 6.x. I couldn't port my copy of it though because my clamav is already modified to support several additional things. Thank you very much.

manarth’s picture

manarth commented
Version: 7.x-1.0-alpha2 » 6.x-1.0-beta2
Status: Patch (to be ported) » Closed (outdated)

ClamAV-6.x is now unsupported, so there are no plans to back-port the patch.

INSTREAM is working as expected in ClamAV 7.x and 8.x.

For documentation of the non-Drupal components, I'd initially suggest http://www.clamav.net/documents/installing-clamav as the canonical guide, to avoid having to maintain a parallel set of documentation that isn't related to the Drupal setup.