Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Maldet + Clamav + Inotify scanning ClamAV's tmp folders #431

Open
dj-rb opened this issue Jan 7, 2025 · 0 comments
Open

Maldet + Clamav + Inotify scanning ClamAV's tmp folders #431

dj-rb opened this issue Jan 7, 2025 · 0 comments

Comments

@dj-rb
Copy link

dj-rb commented Jan 7, 2025

Operating system: Debian 12.8
Maldet version: v1.6.5

It seems that ClamAV has changed the way it name its temporary folders.
As a result inotify notify the folder to be scanned to ClamAV.
So ClamAV is trying to scan his own temporary folders.
This looks like the same issue as #104.

/tmp/20250107_062025-scantemp.ed82fb7483 CREATE,ISDIR 07 Jan 06:20:25
/tmp/20250107_062025-scantemp.d928110df8 CREATE,ISDIR 07 Jan 06:20:25
/tmp/20250107_062025-scantemp.d928110df8/clamav-cd377025266a65d8cf537a9627ac2e9d.tmp CREATE 07 Jan 06:20:25
/tmp/20250107_062025-scantemp.d928110df8/clamav-cd377025266a65d8cf537a9627ac2e9d.tmp MODIFY 07 Jan 06:20:25
/tmp/20250107_062025-scantemp.03666a0674 CREATE,ISDIR 07 Jan 06:20:25
/tmp/20250107_062040-scantemp.d80ebd4b19 CREATE,ISDIR 07 Jan 06:20:40
/tmp/20250107_062055-scantemp.ac8212a820 CREATE,ISDIR 07 Jan 06:20:55
/tmp/20250107_062110-scantemp.803b983120 CREATE,ISDIR 07 Jan 06:21:10

I solved this issue by adding the following to 'ignore_inotify' file.

/tmp/.*scantemp.*

I think it will be better if we can detect the complete folder name YYYYMMDD_HHMMSS-scantemp but I have not been able to make the inotify syntax work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant