mainDazuko - Support: sr #103547, howto do on-access scanning with...

 
 

sr #103547: howto do on-access scanning with clamuko while writing new files

Submitter:  Alexander Stielau <aleks>
Submitted:  Tue 09 Nov 2004 11:47:03 AM UTC
   
 
Assigned to:  ogman Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Wed 02 Mar 2005 08:20:08 PM UTC, comment #8: 

Hi,

I am closing this support item since there has been no further feedback.

John Ogness

John Ogness <ogman>
Group administrator
Sat 05 Feb 2005 03:28:12 PM UTC, comment #7: 

Hi,

ON_CLOSE events for Linux 2.2/2.4 and FreeBSD are now 100% reliable in the new 2.1.0-birthday pre-release.

John Ogness <ogman>
Group administrator
Tue 30 Nov 2004 10:24:13 AM UTC, comment #6: 

Hi,

Dazuko 2.0.5-pre1 has been posted. This version has better support for pipes and redirects.

John Ogness <ogman>
Group administrator
Mon 15 Nov 2004 04:44:51 PM UTC, comment #5: 

What does it do after you hit Ctrl-C? Dazuko reports calls from the system call table. If Dazuko reports CLOSE, then there was probably a sys_close() call involved.

CLOSE under Linux does have some problems. With 2.0.5 it should be much better.

John Ogness <ogman>
Group administrator
Mon 15 Nov 2004 03:57:31 PM UTC, comment #4: 

2.0.4 is not good enough, when i try something like that:

cat > /tmp/foo

i get immediatly an open and a close event:

OPEN   uid:0 pid:1050 mode:438 flags:33345 file_uid:0 file_gid:0 file_device:5639 file_size:0 file:/tmp/foo
CLOSE  uid:0 pid:1050 file:/tmp/foo

It should not until close before, i use ctrl-c to interupt the cat, shouldn't it?


Alexander Stielau <aleks>
Thu 11 Nov 2004 08:07:42 AM UTC, comment #3: 

ON_CLOSE works with 2.4.x, but not 100% reliably. With FreeBSD it works much better. For the next version of Dazuko I will be porting these improvements in FreeBSD over to Linux. For 2.0.5 there should be reliable ON_CLOSE events for Linux 2.2/2.4.

I would recommend trying 2.0.4 with the Linux 2.4.27 kernel and see if it works good enough for your current needs. Otherwise, you may need to wait until 2.0.5.

John Ogness

John Ogness <ogman>
Group administrator
Wed 10 Nov 2004 09:50:19 AM UTC, comment #2: 

Okay, thank you for your advise.

The problem with only ON_OPEN / ON_EXEC behaviour is, that on this way it is possible to download files and save them in the same working process on external media (like usbsticks and that).
It is allowed to use this external media in this environment, so i thought about to scan in that moment - before it will written on the stick and pulled out of the monitored box away.

Is it possible to use this feature (i really need ON_CLOSE) with 2.4.27?

thankyou,
Aleks

Alexander Stielau <aleks>
Wed 10 Nov 2004 07:50:22 AM UTC, comment #1: 

Actually, everything looks like it is running perfectly. :)


> It is possible to cp a 'infected' file into a protected
> filesystem (/tmp is a extra partition) without an
> interception:


There is no ON_CLOSE event for Dazuko under Linux 2.6. This is because Dazuko uses the new Linux Security Model for Linux 2.6 and with this model it is not possible to detect files being closed.


> It is also possible to mv it on the same partition
> without interception


As you said, this is because there is no file access occurring here. Dazuko may support this in the future.

Under Linux 2.6 Dazuko will only generate ON_OPEN or ON_EXEC events. However, this is enough to have an effective anti-virus on-access scanner. Although viruses may be able to be saved on the machine, they cannot be opened or executed.

It is planned for the future to introduce a new stackable filesystem called DazukoFS. This will allow all access events to be captured by Dazuko (even under Linux 2.6). The problem is that it will have a much higher administrative overhead.

John Ogness

John Ogness <ogman>
Group administrator
Tue 09 Nov 2004 11:47:03 AM UTC, original submission:  

my setup:                                                                                                                                                                                                                         Debian/sid, vendor-kernel 2.6.8-1-k7                                   
filesystem is xfs
dazuko-module 2.0.4 (vanilla, debian-package is very old)                                                        clamv 0.80 (vanilla, because of debian package clamav-daemon 0.80-2 seems not to use the clamuk/dazuko-interface:                                                                    Nov  8 16:59:47 taurus2 clamd[2814]: Clamuko is not available.                                                                                                                                                           

Module initialisation and clamv-daemon starting looks good:

[dmesg]
dazuko: linux_dazuko_device_open() [1963]
dazuko: linux_dazuko_device_read() [1963]
dazuko: dazuko_register_daemon() [0]
dazuko: slot[0] assigned to daemon 1
dazuko: adding incl /mnt
dazuko: adding incl /home
dazuko: adding incl /tmp

[syslog]
clamd[2160]: Daemon started. 
clamd[2160]: clamd daemon 0.80 (OS: linux-gnu, ARCH: i386, CPU: i686) 
clamd[2160]: Log file size limit disabled. 
clamd[2160]: Running as user clamav (UID 106, GID 106) 
clamd[2160]: Reading databases from /var/lib/clamav/  
clamd[2160]: Protecting against 26369 viruses. 
clamd[2161]: Unix socket file /var/run/clamav/clamd.ctl 
clamd[2161]: Setting connection queue length to 15 
clamd[2161]: Archive: Archived file size limit set to 62914560 bytes. 
clamd[2161]: Archive: Recursion level limit set to 5.  
clamd[2161]: Archive: Files limit set to 1000. 
clamd[2161]: Archive: Compression ratio limit set to 250. 
clamd[2161]: Archive support enabled. 
clamd[2161]: Archive: RAR support disabled.  
clamd[2161]: Archive: Blocking archives that exceed limits. 
clamd[2161]: Portable Executable support enabled. 
clamd[2161]: Detection of broken executables enabled. 
clamd[2161]: Mail files support enabled. 
clamd[2161]: OLE2 support enabled.  
clamd[2161]: HTML support enabled.  
clamd[2161]: Self checking every 3600 seconds. 
kernel: dazuko: linux_dazuko_device_open() [2162]
kernel: dazuko: linux_dazuko_device_read() [2162]
kernel: dazuko: dazuko_register_daemon() [0]
kernel: dazuko: slot[0] assigned to daemon 2
clamd[2161]: Clamuko: Correctly registered with Dazuko. 
clamd[2161]: Clamuko: Scan-on-open mode activated. 
clamd[2161]: Clamuko: Scan-on-close mode activated. 
clamd[2161]: Clamuko: Scan-on-exec mode activated. 
kernel: dazuko: adding incl /mnt
clamd[2161]: Clamuko: Included path /mnt 
kernel: dazuko: adding incl /home
clamd[2161]: Clamuko: Included path /home 
kernel: dazuko: adding incl /tmp
clamd[2161]: Clamuko: Included path /tmp 
clamd[2161]: Clamuko: File size limit disabled.

I tested the behavour of clamuko/dazuko with simple cp/mv/less-commands, but it looks like dazuko intercept only parttimes:

It is possible to cp a 'infected' file into a protected filesystem (/tmp is a extra partition) without an interception:

taurus2:/tmp/dazukotest# cp /usr/share/clamav-testfiles/clam.exe .
taurus2:/tmp/dazukotest# ls -la
insgesamt 8
drwxr-xr-x    2 root     root           21 2004-11-09 12:21 .
drwxrwxrwt    6 root     root         4096 2004-11-09 12:21 ..
-rw-r--r--    1 root     root          544 2004-11-09 12:21 clam.exe

bad. :-(
But it will intercept if i try to open, copy or move it to another partition:

taurus2:/tmp/dazukotest# less clam.exe
clam.exe: Operation not permitted
-> clamd[2161]: Clamuko: /tmp/dazukotest/clam.exe: ClamAV-Test-File FOUND

It is also possible to mv it on the same partition without interception (because of thats only an reorganizing of inode-descriptions) - thats not my problem.

But i want to use dazuko/clamuko (or later on maybe a commerical onaccess-scanner) to protect 'surf'-stations against download infected files.

I asked already in the clamav-users mailinglist, (<http://lists.clamav.net/lurker/message/20041108.163210.0b404c0d.en.html>) but i could not take really usefull hints from this.

I think, i am looking for something looks as like the dmesg-registering:
dazuko: linux_dazuko_device_WRITE() or close :-)

And i found something like that in dazuko_linux26.c, but i have no c-knowledge.


Alexander Stielau <aleks>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Follow 2 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2005-03-02 ogman Open/ClosedOpen Closed
2004-11-10 ogman Assigned toNone ogman

Back to the top

Powered by Savane 3.13-54b4.
Corresponding source code