Well i feel like the most stupid person in the world as after i read line by line the /etc/avg.conf configuration file of the AVG antivirus application i found out that there was a parameter regarding which directories it should scan and by default the value is "/mnt" which needs to be changed to "/" for the scanner to check on the whole system.

I just think they should have pointed this out in their PDF manual and not just throw a list of parameters which are not well described.

Anyway thanks again for your feedback as i wasn't sure that the example's success was enough to make certain that dazuko was working fine.

Regards.

Thank you Ogman for replying so soon.

I will try other free anti-virus programms.
Still AVG is supposed to work with Dazuko according to Dazuko's list of compatible applications http://www.dazuko.org/applications.shtml

Anyway thanks. I'll post the results.

Hallo to all.

My system is a fedora Core 6 (kernel-2.6.22.3.RVF16.fc6.i686) compiled from sources available at www.kernels.org.
I have AVG antivirus installed and have downloaded the eicar.com test virus for testing. The On-Demand scan of AVG finds the test virus and prompts for action.
Of course the most important thing is the On-Access scanning which needs dazuko in Linux (AVG is compatible with Dazuko).

I have attempted many different ways of installing dazuko in my system and have completely failed.

I tried out the 2.6.22.4-RSBAC-1.3.5 kernel with built-in Dazuko, configured according to RSBAC instructions. Also followed the instructions for the built-in Dazuko.
There is no dazuko.ko in this built-in version which avgd (the AVG deamon) needs to enable On-Access scanning. Nevertheless Dazuko was installed and loaded as the Dazuko example_c was able to connect with it and provide information for file accessing over a given directory. After spending much time searching for the problem, i gave up. Keep in mind that the security capability was built-in (not (M)odule) as in RSBAC instructions i wasn't advised otherwise.

Then i tried a completely stock kernel-2.6.22.2-42.fc6.i686 recompiled with security capability as a (M)odule. This caused HAL and AVAHI loading failures as these, i suppose, need built-in capability. Anyway Dazuko "./configure", "make" and "make install" were carried out without any errors whatsoever. I executed "modprob commoncaps", "rmmod capability", "modprob dazuko" and "modprobe capability" with the last one failing due to "Invalid argument" which some people say that happens cause capability is attempted to be inserted where dazuko is. I found no way of bypassing this. Other than that the example_c was communicating just fine with Dazuko and AVG deamon when started did not complain about missing of dazuko.ko (which is not the case when dazuko.ko is not present). Still any attempt to copy, move or open the test virus was not recognized by AVG deamon. I gave up.

I turned back to my kernel-2.6.22.3.RVF16.fc6.i686 (compiled with security capability built-in for HAL and AVAHI loading) and tried out the following parameters for configuration of dazuko :

[root@RVF16C dazuko-2.3.3]# ./configure --help

override auto-detection values
  --mapfile=MAP        use MAP as System.map file (linux26+syscalls only)
  --sct-readonly       handle sct as read-only (linux26+syscalls only)

optional features
  --enable-syscalls               hook syscalls, not LSM (Linux 2.6 only)

So i tried these parameters as in Dazuko FAQ or instructions this was an alternative to "capability module" and "RSBAC".

[root@RVF16C dazuko-2.3.3]# ./configure --enable-syscalls --sct-readonly --mapfile=/RVF16/RPMbuild/linux-2.6.22.3/System.map
checking host system type... Linux
checking for make utility... ok (make)
checking for C compiler... ok (cc)
kernel source in /lib/modules/2.6.22.3.RVF16.fc6/source... yes
kernel build source in /lib/modules/2.6.22.3.RVF16.fc6/build... yes
acquiring Linux kernel code configuration... ok
checking if Linux is RSBAC patched... no
checking if devfs is enabled... no
discovered host system... Linux (2.6.22)
checking for System.map file... ok (/RVF16/RPMbuild/linux-2.6.22.3/System.map)
locating sys_call_table... ok (0xc0641500)
checking sys_call_table status... read-only (forced)
locating do_execve... ok (0xc046fa90)
identifying device API... ok
inspecting class type... ok (class)
inspecting suspend function... ok (suspend2)
checking whether __d_path() is exported... no (using local copy)
inspecting task_struct structure... ok (using parent)
configure: creating Makefile
configure: creating library/Makefile
configure: creating example_c/Makefile

./configure successful

=======================
 Configuration summary
=======================

module events = ON_OPEN ON_CLOSE ON_EXEC
devfs support = no
rsbac support = no
hooking via syscalls = yes
local __d_path() = yes
module debug = no
library 1.x compatibility = yes

No errors here. On to the next step:

[root@RVF16C dazuko-2.3.3]# make
make -C /lib/modules/2.6.22.3.RVF16.fc6/build include/linux/version.h include/asm scripts
make[1]: Entering directory `/RVF16/RPMbuild/linux-2.6.22.3'
  CHK     include/linux/version.h
make[1]: `include/asm' is up to date.
make[1]: Leaving directory `/RVF16/RPMbuild/linux-2.6.22.3'
make -C /lib/modules/2.6.22.3.RVF16.fc6/build SUBDIRS="/RVF16/dazuko-2.3.3" modules
make[1]: Entering directory `/RVF16/RPMbuild/linux-2.6.22.3'
  CC [M]  /RVF16/dazuko-2.3.3/dazuko_core.o
  CC [M]  /RVF16/dazuko-2.3.3/dazuko_transport.o
  CC [M]  /RVF16/dazuko-2.3.3/dazuko_linux.o
  LD [M]  /RVF16/dazuko-2.3.3/dazuko.o
  Building modules, stage 2.
  MODPOST 1 modules
  CC      /RVF16/dazuko-2.3.3/dazuko.mod.o
  LD [M]  /RVF16/dazuko-2.3.3/dazuko.ko
make[1]: Leaving directory `/RVF16/RPMbuild/linux-2.6.22.3'
touch dummy_rule

No errors so i went for the installation:

[root@RVF16C dazuko-2.3.3]# make install
mkdir -p /lib/modules/2.6.22.3.RVF16.fc6/extra
cp dazuko.ko /lib/modules/2.6.22.3.RVF16.fc6/extra
/sbin/depmod -ae

which only creates a directory and copies there the dazuko module.
I also compiled the example:

[root@RVF16C example_c]# make
cd ../library && make
make[1]: Entering directory `/RVF16/dazuko-2.3.3/library'
make[1]: Nothing to be done for `all'.
make[1]: Leaving directory `/RVF16/dazuko-2.3.3/library'
cc -Wall -O -I.. -L../library -o example example.c -ldazuko
cc -Wall -O -I.. -L../library -pthread -o example_mt example_mt.c -ldazuko


inserted the dazuko module:

[root@RVF16C dazuko-2.3.3]# modprobe dazuko

and checked if dazuko device and module were present:

[root@RVF16C dazuko-2.3.3]# cat /proc/modules

dazuko 44248 0 - Live 0xf0bd4000
autofs4 20484 2 - Live 0xf0af6000
sunrpc 164860 1 - Live 0xf0bf2000
xt_limit 2816 8 - Live 0xf0ad1000
xt_tcpudp 3328 12 - Live 0xf0acf000
iptable_mangle 2944 0 - Live 0xf0a79000
ipt_LOG 6400 8 - Live 0xf0acc000
ipt_MASQUERADE 3584 0 - Live 0xf0a5a000
nf_nat 17708 1 ipt_MASQUERADE, Live 0xf0ad3000
ipt_TOS 2304 0 - Live 0xf0a5c000
ipt_REJECT 4864 1 - Live 0xf0a6d000
nf_conntrack_irc 7192 0 - Live 0xf0a2d000
nf_conntrack_ftp 9728 0 - Live 0xf0a69000
nf_conntrack_ipv4 16908 8 - Live 0xf0a70000
xt_state 2560 6 - Live 0xf0a58000
nf_conntrack 56264 6 ipt_MASQUERADE,nf_nat,nf_conntrack_irc,nf_conntrack_ftp,nf_conntrack_ipv4,xt_state, Live 0xf0abd000
iptable_filter 3072 1 - Live 0xf0966000
ip_tables 12232 2 iptable_mangle,iptable_filter, Live 0xf0a65000
x_tables 15108 8 xt_limit,xt_tcpudp,ipt_LOG,ipt_MASQUERADE,ipt_TOS,ipt_REJECT,xt_state,ip_tables, Live 0xf0a10000
video 16648 0 - Live 0xf0a5f000
backlight 5888 1 video, Live 0xf0a2a000
button 7952 0 - Live 0xf0a27000
battery 10116 0 - Live 0xf0a23000
ac 5252 0 - Live 0xf0a20000
ipv6 249700 20 - Live 0xf0b06000
lp 12360 0 - Live 0xf0a15000
floppy 56772 0 - Live 0xf0a49000
snd_intel8x0 33180 2 - Live 0xf098f000
snd_ac97_codec 97568 1 snd_intel8x0, Live 0xf0a30000
ac97_bus 2304 1 snd_ac97_codec, Live 0xf087e000
snd_seq_dummy 3844 0 - Live 0xf08e5000
snd_seq_oss 31232 0 - Live 0xf099a000
snd_seq_midi_event 7296 1 snd_seq_oss, Live 0xf097d000
snd_seq 47952 5 snd_seq_dummy,snd_seq_oss,snd_seq_midi_event, Live 0xf0a03000
nvidia 4711796 0 - Live 0xf0fe7000 (P)
snd_seq_device 8460 3 snd_seq_dummy,snd_seq_oss,snd_seq, Live 0xf095f000
snd_pcm_oss 40224 0 - Live 0xf09b6000
snd_mixer_oss 16640 2 snd_pcm_oss, Live 0xf0977000
snd_pcm 69000 3 snd_intel8x0,snd_ac97_codec,snd_pcm_oss, Live 0xf09a4000
snd_timer 21892 2 snd_seq,snd_pcm, Live 0xf0970000
snd 51684 11 snd_intel8x0,snd_ac97_codec,snd_seq_oss,snd_seq,snd_seq_device,snd_pcm_oss,snd_mixer_oss,snd_pcm,snd_timer, Live 0xf0981000
soundcore 7520 2 snd, Live 0xf0834000
snd_page_alloc 10120 2 snd_intel8x0,snd_pcm, Live 0xf086f000
i2c_sis96x 5508 0 - Live 0xf0837000
i2c_core 25104 2 nvidia,i2c_sis96x, Live 0xf0968000
cdc_ether 6016 0 - Live 0xf0873000
usbnet 18312 1 cdc_ether, Live 0xf0876000
parport_pc 28068 1 - Live 0xf0957000
mii 5760 1 usbnet, Live 0xf086c000
ide_cd 39200 0 - Live 0xf094c000
parport 35400 2 lp,parport_pc, Live 0xf0921000
cdrom 36384 1 ide_cd, Live 0xf0917000
ns558 4992 0 - Live 0xf0850000
gameport 14728 2 ns558, Live 0xf084b000
serio_raw 6916 0 - Live 0xf0848000
dm_mod 56000 7 - Live 0xf0908000
pata_sis 14084 0 - Live 0xf0843000
libata 123572 1 pata_sis, Live 0xf092c000
sd_mod 29200 0 - Live 0xf0863000
scsi_mod 143244 2 libata,sd_mod, Live 0xf08c1000
ext3 129672 2 - Live 0xf08e7000
jbd 52904 1 ext3, Live 0xf0855000
mbcache 8324 1 ext3, Live 0xf0830000
ehci_hcd 30988 0 - Live 0xf083a000
ohci_hcd 20740 0 - Live 0xf0829000
uhci_hcd 24208 0 - Live 0xf0822000

[root@RVF16C dazuko-2.3.3]# cat /proc/devices

Character devices:
  1 mem
  4 /dev/vc/0
  4 tty
  4 ttyS
  5 /dev/tty
  5 /dev/console
  5 /dev/ptmx
  6 lp
  7 vcs
 10 misc
 13 input
 14 sound
 29 fb
116 alsa
128 ptm
136 pts
171 ieee1394
180 usb
189 usb_device
195 nvidia
252 dazuko
253 usb_endpoint
254 usbmon

Block devices:
  1 ramdisk
  2 fd
  3 ide0
  8 sd
  9 md
 22 ide1
 65 sd
 66 sd
 67 sd
 68 sd
 69 sd
 70 sd
 71 sd
128 sd
129 sd
130 sd
131 sd
132 sd
133 sd
134 sd
135 sd
253 device-mapper
254 mdp

Everything looked fine so i tried out the example:

[root@RVF16C example_c]# ./example /RVF16 #RVF16 is the directory for testing file acceess monitoring

DazukoIO version 2.3.3 (2.3.3.4)
registered with Dazuko successfully
Dazuko version 2.3.3 (2.3.3.4)
set access mask successfully
set scan path successfully
OPEN   uid:0 pid:3810 mode:438 flags:32768 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar.com
CLOSE  uid:0 pid:3810 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar.com
OPEN   uid:0 pid:3811 mode:0 flags:32768 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar.com
OPEN   uid:0 pid:3811 mode:438 flags:33473 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar.com
CLOSE  uid:0 pid:3811 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar.com
OPEN   uid:0 pid:3811 mode:0 flags:32768 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar.com
OPEN   uid:0 pid:3811 mode:438 flags:33473 file:/RVF16/eicar (copy).com
CLOSE  uid:0 pid:3811 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar.com
CLOSE  uid:0 pid:3811 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar (copy).com
OPEN   uid:0 pid:3811 mode:438 flags:32768 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar (copy).com
CLOSE  uid:0 pid:3811 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar (αντίγραφο).com
OPEN   uid:0 pid:3811 mode:-1359187512 flags:100352 file_uid:0 file_gid:0 file_mode:16877 file_device:0 file_size:4096 file:/RVF16
CLOSE  uid:0 pid:3811 file_uid:0 file_gid:0 file_mode:16877 file_device:0 file_size:4096 file:/RVF16
OPEN   uid:0 pid:3811 mode:438 flags:32768 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar (copy).com
CLOSE  uid:0 pid:3811 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar (copy).com
OPEN   uid:0 pid:3811 mode:438 flags:32768 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar (copy).com
CLOSE  uid:0 pid:3811 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar (copy).com
OPEN   uid:0 pid:3815 mode:-1359187512 flags:100352 file_uid:0 file_gid:0 file_mode:16877 file_device:0 file_size:4096 file:/RVF16
CLOSE  uid:0 pid:3815 file_uid:0 file_gid:0 file_mode:16877 file_device:0 file_size:4096 file:/RVF16
OPEN   uid:0 pid:3815 mode:438 flags:32768 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar (copy).com
CLOSE  uid:0 pid:3815 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar (copy).com
OPEN   uid:0 pid:3817 mode:438 flags:32768 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar (copy).com
CLOSE  uid:0 pid:3817 file_uid:0 file_gid:0 file_mode:33188 file_device:0 file_size:68 file:/RVF16/eicar (copy).com
OPEN   uid:0 pid:3819 mode:-1350794808 flags:100352 file_uid:0 file_gid:0 file_mode:16877 file_device:0 file_size:4096 file:/RVF16
CLOSE  uid:0 pid:3819 file_uid:0 file_gid:0 file_mode:16877 file_device:0 file_size:4096 file:/RVF16
OPEN   uid:0 pid:3820 mode:-1350794808 flags:100352 file_uid:0 file_gid:0 file_mode:16877 file_device:0 file_size:4096 file:/RVF16
CLOSE  uid:0 pid:3820 file_uid:0 file_gid:0 file_mode:16877 file_device:0 file_size:4096 file:/RVF16
unregistered with Dazuko successfully

As you can see from above the example was providing info on selecting, copying and deleting a file in /RVF16 directory

It was time for AVG deamon to load and that also didn't complain about dazuko missing:

[root@RVF16C RVF16]# /etc/init.d/avgd start
Starting avgd                                              [  OK  ]

Still it cannot trace any movement or copy of the test virus.

I am sick and tired of this but have to figure it out as real-time scanning of files is vital and the time will soon come when there will be viruses threat for Linux equal to Windows'.

Please help me sort this out.
Thank you.