How to scan on-access with Clamav in v14.04

Question

I try to use clamav for on-access virus scanning for my home directory and all mounted drives. I found some rather old instructions here, and adjusted them.

Since dazuko was replaced by fanotify, the parameters in clamd.conf are slightly different. Here are my relevant clamd.conf entries:

ScanOnAccess true
# ClamukoScanOnOpen true
# ClamukoScanOnExec true
OnAccessIncludePath /home
OnAccessIncludePath /mnt
OnAccessIncludePath /media
VirusEvent /opt/clamdazer %v &

If I restart clamd (by "sudo invoke-rc.d clamav-daemon restart"), the log has the following:

ERROR: ScanOnAccess: fanotify_init failed: Operation not permitted
ScanOnAccess: clamd must be started by root

What am I doing wrong?

Edit: I tried to change the "User clamav" line to "User root", but then the start of clamd will fail with "ERROR: initgroups() failed".

I found some bug reports which maybe relevant here: Ubuntu Bug #1404762 and Debian bug #749027 (I can only post 2 links).

Unfortunately, I did not succeed using the solutions described there. To me, it seems, on-access scanning presently does not work at all.

Solution

Actually you already there. You already done Installing the clam-av, we need a little tweak to make the clamd run as root.

Since this thread already ages. I will summarize the correct things you have done. This is just for step-by-step how to install ClamAV and made it on-access.

First we must install the correct version. Only clamav version > 0.98 have a ifanotify capability for the on-access scan. This ifanotify replace the deprecated dazuko kernel module See more @ ClamAV Blog used by older ClamAV version.

---

STEP 1 - Installation

If you running on 14.04 you may add this ppa for the latest version

ppa:teward/clamav

Then update the apt to refresh the apt cache

sudo apt-get update

Run the following command to install the ClamAV

sudo apt-get install clamav clamav-daemon

If the ClamAV already installed don't forget to update the ClamAV database by running

sudo freshclam

At this step, we already have the ClamAV on our machine. But wait, we need to make it do the on-access scan right? Sure!

---

STEP 2 - Configuration

Now open the ClamAV configuration file (clamd.conf). I am using ubuntu 16.04 LTS and it's located on /etc/clamav/clamd.conf (you can use nano, or vi to edit the file, but make sure you are have the privilege to edit the file).

sudo nano /etc/clamav/clamd.conf

Then you will see all of predifined parameters there.

Now look at the configuration file for this parameter

ScanOnAccess false

Change it to

ScanOnAccess true

Now there is two option to include the directory for the on-access scan. First include the directory as mounted, and the second one as the include directory.

Still on the configuration file, add the following parameter for mounted option

OnAccessMountPath /

This will include all directory or path inside your machine. In other words, it would watch and scan all of your machine directory. But you can add more than one "OnAccessMountPath", by this you can define your own.

OnAccessMountPath /home
OnAccessMountPath /opt
OnAccessMountPath /var
etc...

The second one you can include the directory more specific using "OnAccessIncludePath"

OnAccessIncludePath /home/{youruser}/Desktop
OnAccessIncludePath /home/{youruser}/Documents
OnAccessIncludePath /home/{youruser}/Downloads
OnAccessIncludePath /home/{youruser}/Emulation
OnAccessIncludePath /home/{youruser}/Music
OnAccessIncludePath /home/{youruser}/Pictures
OnAccessIncludePath /home/{youruser}/Public
OnAccessIncludePath /home/{youruser}/Video

And then don't forget to add the following parameter in the end of the configuration paramater

OnAccessPrevention false
OnAccessExtraScanning true
OnAccessExcludeUID 0

(Optional but recomended) You can add your own script to handle the event when the virus found such delete or move the infected file, and do some log. To do this you can add "VirusEvent" parameter in the configuration file. You can add like I do

VirusEvent /opt/clamav-utils/clamd-response

And create a new bash file called "clamd-response" under /opt/clamav-utils or anywhere you like.

Here the script of clamd-response

#!/bin/sh

echo "$(date) - $CLAM_VIRUSEVENT_VIRUSNAME > $CLAM_VIRUSEVENT_FILENAME" >> /var/log/clamav/infected.log
rm $CLAM_VIRUSEVENT_FILENAME
sudo -u yourUserName DISPLAY=:0.0 notify-send "Virus Found $CLAM_VIRUSEVENT_VIRUSNAME" "$CLAM_VIRUSEVENT_FILENAME has been removed"

The script will remove the infected file, do the log, and send OSD notification to your desktop. Note: If the OSD Notification doesn't show up, try to delete

sudo -u yourUserName

and just leave

DISPLAY=:0.0 notify-send "Virus Found $CLAM_VIRUSEVENT_VIRUSNAME" "$CLAM_VIRUSEVENT_FILENAME has been removed"

Now we need to make the clamd (clamav daemon) to run as root. Still on the configuration file look for this parameter

User clamav

Change it into

User root

Now save and close the file. Next we need to prevent app armor prevented clamd run as root.

---

STEP 3 - Give clamd ability run as ROOT

First we need to install app armor utils by run this command

sudo apt install apparmor-utils

Then run this command to complain about clamd disability run as root

sudo aa-complain clamd

Just restart your machine, and ClamAV should be run as on-access now.

Comments

[hako]

works nicely on 14.04. However, I would like to get a message when something was detected. I tried with zenity, but the mentioned "$CLAM_VIRUSEVENT_VIRUSNAME" does not seem to exist.

[Sirius Bey]

Put your zenity script inside the /opt/clamav-utils/clamd-response, it should be works fine.

[Sirius Bey]

I edited the clamd-response script. Now the clamd-response script should be send the osd notification as the script triggered.

[hako]

I tried it, my script looks now like this: #!/bin/sh echo "$(date) - $CLAM_VIRUSEVENT_VIRUSNAME > $CLAM_VIRUSEVENT_FILENAME" >> /var/log/clamav/infected.log DISPLAY=:0.0 notify-send -t 0 "Virus Found: $CLAM_VIRUSEVENT_VIRUSNAME in $CLAM_VIRUSEVENT_FILENAME" The infected.log entry is done, but, unfortunately, the notification does not work. Nothing gets displayed. Any ideas?

[markling]

"If the OSD Notification doesn't show up, try to delete"... come again?

[Jacob Rodrigues]

Some of the settings should probably be set by debconf - it manages some of them... (like the user that it runs as)