Bill Landry wrote the following on 9/22/2007 2:38 PM -0800:
> Tomasz Kojm wrote the following on 9/22/2007 2:29 PM -0800:
>
>> On Sat, 22 Sep 2007 13:31:20 -0700
>> Bill Landry <[EMAIL PROTECTED]> wrote:
>>
>>
>>
>>> And yes, I did try:
>>>
>>> clamscan --debug --leave-temps -d /var/tmp/rsync/MSRBL-Images.hdb - <
>>> /dev/null
>>>
>>> and still no temp file left.
>>>
>>>
>> And that's correct. The above command should not generate any temporary
>> files.
>> Instead of /dev/null scan some zip archive and you'll get a bunch of them.
>>
>>
>>
> Okay, I'll try that. However, note the second line:
>
> clamav-0.91.2]# clamscan -v -d /var/tmp/rsync/MSRBL-Images.hdb - < /dev/null
> Checking /tmp/clamav-cc4d65cd30ff712a24ae0cee745ad50e
> stdin: OK
>
> and strace shows:
>
> [...]
> write(1, "Checking /tmp/clamav-cc4d65cd30f"..., 54Checking
> /tmp/clamav-cc4d65cd30ff712a24ae0cee745ad50e
> ) = 54
> open("/tmp/clamav-cc4d65cd30ff712a24ae0cee745ad50e", O_RDONLY) = 3
> fstat64(3, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
> close(3) = 0
> write(1, "stdin: OK\n", 10stdin: OK
> ) = 10
> unlink("/tmp/clamav-cc4d65cd30ff712a24ae0cee745ad50e") = 0
> gettimeofday({1190496815, 744815}, {420, 0}) = 0
>
> So it sure looks like clamscan is creating temporary files, but then
> deleting them when done.
>
Sorry, snipped too much of the strace output:
open("/tmp/clamav-cc4d65cd30ff712a24ae0cee745ad50e",
O_WRONLY|O_CREAT|O_TRUNC, 0666) = 3
fstat64(0, {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 3), ...}) = 0
ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfcf379c) = -1 ENOTTY
(Inappropriate ioctl for device)
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0xb7f3c000
read(0, "", 8192) = 0
close(3) = 0
fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 1), ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0xb7f3b000
write(1, "Checking /tmp/clamav-cc4d65cd30f"..., 54Checking
/tmp/clamav-cc4d65cd30ff712a24ae0cee745ad50e
) = 54
open("/tmp/clamav-cc4d65cd30ff712a24ae0cee745ad50e", O_RDONLY) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
close(3) = 0
write(1, "stdin: OK\n", 10stdin: OK
) = 10
unlink("/tmp/clamav-cc4d65cd30ff712a24ae0cee745ad50e") = 0
gettimeofday({1190496815, 744815}, {420, 0}) = 0
Bill
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://lurker.clamav.net/list/clamav-users.html
