Hi there, On Fri, 10 Mar 2017, Brad Scalio wrote:
Is there a way to copy to quarantine directory if and only if the file to be copied and identified as a match against the VSD does not exist in the quarantine directory already either matching a hash or name or size? ... Sure we can exclude the quarantine path from clamscan but if someone knows that they can simply put things there to avoid the virus scanner.
Rather than adding more code (and potential ways to break everything) would it not be better simply to restrict permissions on the quarantine directory and - as you suggest - exclude it from the scan? If a miscreant can write to the locked-down quarantine directory then you _already_ have a problem, with or without ClamAV, which needs to be fixed.
Thanks much!! And have a great Friday (or Saturday).
HTH. You too. -- 73, Ged. _______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
