Hello community, here is the log from the commit of package clamav.3762 for openSUSE:13.1:Update checked in at 2015-05-19 10:11:35 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:13.1:Update/clamav.3762 (Old) and /work/SRC/openSUSE:13.1:Update/.clamav.3762.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "clamav.3762" Changes: -------- New Changes file: --- /dev/null 2015-05-15 19:41:08.266053825 +0200 +++ /work/SRC/openSUSE:13.1:Update/.clamav.3762.new/clamav.changes 2015-05-19 10:11:37.000000000 +0200 @@ -0,0 +1,1208 @@ +------------------------------------------------------------------- +Mon May 4 13:39:49 UTC 2015 - m...@suse.com + +- Version 0.98.7 fixes several security issues (bsc#929192) and + other bug fixes/improvements: + * Fix crash in upx decoder with crafted file. Discovered and + patch supplied by Sebastian Andrzej Siewior. CVE-2015-2170. + * Fix infinite loop condition on crafted y0da cryptor + file. Identified and patch suggested by Sebastian Andrzej + Siewior. CVE-2015-2221. + * Fix crash on crafted petite packed file. Reported and patch + supplied by Sebastian Andrzej Siewior. CVE-2015-2222. + * Fix an infinite loop condition on a crafted "xz" archive file. + This was reported by Dimitri Kirchner and Goulven Guiheux. + CVE-2015-2668. + * Apply upstream patch for possible heap overflow in Henry + Spencer's regex library. CVE-2015-2305. + * Fix false negatives on files within iso9660 containers. This + issue was reported by Minzhuan Gong. + * Fix a couple crashes on crafted upack packed file. Identified + and patches supplied by Sebastian Andrzej Siewior. + * Fix a crash during algorithmic detection on crafted PE file. + Identified and patch supplied by Sebastian Andrzej Siewior. + * Fix compilation error after ./configure --disable-pthreads. + Reported and fix suggested by John E. Krokes. + * Fix segfault scanning certain HTML files. Reported with sample + by Kai Risku. + * Improve detections within xar/pkg files. + * Improvements to PDF processing: decryption, escape sequence + handling, and file property collection. + * Scanning/analysis of additional Microsoft Office 2003 XML + format. + +------------------------------------------------------------------- +Thu Feb 5 10:29:02 UTC 2015 - m...@suse.com + +- Version 0.98.6 fixes several security issues: + * bsc#916217, CVE-2015-1461: Remote attackers can have + unspecified impact via Yoda's crypter or mew packer files. + * bsc#916214, CVE-2015-1462: Unspecified impact via acrafted upx + packer file. + * bsc#916215, CVE-2015-1463: Remote attackers can cause a denial + of service via a crafted petite packer file. + * bsc#915512, CVE-2014-9328: heap out of bounds condition with + crafted upack packer files. +- Obsoletes clamav-soname.patch + +------------------------------------------------------------------- +Tue Jan 20 17:27:40 UTC 2015 - m...@suse.com + +- Fix a step backwards in the soname version from 0.98.4 to 0.98.5 + (https://bugzilla.clamav.net/show_bug.cgi?id=11193) +- Add clamav-soname.patch. + +------------------------------------------------------------------- +Wed Nov 19 14:54:58 UTC 2014 - m...@suse.com + +- Version 0.98.5: + * Support for the XDP file format and extracting, decoding, and + scanning PDF files within XDP files. + * Addition of shared library support for LLVM versions 3.1 - 3.5 + for the purpose of just-in-time(JIT) compilation of ClamAV + bytecode signatures. + * Enhancements to the clambc command line utility to assist + ClamAV bytecode signature authors by providing introspection + into compiled bytecode programs. + * Resolution of many of the warning messages from ClamAV + compilation. + * Improved detection of malicious PE files. + * Security fix for ClamAV crash when using 'clamscan -a'. + * Security fix for ClamAV crash when scanning maliciously + crafted yoda's crypter files (bnc#906077, CVE-2013-6497). + * ClamAV 0.98.5 now works with OpenSSL in FIPS compliant + mode (bnc#904207). + * Fix server socket setup code in clamd (bnc#903489). +- Change updateclamconf to prefer the state of the old config + file even for commented-out options (bnc#903719). + +------------------------------------------------------------------- +Thu Jun 26 15:25:33 UTC 2014 - m...@suse.com + +- Version 0.98.4 (bnc#884589) + * Fix infinite loop in clamdscan when clamd is not running. + * Fix buffer underruns when handling multi-part MIME email + attachments. + * Fix onfiguration of OpenSSL on various platforms. + * Fix linking issues with libclamunrar. + +------------------------------------------------------------------- +Thu May 8 15:02:40 UTC 2014 - m...@suse.com + +- Version 0.98.3 (bnc#877475): + * Support for common raw disk image formats using 512 byte + sectors, specifically GPT, APM, and MBR partitioning. + * Experimental support of OpenIOC files. ClamAV will now extract + file hashes from OpenIOC files residing in the signature + database location, and generate ClamAV hash signatures. ClamAV + uses no other OpenIOC features at this time. No OpenIOC files + will be delivered through freshclam. See openioc.org and + iocbucket.com for additional information about OpenIOC. + * All ClamAV sockets (clamd, freshclam, clamav-milter, clamdscan, + clamdtop) now support IPV6 addresses and configuration + parameters. + * Use OpenSSL file hash functions for improved performance. + OpenSSL is now prerequisite software for ClamAV 0.98.3. + * Improved detection of malware scripts within image files. + * Change to circumvent possible denial of service when processing + icons within specially crafted PE files. Icon limits are now in + place with corresponding clamd and clamscan configuration + parameters. This issue was reported by Joxean Koret. + * Improvements to the fidelity of the ClamAV pattern matcher, an + issue reported by Christian Blichmann. + * Opt-in collection of statistics. Statistics collected are: + sizes and MD5 hashes of files, PE file section counts and + section MD5 hashes, and names and counts of detected + viruses. Enable statistics collection with the --enable-stats + clamscan flag or StatsEnabled clamd configuration parameter. + * Improvements to ClamAV build process, unit tests, and platform + support. + * Improve error handling in freshclam. + * ClamAV 0.98.3 also includes miscellaneous bug fixes and + documentation improvements. +- clamav-fan-syscalls.patch isn't needed anymore because ClamAV + now uses sys/fanotify.h . + +------------------------------------------------------------------- +Wed Feb 19 08:15:44 UTC 2014 - meiss...@suse.com + +- add fanotify enablement patc for ppc and arm + +------------------------------------------------------------------- +Fri Jan 31 15:12:06 UTC 2014 - m...@suse.com + +- Version 0.98.1 (bnc#841815): + * remove copy of wxWidgets (halves the size of the tarball). + * Decompression and scanning of files in "Xz" compression + format. + * Extraction, decompression, and scanning of files within Apple + Disk Image (DMG) format. + * Extraction, decompression, and scanning of files within + Extensible Archive (XAR) format. XAR format is commonly used + for software packaging, such as PKG and RPM, as well as + general archival. + * Improvements and fixes to extraction and scanning of ole + formats. + * Option to force all scanned data to disk. + * Various improvements to ClamAV configuration, support of third + party libraries, and unit tests. +- Rediff clamav-conf.patch + +------------------------------------------------------------------- +Sat Sep 28 07:35:34 UTC 2013 - meiss...@suse.com + +- Version 0.98 (bnc#841815) + * code quality fixes on libclamav, clamd, sigtool, clamav-milter, clamconf and clamdtop + * code quality fixes on libclamav, libclamunrar and freshclam + * valgrind suppression rules for dl_catch_error complaints + * bb #8385: PDF ASCII85Decode zero-length fix + * libclamav: SCAN_ALL mode fixes + * bb #7436: elf64 header early exit + * iso9660: iso_scan_file rewrite +- use source urls, add gpg signature retrieval. + +------------------------------------------------------------------- +Mon Apr 29 14:32:07 UTC 2013 - meiss...@suse.com + +- mirror the amavisd-new change of /var/spool/amavis bnc#663726 + +------------------------------------------------------------------- +Sun Apr 28 08:08:14 UTC 2013 - ec...@schirra.net + +- Version 0.97.8 (bnc#816865) + * libclamav: Bugs reported by Felix Groebert of the Google Security Team + +------------------------------------------------------------------- +Wed Mar 20 17:32:19 UTC 2013 - m...@suse.com + +- Version 0.97.7 (bnc#809945) + * several hardening fixes. + +------------------------------------------------------------------- +Mon Jan 14 14:42:03 UTC 2013 - mmeis...@suse.com + +- pids and sockets of clamd and freshclam now reside in /var/run + instead of /var/lib (bnc#770395) +- modified pid path in clamd's, freshclam's and clamav-milter's + init scripts + +------------------------------------------------------------------- +Mon Jan 7 13:40:31 UTC 2013 - m...@suse.com + +- Remove the clamav-db subpackage. ClamAV installations should + fetch current versions of the virus database directly from + upstream. If there really is need for a packaged database, it + should be in a separate package. +- Remove scripts do deal with very old (before 2008) config and + database file formats. ++++ 1011 more lines (skipped) ++++ between /dev/null ++++ and /work/SRC/openSUSE:13.1:Update/.clamav.3762.new/clamav.changes New: ---- clamav-0.98.7.tar.gz clamav-0.98.7.tar.gz.sig clamav-conf.patch clamav-gcc47.patch clamav-rcclamd clamav-rcfreshclam clamav-rcmilter clamav-rpmlintrc clamav-sles9.patch clamav-tmpfiles.conf clamav-updateclamconf clamav.changes clamav.keyring clamav.spec ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ clamav.spec ++++++ # # spec file for package clamav # # Copyright (c) 2015 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed # upon. The license for this file, and modifications and additions to the # file, is the same license as for the pristine package itself (unless the # license for the pristine package is not an Open Source License, in which # case the license is the MIT License). An "Open Source License" is a # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. # Please submit bugfixes or comments via http://bugs.opensuse.org/ # Name: clamav BuildRequires: ncurses-devel BuildRequires: sed BuildRequires: sendmail BuildRequires: sendmail-devel %define llvm --disable-llvm %if 0%{?suse_version} >= 1010 BuildRequires: bc BuildRequires: pkgconfig BuildRequires: zlib-devel %ifarch %ix86 x86_64 %define llvm --enable-llvm # Needed for compiling LLVM. BuildRequires: gcc-c++ %endif %endif %if 0%{?suse_version} >= 1030 BuildRequires: check-devel BuildRequires: libbz2-devel BuildRequires: libopenssl-devel BuildRequires: libxml2-devel BuildRequires: pwdutils BuildRequires: python-devel %define clamav_check --enable-check %else BuildRequires: bzip2 %define clamav_check --disable-check %endif Summary: Antivirus Toolkit License: GPL-2.0 Group: Productivity/Security Version: 0.98.7 Release: 0 Url: http://www.clamav.net Requires: latex2html-pngicons Obsoletes: clamav-db < 0.88.3 PreReq: %_sbindir/groupadd %_sbindir/useradd %_sbindir/usermod PreReq: /usr/bin/awk /bin/sed /bin/tar PreReq: %insserv_prereq Source0: http://downloads.sourceforge.net/clamav/%{name}-%{version}.tar.gz Source10: http://downloads.sourceforge.net/clamav/%{name}-%{version}.tar.gz.sig Source11: %name.keyring Source1: clamav-rcclamd Source2: clamav-rcfreshclam Source3: clamav-updateclamconf Source4: clamav-rpmlintrc Source5: clamav-rcmilter Source6: clamav-tmpfiles.conf Patch1: clamav-conf.patch Patch2: clamav-sles9.patch Patch3: clamav-gcc47.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build %description ClamAV is an open source (GPL) antivirus engine designed for detecting Trojans, viruses, malware and other malicious threats. It is the de facto standard for mail gateway scanning. It provides a high performance mutli-threaded scanning daemon, command line utilities for on demand file scanning, and an intelligent tool for automatic signature updates. The core ClamAV library provides numerous file format detection mechanisms, file unpacking support, archive support, and multiple signature languages for detecting threats. %prep %setup -q %patch1 -p1 %if 0%{?suse_version} == 0910 # SLES9's libmilter doesn't have smfi_insheader() %patch2 %endif %patch3 -p1 %build %if 0%{?suse_version} >= 1010 CFLAGS="-fstack-protector" CXXFLAGS="-fstack-protector" %endif export CFLAGS="%optflags $CFLAGS" export CXXFLAGS="%optflags $CXXFLAGS" %if 0%{?suse_version} == 0910 # SLES9 needs this macro to enable the quarantine feature in libmilter CFLAGS="$CFLAGS -D_FFR_QUARANTINE -D_FFR_SMFI_OPENSOCKET" %endif ./configure \ --prefix=%_prefix \ --libdir=%_libdir \ --mandir=%_mandir \ --sysconfdir=%_sysconfdir \ --disable-clamav \ --disable-static \ --with-dbdir=/var/lib/clamav \ --with-user=vscan \ --with-group=vscan \ --enable-milter \ %clamav_check \ %llvm \ --disable-zlib-vcheck \ --enable-clamdtop \ --disable-timestamps make V=1 %{?jobs:-j%jobs} %install %makeinstall ln -sf docs/html/{clamdoc,index}.html mkdir -p %buildroot/etc/init.d install -m755 %SOURCE1 %buildroot/etc/init.d/clamd ln -s /etc/init.d/clamd %buildroot%_sbindir/rcclamd install -m755 %SOURCE2 %buildroot/etc/init.d/freshclam ln -s /etc/init.d/freshclam %buildroot%_sbindir/rcfreshclam install -m755 %SOURCE5 %buildroot/etc/init.d/clamav-milter ln -s /etc/init.d/clamav-milter %buildroot%_sbindir/rcclamav-milter install -m755 %SOURCE3 %buildroot%_sbindir/updateclamconf install -d -m755 %buildroot/var/{lib,run}/clamav install -d -m755 %buildroot/usr/lib/tmpfiles.d install -m644 %SOURCE6 %buildroot/usr/lib/tmpfiles.d/clamav.conf mkdir -p %buildroot/var/spool/amavis %if 0%{?suse_version} > 1020 rm %buildroot/%_libdir/*.la %endif # Remove bogus dependencies from libclamav.pc sed -i 's/^Libs: .*/Libs: -lclamav/' %buildroot%_libdir/pkgconfig/libclamav.pc # fix the new config file names pushd %buildroot/etc mv clamd.conf.sample clamd.conf mv clamav-milter.conf.sample clamav-milter.conf mv freshclam.conf.sample freshclam.conf popd %check # regression tests %if !0%{?qemu_user_space_build:1} VALGRIND_GENSUP=1 make check %endif %files %defattr(-,root,root,-) %config(noreplace) %_sysconfdir/*.conf %config %attr(744,root,root)/etc/init.d/* %dir /usr/lib/tmpfiles.d /usr/lib/tmpfiles.d/clamav.conf %doc AUTHORS BUGS ChangeLog COPYING FAQ NEWS README UPGRADE %doc docs/*.pdf docs/html %doc %_mandir/*/* %_bindir/* %_sbindir/* %_includedir/* %_libdir/lib* %_libdir/pkgconfig/libclamav.pc %defattr(-,vscan,vscan) %dir %attr(750,vscan,vscan) /var/spool/amavis %dir /var/lib/clamav %dir %attr(755,vscan,vscan) /var/run/clamav %pre %_sbindir/groupadd -r vscan 2> /dev/null || : %_sbindir/useradd -r -o -g vscan -u 65 -s /bin/false -c "Vscan account" -d /var/spool/amavis vscan 2> /dev/null || : %_sbindir/usermod vscan -g vscan 2> /dev/null || : %post /sbin/ldconfig # merge config files on update test "0$1" -lt 2 && exit 0 umask 022 for f in /etc/clamd.conf /etc/freshclam.conf /etc/clamav-milter.conf; do if test -e $f.rpmnew; then echo "Merging $f and $f.rpmnew" %_sbindir/updateclamconf -v override="$OVERRIDE" $f $f.rpmnew > $f.tmp if test $? == 0; then mv $f $f.old mv $f.tmp $f else echo "Merging $f with $f.rpmnew failed" fi fi done %preun %stop_on_removal clamd freshclam %postun /sbin/ldconfig %restart_on_update clamd freshclam %insserv_cleanup %changelog ++++++ clamav-conf.patch ++++++ Index: clamav-0.98.3/etc/clamav-milter.conf.sample =================================================================== --- clamav-0.98.3.orig/etc/clamav-milter.conf.sample 2014-05-06 20:39:56.000000000 +0200 +++ clamav-0.98.3/etc/clamav-milter.conf.sample 2014-05-08 16:42:14.865949467 +0200 @@ -2,10 +2,6 @@ ## Example config file for clamav-milter ## -# Comment or remove the line below. -Example - - ## ## Main options ## @@ -17,8 +13,7 @@ # inet6:port@[hostname|ip-address] - to specify an ipv6 socket # # Default: no default -#MilterSocket /tmp/clamav-milter.socket -#MilterSocket inet:7357 +MilterSocket /var/run/clamav/clamav-milter-socket # Define the group ownership for the (unix) milter socket. # Default: disabled (the primary group of the user running clamd) @@ -36,7 +31,7 @@ # Run as another user (clamav-milter must be started by root for this option to work) # # Default: unset (don't drop privileges) -#User clamav +User vscan # Initialize supplementary group access (clamav-milter must be started by root). # @@ -64,7 +59,7 @@ # daemon (main thread). # # Default: disabled -#PidFile /var/run/clamav-milter.pid +PidFile /var/run/clamav/clamav-milter.pid # Optional path to the global temporary directory. # Default: system specific (usually /tmp or /var/tmp). @@ -90,7 +85,7 @@ # with the same socket: clamd servers will be selected in a round-robin fashion. # # Default: no default -#ClamdSocket tcp:scanner.mydomain:7357 +ClamdSocket unix:/var/run/clamav/clamd-socket ## @@ -239,13 +234,13 @@ # Use system logger (can work together with LogFile). # # Default: no -#LogSyslog yes +LogSyslog yes # Specify the type of syslog messages - please refer to 'man syslog' # for facility names. # # Default: LOG_LOCAL6 -#LogFacility LOG_MAIL +LogFacility LOG_MAIL # Enable verbose logging. # Index: clamav-0.98.3/etc/clamd.conf.sample =================================================================== --- clamav-0.98.3.orig/etc/clamd.conf.sample 2014-05-08 16:42:07.318862339 +0200 +++ clamav-0.98.3/etc/clamd.conf.sample 2014-05-08 16:45:03.177891683 +0200 @@ -1,12 +1,8 @@ ## -## Example config file for the Clam AV daemon +## Config file for the Clam AV daemon ## Please read the clamd.conf(5) manual before editing this file. ## - -# Comment or remove the line below. -Example - # Uncomment this option to enable logging. # LogFile must be writable for the user running daemon. # A full path is required. @@ -41,12 +37,12 @@ # Use system logger (can work together with LogFile). # Default: no -#LogSyslog yes +LogSyslog yes # Specify the type of syslog messages - please refer to 'man syslog' # for facility names. # Default: LOG_LOCAL6 -#LogFacility LOG_MAIL +LogFacility LOG_MAIL # Enable verbose logging. # Default: no @@ -63,7 +59,7 @@ # This option allows you to save a process identifier of the listening # daemon (main thread). # Default: disabled -#PidFile /var/run/clamd.pid +PidFile /var/run/clamav/clamd.pid # Optional path to the global temporary directory. # Default: system specific (usually /tmp or /var/tmp). @@ -82,7 +78,7 @@ # Path to a local socket file the daemon will listen on. # Default: disabled (must be specified by a user) -#LocalSocket /tmp/clamd.socket +LocalSocket /var/run/clamav/clamd-socket # Sets the group ownership on the unix socket. # Default: disabled (the primary group of the user running clamd) @@ -98,7 +94,7 @@ # TCP port address. # Default: no -#TCPSocket 3310 +TCPSocket 3310 # TCP address. # By default we bind to INADDR_ANY, probably not wise. @@ -106,7 +102,7 @@ # from the outside world. This option can be specified multiple # times if you want to listen on multiple IPs. IPv6 is now supported. # Default: no -#TCPAddr 127.0.0.1 +TCPAddr 127.0.0.1 # Maximum length the queue of pending connections may grow to. # Default: 200 @@ -192,7 +188,7 @@ # Run as another user (clamd must be started by root for this option to work) # Default: don't drop privileges -#User clamav +User vscan # Initialize supplementary group access (clamd must be started by root). # Default: no @@ -525,6 +521,10 @@ ## ## On-access Scan Settings ## +# +# When enabling this, you most probably have to set "User root" above, +# so that clamav can access the files to be scanned. +# # Enable on-access scanning. Currently, this is supported via fanotify. # Clamuko/Dazuko support has been deprecated. Index: clamav-0.98.3/etc/freshclam.conf.sample =================================================================== --- clamav-0.98.3.orig/etc/freshclam.conf.sample 2014-05-08 16:42:07.349862696 +0200 +++ clamav-0.98.3/etc/freshclam.conf.sample 2014-05-08 16:42:14.866949479 +0200 @@ -1,12 +1,8 @@ ## -## Example config file for freshclam +## Config file for freshclam ## Please read the freshclam.conf(5) manual before editing this file. ## - -# Comment or remove the line below. -Example - # Path to the database directory. # WARNING: It must match clamd.conf's directive! # Default: hardcoded (depends on installation options) @@ -35,12 +31,12 @@ # Use system logger (can work together with UpdateLogFile). # Default: no -#LogSyslog yes +LogSyslog yes # Specify the type of syslog messages - please refer to 'man syslog' # for facility names. # Default: LOG_LOCAL6 -#LogFacility LOG_MAIL +LogFacility LOG_MAIL # Enable log rotation. Always enabled when LogFileMaxSize is enabled. # Default: no @@ -48,12 +44,12 @@ # This option allows you to save the process identifier of the daemon # Default: disabled -#PidFile /var/run/freshclam.pid +PidFile /var/run/clamav/freshclam.pid # By default when started freshclam drops privileges and switches to the # "clamav" user. This directive allows you to change the database owner. # Default: clamav (may depend on installation options) -#DatabaseOwner clamav +DatabaseOwner vscan # Initialize supplementary group access (freshclam must be started by root). # Default: no @@ -136,7 +132,7 @@ # Send the RELOAD command to clamd. # Default: no -#NotifyClamd /path/to/clamd.conf +NotifyClamd /etc/clamd.conf # Run command after successful database update. # Default: disabled @@ -179,7 +175,7 @@ # detected in the field and in what geographic area they are. # Freshclam will connect to clamd in order to get recent statistics. # Default: no -#SubmitDetectionStats /path/to/clamd.conf +#SubmitDetectionStats /etc/clamd.conf # Country of origin of malware/detection statistics (for statistical # purposes only). The statistics collector at ClamAV.net will look up ++++++ clamav-gcc47.patch ++++++ Index: clamav-0.97.3/libclamav/c++/llvm/lib/ExecutionEngine/JIT/Intercept.cpp =================================================================== --- clamav-0.97.3.orig/libclamav/c++/llvm/lib/ExecutionEngine/JIT/Intercept.cpp +++ clamav-0.97.3/libclamav/c++/llvm/lib/ExecutionEngine/JIT/Intercept.cpp @@ -15,6 +15,7 @@ // //===----------------------------------------------------------------------===// +#include <unistd.h> #include "JIT.h" #include "llvm/Support/ErrorHandling.h" #include "llvm/System/DynamicLibrary.h" ++++++ clamav-rcclamd ++++++ #! /bin/sh # Copyright (c) 1995-2003 SuSE Linux AG, Nuernberg, Germany. # All rights reserved. # # Author: Kurt Garloff # Please send feedback to http://www.suse.de/feedback/ # # /etc/init.d/clamd # and its symbolic link # /(usr/)sbin/rcclamd # # # LSB compatible service control script; see http://www.linuxbase.org/spec/ # # Note: This template uses functions rc_XXX defined in /etc/rc.status on # UnitedLinux (UL) based Linux distributions. If you want to base your # script on this template and ensure that it works on non UL based LSB # compliant Linux distributions, you either have to provide the rc.status # functions from UL or change the script to work without them. # ### BEGIN INIT INFO # Provides: clamd # Required-Start: $syslog $remote_fs # Required-Stop: $syslog $remote_fs # Default-Start: 3 5 # Default-Stop: 0 1 2 6 # Short-Description: virus scanner daemon # Description: Start the clamd virus scanner daemon ### END INIT INFO # # Any extensions to the keywords given above should be preceeded by # X-VendorTag- (X-UnitedLinux- for us) according to LSB. # # Notes on Required-Start/X-UnitedLinux-Should-Start: # * There are two different issues that are solved by Required-Start # and X-UnitedLinux-Should-Start # (a) Hard dependencies: This is used by the runlevel editor to determine # which services absolutely need to be started to make the start of # this service make sense. Example: nfsserver should have # Required-Start: $portmap # Also, required services are started before the dependent ones. # The runlevel editor will warn about such missing hard dependencies # and suggest enabling. During system startup, you may expect an error, # if the dependency is not fulfilled. # (b) Specifying the init script ordering, not real (hard) dependencies. # This is needed by insserv to determine which service should be # started first (and at a later stage what services can be started # in parallel). The tag X-UnitedLinux-Should-Start: is used for this. # It tells, that if a service is available, it should be started # before. If not, never mind. # * When specifying hard dependencies or ordering requirements, you can # use names of services (contents of their Provides: section) # or pseudo names starting with a $. The following ones are available # according to LSB (1.1): # $local_fs all local file systems are mounted # (most services should need this!) # $remote_fs all remote file systems are mounted # (note that /usr may be remote, so # many services should Require this!) # $syslog system logging facility up # $network low level networking (eth card, ...) # $named hostname resolution available # $netdaemons all network daemons are running # The $netdaemons pseudo service has been removed in LSB 1.2. # For now, we still offer it for backward compatibility. # These are new (LSB 1.2): # $time the system time has been set correctly # $portmap SunRPC portmapping service available # UnitedLinux extensions: # $ALL indicates that a script should be inserted # at the end # * The services specified in the stop tags # (Required-Stop/X-UnitedLinux-Should-Stop) # specify which services need to be still running when this service # is shut down. Often the entries there are just copies or a subset # from the respective start tag. # * X-UnitedLinux-Should-Start/Stop are not part of LSB (as of 1.3) # but official Should-Start/Stop tags are in discussion (1.9). # insserv does support these as well. # * X-UnitedLinux-Default-Enabled: yes/no is used at installation time # (%fillup_and_insserv macro in %post of many RPMs) to specify whether # a startup script should default to be enabled after installation. # It's not used by insserv. # # Note on runlevels: # 0 - halt/poweroff 6 - reboot # 1 - single user 2 - multiuser without network exported # 3 - multiuser w/ network (text mode) 5 - multiuser w/ network and X11 (xdm) # # Note on script names: # http://www.linuxbase.org/spec/refspecs/LSB_1.3.0/gLSB/gLSB/scrptnames.html # A registry has been set up to manage the init script namespace. # http://www.lanana.org/ # Please use the names already registered or register one or use a # vendor prefix. # Check for missing binaries (stale symlinks should not happen) # Note: Special treatment of stop for LSB conformance CLAMD_BIN=/usr/sbin/clamd test -x $CLAMD_BIN || { echo "$CLAMD_BIN not installed"; if [ "$1" = "stop" ]; then exit 0; else exit 5; fi; } CLAMD_DBDIR=$(clamconf | sed -n '/DatabaseDirectory = /{s///;s/"//g;p;q}') CLAMD_PIDFILE=$(clamconf | sed -n ' /Config file: clamd.conf/,/^$/ { /PidFile = / { s/// s/"//g p q } }') # Source LSB init functions # providing start_daemon, killproc, pidofproc, # log_success_msg, log_failure_msg and log_warning_msg. # This is currently not used by UnitedLinux based distributions and # not needed for init scripts for UnitedLinux only. If it is used, # the functions from rc.status should not be sourced or used. #. /lib/lsb/init-functions # Shell functions sourced from /etc/rc.status: # rc_check check and set local and overall rc status # rc_status check and set local and overall rc status # rc_status -v be verbose in local rc status and clear it afterwards # rc_status -v -r ditto and clear both the local and overall rc status # rc_status -s display "skipped" and exit with status 3 # rc_status -u display "unused" and exit with status 3 # rc_failed set local and overall rc status to failed # rc_failed <num> set local and overall rc status to <num> # rc_reset clear both the local and overall rc status # rc_exit exit appropriate to overall rc status # rc_active checks whether a service is activated by symlinks # rc_splash arg sets the boot splash screen to arg (if active) . /etc/rc.status # Reset status of this service rc_reset # Return values acc. to LSB for all commands but status: # 0 - success # 1 - generic or unspecified error # 2 - invalid or excess argument(s) # 3 - unimplemented feature (e.g. "reload") # 4 - user had insufficient privileges # 5 - program is not installed # 6 - program is not configured # 7 - program is not running # 8--199 - reserved (8--99 LSB, 100--149 distrib, 150--199 appl) # # Note that starting an already running service, stopping # or restarting a not-running service as well as the restart # with force-reload (in case signaling is not supported) are # considered a success. case "$1" in start) echo -n "Starting Clam AntiVirus daemon " OUT=$(startproc -p $CLAMD_PIDFILE $CLAMD_BIN 2>&1) rc_status -v && rc_exit # If clamd failed to start, check if the reason is # missing virus database files. clamscan - < /dev/null &> /dev/null if test "$?" -eq "50"; then echo " !!" echo " !! ClamAV Virus definition files are missing from $CLAMD_DBDIR." echo " !! Plase run freshclam manually to download the latest version (>20MB)" echo " !! or install the clamav-db package." echo " !!" else echo "$OUT" fi ;; stop) echo -n "Shutting down Clam AntiVirus daemon " ## Stop daemon with killproc(8) and if this fails ## killproc sets the return value according to LSB. killproc -p $CLAMD_PIDFILE -TERM $CLAMD_BIN # Remember status and be verbose rc_status -v ;; try-restart | condrestart) ## Do a restart only if the service was active before. ## Note: try-restart is now part of LSB (as of 1.9). ## RH has a similar command named condrestart. if test "$1" = "condrestart"; then echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}" fi $0 status if test $? = 0; then $0 restart else rc_reset # Not running is not a failure. fi # Remember status and be quiet rc_status ;; restart) ## Stop the service and regardless of whether it was ## running or not, start it again. $0 stop $0 start # Remember status and be quiet rc_status ;; reload | force-reload) ## Signal the daemon to reload its config. echo -n "Reloading Clam AntiVirus daemon " checkproc -p $CLAMD_PIDFILE $CLAMD_BIN && echo RELOAD > /dev/tcp/127.0.0.1/3310 rc_status -v ;; status) echo -n "Checking for Clam AntiVirus daemon " ## Check status with checkproc(8), if process is running ## checkproc will return with exit status 0. # Return value is slightly different for the status command: # 0 - service up and running # 1 - service dead, but /var/run/ pid file exists # 2 - service dead, but /var/lock/ lock file exists # 3 - service not running (unused) # 4 - service status unknown :-( # 5--199 reserved (5--99 LSB, 100--149 distro, 150--199 appl.) # NOTE: checkproc returns LSB compliant status values. checkproc -p $CLAMD_PIDFILE $CLAMD_BIN # NOTE: rc_status knows that we called this init script with # "status" option and adapts its messages accordingly. rc_status -v ;; *) echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload}" exit 1 ;; esac rc_exit ++++++ clamav-rcfreshclam ++++++ #! /bin/sh # Copyright (c) 1995-2003 SuSE Linux AG, Nuernberg, Germany. # All rights reserved. # # Author: Kurt Garloff # Please send feedback to http://www.suse.de/feedback/ # # /etc/init.d/freshclam # and its symbolic link # /(usr/)sbin/rcfreshclam # # # LSB compatible service control script; see http://www.linuxbase.org/spec/ # # Note: This template uses functions rc_XXX defined in /etc/rc.status on # UnitedLinux (UL) based Linux distributions. If you want to base your # script on this template and ensure that it works on non UL based LSB # compliant Linux distributions, you either have to provide the rc.status # functions from UL or change the script to work without them. # ### BEGIN INIT INFO # Provides: freshclam # Required-Start: $syslog $remote_fs # Should-Start: $time ypbind sendmail # Required-Stop: $syslog $remote_fs # Should-Stop: $time ypbind sendmail # Default-Start: 3 5 # Default-Stop: 0 1 2 6 # Short-Description: virus scanner daemon # Description: Start the freshclam virus database update daemon ### END INIT INFO # # Any extensions to the keywords given above should be preceeded by # X-VendorTag- (X-UnitedLinux- for us) according to LSB. # # Notes on Required-Start/X-UnitedLinux-Should-Start: # * There are two different issues that are solved by Required-Start # and X-UnitedLinux-Should-Start # (a) Hard dependencies: This is used by the runlevel editor to determine # which services absolutely need to be started to make the start of # this service make sense. Example: nfsserver should have # Required-Start: $portmap # Also, required services are started before the dependent ones. # The runlevel editor will warn about such missing hard dependencies # and suggest enabling. During system startup, you may expect an error, # if the dependency is not fulfilled. # (b) Specifying the init script ordering, not real (hard) dependencies. # This is needed by insserv to determine which service should be # started first (and at a later stage what services can be started # in parallel). The tag X-UnitedLinux-Should-Start: is used for this. # It tells, that if a service is available, it should be started # before. If not, never mind. # * When specifying hard dependencies or ordering requirements, you can # use names of services (contents of their Provides: section) # or pseudo names starting with a $. The following ones are available # according to LSB (1.1): # $local_fs all local file systems are mounted # (most services should need this!) # $remote_fs all remote file systems are mounted # (note that /usr may be remote, so # many services should Require this!) # $syslog system logging facility up # $network low level networking (eth card, ...) # $named hostname resolution available # $netdaemons all network daemons are running # The $netdaemons pseudo service has been removed in LSB 1.2. # For now, we still offer it for backward compatibility. # These are new (LSB 1.2): # $time the system time has been set correctly # $portmap SunRPC portmapping service available # UnitedLinux extensions: # $ALL indicates that a script should be inserted # at the end # * The services specified in the stop tags # (Required-Stop/X-UnitedLinux-Should-Stop) # specify which services need to be still running when this service # is shut down. Often the entries there are just copies or a subset # from the respective start tag. # * X-UnitedLinux-Should-Start/Stop are not part of LSB (as of 1.3) # but official Should-Start/Stop tags are in discussion (1.9). # insserv does support these as well. # * X-UnitedLinux-Default-Enabled: yes/no is used at installation time # (%fillup_and_insserv macro in %post of many RPMs) to specify whether # a startup script should default to be enabled after installation. # It's not used by insserv. # # Note on runlevels: # 0 - halt/poweroff 6 - reboot # 1 - single user 2 - multiuser without network exported # 3 - multiuser w/ network (text mode) 5 - multiuser w/ network and X11 (xdm) # # Note on script names: # http://www.linuxbase.org/spec/refspecs/LSB_1.3.0/gLSB/gLSB/scrptnames.html # A registry has been set up to manage the init script namespace. # http://www.lanana.org/ # Please use the names already registered or register one or use a # vendor prefix. # Check for missing binaries (stale symlinks should not happen) # Note: Special treatment of stop for LSB conformance FRESHCLAM_BIN=/usr/bin/freshclam test -x $FRESHCLAM_BIN || { echo "$FRESHCLAM_BIN not installed"; if [ "$1" = "stop" ]; then exit 0; else exit 5; fi; } FRESHCLAM_PIDFILE=$(clamconf | sed -n ' /Config file: freshclam.conf/,/^$/ { /PidFile = / { s/// s/"//g p q } }') # Source LSB init functions # providing start_daemon, killproc, pidofproc, # log_success_msg, log_failure_msg and log_warning_msg. # This is currently not used by UnitedLinux based distributions and # not needed for init scripts for UnitedLinux only. If it is used, # the functions from rc.status should not be sourced or used. #. /lib/lsb/init-functions # Shell functions sourced from /etc/rc.status: # rc_check check and set local and overall rc status # rc_status check and set local and overall rc status # rc_status -v be verbose in local rc status and clear it afterwards # rc_status -v -r ditto and clear both the local and overall rc status # rc_status -s display "skipped" and exit with status 3 # rc_status -u display "unused" and exit with status 3 # rc_failed set local and overall rc status to failed # rc_failed <num> set local and overall rc status to <num> # rc_reset clear both the local and overall rc status # rc_exit exit appropriate to overall rc status # rc_active checks whether a service is activated by symlinks # rc_splash arg sets the boot splash screen to arg (if active) . /etc/rc.status # Reset status of this service rc_reset # Return values acc. to LSB for all commands but status: # 0 - success # 1 - generic or unspecified error # 2 - invalid or excess argument(s) # 3 - unimplemented feature (e.g. "reload") # 4 - user had insufficient privileges # 5 - program is not installed # 6 - program is not configured # 7 - program is not running # 8--199 - reserved (8--99 LSB, 100--149 distrib, 150--199 appl) # # Note that starting an already running service, stopping # or restarting a not-running service as well as the restart # with force-reload (in case signaling is not supported) are # considered a success. case "$1" in start) echo -n "Starting Clam AntiVirus database update daemon " # Check if there is a virus definition file startproc -p $FRESHCLAM_PIDFILE $FRESHCLAM_BIN -d # Remember status and be verbose rc_status -v ;; stop) echo -n "Shutting down Clam AntiVirus database update daemon " ## Stop daemon with killproc(8) and if this fails ## killproc sets the return value according to LSB. killproc -p $FRESHCLAM_PIDFILE -TERM $FRESHCLAM_BIN # Remember status and be verbose rc_status -v ;; try-restart | condrestart) ## Do a restart only if the service was active before. ## Note: try-restart is now part of LSB (as of 1.9). ## RH has a similar command named condrestart. if test "$1" = "condrestart"; then echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}" fi $0 status if test $? = 0; then $0 restart else rc_reset # Not running is not a failure. fi # Remember status and be quiet rc_status ;; restart) ## Stop the service and regardless of whether it was ## running or not, start it again. $0 stop $0 start # Remember status and be quiet rc_status ;; reload | force-reload) ## Signal the daemon to reload its config. echo -n "Reloading Clam AntiVirus database update daemon " checkproc -p $FRESHCLAM_PIDFILE $FRESHCLAM_BIN && killproc -p $FRESHCLAM_PIDFILE -HUP $FRESHCLAM_BIN rc_status -v ;; status) echo -n "Checking for Clam AntiVirus database update daemon " ## Check status with checkproc(8), if process is running ## checkproc will return with exit status 0. # Return value is slightly different for the status command: # 0 - service up and running # 1 - service dead, but /var/run/ pid file exists # 2 - service dead, but /var/lock/ lock file exists # 3 - service not running (unused) # 4 - service status unknown :-( # 5--199 reserved (5--99 LSB, 100--149 distro, 150--199 appl.) # NOTE: checkproc returns LSB compliant status values. checkproc -p $FRESHCLAM_PIDFILE $FRESHCLAM_BIN # NOTE: rc_status knows that we called this init script with # "status" option and adapts its messages accordingly. rc_status -v ;; *) echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload}" exit 1 ;; esac rc_exit ++++++ clamav-rcmilter ++++++ #!/bin/sh # # SUSE system startup script for clamav-milter # Copyright (C) 1995--2005 Kurt Garloff, SUSE / Novell Inc. # Copyright (C) 2007 Reinhard Max, SUSE / Novell Inc. # # This library is free software; you can redistribute it and/or modify it # under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2.1 of the License, or (at # your option) any later version. # # This library is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # Lesser General Public License for more details. # # You should have received a copy of the GNU Lesser General Public # License along with this library; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, # USA. # # /etc/init.d/clamav-milter # and its symbolic link # /(usr/)sbin/rcclamav-milter # ### BEGIN INIT INFO # Provides: clamav-milter # Required-Start: clamd $syslog $remote_fs # Required-Stop: clamd $syslog $remote_fs # Default-Start: 3 5 # Default-Stop: 0 1 2 6 # Short-Description: milter compatible mail scanner # Description: Start clamav-milter, which is needed to # use ClamAV for virus scanning in a sendmail environment. ### END INIT INFO # Check for missing binaries (stale symlinks should not happen) # Note: Special treatment of stop for LSB conformance BIN=/usr/sbin/clamav-milter # Read the pidfile from the config PIDFILE=$(clamconf | sed -n ' /Config file: clamav-milter.conf/,/^$/ { /PidFile = / { s/// s/"//g p q } }') test -x $BIN || { echo "$BIN not installed"; if [ "$1" = "stop" ]; then exit 0; else exit 5; fi; } # Source LSB init functions . /etc/rc.status # Reset status of this service rc_reset # Return values acc. to LSB for all commands but status: # 0 - success # 1 - generic or unspecified error # 2 - invalid or excess argument(s) # 3 - unimplemented feature (e.g. "reload") # 4 - user had insufficient privileges # 5 - program is not installed # 6 - program is not configured # 7 - program is not running # 8--199 - reserved (8--99 LSB, 100--149 distrib, 150--199 appl) # # Note that starting an already running service, stopping # or restarting a not-running service as well as the restart # with force-reload (in case signaling is not supported) are # considered a success. case "$1" in start) echo -n "Starting clamav-milter " # make sure everybody can access the local socket umask 0 ## Start daemon with startproc(8). If this fails ## the return value is set appropriately by startproc. /sbin/startproc ${PIDFILE:+-p $PIDFILE} $BIN # Remember status and be verbose rc_status -v ;; stop) echo -n "Shutting down clamav-milter " ## Stop daemon with killproc(8) and if this fails ## killproc sets the return value according to LSB. /sbin/killproc -TERM ${PIDFILE:+-p $PIDFILE} -G $BIN # Remember status and be verbose rc_status -v ;; try-restart|condrestart) ## Do a restart only if the service was active before. ## Note: try-restart is now part of LSB (as of 1.9). ## RH has a similar command named condrestart. if test "$1" = "condrestart"; then echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}" fi $0 status if test $? = 0; then $0 restart else rc_reset # Not running is not a failure. fi # Remember status and be quiet rc_status ;; restart) ## Stop the service and regardless of whether it was ## running or not, start it again. $0 stop $0 start # Remember status and be quiet rc_status ;; force-reload) ## Signal the daemon to reload its config. Most daemons ## do this on signal 1 (SIGHUP). ## If it does not support it, restart the service if it ## is running. $0 try-restart rc_status ;; reload) ## Like force-reload, but if daemon does not support ## signaling, do nothing (!) rc_failed 3 rc_status -v ;; status) echo -n "Checking for clamav-milter " ## Check status with checkproc(8), if process is running ## checkproc will return with exit status 0. # Return value is slightly different for the status command: # 0 - service up and running # 1 - service dead, but /var/run/ pid file exists # 2 - service dead, but /var/lock/ lock file exists # 3 - service not running (unused) # 4 - service status unknown :-( # 5--199 reserved (5--99 LSB, 100--149 distro, 150--199 appl.) # NOTE: checkproc returns LSB compliant status values. /sbin/checkproc ${PIDFILE:+-p $PIDFILE} $BIN # NOTE: rc_status knows that we called this init script with # "status" option and adapts its messages accordingly. rc_status -v ;; probe) ## Optional: Probe for the necessity of a reload, print out the ## argument to this init script which is required for a reload. ## Note: probe is not (yet) part of LSB (as of 1.9) test /etc/clamd.conf -nt $PIDFILE -o \ /etc/sysconfig/clamav-milter -nt $PIDFILE \ && echo restart ;; *) echo "Usage: $0 {start|stop|status|try-restart|restart|force-reload|reload|probe}" exit 1 ;; esac rc_exit ++++++ clamav-rpmlintrc ++++++ addFilter("non-standard-uid.*") addFilter("devel-file-in-non-devel-package.*") addFilter("obsolete-not-provided") ++++++ clamav-sles9.patch ++++++ Index: clamav-milter/clamfi.c =================================================================== --- clamav-milter/clamfi.c.orig +++ clamav-milter/clamfi.c @@ -90,16 +90,11 @@ static void add_x_header(SMFICTX *ctx, c while(status) if(smfi_chgheader(ctx, (char *)"X-Virus-Status", status--, NULL) != MI_SUCCESS) logg("^Failed to remove existing X-Virus-Status header\n"); + } if(smfi_addheader(ctx, (char *)"X-Virus-Scanned", xvirushdr) != MI_SUCCESS) logg("^Failed to add X-Virus-Scanned header\n"); if(smfi_addheader(ctx, (char *)"X-Virus-Status", st) != MI_SUCCESS) logg("^Failed to add X-Virus-Status header\n"); - } else { /* Add */ - if(smfi_insheader(ctx, 1, (char *)"X-Virus-Scanned", xvirushdr) != MI_SUCCESS) - logg("^Failed to insert X-Virus-Scanned header\n"); - if(smfi_insheader(ctx, 1, (char *)"X-Virus-Status", st) != MI_SUCCESS) - logg("^Failed to insert X-Virus-Status header\n"); - } } enum CFWHAT { --- clamav-milter/clamav-milter.c +++ clamav-milter/clamav-milter.c @@ -282,7 +282,7 @@ } opt = optget(opts, "FixStaleSocket"); umsk = umask(0777); /* socket is created with 000 to avoid races */ - if(smfi_opensocket(opt->enabled) == MI_FAILURE) { + if(smfi_opensocket() == MI_FAILURE) { logg("!Failed to create socket %s\n", my_socket); localnets_free(); whitelist_free(); ++++++ clamav-tmpfiles.conf ++++++ # clamav needs a directory in /var/run: d /var/run/clamav 0755 vscan vscan - ++++++ clamav-updateclamconf ++++++ #!/usr/bin/awk -f # # updateclamconf # # Merge two clamd.conf or freshclam.conf files and write the result to # the standard output. The result file contains all comments from the # second file with the active (i.e. not commented-out) settings from # the first file merged into it. Settings which were only in the first # file file and not mentioned in the second file any more, are appended # at the end, but commented out. # # Any comment must start with a hash and a space: # # comment # while any commented out setting must start with a hash and no space: # #settingname settingvalue # # The first file may optionally have the format that was used up to # version 0.88.7. In that case the settings will be converted to the # format that is used in version 0.90 and newer. # # Known issues: # # If an option exists more than once in eiter file, only the first # occurance will be moved over from the first file. AFAIK this # currently only applies to the DatabaseMirror option in # freshclam.conf. # Copyright (c) 2006 SUSE LINUX Products GmbH, Nuernberg, Germany. # # Authors: Reinhard Max <m...@suse.de> # Kurt Keller <k...@pinboard.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 as # published by the Free Software Foundation. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. BEGIN { if (ARGC != 3) { print "usage: updateclamconf oldfile newfile" > "/dev/stderr" exit 1 } # some options may be overridden from the command line $0 = override for (i=1; i<=NF; i+=2) { options[$i] = $i " " $(i+1) } pass = 0 } lastname != FILENAME { lastname = FILENAME pass++ } # collect options from the first file pass == 1 && $0 ~ /^[[:space:]]*#?[^[:space:]]/ { if (NF == 1) { $2 = "yes" } # copy $1, so that sub() doesn't modify $0 o = $1 sub("^#", "", o) if (!(o in options)) { options[o] = $0 } } # merge options into the content of the second file pass == 2 { # copy $1, so that sub() doesn't modify $0 o = $1 sub("^[[:space:]]*#", "", o) if (o in options) { if (options[o] ~ /^[[:space:]]*#/ && $0 ~ /^[[:space:]]*#/) { print } else { print options[o] } delete options[o] } else { print } } # print out any options that were only found in the first file END { for (o in options) { print "\n# These options weren't found in the new config file" for (o in options) { print "# " options[o] } break } }
