I don’t know, but I would really
like to be able to use InoculateIT with qmail-scanner. Please keep us posted
if you figure out a fix.
Dan
-----Original Message-----
From: Bob Jones
[mailto:[EMAIL PROTECTED]
Sent: Thursday, October 16, 2003
12:36 PM
To:
[EMAIL PROTECTED]
Subject:
[Qmail-scanner-general]inocmd32 needs to run as root
Greetings,
I am using Q-S 1.20rc3 and have sucessfully modified it to recognize and use
InoculateIT/eTrus Antrivirus 7.0 for Linux. It generates a working
qmail-scanner-queue.pl script at least. However, I have run across a problem
and was wondering if anyone on the list knows of a way to handle it.
Part of modifying Q-S to recognize ETAV7 was creating a modified
sub-inocucmd.pl and calling it sub-inocmd32.pl. Here are its contents:
-------------------
sub inocmd32_scanner {
#InoculaateIT (eTrust Antivirus) scanner
&debug("inocmd32: starting scan of directory
\"$scandir/$file_id\"...");
my ($start_inocmd32_time)=[gettimeofday];
my ($DD,$inocmd32_status,$stop_inocmd32_time,$inocmd32_time);
&debug("run $inocmd32_binary -MOD Secure -ARC -SPM H
$scandir/$file_id 2>&1");
$DD=`$inocmd32_binary -MOD Secure -ARC -SPM H $scandir/$file_id
2>&1`;
$inocmd32_status=($? >> 8);
&debug("--output of inocmd32 was:\n$DD--");
if ( $inocmd32_status == 100 && $DD =~
/.*infected\sby\svirus\s(.*)\s/m ) {
$quarantine_description=$1;
&debug("There be a virus!
($quarantine_description)");
($quarantine_event=$quarantine_description)=~s/\s/_/g;
$quarantine_event="INOC:".substr($quarantine_event,0,$QE_LEN);
$description .= "\n$DD\n";
} elsif ( $inocmd32_status > 0 ) {
#This implies a corrupt set of DAT files or resource
problems...
&error_condition("corrupt or unknown InoculateIT
scanner error or memory/resource/perms problem - exit status
$inocmd32_status");
}
$stop_inocmd32_time=[gettimeofday];
$inocmd32_time = tv_interval ($start_inocmd32_time,
$stop_inocmd32_time);
&debug("inocmd32: finished scan of dir
\"$scandir/$file_id\" in $inocmd32_time secs");
}
------------------------------------------------------
The problems comes when running the line
$DD=`$inocmd32_binary .......`;
Apparently, this gets run as the user qscand. Inocmd32 *has* to be run as
root - sudo (or sudo -u root) does not do the trick even after giving the group
qscand access to the file via /etc/sudoers.
Does anyone on this list have any ideas on how to accomplish this? Once I
can fix this problem, I will send the mods to Jason for possible inclusion into
the source tree.
Thanks in advance,
Bob J
-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
SourceForge.net hosts over 70,000 Open Source Projects.
See the people who have HELPED US provide better services:
Click here: http://sourceforge.net/supporters.php
_______________________________________________
Qmail-scanner-general mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general |
