The branch, v4-8-stable has been updated via 4348e64 VERSION: Disable GIT_SNAPSHOT for the 4.8.0rc3 release. via 4b6a12e WHATSNEW: Add release notes for Samba 4.8.0rc3. via ca87709 winbindd: WBFLAG_PAM_AUTH_PAC should call add_trusted_domain_from_auth() is the result is trusted via 7e8ee67 winbindd: rename winbindd_pam_auth_pac_send and let it return validation via df6062e winbindd: complete WBFLAG_PAM_AUTH_PAC handling in winbindd_pam_auth_crap_send() via c1ab6c5 winbindd: let winbindd_pam_auth_pac_send() compute info6 from PAC via be33ac4 winbindd: call add_trusted_domain_from_auth() in winbindd_pam_auth_crap_done() via 8269dc9 winbindd: get netr_SamInfo6 out of winbindd_dual_pam_auth_kerberos() via 95ca85d s3/rpc_client: add map_info6_to_validation() via e57baf7 s3/auth: add create_info6_from_pac() via f85ff76 s4/auth_winbind: ask for validation level 6 via 974b4ea winbindd: allow validation level 6 in winbind_SamLogon via dafb614 s3/rpc_client: add copy_netr_SamInfo6() and map_validation_to_info6() via b06743e winbindd: introduce a cm_connect_netlogon_secure() which gives a valid netlogon_creds_ctx via 4dac164 winbindd: handle interactive logons in _winbind_SamLogon() via 41c0698 winbindd: pass 'bool interactive' to winbind_dual_SamLogon() via ce965d3 winbindd: add a comment to a parameter in _winbind_SamLogon() via fb14f0f winbindd: separate plaintext given and interactive in winbind_samlogon_retry_loop() via 05b7972 s3/rpc_client: add rpccli_netlogon_interactive_logon() via 6fac545 winbindd: add_trusted_domain_from_auth() should not use dns_name = "" via c549aa4 wbinfo: avoid segfault in wbinfo_auth_crap() if winbindd is not available via 2fae412 winbindd: fix debug message in find_default_route_domain() on a DC via bf361c5 s4/rpc_server: trigger trusts reload in winbindd after successfull trust info acquisition via bf8e88d winbindd: rename MSG_WINBIND_NEW_TRUSTED_DOMAIN to MSG_WINBIND_RELOAD_TRUSTED_DOMAINS via cc7592e s4/rpc_server: remove unused data argument from MSG_WINBIND_NEW_TRUSTED_DOMAIN via e465b1f winbindd: use add_trusted_domains_dc in wb_imsg_new_trusted_domain via 523ca1b winbindd: move loading of trusted domains on a DC to a seperate function via 304c95c winbindd: don't force using LSA_LOOKUP_NAMES_ALL for non workstation trusts. via 5db31e7 s3:rpc_client: pass down lsa_LookupNamesLevel to dcerpc_lsa_lookup_sids_generic() via 33d901b winbindd: prepare find_lookup_domain_from_{name,sid}() transitive trusts on a DC via 296f677 winbindd: prepare find_auth_domain() transitive trusts on a DC via d103727 winbindd: remove const from set_routing_domain() via 74bbba0 winbindd: use Netlogon{Interactive,Network}TransitiveInformation on transitive trusts via 5dc2e89 s3:rpc_client: allow passing NetlogonNetwork[Transitive]Information to rpccli_netlogon_network_logon() via a895873 s3:rpc_client: allow Netlogon{Network,Interactive}TransitiveInformation in rpccli_netlogon_password_logon() via 0f86338 winbindd: add routing_domain as parameter to add_trusted_domain via 8cd948f winbindd: add missing can_do_ncacn_ip_tcp initialisation via 3a78306 winbindd: remove useless calls to get_trust_credentials() before cli_rpc_pipe_open_schannel_with_creds() via ae13d62 winbindd: fix LSA connections via DCERPC_AUTH_SCHANNEL via 099b720 winbind: Fix CID 1427626 Uninitialized scalar variable via d800e1c pdb: Fix CID 1427620 Resource leak via 4360d83 winbind: Fix CID 1427626 Uninitialized scalar variable via 8ee283a pdb: Fix CID 1427624 Resource leak via b368ad2 docs-xml: Add 'samba-tool visualize' to man samba-tool.8. via a9b71ef WHATSNEW: Add section for "samba-tool visualize" via 74208be WHATSNEW: Mention new option "apply group policies" via 0ae4e26 dbcheck: skip find_missing_forward_links_from_backlinks() if the db has the sortedLinks feature via a3a1768 dbcheck: add support for restoring missing forward links via 367970e dbcheck: add find_missing_forward_links_from_backlinks() via 307ffdc dbcheck: make sure we ask for replPropertyMetaData if we need to process any forward link attributes via 5f933b9 dbcheck: make sure we always ask for the objectGUID attribute explicitly via 54b7de0 dbcheck: add a helper function that checks is a value has duplicate links via f4cb28b dbcheck: add a dict where we remember attributes with duplicate links via 8451906 dbcheck: split out check_duplicate_links from check_dn via 6564239 dbcheck: store fixed forward link attributes with the correct sorting via 528cee7 dbcheck: remove ldb.FLAG_MOD_REPLACE when replacing search results for forward links via c17794d dbcheck: rename err_duplicate_links() to err_recover_forward_links() and adjust the output message via 9971ea3 dbcheck: add link direction to error message for duplicate links via 973b722 dbcheck: rename err_duplicate_links arguments via 08dcf2e dbcheck: only pass obj_dn to err_orphaned_backlink() via 0e24b58 dbcheck: add forward_syntax argument to err_orphaned_backlink via cae3003 dbcheck: rename and reorder err_orphaned_backlink arguments via f4940e6 selftest/dbcheck: add a test for corrupt forward links restoration via 910d2b2 Revert "dbcheck: disable fixing duplicate linked attributes until we can recover lost forward links" via 07e3be6 python/common: add __cmp__ function to dsdb_Dn similar to parsed_dn_compare() via ba0c378 python:tests: add test_dsdb_Dn_sorted() to "samba.tests.common" via b8741f1 python:tests: remove test_dsdb_Dn() to test_dsdb_Dn_binary() via 659e390 python:tests: use TestCaseInTempDir for "samba.tests.common" via 849a688 WHATSNEW: briefly mention the new vfs_virusfilter module via 52109e5 Samba-VirusFilter: fix virusfilter_vfs_close() crash via 9511aa8 Samba-VirusFilter: clamav VFS and man page. via 36ec386 Samba-VirusFilter: F-Secure AntiVirus (fsav) VFS and man page. via 326a1e4 Samba-VirusFilter: Sophos VFS backend. via 63f9a03 Samba-VirusFilter: common headers and sources. via 8f20444 Samba-VirusFilter: memcache changes. via ef18e12 python: fix the build with python3. via 7b784df gpo: Correct WHATSNEW via b37223e gpo: Correct documentation via ad481bd VERSION: Bump version up to 4.8.0rc3... from 20fe434 VERSION: Disable GIT_SNAPSHOT for the 4.8.0rc2 release.
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-8-stable - Log ----------------------------------------------------------------- ----------------------------------------------------------------------- Summary of changes: VERSION | 2 +- WHATSNEW.txt | 50 +- docs-xml/manpages/samba-tool.8.xml | 57 +- docs-xml/manpages/vfs_virusfilter.8.xml | 369 +++++ docs-xml/smbdotconf/domain/gpoupdatecommand.xml | 9 +- docs-xml/wscript_build | 1 + .../scripts/vfs/virusfilter/virusfilter-notify.ksh | 284 ++++ lib/util/memcache.c | 1 + lib/util/memcache.h | 3 +- librpc/idl/messaging.idl | 2 +- nsswitch/wbinfo.c | 13 +- python/samba/common.py | 17 + python/samba/dbchecker.py | 332 ++++- python/samba/emulate/traffic_packets.py | 2 +- python/samba/forest_update.py | 4 +- python/samba/tests/blackbox/traffic_summary.py | 2 +- python/samba/tests/common.py | 33 +- python/samba/tests/samba_tool/visualize.py | 6 +- selftest/knownfail.d/dbcheck_duplicate_member | 5 - source3/auth/proto.h | 4 + source3/auth/server_info.c | 56 + source3/modules/vfs_virusfilter.c | 1521 ++++++++++++++++++++ source3/modules/vfs_virusfilter_clamav.c | 195 +++ source3/modules/vfs_virusfilter_common.h | 153 ++ source3/modules/vfs_virusfilter_fsav.c | 451 ++++++ source3/modules/vfs_virusfilter_sophos.c | 391 +++++ source3/modules/vfs_virusfilter_utils.c | 1025 +++++++++++++ source3/modules/vfs_virusfilter_utils.h | 177 +++ source3/modules/wscript_build | 18 + source3/passdb/pdb_samba_dsdb.c | 5 +- source3/rpc_client/cli_lsarpc.c | 10 +- source3/rpc_client/cli_lsarpc.h | 1 + source3/rpc_client/cli_netlogon.c | 131 +- source3/rpc_client/cli_netlogon.h | 16 + source3/rpc_client/util_netlogon.c | 171 +++ source3/rpc_client/util_netlogon.h | 11 + source3/winbindd/winbindd.h | 3 +- source3/winbindd/winbindd_cm.c | 59 +- source3/winbindd/winbindd_dual.c | 7 +- source3/winbindd/winbindd_dual_srv.c | 182 ++- source3/winbindd/winbindd_msrpc.c | 63 +- source3/winbindd/winbindd_pam.c | 252 +++- source3/winbindd/winbindd_pam_auth_crap.c | 106 +- source3/winbindd/winbindd_proto.h | 12 +- source3/winbindd/winbindd_util.c | 556 ++++--- source3/wscript | 2 +- source4/auth/ntlm/auth_winbind.c | 2 +- source4/rpc_server/lsa/dcesrv_lsa.c | 28 +- ...ted-after-dbcheck-forward-link-corruption.ldif} | 8 +- ...dbcheck-link-output-forward-link-corruption.txt | 12 + ...pected-dbcheck-link-output_duplicate_member.txt | 5 +- testprogs/blackbox/dbcheck-links.sh | 78 + 52 files changed, 6279 insertions(+), 624 deletions(-) create mode 100644 docs-xml/manpages/vfs_virusfilter.8.xml create mode 100644 examples/scripts/vfs/virusfilter/virusfilter-notify.ksh delete mode 100644 selftest/knownfail.d/dbcheck_duplicate_member create mode 100644 source3/modules/vfs_virusfilter.c create mode 100644 source3/modules/vfs_virusfilter_clamav.c create mode 100644 source3/modules/vfs_virusfilter_common.h create mode 100644 source3/modules/vfs_virusfilter_fsav.c create mode 100644 source3/modules/vfs_virusfilter_sophos.c create mode 100644 source3/modules/vfs_virusfilter_utils.c create mode 100644 source3/modules/vfs_virusfilter_utils.h copy source4/selftest/provisions/release-4-5-0-pre1/{expected-duplicates-after-link-dbcheck.ldif => expected-after-dbcheck-forward-link-corruption.ldif} (65%) create mode 100644 source4/selftest/provisions/release-4-5-0-pre1/expected-dbcheck-link-output-forward-link-corruption.txt Changeset truncated at 500 lines: diff --git a/VERSION b/VERSION index 4b16f37..de9fb9c 100644 --- a/VERSION +++ b/VERSION @@ -87,7 +87,7 @@ SAMBA_VERSION_PRE_RELEASE= # e.g. SAMBA_VERSION_RC_RELEASE=1 # # -> "3.0.0rc1" # ######################################################## -SAMBA_VERSION_RC_RELEASE=2 +SAMBA_VERSION_RC_RELEASE=3 ######################################################## # To mark SVN snapshots this should be set to 'yes' # diff --git a/WHATSNEW.txt b/WHATSNEW.txt index 9365008..6b111c4 100644 --- a/WHATSNEW.txt +++ b/WHATSNEW.txt @@ -1,7 +1,7 @@ Release Announcements ===================== -This is the second release candidate of Samba 4.8. This is *not* +This is the third release candidate of Samba 4.8. This is *not* intended for production environments and is designed for testing purposes only. Please report any defects via the Samba bug reporting system at https://bugzilla.samba.org/. @@ -27,7 +27,7 @@ renew lifetime). Adds the samba_gpoupdate script for applying and unapplying policy. Can be applied automatically by setting - 'server services = +gpoupdate'. + 'apply group policies = yes'. Time Machine Support with vfs_fruit ----------------------------------- @@ -88,6 +88,29 @@ The key file "encrypted_secrets.key" is created in the same directory as the database and should NEVER be disclosed. It is included by the samba_backup script. +Active Directory replication visualisation +------------------------------------------ + +To work out what is happening in a replication graph, it is sometimes +helpful to use visualisations. We introduce a samba-tool subcommand to +write Graphviz dot output and generate text-based heatmaps of the +distance in hops between DCs. + +There are two subcommands, two graphical modes, and (roughly) two modes of +operation with respect to the location of authority. + +`samba-tool visualize ntdsconn` looks at NTDS Connections. +`samba-tool visualize reps` looks at repsTo and repsFrom objects. + +In '--distance' mode (default), the distances between DCs are shown in +a matrix in the terminal. With '--color=yes', this is depicted as a +heatmap. With '--utf8' it is a lttle prettier. + +In '--dot' mode, Graphviz dot output is generated. When viewed using +dot or xdot, this shows the network as a graph with DCs as vertices +and connections edges. Certain types of degenerate edges are shown in +different colours or line-styles. + NT4-style replication based net commands removed ------------------------------------------------ @@ -147,6 +170,12 @@ domains. Some pam_winbind setups may also require the global list. If you have a setup that doesn't require the global list, you should set "winbind scan trusted domains = no". +VirusFilter VFS module +---------------------- + +This new module integrates with Sophos, F-Secure and ClamAV anti-virus +software to provide scanning and filtering of files on a Samba share. + REMOVED FEATURES ================ @@ -171,6 +200,7 @@ smb.conf changes Parameter Name Description Default -------------- ----------- ------- + apply group policies New no auth methods Removed binddns dir New client schannel Default changed/ yes @@ -191,6 +221,22 @@ smb.conf changes winbind trusted domains only Removed +CHANGES SINCE 4.8.0rc2 +====================== + +o Trever L. Adams <trever.ad...@gmail.com> + * BUG 13246: Backport Samba VirusFilter. + +o Ralph Boehme <s...@samba.org> + * BUG 13228: dbcheck: Add support for restoring missing forward links. + +o Günther Deschner <g...@samba.org> + * BUG 13221: python: fix the build with python3. + +o Stefan Metzmacher <me...@samba.org> + * BUG 13228: dbcheck: Add support for restoring missing forward links. + + CHANGES SINCE 4.8.0rc1 ====================== diff --git a/docs-xml/manpages/samba-tool.8.xml b/docs-xml/manpages/samba-tool.8.xml index ed10d61..1349654 100644 --- a/docs-xml/manpages/samba-tool.8.xml +++ b/docs-xml/manpages/samba-tool.8.xml @@ -607,6 +607,61 @@ </refsect2> <refsect2> + <title>visualize [options] <replaceable>subcommand</replaceable></title> + <para>Produce graphical representations of Samba network state. + To work out what is happening in a replication graph, it is sometimes + helpful to use visualisations.</para> + + <para> + There are two subcommands, two graphical modes, and (roughly) two modes + of operation with respect to the location of authority.</para> + + <refsect3><title>MODES OF OPERATION</title> + <varlistentry> + <term>samba-tool visualize ntdsconn</term> + <listitem><para>Looks at NTDS connections. + </para></listitem> + </varlistentry> + + <varlistentry> + <term>samba-tool visualize reps</term> + <listitem><para>Looks at repsTo and repsFrom objects. + </para></listitem> + </varlistentry> + </refsect3> + + <refsect3><title>GRAPHICAL MODES</title> + <varlistentry> + <term>--distance</term> + <listitem><para>Distances between DCs are shown in a matrix in + the terminal. + </para></listitem> + </varlistentry> + + <varlistentry> + <term>--dot</term> + <listitem><para>Generate Graphviz dot output. When viewed using + dot or xdot, this shows the network as a graph with DCs as + vertices and connections edges. Certain types of degenerate + edges are shown in different colours or line-styles. + </para></listitem> + </varlistentry> + </refsect3> + + <varlistentry> + <term>-r</term> + <listitem><para>Normally, <command>samba-tool</command> talks + to one database; with the <arg choice="opt">-r</arg> option + attempts are made to contact all the DCs known to the first + database. This is necessary to get sensible results from + <command>samba-tool visualize reps</command> because the + repsFrom/To objects are not replicated, and it can reveal + replication issues in other modes. + </para></listitem> + </varlistentry> +</refsect2> + +<refsect2> <title>help</title> <para>Gives usage information.</para> </refsect2> @@ -627,8 +682,6 @@ were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.</para> - - <para>The samba-tool manpage was written by Karolin Seeger.</para> </refsect1> </refentry> diff --git a/docs-xml/manpages/vfs_virusfilter.8.xml b/docs-xml/manpages/vfs_virusfilter.8.xml new file mode 100644 index 0000000..ee49df1 --- /dev/null +++ b/docs-xml/manpages/vfs_virusfilter.8.xml @@ -0,0 +1,369 @@ +<?xml version="1.0" encoding="iso-8859-1"?> +<!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc"> +<refentry id="vfs_virusfilter.8"> + +<refmeta> + <refentrytitle>vfs_virusfilter</refentrytitle> + <manvolnum>8</manvolnum> + <refmiscinfo class="source">Samba</refmiscinfo> + <refmiscinfo class="manual">System Administration tools</refmiscinfo> + <refmiscinfo class="version">4.8</refmiscinfo> +</refmeta> + + +<refnamediv> + <refname>vfs_virusfilter</refname> + <refpurpose>On access virus scanner</refpurpose> +</refnamediv> + +<refsynopsisdiv> + <cmdsynopsis> + <command>vfs objects = virusfilter</command> + </cmdsynopsis> +</refsynopsisdiv> + +<refsect1> + <title>DESCRIPTION</title> + + <para>This is a set of various Samba VFS modules to scan and filter + virus files on Samba file services with an anti-virus scanner.</para> + + <para>This module is stackable.</para> + +</refsect1> + +<refsect1> + <title>OPTIONS</title> + + <variablelist> + + <varlistentry> + <term>virusfilter:scanner</term> + <listitem> + <para>The antivirus scan-engine.</para> + <itemizedlist> + <listitem><para><emphasis>sophos</emphasis>, the Sophos AV + scanner</para></listitem> + <listitem><para><emphasis>fsav</emphasis>, the F-Secure AV + scanner</para></listitem> + <listitem><para><emphasis>clamav</emphasis>, the ClamAV + scanner</para></listitem> + </itemizedlist> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:socket path = PATH</term> + <listitem> + <para>Path of local socket for the virus scanner. + </para> + <para>If this option is not set, the default path depends on the + configured AV scanning engine. + </para> + <para>For the <emphasis>sophos</emphasis>backend the default is + <emphasis>/var/run/savdi/sssp.sock</emphasis>.</para> + <para>For the <emphasis>fsav</emphasis> backend the default is + <emphasis>/tmp/.fsav-0</emphasis>.</para> + <para>For the <emphasis>fsav</emphasis> backend the default is + <emphasis>/var/run/clamav/clamd.ctl</emphasis>.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:connect timeout = 30000</term> + <listitem> + <para>Controls how long to wait on connecting to the virus + scanning process before timing out. Value is in milliseconds. + </para> + <para>If this option is not set, the default is 30000.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:io timeout = 60000</term> + <listitem> + <para>Controls how long to wait on communications with the virus + scanning process before timing out. Value is in milliseconds. + </para> + <para>If this option is not set, the default is 60000.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:scan on open = yes</term> + <listitem> + <para>This option controls whether files are scanned on open. + </para> + <para>If this option is not set, the default is yes.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:scan on close = no</term> + <listitem> + <para>This option controls whether files are scanned on close. + </para> + <para>If this option is not set, the default is no.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:max file size = 100000000</term> + <listitem> + <para>This is the largest sized file, in bytes, which will be scanned. + </para> + <para>If this option is not set, the default is 100MB.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:min file size = 10</term> + <listitem> + <para>This is the smallest sized file, in bytes, which will be scanned. + </para> + <para>If this option is not set, the default is 10.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:infected file action = nothing</term> + <listitem> + <para>What to do with an infected file. The options are + nothing, quarantine, rename, delete.</para> + <para>If this option is not set, the default is nothing.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:infected file errno on open = EACCES</term> + <listitem> + <para>What errno to return on open if the file is infected. + </para> + <para>If this option is not set, the default is EACCES.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:infected file errno on close = 0</term> + <listitem> + <para>What errno to return on close if the file is infected. + </para> + <para>If this option is not set, the default is 0.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:quarantine directory = PATH</term> + <listitem> + <para>Where to move infected files. This path must be an + absolute path.</para> + <para>If this option is not set, the default is ".quarantine" + relative to the share path. </para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:quarantine prefix = virusfilter.</term> + <listitem> + <para>Prefix for quarantined files.</para> + <para>If this option is not set, the default is "virusfilter.".</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:quarantine suffix = .infected</term> + <listitem> + <para>Suffix for quarantined files. + This option is only used if keep name is true. Otherwise it is ignored.</para> + <para>If this option is not set, the default is ".infected".</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:rename prefix = virusfilter.</term> + <listitem> + <para>Prefix for infected files.</para> + <para>If this option is not set, the default is "virusfilter.".</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:rename suffix = .infected</term> + <listitem> + <para>Suffix for infected files.</para> + <para>If this option is not set, the default is ".infected".</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:quarantine keep tree = yes</term> + <listitem> + <para>If keep tree is set, the directory structure relative + to the share is maintained in the quarantine directory. + </para> + <para>If this option is not set, the default is yes.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:quarantine keep name = yes</term> + <listitem> + <para>Should the file name be left unmodified other than adding a suffix + and/or prefix and a random suffix name as defined in virusfilter:rename prefix + and virusfilter:rename suffix.</para> + <para>If this option is not set, the default is yes.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:infected file command = @SAMBA_DATADIR@/bin/virusfilter-notify --mail-to virusmas...@example.com --cc "%u...@example.com" --from sa...@example.com --subject-prefix "Samba: Infected File: "</term> + <listitem> + <para>External command to run on an infected file is found.</para> + <para>If this option is not set, the default is none.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:scan archive = true</term> + <listitem> + <para>This defines whether or not to scan archives.</para> + <para>Sophos and F-Secure support this and it defaults to false.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:max nested scan archive = 1</term> + <listitem> + <para>This defines the maximum depth to search nested archives.</para> + <para>The Sophos and F-Secure support this and it defaults to 1.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:scan mime = true</term> + <listitem> + <para>This defines whether or not to scan mime files.</para> + <para>Only the <emphasis>fsav</emphasis>scanner supports this + option and defaults to false.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:scan error command = @SAMBA_DATADIR@/bin/virusfilter-notify --mail-to virusmas...@example.com --from sa...@example.com --subject-prefix "Samba: Scan Error: "</term> + <listitem> + <para>External command to run on scan error.</para> + <para>If this option is not set, the default is none.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:exclude files = empty</term> + <listitem> + <para>Files to exclude from scanning.</para> + <para>If this option is not set, the default is empty.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:block access on error = false</term> + <listitem> + <para>Controls whether or not access should be blocked on + a scanning error.</para> + <para>If this option is not set, the default is false.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:scan error errno on open = EACCES</term> + <listitem> + <para>What errno to return on open if there is an error in + scanning the file and block access on error is true. + </para> + <para>If this option is not set, the default is EACCES.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:scan error errno on close = 0</term> + <listitem> + <para>What errno to return on close if there is an error in + scanning the file and block access on error is true. + </para> + <para>If this option is not set, the default is 0.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:cache entry limit = 100</term> + <listitem> + <para>The maximum number of entries in the scanning results + cache. Due to how Samba's memcache works, this is approximate.</para> + <para>If this option is not set, the default is 100.</para> + </listitem> + </varlistentry> + + <varlistentry> + <term>virusfilter:cache time limit = 10</term> + <listitem> + <para>The maximum number of seconds that a scanning result + will stay in the results cache. -1 disables the limit. + 0 disables caching.</para> -- Samba Shared Repository