diff --git a/README.md b/README.md index aee2f97..a9894a1 100644 --- a/README.md +++ b/README.md @@ -33,7 +33,7 @@ - manage required config files - manage cronjob settings via parameters - run cron job to scan the file system (by default starting at root, configurable) via clamdscan -- set ConcurrentDatabaseReload option yes/no to optimize RAM consumption +- set ConcurrentDatabaseReload option `yes`/`no` to optimize RAM consumption. defaults to `no` - manage services ## Dependencies diff --git a/manifests/main/files.pp b/manifests/main/files.pp index e5cea2e..0890bba 100644 --- a/manifests/main/files.pp +++ b/manifests/main/files.pp @@ -33,6 +33,7 @@ class confdroid_clamav::main::files ( seltype => etc_t, seluser => system_u, content => template($cv_freshclam_erb), + notify => Service[$cv_freshclam], } # freshclam service config file @@ -46,6 +47,21 @@ class confdroid_clamav::main::files ( seltype => etc_t, seluser => system_u, content => template($cv_freshclam_svc_erb), + notify => Service[$cv_freshclam], + } + + # clamd service config file + file { $cv_clamd_svc : + ensure => file, + owner => 'root', + group => 'root', + mode => '0600', + selrange => s0, + selrole => object_r, + seltype => etc_t, + seluser => system_u, + content => template($cv_clamd_svc_erb), + notify => Service[$cv_service], } # shell script for scanning and alerting diff --git a/manifests/params.pp b/manifests/params.pp index 0c1205b..4cd38c3 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -36,6 +36,10 @@ # @param [Boolean] cv_enable_freshclam whether to enable the freshclam service # @param [Boolean] cv_enable_clamd whether to enable the clamd service # @param [Boolean] cv_use_excludepaths whether to use advanced exclude paths +# @param [String] cv_concurrentdatabasereload whether to enable concurrent +# database reloads. This is useful when you have multiple clamd instances +# running on the same machine. If you have only one clamd instance, this +# should be set to 'no'. ############################################################################## class confdroid_clamav::params ( @@ -83,6 +87,8 @@ class confdroid_clamav::params ( $cv_freshclam_erb = 'confdroid_clamav/freshclam_conf.erb' $cv_freshclam_svc = '/usr/lib/systemd/system/freshclam.service' $cv_freshclam_svc_erb = 'confdroid_clamav/freshclam_svc.erb' + $cv_clamd_svc = '/usr/lib/systemd/system/clamd@.service' + $cv_clamd_svc_erb = 'confdroid_clamav/clamd_svc.erb' $cv_shell_script = "${cv_config_d_dir}/scan.sh" $cv_shell_script_erb = 'confdroid_clamav/scan.sh.erb' diff --git a/templates/clamd_svc.erb b/templates/clamd_svc.erb new file mode 100644 index 0000000..9eee048 --- /dev/null +++ b/templates/clamd_svc.erb @@ -0,0 +1,19 @@ +################################################################################ +### clamd.svc created by Puppet, manual changes will be overwritten!!! ### +################################################################################ + +[Unit] +Description = clamd scanner (%i) daemon +Documentation=man:clamd(8) man:clamd.conf(5) https://www.clamav.net/documents/ +After = syslog.target nss-lookup.target network.target + +[Service] +Type = forking +ExecStart = /usr/sbin/clamd -c /etc/clamd.d/%i.conf +# Reload the database +ExecReload=/bin/kill -USR2 $MAINPID +Restart = on-failure +TimeoutStartSec=420 + +[Install] +WantedBy = multi-user.target