OP#785 revert

.vscode/settings.json

@@ -11,6 +11,7 @@
         "clamscan",
         "Clamuko",
         "clamupdate",
+        "concurrentdatabasereload",
         "Dazuko",
         "dbname",
         "epel",
@@ -32,6 +33,7 @@
         "logsyslog",
         "logtime",
         "logverbose",
+        "MAINPID",
         "multiscan",
         "mypass",
         "myproxy",

README.md

@@ -33,7 +33,8 @@
 - manage required config files
 - manage cronjob settings via parameters
 - run cron job to scan the file system (by default starting at root, configurable) via clamdscan
-- manage services
+- set ConcurrentDatabaseReload option `yes`/`no` to optimize RAM consumption. defaults to `no`
+- manage `freshclam` and `clamd` services
 
 ## Dependencies
 

manifests/main/files.pp

@@ -33,6 +33,7 @@ class confdroid_clamav::main::files (
     seltype  => etc_t,
     seluser  => system_u,
     content  => template($cv_freshclam_erb),
+    notify   => Service[$cv_freshclam],
   }
 
   # freshclam service config file
@@ -46,6 +47,21 @@ class confdroid_clamav::main::files (
     seltype  => etc_t,
     seluser  => system_u,
     content  => template($cv_freshclam_svc_erb),
+    notify   => Service[$cv_freshclam],
+  }
+
+  # clamd service config file
+  file { $cv_clamd_svc  :
+    ensure   => file,
+    owner    => 'root',
+    group    => 'root',
+    mode     => '0600',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => etc_t,
+    seluser  => system_u,
+    content  => template($cv_clamd_svc_erb),
+    notify   => Service[$cv_service],
   }
 
   # shell script for scanning and alerting

manifests/params.pp

@@ -36,36 +36,51 @@
 # @param [Boolean] cv_enable_freshclam whether to enable the freshclam service
 # @param [Boolean] cv_enable_clamd whether to enable the clamd service
 # @param [Boolean] cv_use_excludepaths whether to use advanced exclude paths
+# @param [String] cv_concurrentdatabasereload whether to enable concurrent
+#   database reloads. This is useful when you have multiple clamd instances
+#   running on the same machine. If you have only one clamd instance, this
+#   should be set to 'no'.
+# @param [String] cv_clamd_max_mem maximum memory usage for clamd. 
+# @param [String] cv_clamd_cpu_quota maximum CPU usage for clamd.
+# @param [String] cv_nice_value nice value for clamd. This is a number between
+#   -20 and 19. The lower the number, the higher the priority. The default is 
+#   19, which is the lowest priority.
+# @param [String] cv_timeout_start_sec timeout for starting the clamd service.
 ##############################################################################
 class confdroid_clamav::params (
 
 # installation
-  Array $cv_reqpackages              = ['clamav','clamd','s-nail'],
-  String $cv_pkg_ensure              = 'present',
+  Array $cv_reqpackages               = ['clamav','clamd','s-nail'],
+  String $cv_pkg_ensure               = 'present',
 
 # clamd
-  String $cv_logfile              = '/var/log/clamd.scan',
-  String $cv_logfileunlock        = 'no',
-  String $cv_logfilemaxsize       = '2M',
-  String $cv_logtime              = 'yes',
-  String $cv_logclean             = 'no',
-  String $cv_logsyslog            = 'yes',
-  String $cv_logfacility          = 'LOG_MAIL',
-  String $cv_logverbose           = 'no',
-  String $cv_logrotate            = 'yes',
-  String $cv_preludeenable        = 'no',
-  String $cv_preludeanalyzername  = 'ClamAV',
-  String $cv_tcpsocket            = '3310',
-  String $cv_tcpaddress           = 'localhost',
-  String $cv_alert_email          = 'you@example.com',
-  String $cv_cron_hour            = '2',
-  String $cv_cron_minute          = '0',
-  String $cv_cron_user            = 'root',
-  String $cv_scan_dir             = '/',
-  String $cv_alert_file           = 'tmp/clamav-alert.txt',
-  Boolean $cv_enable_freshclam    = true,
-  Boolean $cv_enable_clamd        = true,
-  Boolean $cv_use_excludepaths    = true
+  String $cv_logfile                  = '/var/log/clamd.scan',
+  String $cv_logfileunlock            = 'no',
+  String $cv_logfilemaxsize           = '2M',
+  String $cv_logtime                  = 'yes',
+  String $cv_logclean                 = 'no',
+  String $cv_logsyslog                = 'yes',
+  String $cv_logfacility              = 'LOG_MAIL',
+  String $cv_logverbose               = 'no',
+  String $cv_logrotate                = 'yes',
+  String $cv_preludeenable            = 'no',
+  String $cv_preludeanalyzername      = 'ClamAV',
+  String $cv_tcpsocket                = '3310',
+  String $cv_tcpaddress               = 'localhost',
+  String $cv_alert_email              = 'you@example.com',
+  String $cv_cron_hour                = '2',
+  String $cv_cron_minute              = '0',
+  String $cv_cron_user                = 'root',
+  String $cv_scan_dir                 = '/',
+  String $cv_alert_file               = 'tmp/clamav-alert.txt',
+  Boolean $cv_enable_freshclam        = true,
+  Boolean $cv_enable_clamd            = true,
+  Boolean $cv_use_excludepaths        = true,
+  String $cv_concurrentdatabasereload = 'no',
+  String $cv_clamd_max_mem            = '512M',
+  String $cv_clamd_cpu_quota          = '30%',
+  String $cv_nice_value               = '19',
+  String $cv_timeout_start_sec        = '420'
 
 ) {
   # service
@@ -82,6 +97,8 @@ class confdroid_clamav::params (
   $cv_freshclam_erb       = 'confdroid_clamav/freshclam_conf.erb'
   $cv_freshclam_svc       = '/usr/lib/systemd/system/freshclam.service'
   $cv_freshclam_svc_erb   = 'confdroid_clamav/freshclam_svc.erb'
+  $cv_clamd_svc           = '/usr/lib/systemd/system/clamd@.service'
+  $cv_clamd_svc_erb       = 'confdroid_clamav/clamd_svc.erb'
   $cv_shell_script        = "${cv_config_d_dir}/scan.sh"
   $cv_shell_script_erb    = 'confdroid_clamav/scan.sh.erb'
 

templates/clamd_svc.erb

@@ -0,0 +1,22 @@
+################################################################################
+###    clamd.svc created by Puppet, manual changes will be overwritten!!!    ###
+################################################################################
+
+[Unit]
+Description = clamd scanner (%i) daemon
+Documentation=man:clamd(8) man:clamd.conf(5) https://www.clamav.net/documents/
+After = syslog.target nss-lookup.target network.target
+
+[Service]
+Type = forking
+ExecStart = /usr/sbin/clamd -c /etc/clamd.d/%i.conf
+# Reload the database
+ExecReload=/bin/kill -USR2 $MAINPID
+Restart = on-failure
+TimeoutStartSec=<%= @cv_timeout_start_sec %>
+MemoryMax=<%= @cv_clamd_max_mem %>
+CPUQuota=<%= @cv_clamd_cpu_quota %>
+Nice=<%= @cv_nice_value %>
+
+[Install]
+WantedBy = multi-user.target

templates/scan.sh.erb

@@ -23,4 +23,4 @@ if grep -q "Infected files: [^0]" "$LOG_FILE" 2>/dev/null; then
     mail -s "⚠️ ClamAV Alert on $(hostname)" "$EMAIL" < "$TMP_ALERT"
 fi
 
-rm -f "$TMP_ALERT"
+rm -f "$TMP_ALERT"

templates/scan_conf.erb

@@ -14,6 +14,7 @@ LogRotate       <%= @cv_logrotate %>
 PreludeEnable   <%= @cv_preludeenable %>
 TCPSocket       <%= @cv_tcpsocket %>
 TCPAddr         <%= @cv_tcpaddress %>
+ConcurrentDatabaseReload <%= @cv_concurrentdatabasereload %>
 #
 # Set the name of the analyzer used by prelude-admin.
 # Default: ClamAV