OP#785 revert

.vscode/settings.json

@@ -11,6 +11,7 @@
         "clamscan",
         "Clamuko",
         "clamupdate",
+        "concurrentdatabasereload",
         "Dazuko",
         "dbname",
         "epel",
@@ -32,6 +33,7 @@
         "logsyslog",
         "logtime",
         "logverbose",
+        "MAINPID",
         "multiscan",
         "mypass",
         "myproxy",

README.md

@@ -33,7 +33,8 @@
 - manage required config files
 - manage cronjob settings via parameters
 - run cron job to scan the file system (by default starting at root, configurable) via clamdscan
-- manage services
+- set ConcurrentDatabaseReload option `yes`/`no` to optimize RAM consumption. defaults to `no`
+- manage `freshclam` and `clamd` services
 
 ## Dependencies
 

manifests/main/files.pp

@@ -33,6 +33,7 @@ class confdroid_clamav::main::files (
     seltype  => etc_t,
     seluser  => system_u,
     content  => template($cv_freshclam_erb),
+    notify   => Service[$cv_freshclam],
   }
 
   # freshclam service config file
@@ -46,6 +47,21 @@ class confdroid_clamav::main::files (
     seltype  => etc_t,
     seluser  => system_u,
     content  => template($cv_freshclam_svc_erb),
+    notify   => Service[$cv_freshclam],
+  }
+
+  # clamd service config file
+  file { $cv_clamd_svc  :
+    ensure   => file,
+    owner    => 'root',
+    group    => 'root',
+    mode     => '0600',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => etc_t,
+    seluser  => system_u,
+    content  => template($cv_clamd_svc_erb),
+    notify   => Service[$cv_service],
   }
 
   # shell script for scanning and alerting

manifests/params.pp

@@ -36,6 +36,16 @@
 # @param [Boolean] cv_enable_freshclam whether to enable the freshclam service
 # @param [Boolean] cv_enable_clamd whether to enable the clamd service
 # @param [Boolean] cv_use_excludepaths whether to use advanced exclude paths
+# @param [String] cv_concurrentdatabasereload whether to enable concurrent
+#   database reloads. This is useful when you have multiple clamd instances
+#   running on the same machine. If you have only one clamd instance, this
+#   should be set to 'no'.
+# @param [String] cv_clamd_max_mem maximum memory usage for clamd. 
+# @param [String] cv_clamd_cpu_quota maximum CPU usage for clamd.
+# @param [String] cv_nice_value nice value for clamd. This is a number between
+#   -20 and 19. The lower the number, the higher the priority. The default is 
+#   19, which is the lowest priority.
+# @param [String] cv_timeout_start_sec timeout for starting the clamd service.
 ##############################################################################
 class confdroid_clamav::params (
 
@@ -65,7 +75,12 @@ class confdroid_clamav::params (
   String $cv_alert_file               = 'tmp/clamav-alert.txt',
   Boolean $cv_enable_freshclam        = true,
   Boolean $cv_enable_clamd            = true,
-  Boolean $cv_use_excludepaths    = true
+  Boolean $cv_use_excludepaths        = true,
+  String $cv_concurrentdatabasereload = 'no',
+  String $cv_clamd_max_mem            = '512M',
+  String $cv_clamd_cpu_quota          = '30%',
+  String $cv_nice_value               = '19',
+  String $cv_timeout_start_sec        = '420'
 
 ) {
   # service
@@ -82,6 +97,8 @@ class confdroid_clamav::params (
   $cv_freshclam_erb       = 'confdroid_clamav/freshclam_conf.erb'
   $cv_freshclam_svc       = '/usr/lib/systemd/system/freshclam.service'
   $cv_freshclam_svc_erb   = 'confdroid_clamav/freshclam_svc.erb'
+  $cv_clamd_svc           = '/usr/lib/systemd/system/clamd@.service'
+  $cv_clamd_svc_erb       = 'confdroid_clamav/clamd_svc.erb'
   $cv_shell_script        = "${cv_config_d_dir}/scan.sh"
   $cv_shell_script_erb    = 'confdroid_clamav/scan.sh.erb'
 

templates/clamd_svc.erb

@@ -0,0 +1,22 @@
+################################################################################
+###    clamd.svc created by Puppet, manual changes will be overwritten!!!    ###
+################################################################################
+
+[Unit]
+Description = clamd scanner (%i) daemon
+Documentation=man:clamd(8) man:clamd.conf(5) https://www.clamav.net/documents/
+After = syslog.target nss-lookup.target network.target
+
+[Service]
+Type = forking
+ExecStart = /usr/sbin/clamd -c /etc/clamd.d/%i.conf
+# Reload the database
+ExecReload=/bin/kill -USR2 $MAINPID
+Restart = on-failure
+TimeoutStartSec=<%= @cv_timeout_start_sec %>
+MemoryMax=<%= @cv_clamd_max_mem %>
+CPUQuota=<%= @cv_clamd_cpu_quota %>
+Nice=<%= @cv_nice_value %>
+
+[Install]
+WantedBy = multi-user.target

templates/scan_conf.erb

@@ -14,6 +14,7 @@ LogRotate       <%= @cv_logrotate %>
 PreludeEnable   <%= @cv_preludeenable %>
 TCPSocket       <%= @cv_tcpsocket %>
 TCPAddr         <%= @cv_tcpaddress %>
+ConcurrentDatabaseReload <%= @cv_concurrentdatabasereload %>
 #
 # Set the name of the analyzer used by prelude-admin.
 # Default: ClamAV