OP#785 revert

.vscode/settings.json

@@ -11,14 +11,18 @@
         "clamscan",
         "Clamuko",
         "clamupdate",
+        "concurrentdatabasereload",
         "Dazuko",
         "dbname",
         "epel",
+        "excludepaths",
         "fanotify",
+        "fdpass",
         "filesize",
         "freshclam",
         "getsebool",
         "INADDR",
+        "kubelet",
         "libclamav",
         "logclean",
         "logfacility",
@@ -29,12 +33,15 @@
         "logsyslog",
         "logtime",
         "logverbose",
+        "MAINPID",
+        "multiscan",
         "mypass",
         "myproxy",
         "myusername",
         "NOFILE",
         "normalisation",
         "PCRE",
+        "pipefail",
         "preludeanalyzername",
         "preludeenable",
         "recieve",

README.md

@@ -33,7 +33,8 @@
 - manage required config files
 - manage cronjob settings via parameters
 - run cron job to scan the file system (by default starting at root, configurable) via clamdscan
-- manage services
+- set ConcurrentDatabaseReload option `yes`/`no` to optimize RAM consumption. defaults to `no`
+- manage `freshclam` and `clamd` services
 
 ## Dependencies
 
@@ -41,7 +42,7 @@ All dependencies must be included in the catalogue.
 
 - [confdroid_resources](https://sourcecode.confdroid.com/confdroid/confdroid_resources) for managing yum repo resources.
 
-### Deployment
+## Deployment
 
 - native Puppet deployment
 

manifests/main/files.pp

@@ -33,6 +33,7 @@ class confdroid_clamav::main::files (
     seltype  => etc_t,
     seluser  => system_u,
     content  => template($cv_freshclam_erb),
+    notify   => Service[$cv_freshclam],
   }
 
   # freshclam service config file
@@ -46,6 +47,21 @@ class confdroid_clamav::main::files (
     seltype  => etc_t,
     seluser  => system_u,
     content  => template($cv_freshclam_svc_erb),
+    notify   => Service[$cv_freshclam],
+  }
+
+  # clamd service config file
+  file { $cv_clamd_svc  :
+    ensure   => file,
+    owner    => 'root',
+    group    => 'root',
+    mode     => '0600',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => etc_t,
+    seluser  => system_u,
+    content  => template($cv_clamd_svc_erb),
+    notify   => Service[$cv_service],
   }
 
   # shell script for scanning and alerting

manifests/main/install.pp

@@ -9,7 +9,7 @@ class confdroid_clamav::main::install (
 ) inherits confdroid_clamav::params {
   require confdroid_resources::main::epel
 
-  package { $reqpackages:
-    ensure => $pkg_ensure,
+  package { $cv_reqpackages:
+    ensure => $cv_pkg_ensure,
   }
 }

manifests/params.pp

@@ -3,8 +3,8 @@
 # Author: 12ww1160 (12ww1160@confdroid.com)
 # @summary  Class holds all parameters for the confdroid_clamav module and is
 #   inherited by all classes except defines.
-# @param [Array] reqpackages List of packages to install.
-# @param [String] pkg_ensure
+# @param [Array] cv_reqpackages List of packages to install.
+# @param [String] cv_pkg_ensure
 #   which [package type](https://confdroid.com/2017/05/puppet-type-package/)
 #   to choose, i.e. `latest` or `present`.
 # @param [String] cv_logfile where to log messages for the clamd service.
@@ -35,12 +35,23 @@
 # @param [String] cv_alert_file location and name of the alert file
 # @param [Boolean] cv_enable_freshclam whether to enable the freshclam service
 # @param [Boolean] cv_enable_clamd whether to enable the clamd service
+# @param [Boolean] cv_use_excludepaths whether to use advanced exclude paths
+# @param [String] cv_concurrentdatabasereload whether to enable concurrent
+#   database reloads. This is useful when you have multiple clamd instances
+#   running on the same machine. If you have only one clamd instance, this
+#   should be set to 'no'.
+# @param [String] cv_clamd_max_mem maximum memory usage for clamd. 
+# @param [String] cv_clamd_cpu_quota maximum CPU usage for clamd.
+# @param [String] cv_nice_value nice value for clamd. This is a number between
+#   -20 and 19. The lower the number, the higher the priority. The default is 
+#   19, which is the lowest priority.
+# @param [String] cv_timeout_start_sec timeout for starting the clamd service.
 ##############################################################################
 class confdroid_clamav::params (
 
 # installation
-  Array $reqpackages              = ['clamav','clamd','s-nail'],
-  String $pkg_ensure              = 'present',
+  Array $cv_reqpackages               = ['clamav','clamd','s-nail'],
+  String $cv_pkg_ensure               = 'present',
 
 # clamd
   String $cv_logfile                  = '/var/log/clamd.scan',
@@ -64,6 +75,12 @@ class confdroid_clamav::params (
   String $cv_alert_file               = 'tmp/clamav-alert.txt',
   Boolean $cv_enable_freshclam        = true,
   Boolean $cv_enable_clamd            = true,
+  Boolean $cv_use_excludepaths        = true,
+  String $cv_concurrentdatabasereload = 'no',
+  String $cv_clamd_max_mem            = '512M',
+  String $cv_clamd_cpu_quota          = '30%',
+  String $cv_nice_value               = '19',
+  String $cv_timeout_start_sec        = '420'
 
 ) {
   # service
@@ -80,6 +97,8 @@ class confdroid_clamav::params (
   $cv_freshclam_erb       = 'confdroid_clamav/freshclam_conf.erb'
   $cv_freshclam_svc       = '/usr/lib/systemd/system/freshclam.service'
   $cv_freshclam_svc_erb   = 'confdroid_clamav/freshclam_svc.erb'
+  $cv_clamd_svc           = '/usr/lib/systemd/system/clamd@.service'
+  $cv_clamd_svc_erb       = 'confdroid_clamav/clamd_svc.erb'
   $cv_shell_script        = "${cv_config_d_dir}/scan.sh"
   $cv_shell_script_erb    = 'confdroid_clamav/scan.sh.erb'
 

templates/clamd_svc.erb

@@ -0,0 +1,22 @@
+################################################################################
+###    clamd.svc created by Puppet, manual changes will be overwritten!!!    ###
+################################################################################
+
+[Unit]
+Description = clamd scanner (%i) daemon
+Documentation=man:clamd(8) man:clamd.conf(5) https://www.clamav.net/documents/
+After = syslog.target nss-lookup.target network.target
+
+[Service]
+Type = forking
+ExecStart = /usr/sbin/clamd -c /etc/clamd.d/%i.conf
+# Reload the database
+ExecReload=/bin/kill -USR2 $MAINPID
+Restart = on-failure
+TimeoutStartSec=<%= @cv_timeout_start_sec %>
+MemoryMax=<%= @cv_clamd_max_mem %>
+CPUQuota=<%= @cv_clamd_cpu_quota %>
+Nice=<%= @cv_nice_value %>
+
+[Install]
+WantedBy = multi-user.target

templates/scan.sh.erb

@@ -1,23 +1,26 @@
 #!/bin/bash
+set -euo pipefail
 
-# Set paths
 SCAN_DIR="<%= @cv_scan_dir %>"
 LOG_FILE="<%= @cv_logfile %>"
 TMP_ALERT="<%= @cv_alert_file %>"
 EMAIL="<%= @cv_alert_email %>"
 
-# Run clamscan
-clamscan -r --infected --log="$LOG_FILE" "$SCAN_DIR" > /dev/null
+# Ensure the log directory exists
+mkdir -p "$(dirname "$LOG_FILE")"
 
-# Check if infections were found
-if grep -q "Infected files: [^0]" "$LOG_FILE"; then
-    echo "ClamAV has found infected files on $(hostname)!" > "$TMP_ALERT"
-    echo "" >> "$TMP_ALERT"
-    grep "FOUND" "$LOG_FILE" >> "$TMP_ALERT"
+# Preferred: clamdscan with multiscan + fdpass
+clamdscan --multiscan --fdpass --infected --log="$LOG_FILE" "$SCAN_DIR" > /dev/null || true
+
+# Check for infections (same logic as before)
+if grep -q "Infected files: [^0]" "$LOG_FILE" 2>/dev/null; then
+    {
+        echo "ClamAV has found infected files on $(hostname)!"
+        echo ""
+        grep "FOUND" "$LOG_FILE" || true
+    } > "$TMP_ALERT"
 
-    # Send the alert email
     mail -s "⚠️ ClamAV Alert on $(hostname)" "$EMAIL" < "$TMP_ALERT"
 fi
 
-# Clean up
 rm -f "$TMP_ALERT"

templates/scan_conf.erb

@@ -14,6 +14,7 @@ LogRotate       <%= @cv_logrotate %>
 PreludeEnable   <%= @cv_preludeenable %>
 TCPSocket       <%= @cv_tcpsocket %>
 TCPAddr         <%= @cv_tcpaddress %>
+ConcurrentDatabaseReload <%= @cv_concurrentdatabasereload %>
 #
 # Set the name of the analyzer used by prelude-admin.
 # Default: ClamAV
@@ -21,7 +22,7 @@ PreludeAnalyzerName ClamAV
 
 # Log additional information about the infected file, such as its
 # size and hash, together with the virus name.
-#ExtendedDetectionInfo yes
+ExtendedDetectionInfo yes
 
 # This option allows you to save a process identifier of the listening
 # daemon (main thread).
@@ -132,6 +133,28 @@ PreludeAnalyzerName ClamAV
 #ExcludePath ^/proc/
 #ExcludePath ^/sys/
 
+<% if @cv_use_excludepaths %>
+ExcludePath ^/proc
+ExcludePath ^/sys
+ExcludePath ^/dev
+ExcludePath ^/run
+ExcludePath ^/var/run
+ExcludePath ^/var/tmp
+ExcludePath ^/tmp
+ExcludePath ^/var/lib/clamav
+ExcludePath ^/var/log/clamav
+ExcludePath ^/var/lib/docker
+ExcludePath ^/var/lib/containerd
+ExcludePath ^/var/lib/kubelet/pods
+ExcludePath ^/var/lib/kubelet/plugins
+ExcludePath ^/var/lib/kubelet/plugins_registry
+ExcludePath ^/var/log/pods
+ExcludePath ^/var/log/containers
+ExcludePath ^/var/cache
+ExcludePath ^/run/containerd
+ExcludePath ^/run/docker
+<% end %>
+
 # Maximum depth directories are scanned at.
 # Default: 15
 #MaxDirectoryRecursion 20