Recommit for updates in build 18

README.md

@@ -33,7 +33,8 @@
 - manage required config files
 - manage cronjob settings via parameters
 - run cron job to scan the file system (by default starting at root, configurable) via clamdscan
-- manage services
+- set ConcurrentDatabaseReload option `yes`/`no` to optimize RAM consumption. defaults to `no`
+- manage `freshclam` and `clamd` services
 
 ## Dependencies
 
@@ -41,7 +42,7 @@ All dependencies must be included in the catalogue.
 
 - [confdroid_resources](https://sourcecode.confdroid.com/confdroid/confdroid_resources) for managing yum repo resources.
 
-### Deployment
+## Deployment
 
 - native Puppet deployment
 

doc/file.README.html

@@ -71,9 +71,8 @@
 <p><a href="#features">Features</a></p>
 </li><li>
 <p><a href="#dependencies">Dependencies</a></p>
-<ul><li>
+</li><li>
 <p><a href="#deployment">Deployment</a></p>
-</li></ul>
 </li><li>
 <p><a href="#parameters">Parameters</a></p>
 </li><li>
@@ -108,7 +107,9 @@
 </li><li>
 <p>run cron job to scan the file system (by default starting at root, configurable) via clamdscan</p>
 </li><li>
-<p>manage services</p>
+<p>set ConcurrentDatabaseReload option <code>yes</code>/<code>no</code> to optimize RAM consumption. defaults to <code>no</code></p>
+</li><li>
+<p>manage <code>freshclam</code> and <code>clamd</code> services</p>
 </li></ul>
 
 <h2 id="label-Dependencies">Dependencies</h2>
@@ -118,7 +119,7 @@
 <p><a href="https://sourcecode.confdroid.com/confdroid/confdroid_resources">confdroid_resources</a> for managing yum repo resources.</p>
 </li></ul>
 
-<h3 id="label-Deployment">Deployment</h3>
+<h2 id="label-Deployment">Deployment</h2>
 <ul><li>
 <p>native Puppet deployment</p>
 </li></ul>

doc/index.html

@@ -71,9 +71,8 @@
 <p><a href="#features">Features</a></p>
 </li><li>
 <p><a href="#dependencies">Dependencies</a></p>
-<ul><li>
+</li><li>
 <p><a href="#deployment">Deployment</a></p>
-</li></ul>
 </li><li>
 <p><a href="#parameters">Parameters</a></p>
 </li><li>
@@ -108,7 +107,9 @@
 </li><li>
 <p>run cron job to scan the file system (by default starting at root, configurable) via clamdscan</p>
 </li><li>
-<p>manage services</p>
+<p>set ConcurrentDatabaseReload option <code>yes</code>/<code>no</code> to optimize RAM consumption. defaults to <code>no</code></p>
+</li><li>
+<p>manage <code>freshclam</code> and <code>clamd</code> services</p>
 </li></ul>
 
 <h2 id="label-Dependencies">Dependencies</h2>
@@ -118,7 +119,7 @@
 <p><a href="https://sourcecode.confdroid.com/confdroid/confdroid_resources">confdroid_resources</a> for managing yum repo resources.</p>
 </li></ul>
 
-<h3 id="label-Deployment">Deployment</h3>
+<h2 id="label-Deployment">Deployment</h2>
 <ul><li>
 <p>native Puppet deployment</p>
 </li></ul>

doc/puppet_classes/confdroid_clamav_3A_3Amain_3A_3Afiles.html

@@ -158,7 +158,23 @@
 60
 61
 62
-63</pre>
+63
+64
+65
+66
+67
+68
+69
+70
+71
+72
+73
+74
+75
+76
+77
+78
+79</pre>
       </td>
       <td>
         <pre class="code"><span class="info file"># File 'manifests/main/files.pp', line 6</span>
@@ -193,6 +209,7 @@ class confdroid_clamav::main::files (
     seltype  =&gt; etc_t,
     seluser  =&gt; system_u,
     content  =&gt; template($cv_freshclam_erb),
+    notify   =&gt; Service[$cv_freshclam],
   }
 
   # freshclam service config file
@@ -206,6 +223,21 @@ class confdroid_clamav::main::files (
     seltype  =&gt; etc_t,
     seluser  =&gt; system_u,
     content  =&gt; template($cv_freshclam_svc_erb),
+    notify   =&gt; Service[$cv_freshclam],
+  }
+
+  # clamd service config file
+  file { $cv_clamd_svc  :
+    ensure   =&gt; file,
+    owner    =&gt; &#39;root&#39;,
+    group    =&gt; &#39;root&#39;,
+    mode     =&gt; &#39;0600&#39;,
+    selrange =&gt; s0,
+    selrole  =&gt; object_r,
+    seltype  =&gt; etc_t,
+    seluser  =&gt; system_u,
+    content  =&gt; template($cv_clamd_svc_erb),
+    notify   =&gt; Service[$cv_service],
   }
 
   # shell script for scanning and alerting

doc/puppet_classes/confdroid_clamav_3A_3Amain_3A_3Ainstall.html

@@ -120,8 +120,8 @@ class confdroid_clamav::main::install (
 ) inherits confdroid_clamav::params {
   require confdroid_resources::main::epel
 
-  package { $reqpackages:
+  package { $cv_reqpackages:
-    ensure => $pkg_ensure,
+    ensure => $cv_pkg_ensure,
   }
 }</pre>
       </td>

doc/puppet_classes/confdroid_clamav_3A_3Aparams.html

@@ -109,7 +109,7 @@ inherited by all classes except defines.
   
     <li>
       
-        <span class='name'>reqpackages</span>
+        <span class='name'>cv_reqpackages</span>
       
       
         <span class='type'>(<tt>Array</tt>)</span>
@@ -127,7 +127,7 @@ inherited by all classes except defines.
   
     <li>
       
-        <span class='name'>pkg_ensure</span>
+        <span class='name'>cv_pkg_ensure</span>
       
       
         <span class='type'>(<tt>String</tt>)</span>
@@ -517,6 +517,114 @@ inherited by all classes except defines.
         &mdash;
         <div class='inline'>
 <p>whether to enable the clamd service</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>cv_use_excludepaths</span>
+      
+      
+        <span class='type'>(<tt>Boolean</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>true</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>whether to use advanced exclude paths</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>cv_concurrentdatabasereload</span>
+      
+      
+        <span class='type'>(<tt>String</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>&#39;no&#39;</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>whether to enable concurrent database reloads. This is useful when you have multiple clamd instances running on the same machine. If you have only one clamd instance, this should be set to ‘no’.</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>cv_clamd_max_mem</span>
+      
+      
+        <span class='type'>(<tt>String</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>&#39;512M&#39;</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>maximum memory usage for clamd.</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>cv_clamd_cpu_quota</span>
+      
+      
+        <span class='type'>(<tt>String</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>&#39;30%&#39;</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>maximum CPU usage for clamd.</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>cv_nice_value</span>
+      
+      
+        <span class='type'>(<tt>String</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>&#39;19&#39;</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>nice value for clamd. This is a number between -20 and 19. The lower the number, the higher the priority. The default is 19, which is the lowest priority.</p>
+</div>
+      
+    </li>
+  
+    <li>
+      
+        <span class='name'>cv_timeout_start_sec</span>
+      
+      
+        <span class='type'>(<tt>String</tt>)</span>
+      
+      
+        <em class="default">(defaults to: <tt>&#39;420&#39;</tt>)</em>
+      
+      
+        &mdash;
+        <div class='inline'>
+<p>timeout for starting the clamd service.</p>
 </div>
       
     </li>
@@ -532,17 +640,6 @@ inherited by all classes except defines.
         <pre class="lines">
 
 
-39
-40
-41
-42
-43
-44
-45
-46
-47
-48
-49
 50
 51
 52
@@ -582,16 +679,35 @@ inherited by all classes except defines.
 86
 87
 88
-89</pre>
+89
+90
+91
+92
+93
+94
+95
+96
+97
+98
+99
+100
+101
+102
+103
+104
+105
+106
+107
+108</pre>
       </td>
       <td>
-        <pre class="code"><span class="info file"># File 'manifests/params.pp', line 39</span>
+        <pre class="code"><span class="info file"># File 'manifests/params.pp', line 50</span>
 
 class confdroid_clamav::params (
 
 # installation
-  Array $reqpackages              = [&#39;clamav&#39;,&#39;clamd&#39;,&#39;s-nail&#39;],
+  Array $cv_reqpackages               = [&#39;clamav&#39;,&#39;clamd&#39;,&#39;s-nail&#39;],
-  String $pkg_ensure              = &#39;present&#39;,
+  String $cv_pkg_ensure               = &#39;present&#39;,
 
 # clamd
   String $cv_logfile                  = &#39;/var/log/clamd.scan&#39;,
@@ -615,6 +731,12 @@ class confdroid_clamav::params (
   String $cv_alert_file               = &#39;tmp/clamav-alert.txt&#39;,
   Boolean $cv_enable_freshclam        = true,
   Boolean $cv_enable_clamd            = true,
+  Boolean $cv_use_excludepaths        = true,
+  String $cv_concurrentdatabasereload = &#39;no&#39;,
+  String $cv_clamd_max_mem            = &#39;512M&#39;,
+  String $cv_clamd_cpu_quota          = &#39;30%&#39;,
+  String $cv_nice_value               = &#39;19&#39;,
+  String $cv_timeout_start_sec        = &#39;420&#39;
 
 ) {
   # service
@@ -631,6 +753,8 @@ class confdroid_clamav::params (
   $cv_freshclam_erb       = &#39;confdroid_clamav/freshclam_conf.erb&#39;
   $cv_freshclam_svc       = &#39;/usr/lib/systemd/system/freshclam.service&#39;
   $cv_freshclam_svc_erb   = &#39;confdroid_clamav/freshclam_svc.erb&#39;
+  $cv_clamd_svc           = &#39;/usr/lib/systemd/system/clamd@.service&#39;
+  $cv_clamd_svc_erb       = &#39;confdroid_clamav/clamd_svc.erb&#39;
   $cv_shell_script        = &quot;${cv_config_d_dir}/scan.sh&quot;
   $cv_shell_script_erb    = &#39;confdroid_clamav/scan.sh.erb&#39;
 

manifests/main/files.pp

@@ -33,6 +33,7 @@ class confdroid_clamav::main::files (
     seltype  => etc_t,
     seluser  => system_u,
     content  => template($cv_freshclam_erb),
+    notify   => Service[$cv_freshclam],
   }
 
   # freshclam service config file
@@ -46,6 +47,21 @@ class confdroid_clamav::main::files (
     seltype  => etc_t,
     seluser  => system_u,
     content  => template($cv_freshclam_svc_erb),
+    notify   => Service[$cv_freshclam],
+  }
+
+  # clamd service config file
+  file { $cv_clamd_svc  :
+    ensure   => file,
+    owner    => 'root',
+    group    => 'root',
+    mode     => '0600',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => etc_t,
+    seluser  => system_u,
+    content  => template($cv_clamd_svc_erb),
+    notify   => Service[$cv_service],
   }
 
   # shell script for scanning and alerting

manifests/main/install.pp

@@ -9,7 +9,7 @@ class confdroid_clamav::main::install (
 ) inherits confdroid_clamav::params {
   require confdroid_resources::main::epel
 
-  package { $reqpackages:
+  package { $cv_reqpackages:
-    ensure => $pkg_ensure,
+    ensure => $cv_pkg_ensure,
   }
 }

manifests/params.pp

@@ -3,8 +3,8 @@
 # Author: 12ww1160 (12ww1160@confdroid.com)
 # @summary  Class holds all parameters for the confdroid_clamav module and is
 #   inherited by all classes except defines.
-# @param [Array] reqpackages List of packages to install.
+# @param [Array] cv_reqpackages List of packages to install.
-# @param [String] pkg_ensure
+# @param [String] cv_pkg_ensure
 #   which [package type](https://confdroid.com/2017/05/puppet-type-package/)
 #   to choose, i.e. `latest` or `present`.
 # @param [String] cv_logfile where to log messages for the clamd service.
@@ -35,12 +35,23 @@
 # @param [String] cv_alert_file location and name of the alert file
 # @param [Boolean] cv_enable_freshclam whether to enable the freshclam service
 # @param [Boolean] cv_enable_clamd whether to enable the clamd service
+# @param [Boolean] cv_use_excludepaths whether to use advanced exclude paths
+# @param [String] cv_concurrentdatabasereload whether to enable concurrent
+#   database reloads. This is useful when you have multiple clamd instances
+#   running on the same machine. If you have only one clamd instance, this
+#   should be set to 'no'.
+# @param [String] cv_clamd_max_mem maximum memory usage for clamd. 
+# @param [String] cv_clamd_cpu_quota maximum CPU usage for clamd.
+# @param [String] cv_nice_value nice value for clamd. This is a number between
+#   -20 and 19. The lower the number, the higher the priority. The default is 
+#   19, which is the lowest priority.
+# @param [String] cv_timeout_start_sec timeout for starting the clamd service.
 ##############################################################################
 class confdroid_clamav::params (
 
 # installation
-  Array $reqpackages              = ['clamav','clamd','s-nail'],
+  Array $cv_reqpackages               = ['clamav','clamd','s-nail'],
-  String $pkg_ensure              = 'present',
+  String $cv_pkg_ensure               = 'present',
 
 # clamd
   String $cv_logfile                  = '/var/log/clamd.scan',
@@ -64,6 +75,12 @@ class confdroid_clamav::params (
   String $cv_alert_file               = 'tmp/clamav-alert.txt',
   Boolean $cv_enable_freshclam        = true,
   Boolean $cv_enable_clamd            = true,
+  Boolean $cv_use_excludepaths        = true,
+  String $cv_concurrentdatabasereload = 'no',
+  String $cv_clamd_max_mem            = '512M',
+  String $cv_clamd_cpu_quota          = '30%',
+  String $cv_nice_value               = '19',
+  String $cv_timeout_start_sec        = '420'
 
 ) {
   # service
@@ -80,6 +97,8 @@ class confdroid_clamav::params (
   $cv_freshclam_erb       = 'confdroid_clamav/freshclam_conf.erb'
   $cv_freshclam_svc       = '/usr/lib/systemd/system/freshclam.service'
   $cv_freshclam_svc_erb   = 'confdroid_clamav/freshclam_svc.erb'
+  $cv_clamd_svc           = '/usr/lib/systemd/system/clamd@.service'
+  $cv_clamd_svc_erb       = 'confdroid_clamav/clamd_svc.erb'
   $cv_shell_script        = "${cv_config_d_dir}/scan.sh"
   $cv_shell_script_erb    = 'confdroid_clamav/scan.sh.erb'
 

templates/clamd_svc.erb

@@ -0,0 +1,22 @@
+################################################################################
+###    clamd.svc created by Puppet, manual changes will be overwritten!!!    ###
+################################################################################
+
+[Unit]
+Description = clamd scanner (%i) daemon
+Documentation=man:clamd(8) man:clamd.conf(5) https://www.clamav.net/documents/
+After = syslog.target nss-lookup.target network.target
+
+[Service]
+Type = forking
+ExecStart = /usr/sbin/clamd -c /etc/clamd.d/%i.conf
+# Reload the database
+ExecReload=/bin/kill -USR2 $MAINPID
+Restart = on-failure
+TimeoutStartSec=<%= @cv_timeout_start_sec %>
+MemoryMax=<%= @cv_clamd_max_mem %>
+CPUQuota=<%= @cv_clamd_cpu_quota %>
+Nice=<%= @cv_nice_value %>
+
+[Install]
+WantedBy = multi-user.target

templates/scan.sh.erb

@@ -1,23 +1,26 @@
 #!/bin/bash
+set -euo pipefail
 
-# Set paths
 SCAN_DIR="<%= @cv_scan_dir %>"
 LOG_FILE="<%= @cv_logfile %>"
 TMP_ALERT="<%= @cv_alert_file %>"
 EMAIL="<%= @cv_alert_email %>"
 
-# Run clamscan
+# Ensure the log directory exists
-clamscan -r --infected --log="$LOG_FILE" "$SCAN_DIR" > /dev/null
+mkdir -p "$(dirname "$LOG_FILE")"
 
-# Check if infections were found
+# Preferred: clamdscan with multiscan + fdpass
-if grep -q "Infected files: [^0]" "$LOG_FILE"; then
+clamdscan --multiscan --fdpass --infected --log="$LOG_FILE" "$SCAN_DIR" > /dev/null || true
-    echo "ClamAV has found infected files on $(hostname)!" > "$TMP_ALERT"
+
-    echo "" >> "$TMP_ALERT"
+# Check for infections (same logic as before)
-    grep "FOUND" "$LOG_FILE" >> "$TMP_ALERT"
+if grep -q "Infected files: [^0]" "$LOG_FILE" 2>/dev/null; then
+    {
+        echo "ClamAV has found infected files on $(hostname)!"
+        echo ""
+        grep "FOUND" "$LOG_FILE" || true
+    } > "$TMP_ALERT"
 
-    # Send the alert email
     mail -s "⚠️ ClamAV Alert on $(hostname)" "$EMAIL" < "$TMP_ALERT"
 fi
 
-# Clean up
 rm -f "$TMP_ALERT"

templates/scan_conf.erb

@@ -14,6 +14,7 @@ LogRotate       <%= @cv_logrotate %>
 PreludeEnable   <%= @cv_preludeenable %>
 TCPSocket       <%= @cv_tcpsocket %>
 TCPAddr         <%= @cv_tcpaddress %>
+ConcurrentDatabaseReload <%= @cv_concurrentdatabasereload %>
 #
 # Set the name of the analyzer used by prelude-admin.
 # Default: ClamAV
@@ -21,7 +22,7 @@ PreludeAnalyzerName ClamAV
 
 # Log additional information about the infected file, such as its
 # size and hash, together with the virus name.
-#ExtendedDetectionInfo yes
+ExtendedDetectionInfo yes
 
 # This option allows you to save a process identifier of the listening
 # daemon (main thread).
@@ -132,6 +133,28 @@ PreludeAnalyzerName ClamAV
 #ExcludePath ^/proc/
 #ExcludePath ^/sys/
 
+<% if @cv_use_excludepaths %>
+ExcludePath ^/proc
+ExcludePath ^/sys
+ExcludePath ^/dev
+ExcludePath ^/run
+ExcludePath ^/var/run
+ExcludePath ^/var/tmp
+ExcludePath ^/tmp
+ExcludePath ^/var/lib/clamav
+ExcludePath ^/var/log/clamav
+ExcludePath ^/var/lib/docker
+ExcludePath ^/var/lib/containerd
+ExcludePath ^/var/lib/kubelet/pods
+ExcludePath ^/var/lib/kubelet/plugins
+ExcludePath ^/var/lib/kubelet/plugins_registry
+ExcludePath ^/var/log/pods
+ExcludePath ^/var/log/containers
+ExcludePath ^/var/cache
+ExcludePath ^/run/containerd
+ExcludePath ^/run/docker
+<% end %>
+
 # Maximum depth directories are scanned at.
 # Default: 15
 #MaxDirectoryRecursion 20