OP#785 revert

Auto-merge for build 18

See merge request puppet/clamav_cd!15

.vscode/settings.json

@@ -4,19 +4,25 @@
         "authenticode",
         "behaviour",
         "bofh",
+        "clamav",
         "clamd",
+        "clamdscan",
         "clamonacc",
         "clamscan",
         "Clamuko",
         "clamupdate",
+        "concurrentdatabasereload",
         "Dazuko",
         "dbname",
         "epel",
+        "excludepaths",
         "fanotify",
+        "fdpass",
         "filesize",
         "freshclam",
         "getsebool",
         "INADDR",
+        "kubelet",
         "libclamav",
         "logclean",
         "logfacility",
@@ -27,12 +33,15 @@
         "logsyslog",
         "logtime",
         "logverbose",
+        "MAINPID",
+        "multiscan",
         "mypass",
         "myproxy",
         "myusername",
         "NOFILE",
         "normalisation",
         "PCRE",
+        "pipefail",
         "preludeanalyzername",
         "preludeenable",
         "recieve",

Jenkinsfile

@@ -69,7 +69,7 @@ pipeline {
             withCredentials([string(credentialsId: 'sonar-token', variable: 'SONAR_TOKEN')]) {
               sh '''
               /opt/sonar-scanner/bin/sonar-scanner \
-                -Dsonar.projectKey=clamav_cd \
+                -Dsonar.projectKey=confdroid_clamav \
                 -Dsonar.sources=. \
                 -Dsonar.host.url=https://sonarqube.confdroid.com \
                 -Dsonar.token=$SONAR_TOKEN
@@ -90,16 +90,39 @@ pipeline {
             sh '''
                 git config user.name "Jenkins Server"
                 git config user.email jenkins@confdroid.com
+                git rm -r --cached .vscode || echo "No .vscode to remove from git"
                 git add -A && git commit -am "Recommit for updates in build $BUILD_NUMBER" || echo "No changes to commit"
-                git push -o merge_request.create \
+                git push origin HEAD:master
-                         -o merge_request.target=master \
+            '''
-                         -o merge_request.title="Auto-merge for build $BUILD_NUMBER" \
+        }
-                         -o merge_request.description="Automated changes from Jenkins build $BUILD_NUMBER" \
+      }
-                         -o merge_request.merge_when_pipeline_succeeds=true \
+    }
-                         origin jenkins-build-$BUILD_NUMBER
+
+      stage('Mirror to Gitea') {
+        steps {
+          sshagent(['edd05eb6-26b5-4c7b-a5cc-ea2ab899f4fa']) {
+            withCredentials([usernamePassword(
+              credentialsId: 'Jenkins-gitea',
+              usernameVariable: 'GITEA_USER',
+              passwordVariable: 'GITEA_TOKEN')]) {
+              script {
+                // Checkout from GitLab (already done implicitly)
+                  sh '''
+                    git checkout master
+                    git pull origin master
+                    git branch -D development
+                    git branch -D jenkins-build-$BUILD_NUMBER
+                    git rm -f Jenkinsfile
+                    git rm -r --cached .vscode || echo "No .vscode to remove from git"
+                    git commit --amend --no-edit --allow-empty
+                    git remote add master https://sourcecode.confdroid.com/confdroid/confdroid_clamav.git
+                    git -c credential.helper="!f() { echo username=${GITEA_USER}; echo password=${GITEA_TOKEN}; }; f" \
+                    push master --mirror
                   '''
             }
           }
         }
       }
     }
+  }
+}

README.md

@@ -1,47 +1,62 @@
 # Readme
 
-[![Build Status](https://jenkins.confdroid.com/buildStatus/icon?job=clamav_cd)](https://jenkins.confdroid.com/job/clamav_cd/)|
+[![Build Status](https://jenkins.confdroid.com/buildStatus/icon?job=confdroid_clamav&style=plastic)](https://jenkins.confdroid.com/job/confdroid_clamav/)
+[![Security Hotspots](https://sonarqube.confdroid.com/api/project_badges/measure?project=confdroid_clamav&metric=security_hotspots&token=sqb_cdcd204545668e8367aed118aa87ad814b58863b)](https://sonarqube.confdroid.com/dashboard?id=confdroid_clamav)
+[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/grizzlycoda/puppet_collection)
 
-[[_TOC_]]
+- [Readme](#readme)
+  - [Synopsis](#synopsis)
+  - [WARNING](#warning)
+  - [Features](#features)
+  - [Dependencies](#dependencies)
+  - [Deployment](#deployment)
+  - [Parameters](#parameters)
+  - [SELINUX](#selinux)
+  - [Support](#support)
+  - [Tests](#tests)
+  - [Contact Us](#contact-us)
+  - [Disclaimer](#disclaimer)
 
 ## Synopsis
 
 `Clamav` is a powerful antivirus scanner with several components.
 
-`clamav_cd` is a puppet module to manage clamav installations and configurations.
+`confdroid_clamav` is a puppet module to manage clamav installations and configurations.
 
 ## WARNING
 
 ***Attention: Never use this puppet module on systems which have been previously configured manually. It is impossible to predict how and what would have been configured, hence previous configurations outside the scope of this module may be overwritten! Automated configurations require a test environment to verify that the module suits the purpose intended by the user, as well as tune the parameters, before deploying into live production***
 
 ## Features
-* install all required binaries including s-nail as mail program to send alerts when infected files are found
+
-* manage required config files
+- install all required binaries including s-nail as mail program to send alerts when infected files are found
-* manage cronjob settings via parameters
+- manage required config files
-* run cron job to scan the file system ( by default starting at root, configurable)
+- manage cronjob settings via parameters
-* manage services
+- run cron job to scan the file system (by default starting at root, configurable) via clamdscan
+- set ConcurrentDatabaseReload option `yes`/`no` to optimize RAM consumption. defaults to `no`
+- manage `freshclam` and `clamd` services
 
 ## Dependencies
 
 All dependencies must be included in the catalogue.
 
-* [cd_resources](https://gitlab.confdroid.com/puppet/cd_resources) for managing yum repo resources.
+- [confdroid_resources](https://sourcecode.confdroid.com/confdroid/confdroid_resources) for managing yum repo resources.
 
-### Deployment
+## Deployment
 
-* native Puppet deployment
+- native Puppet deployment
 
 via site.pp or nodes.pp
 
 ```bash
 node 'example.example.net' {
-  include clamav_cd
+  include confdroid_clamav
 }
 ```
 
-* through Foreman:
+- through Foreman:
 
-In order to apply parameters through Foreman, **__clamav_cd::params__** must be added to the host or host group in question.
+In order to apply parameters through Foreman, **__confdroid_clamav::params__*- must be added to the host or host group in question.
 
 See [more details about class deployment on Confdroid.com](https://confdroid.com/2017/05/deploying-our-puppet-modules/).
 
@@ -55,21 +70,22 @@ All files and directories are configured with correct selinux context. If selinu
 
 ## Support
 
-* OS: Rocky 9
+- OS: Rocky 9
-* Puppet 6-8
+- Puppet 8
 
 ## Tests
 
-* Puppet Lint
+- Puppet Lint
-  * excluded tests:
+  - excluded tests:
-    * `--no-class_inherits_from_params_class-check`:relevant only to non-supported outdated puppet versions
+    - `--no-class_inherits_from_params_class-check`:relevant only to non-supported outdated puppet versions
-* Puppet Parser
+- Puppet Parser
-* ERB Template Parser
+- ERB Template Parser
-* Sonar Quality Gate
+- Sonar Quality Gate
 
 ## Contact Us
 
-[contact Us](https://confdroid.com/contact/)
+- [contact Us](https://confdroid.com/contact/)
+- [Feedback Portal](https://feedback.confdroid.com)
 
 ## Disclaimer
 

manifests/init.pp

@@ -1,10 +1,10 @@
-## clamav_cd::init.pp
+## confdroid_clamav::init.pp
-# Module name: clamav_cd
+# Module name: confdroid_clamav
-# Author: Arne Teuke (arne_teuke@confdroid.com)
+# Author: 12ww1160 (12ww1160@confdroid.com)
-# @summary Class initializes the clamav_cd Module.
+# @summary Class initializes the confdroid_clamav Module.
 ##############################################################################
-class clamav_cd {
+class confdroid_clamav {
-  include clamav_cd::params
+  include confdroid_clamav::params
 
   resources { 'firewall':
     purge => true,

manifests/main/config.pp

@@ -1,13 +1,13 @@
-## clamav_cd::main::config.pp
+## confdroid_clamav::main::config.pp
-# Module name: clamav_cd
+# Module name: confdroid_clamav
-# Author: Arne Teuke (arne_teuke@confdroid.com)
+# Author: 12ww1160 (12ww1160@confdroid.com)
 # @summary  Class manages all aspects of configuring the module logic for
-#   clamav_cd.
+#   confdroid_clamav.
 ##############################################################################
-class clamav_cd::main::config (
+class confdroid_clamav::main::config (
 
-) inherits clamav_cd::params {
+) inherits confdroid_clamav::params {
-  include clamav_cd::main::service
+  include confdroid_clamav::main::service
 
   # Ensure the SELinux boolean antivirus_can_scan_system is enabled if disabled
   exec { 'enable_antivirus_can_scan_system':

manifests/main/dirs.pp

@@ -1,12 +1,12 @@
-## clamav_cd::main::dirs.pp
+## confdroid_clamav::main::dirs.pp
-# Module name: clamav_cd
+# Module name: confdroid_clamav
-# Author: Arne Teuke (arne_teuke@confdroid.com)
+# Author: 12ww1160 (12ww1160@confdroid.com)
-# @summary Class manages all directories required for clamav_cd.
+# @summary Class manages all directories required for confdroid_clamav.
 ###############################################################################
-class clamav_cd::main::dirs (
+class confdroid_clamav::main::dirs (
 
-) inherits clamav_cd::params {
+) inherits confdroid_clamav::params {
-  require clamav_cd::main::install
+  require confdroid_clamav::main::install
 
   # config.d dir
   file { $cv_config_d_dir:

manifests/main/files.pp

@@ -1,12 +1,12 @@
-## clamav_cd::main::files.pp
+## confdroid_clamav::main::files.pp
-# Module name: clamav_cd
+# Module name: confdroid_clamav
-# Author: Arne Teuke (arne_teuke@confdroid.com)
+# Author: 12ww1160 (12ww1160@confdroid.com)
-# @summary  Class manages all configuration files required for clamav_cd.
+# @summary  Class manages all configuration files required for confdroid_clamav.
 ##############################################################################
-class clamav_cd::main::files (
+class confdroid_clamav::main::files (
 
-) inherits clamav_cd::params {
+) inherits confdroid_clamav::params {
-  require clamav_cd::main::dirs
+  require confdroid_clamav::main::dirs
 
   # clamd config file
   file { $cv_clamd_config_file:
@@ -33,6 +33,7 @@ class clamav_cd::main::files (
     seltype  => etc_t,
     seluser  => system_u,
     content  => template($cv_freshclam_erb),
+    notify   => Service[$cv_freshclam],
   }
 
   # freshclam service config file
@@ -46,6 +47,21 @@ class clamav_cd::main::files (
     seltype  => etc_t,
     seluser  => system_u,
     content  => template($cv_freshclam_svc_erb),
+    notify   => Service[$cv_freshclam],
+  }
+
+  # clamd service config file
+  file { $cv_clamd_svc  :
+    ensure   => file,
+    owner    => 'root',
+    group    => 'root',
+    mode     => '0600',
+    selrange => s0,
+    selrole  => object_r,
+    seltype  => etc_t,
+    seluser  => system_u,
+    content  => template($cv_clamd_svc_erb),
+    notify   => Service[$cv_service],
   }
 
   # shell script for scanning and alerting

manifests/main/install.pp

@@ -1,15 +1,15 @@
-## clamav_cd	::main::install.pp
+## confdroid_clamav	::main::install.pp
-# Module name: clamav_cd
+# Module name: confdroid_clamav
-# Author: Arne Teuke (arne_teuke@confdroid.com)
+# Author: 12ww1160 (12ww1160@confdroid.com)
 # @summary Class manage all aspects of installing binaries required for
-#   clamav_cd
+#   confdroid_clamav
 ###############################################################################
-class clamav_cd::main::install (
+class confdroid_clamav::main::install (
 
-) inherits clamav_cd::params {
+) inherits confdroid_clamav::params {
   require confdroid_resources::main::epel
 
-  package { $reqpackages:
+  package { $cv_reqpackages:
-    ensure => $pkg_ensure,
+    ensure => $cv_pkg_ensure,
   }
 }

manifests/main/service.pp

@@ -1,24 +1,42 @@
-## clamav_cd::main::service.pp
+## confdroid_clamav::main::service.pp
-# Module name: clamav_cd
+# Module name: confdroid_clamav
-# Author: Arne Teuke (arne_teuke@confdroid.com)
+# Author: 12ww1160 (12ww1160@confdroid.com)
-# @summary Class manages the service(s) for clamav_cd.
+# @summary Class manages the service(s) for confdroid_clamav.
 #############################################################################
-class clamav_cd::main::service (
+class confdroid_clamav::main::service (
 
-) inherits clamav_cd::params {
+) inherits confdroid_clamav::params {
-  require clamav_cd::main::files
+  require confdroid_clamav::main::files
 
+  if $cv_enable_clamd == true {
     service { $cv_service:
       ensure     => running,
       hasstatus  => true,
       hasrestart => true,
       enable     => true,
     }
+  } else {
+    service { $cv_service:
+      ensure     => stopped,
+      hasstatus  => true,
+      hasrestart => true,
+      enable     => false,
+    }
+  }
 
+  if $cv_enable_freshclam == true {
     service { $cv_freshclam:
       ensure     => running,
       hasstatus  => true,
       hasrestart => true,
       enable     => true,
     }
+  } else {
+    service { $cv_freshclam:
+      ensure     => stopped,
+      hasstatus  => true,
+      hasrestart => true,
+      enable     => false,
+    }
+  }
 }

manifests/params.pp

@@ -1,10 +1,10 @@
-## clamav_cd::params.pp
+## confdroid_clamav::params.pp
-# Module name: clamav_cd
+# Module name: confdroid_clamav
-# Author: Arne Teuke (arne_teuke@confdroid.com)
+# Author: 12ww1160 (12ww1160@confdroid.com)
-# @summary  Class holds all parameters for the clamav_cd module and is
+# @summary  Class holds all parameters for the confdroid_clamav module and is
 #   inherited by all classes except defines.
-# @param [Array] reqpackages List of packages to install.
+# @param [Array] cv_reqpackages List of packages to install.
-# @param [String] pkg_ensure
+# @param [String] cv_pkg_ensure
 #   which [package type](https://confdroid.com/2017/05/puppet-type-package/)
 #   to choose, i.e. `latest` or `present`.
 # @param [String] cv_logfile where to log messages for the clamd service.
@@ -33,12 +33,25 @@
 # @param [String] cv_cron_user which user should run the cron job
 # @param [String] cv_scan_dir which directory should be scanned
 # @param [String] cv_alert_file location and name of the alert file
+# @param [Boolean] cv_enable_freshclam whether to enable the freshclam service
+# @param [Boolean] cv_enable_clamd whether to enable the clamd service
+# @param [Boolean] cv_use_excludepaths whether to use advanced exclude paths
+# @param [String] cv_concurrentdatabasereload whether to enable concurrent
+#   database reloads. This is useful when you have multiple clamd instances
+#   running on the same machine. If you have only one clamd instance, this
+#   should be set to 'no'.
+# @param [String] cv_clamd_max_mem maximum memory usage for clamd. 
+# @param [String] cv_clamd_cpu_quota maximum CPU usage for clamd.
+# @param [String] cv_nice_value nice value for clamd. This is a number between
+#   -20 and 19. The lower the number, the higher the priority. The default is 
+#   19, which is the lowest priority.
+# @param [String] cv_timeout_start_sec timeout for starting the clamd service.
 ##############################################################################
-class clamav_cd::params (
+class confdroid_clamav::params (
 
 # installation
-  Array $reqpackages              = ['clamav','clamd','s-nail'],
+  Array $cv_reqpackages               = ['clamav','clamd','s-nail'],
-  String $pkg_ensure              = 'present',
+  String $cv_pkg_ensure               = 'present',
 
 # clamd
   String $cv_logfile                  = '/var/log/clamd.scan',
@@ -60,7 +73,14 @@ class clamav_cd::params (
   String $cv_cron_user                = 'root',
   String $cv_scan_dir                 = '/',
   String $cv_alert_file               = 'tmp/clamav-alert.txt',
-
+  Boolean $cv_enable_freshclam        = true,
+  Boolean $cv_enable_clamd            = true,
+  Boolean $cv_use_excludepaths        = true,
+  String $cv_concurrentdatabasereload = 'no',
+  String $cv_clamd_max_mem            = '512M',
+  String $cv_clamd_cpu_quota          = '30%',
+  String $cv_nice_value               = '19',
+  String $cv_timeout_start_sec        = '420'
 
 ) {
   # service
@@ -72,15 +92,17 @@ class clamav_cd::params (
 
   # files
   $cv_clamd_config_file   = "${cv_config_d_dir}/scan.conf"
-  $cv_clamd_config_erb    = 'clamav_cd/scan_conf.erb'
+  $cv_clamd_config_erb    = 'confdroid_clamav/scan_conf.erb'
   $cv_freshclam_file      = '/etc/freshclam.conf'
-  $cv_freshclam_erb       = 'clamav_cd/freshclam_conf.erb'
+  $cv_freshclam_erb       = 'confdroid_clamav/freshclam_conf.erb'
   $cv_freshclam_svc       = '/usr/lib/systemd/system/freshclam.service'
-  $cv_freshclam_svc_erb   = 'clamav_cd/freshclam_svc.erb'
+  $cv_freshclam_svc_erb   = 'confdroid_clamav/freshclam_svc.erb'
+  $cv_clamd_svc           = '/usr/lib/systemd/system/clamd@.service'
+  $cv_clamd_svc_erb       = 'confdroid_clamav/clamd_svc.erb'
   $cv_shell_script        = "${cv_config_d_dir}/scan.sh"
-  $cv_shell_script_erb    = 'clamav_cd/scan.sh.erb'
+  $cv_shell_script_erb    = 'confdroid_clamav/scan.sh.erb'
 
   # includes must be last
 
-  include clamav_cd::main::config
+  include confdroid_clamav::main::config
 }

templates/clamd_svc.erb

@@ -0,0 +1,22 @@
+################################################################################
+###    clamd.svc created by Puppet, manual changes will be overwritten!!!    ###
+################################################################################
+
+[Unit]
+Description = clamd scanner (%i) daemon
+Documentation=man:clamd(8) man:clamd.conf(5) https://www.clamav.net/documents/
+After = syslog.target nss-lookup.target network.target
+
+[Service]
+Type = forking
+ExecStart = /usr/sbin/clamd -c /etc/clamd.d/%i.conf
+# Reload the database
+ExecReload=/bin/kill -USR2 $MAINPID
+Restart = on-failure
+TimeoutStartSec=<%= @cv_timeout_start_sec %>
+MemoryMax=<%= @cv_clamd_max_mem %>
+CPUQuota=<%= @cv_clamd_cpu_quota %>
+Nice=<%= @cv_nice_value %>
+
+[Install]
+WantedBy = multi-user.target

templates/scan.sh.erb

@@ -1,23 +1,26 @@
 #!/bin/bash
+set -euo pipefail
 
-# Set paths
 SCAN_DIR="<%= @cv_scan_dir %>"
 LOG_FILE="<%= @cv_logfile %>"
 TMP_ALERT="<%= @cv_alert_file %>"
 EMAIL="<%= @cv_alert_email %>"
 
-# Run clamscan
+# Ensure the log directory exists
-clamscan -r --infected --log="$LOG_FILE" "$SCAN_DIR" > /dev/null
+mkdir -p "$(dirname "$LOG_FILE")"
 
-# Check if infections were found
+# Preferred: clamdscan with multiscan + fdpass
-if grep -q "Infected files: [^0]" "$LOG_FILE"; then
+clamdscan --multiscan --fdpass --infected --log="$LOG_FILE" "$SCAN_DIR" > /dev/null || true
-    echo "ClamAV has found infected files on $(hostname)!" > "$TMP_ALERT"
+
-    echo "" >> "$TMP_ALERT"
+# Check for infections (same logic as before)
-    grep "FOUND" "$LOG_FILE" >> "$TMP_ALERT"
+if grep -q "Infected files: [^0]" "$LOG_FILE" 2>/dev/null; then
+    {
+        echo "ClamAV has found infected files on $(hostname)!"
+        echo ""
+        grep "FOUND" "$LOG_FILE" || true
+    } > "$TMP_ALERT"
 
-    # Send the alert email
     mail -s "⚠️ ClamAV Alert on $(hostname)" "$EMAIL" < "$TMP_ALERT"
 fi
 
-# Clean up
 rm -f "$TMP_ALERT"

templates/scan_conf.erb

@@ -14,6 +14,7 @@ LogRotate       <%= @cv_logrotate %>
 PreludeEnable   <%= @cv_preludeenable %>
 TCPSocket       <%= @cv_tcpsocket %>
 TCPAddr         <%= @cv_tcpaddress %>
+ConcurrentDatabaseReload <%= @cv_concurrentdatabasereload %>
 #
 # Set the name of the analyzer used by prelude-admin.
 # Default: ClamAV
@@ -21,7 +22,7 @@ PreludeAnalyzerName ClamAV
 
 # Log additional information about the infected file, such as its
 # size and hash, together with the virus name.
-#ExtendedDetectionInfo yes
+ExtendedDetectionInfo yes
 
 # This option allows you to save a process identifier of the listening
 # daemon (main thread).
@@ -132,6 +133,28 @@ PreludeAnalyzerName ClamAV
 #ExcludePath ^/proc/
 #ExcludePath ^/sys/
 
+<% if @cv_use_excludepaths %>
+ExcludePath ^/proc
+ExcludePath ^/sys
+ExcludePath ^/dev
+ExcludePath ^/run
+ExcludePath ^/var/run
+ExcludePath ^/var/tmp
+ExcludePath ^/tmp
+ExcludePath ^/var/lib/clamav
+ExcludePath ^/var/log/clamav
+ExcludePath ^/var/lib/docker
+ExcludePath ^/var/lib/containerd
+ExcludePath ^/var/lib/kubelet/pods
+ExcludePath ^/var/lib/kubelet/plugins
+ExcludePath ^/var/lib/kubelet/plugins_registry
+ExcludePath ^/var/log/pods
+ExcludePath ^/var/log/containers
+ExcludePath ^/var/cache
+ExcludePath ^/run/containerd
+ExcludePath ^/run/docker
+<% end %>
+
 # Maximum depth directories are scanned at.
 # Default: 15
 #MaxDirectoryRecursion 20