clamav-daemon on access scanning

I have been using https://www.eicar.org/?page_id=3950 for testing which works with a manual scan.

I am able to run clamonacc by appending to /etc/clamav/clamd.conf

  OnAccessExcludeUname clamav

Even this shows no sign of actually doing on access checks.

I was missing a path to scan:

  OnAccessIncludePath /home/user

With that and clamonacc running I get on access scans.

Which means that clamonacc should have it's own service file.

Though I think I'm about to give up on it, as after that I receive warnings about:

  ^lstat() failed on: /home/user/path/to/file

Though the clamav user is part of the user's group so should have access, I suspect apparmour is doing something to prevent access here. And it is not recommended to run clamav without apparmour or as root.

So I guess no one is actually using on access scanning with clamav-daemon in this way.

Hello Mikey, I remember OnAccessIncludePath working well as long as it was coupled with clamonacc --fdpass. The FD passing allowed to sidestep problems coming from Apparmor IIRC.

It's unfortunate that the package doesn't ship a clamonacc.service but this should work:

[Unit]
Description=ClamAV On-Access Scanning
After=clamav-daemon.service
Wants=clamav-daemon.service

[Service]
ExecStart=/usr/sbin/clamonacc --foreground --fdpass
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

This should serve as a reminder for me to take the time and propose that to Debian ;)

Hi mikey,

Thank you for reporting this bug and trying to make Ubuntu better!

My understanding here, given Simon's suggestion for the issue, is that the package is working as expected, but it would be nice to have the additional service running "clamonacc" with the proper parameters.

I am marking this bug as triaged as a wishlist bug, ideally to be fixed in Debian. Let us know if you disagree with my assessment here.