Comment 4 for bug 1881761

Hello Mikey, I remember OnAccessIncludePath working well as long as it was coupled with clamonacc --fdpass. The FD passing allowed to sidestep problems coming from Apparmor IIRC.

It's unfortunate that the package doesn't ship a clamonacc.service but this should work:

[Unit]
Description=ClamAV On-Access Scanning
After=clamav-daemon.service
Wants=clamav-daemon.service

[Service]
ExecStart=/usr/sbin/clamonacc --foreground --fdpass
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

This should serve as a reminder for me to take the time and propose that to Debian ;)