[prev in list] [next in list] [prev in thread] [next in thread] 

List:       clamav-users
Subject:    Re: [clamav-users] Quarantine Copy
From:       Brad Scalio <scalio () gmail ! com>
Date:       2017-03-10 19:09:23
Message-ID: CAAX+qYYFJgzpUZMLahF_C1HoWEN7w_vEQTj0ZmerDHFtTv7RYQ () mail ! gmail ! com
[Download RAW message or body]

Indeed, that's the path of least resistance and still technically
acceptable from all perspectives.

Many thanks!

On Mar 10, 2017 12:15, "G.W. Haywood" <clamav@jubileegroup.co.uk> wrote:

> Hi there,
> 
> On Fri, 10 Mar 2017, Brad Scalio wrote:
> 
> Is there a way to copy to quarantine directory if and only if the file to
>> be copied and identified as a match against the VSD does not exist in the
>> quarantine directory already either matching a hash or name or size?
>> ...
>> Sure we can exclude the quarantine path from clamscan but if someone knows
>> that they can simply put things there to avoid the virus scanner.
>> 
> 
> Rather than adding more code (and potential ways to break everything) would
> it not be better simply to restrict permissions on the quarantine directory
> and - as you suggest - exclude it from the scan?  If a miscreant can write
> to the locked-down quarantine directory then you _already_ have a problem,
> with or without ClamAV, which needs to be fixed.
> 
> Thanks much!!  And have a great Friday (or Saturday).
>> 
> 
> HTH.  You too.
> 
> --
> 
> 73,
> Ged.
> _______________________________________________
> clamav-users mailing list
> clamav-users@lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml
> 
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
_______________________________________________
clamav-users mailing list
clamav-users@lists.clamav.net
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
[prev in list] [next in list] [prev in thread] [next in thread]