clamav: avoiding false positives for large files
This document (000020324) is provided subject to the disclaimer at the end of this document.
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server 15 for SAP
SUSE Linux Enterprise Server 12 for SAP
clamav by default is not scanning files exceeding various limits like sizes, or recursion depths, reporting them as OK.
A change of default is not easy, as clamav has no reporting of “SKIPPED” files during scans, only “OK” or “FOUND” (potentially) infected.
- Files and archives are scanned, but only up to the configured or default limits for size, nesting level, scan time, etc.
- The scan engine reports these files as being "OK"
- This could potentially allow attackers to bypass the virus scanning
The reason clamav is showing "OK" is that the clamav interfaces do not have a concept of "skipped" or "ignored" files at this time.
Alerts can be enabled for these cases:
- using --alert-exceeds-max=yes in the clamscan commandline
- via "AlertExceedsMax TRUE" in clamd.conf for daemon based scans.
However setting this option will cause a FOUND report of status type "Heuristics.Limits.Exceeded" to be reported for files exceeding the limits, which will need to be handled differently in front-ends or processing of reports. So before enabling the alert, ensure that front-ends will not suddenly quarantine or remove those files, which can include ISOs, databases, etc.
This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.
- Document ID:000020324
- Creation Date: 09-Jul-2021
- Modified Date:09-Jul-2021
- SUSE Linux Enterprise Desktop
- SUSE Linux Enterprise Server
- SUSE Linux Enterprise Server for SAP Applications
For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com