Skip to content

fix: remove the ClamAV virus scan (GH-28) - #170

Merged
mastacontrola merged 1 commit into
masterfrom
fix/gh-28-remove-virus-scan
Sep 1, 2026
Merged

fix: remove the ClamAV virus scan (GH-28)#170
mastacontrola merged 1 commit into
masterfrom
fix/gh-28-remove-virus-scan

Conversation

@mastacontrola

Copy link
Copy Markdown
Member

Closes #28. Companion to fogproject#328 (FOGProject/fogproject#1608), which removes the task types, the clamav= kernel argument and the virus table server-side.

The scan cannot run today, on either release line

fog.av does not use a ClamAV built into the image — BR2_PACKAGE_CLAMAV is not set in both fsx64.config and fsarm64.config. It NFS-mounts the binaries from the server, at the path the clamav= argument carries: <server>:/opt/fog/clamav.

Neither installer has ever created or exported that directory. bin/installfog.sh and lib/ contain no reference to clamav on working-1.6 or on dev-branch, and the path is absent from a live 1.6 server's filesystem and its /etc/exports. The mount fails and the script dies at

handleError "Cannot find clamav binaries to run task."

before it reaches a single partition.

The reporting half is dead too

This is the part worth checking rather than assuming, because 1.5 looks live where 1.6 plainly is not.

1.6 never carried service/av.php across from 1.5 — nothing to post to
1.5 has the endpoint, the Virus model, the manager and the report — and rejects every submission

The 1.5 guard reads:

if (trim($_REQUEST['mode']) != array('q', 's')) {
    throw new Exception(_('Invalid operational mode'));
}

That compares a string to an array, and PHP ranks any array above any non-array — so it is true for every input and the endpoint always throws. Verified on 7.4.33 and 8.3.33, both supported; the line dates to 2014.

What this removes

  • Buildroot/board/FOG/FOS/rootfs_overlay/bin/fog.av
  • the clamav) arm of the mode dispatch in bin/fog
  • the clamav) arm in bin/fog.checkin, which appended avmode to the check-in POST. Nothing reads it — avmode appears nowhere else in this tree, and neither Pre_Stage1.php nor mc_checkin.php references it on either branch
  • fog.av from the documented raw-curl exceptions in tests/checks/server-post-reporting.sh

# BR2_PACKAGE_CLAMAV is not set stays in both configs. Those are generated defconfig lines present for every unselected package, not a choice this change gets to edit.

Behavior change, confined to 1.5

dev-branch still emits mode=clamav, so a 1.5 Virus Scan task now fails as Unknown mode :: clamav rather than Cannot find clamav binaries. Both are handleError paths reached before any scanning — no working behavior is lost. 1.6 stops emitting the mode entirely once fogproject#1608 lands.

Verified

  • tests/run-all.sh18 passed, 0 failed, both before and after
  • every touched script passes bash -n
  • the exceptions trim restores a real gate, not just tidier text. Reintroducing a fog.av that reads a raw curl reply turns check 11 red:
    FAIL: 11. raw curl reads a reply only in the documented exceptions ( fog.av)
    passed: 14   failed: 1
    
    and green again once removed. Mutation run, not assumed.

The companion to fogproject GH-328, which removes the task types, the
`clamav=` kernel argument and the `virus` table on the server side.

THE SCAN CANNOT RUN TODAY, ON EITHER RELEASE LINE. `fog.av` does not use
a ClamAV built into the image -- `BR2_PACKAGE_CLAMAV is not set` in both
fsx64 and fsarm64 -- it NFS-mounts the binaries from the server, at the
path the `clamav=` argument carries: `<server>:/opt/fog/clamav`. Neither
installer has ever created or exported that directory. `bin/installfog.sh`
and `lib/` on working-1.6 and on dev-branch contain no reference to
clamav, and it is absent from a live 1.6 server's filesystem and its
/etc/exports. So the mount fails and the script dies at

    handleError "Cannot find clamav binaries to run task."

before it reaches a single partition.

The reporting half is dead too, which is what made this worth checking
rather than assuming. 1.6 never carried `service/av.php` across from 1.5.
1.5 still has it, so it looks live -- but its guard reads

    if (trim($_REQUEST['mode']) != array('q', 's'))

comparing a string to an array, where PHP ranks any array above any
non-array. That is TRUE for every input, so the endpoint throws "Invalid
operational mode" and saves nothing. Verified on 7.4.33 and 8.3.33, both
of which FOG supports; the line dates to 2014.

Removed:

  - `bin/fog.av`
  - the `clamav)` arm of the mode dispatch in `bin/fog`
  - the `clamav)` arm in `bin/fog.checkin`, which appended `avmode` to the
    check-in POST. Nothing reads it: `avmode` appears nowhere else in this
    tree, and neither Pre_Stage1.php nor mc_checkin.php on either branch
    references it
  - `fog.av` from the documented raw-curl exceptions in
    tests/checks/server-post-reporting.sh

`# BR2_PACKAGE_CLAMAV is not set` stays in both configs. Those lines are
generated defconfig output present for every unselected package, not a
choice this change gets to edit.

BEHAVIOR CHANGE, and it is confined to 1.5. dev-branch still emits
`mode=clamav`, so a 1.5 Virus Scan task now fails as "Unknown mode ::
clamav" rather than "Cannot find clamav binaries". Both are handleError
paths reached before any scanning; no working behavior is lost.

Verified: tests/run-all.sh 18 passed / 0 failed, before and after.
Removing `fog.av` from the exceptions list restores a real gate rather
than tidying text -- reintroducing a `fog.av` that reads a raw curl reply
turns check 11 red, and green again once removed.

Co-Authored-By: Claude <noreply@anthropic.com>
@mastacontrola
mastacontrola merged commit b44ee2c into master Sep 1, 2026
1 check passed
@mastacontrola
mastacontrola deleted the fix/gh-28-remove-virus-scan branch September 1, 2026 15:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Remove Virusscan option

1 participant