fix: remove the ClamAV virus scan (GH-28) - #170
Merged
Conversation
The companion to fogproject GH-328, which removes the task types, the
`clamav=` kernel argument and the `virus` table on the server side.
THE SCAN CANNOT RUN TODAY, ON EITHER RELEASE LINE. `fog.av` does not use
a ClamAV built into the image -- `BR2_PACKAGE_CLAMAV is not set` in both
fsx64 and fsarm64 -- it NFS-mounts the binaries from the server, at the
path the `clamav=` argument carries: `<server>:/opt/fog/clamav`. Neither
installer has ever created or exported that directory. `bin/installfog.sh`
and `lib/` on working-1.6 and on dev-branch contain no reference to
clamav, and it is absent from a live 1.6 server's filesystem and its
/etc/exports. So the mount fails and the script dies at
handleError "Cannot find clamav binaries to run task."
before it reaches a single partition.
The reporting half is dead too, which is what made this worth checking
rather than assuming. 1.6 never carried `service/av.php` across from 1.5.
1.5 still has it, so it looks live -- but its guard reads
if (trim($_REQUEST['mode']) != array('q', 's'))
comparing a string to an array, where PHP ranks any array above any
non-array. That is TRUE for every input, so the endpoint throws "Invalid
operational mode" and saves nothing. Verified on 7.4.33 and 8.3.33, both
of which FOG supports; the line dates to 2014.
Removed:
- `bin/fog.av`
- the `clamav)` arm of the mode dispatch in `bin/fog`
- the `clamav)` arm in `bin/fog.checkin`, which appended `avmode` to the
check-in POST. Nothing reads it: `avmode` appears nowhere else in this
tree, and neither Pre_Stage1.php nor mc_checkin.php on either branch
references it
- `fog.av` from the documented raw-curl exceptions in
tests/checks/server-post-reporting.sh
`# BR2_PACKAGE_CLAMAV is not set` stays in both configs. Those lines are
generated defconfig output present for every unselected package, not a
choice this change gets to edit.
BEHAVIOR CHANGE, and it is confined to 1.5. dev-branch still emits
`mode=clamav`, so a 1.5 Virus Scan task now fails as "Unknown mode ::
clamav" rather than "Cannot find clamav binaries". Both are handleError
paths reached before any scanning; no working behavior is lost.
Verified: tests/run-all.sh 18 passed / 0 failed, before and after.
Removing `fog.av` from the exceptions list restores a real gate rather
than tidying text -- reintroducing a `fog.av` that reads a raw curl reply
turns check 11 red, and green again once removed.
Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #28. Companion to fogproject#328 (FOGProject/fogproject#1608), which removes the task types, the
clamav=kernel argument and thevirustable server-side.The scan cannot run today, on either release line
fog.avdoes not use a ClamAV built into the image —BR2_PACKAGE_CLAMAV is not setin bothfsx64.configandfsarm64.config. It NFS-mounts the binaries from the server, at the path theclamav=argument carries:<server>:/opt/fog/clamav.Neither installer has ever created or exported that directory.
bin/installfog.shandlib/contain no reference to clamav onworking-1.6or ondev-branch, and the path is absent from a live 1.6 server's filesystem and its/etc/exports. The mount fails and the script dies atbefore it reaches a single partition.
The reporting half is dead too
This is the part worth checking rather than assuming, because 1.5 looks live where 1.6 plainly is not.
service/av.phpacross from 1.5 — nothing to post toVirusmodel, the manager and the report — and rejects every submissionThe 1.5 guard reads:
That compares a string to an array, and PHP ranks any array above any non-array — so it is
truefor every input and the endpoint always throws. Verified on 7.4.33 and 8.3.33, both supported; the line dates to 2014.What this removes
Buildroot/board/FOG/FOS/rootfs_overlay/bin/fog.avclamav)arm of the mode dispatch inbin/fogclamav)arm inbin/fog.checkin, which appendedavmodeto the check-in POST. Nothing reads it —avmodeappears nowhere else in this tree, and neitherPre_Stage1.phpnormc_checkin.phpreferences it on either branchfog.avfrom the documented raw-curl exceptions intests/checks/server-post-reporting.sh# BR2_PACKAGE_CLAMAV is not setstays in both configs. Those are generated defconfig lines present for every unselected package, not a choice this change gets to edit.Behavior change, confined to 1.5
dev-branchstill emitsmode=clamav, so a 1.5 Virus Scan task now fails asUnknown mode :: clamavrather thanCannot find clamav binaries. Both arehandleErrorpaths reached before any scanning — no working behavior is lost. 1.6 stops emitting the mode entirely once fogproject#1608 lands.Verified
tests/run-all.sh— 18 passed, 0 failed, both before and afterbash -nfog.avthat reads a raw curl reply turns check 11 red: