From 1520cf60b63a8ce92a7365c1c8633c00554ce9d2 Mon Sep 17 00:00:00 2001 From: Tom Elliott Date: Tue, 1 Sep 2026 09:00:19 -0500 Subject: [PATCH] fix: remove the ClamAV virus scan (GH-28) The companion to fogproject GH-328, which removes the task types, the `clamav=` kernel argument and the `virus` table on the server side. THE SCAN CANNOT RUN TODAY, ON EITHER RELEASE LINE. `fog.av` does not use a ClamAV built into the image -- `BR2_PACKAGE_CLAMAV is not set` in both fsx64 and fsarm64 -- it NFS-mounts the binaries from the server, at the path the `clamav=` argument carries: `:/opt/fog/clamav`. Neither installer has ever created or exported that directory. `bin/installfog.sh` and `lib/` on working-1.6 and on dev-branch contain no reference to clamav, and it is absent from a live 1.6 server's filesystem and its /etc/exports. So the mount fails and the script dies at handleError "Cannot find clamav binaries to run task." before it reaches a single partition. The reporting half is dead too, which is what made this worth checking rather than assuming. 1.6 never carried `service/av.php` across from 1.5. 1.5 still has it, so it looks live -- but its guard reads if (trim($_REQUEST['mode']) != array('q', 's')) comparing a string to an array, where PHP ranks any array above any non-array. That is TRUE for every input, so the endpoint throws "Invalid operational mode" and saves nothing. Verified on 7.4.33 and 8.3.33, both of which FOG supports; the line dates to 2014. Removed: - `bin/fog.av` - the `clamav)` arm of the mode dispatch in `bin/fog` - the `clamav)` arm in `bin/fog.checkin`, which appended `avmode` to the check-in POST. Nothing reads it: `avmode` appears nowhere else in this tree, and neither Pre_Stage1.php nor mc_checkin.php on either branch references it - `fog.av` from the documented raw-curl exceptions in tests/checks/server-post-reporting.sh `# BR2_PACKAGE_CLAMAV is not set` stays in both configs. Those lines are generated defconfig output present for every unselected package, not a choice this change gets to edit. BEHAVIOR CHANGE, and it is confined to 1.5. dev-branch still emits `mode=clamav`, so a 1.5 Virus Scan task now fails as "Unknown mode :: clamav" rather than "Cannot find clamav binaries". Both are handleError paths reached before any scanning; no working behavior is lost. Verified: tests/run-all.sh 18 passed / 0 failed, before and after. Removing `fog.av` from the exceptions list restores a real gate rather than tidying text -- reintroducing a `fog.av` that reads a raw curl reply turns check 11 red, and green again once removed. Co-Authored-By: Claude --- .../board/FOG/FOS/rootfs_overlay/bin/fog | 3 - .../board/FOG/FOS/rootfs_overlay/bin/fog.av | 193 ------------------ .../FOG/FOS/rootfs_overlay/bin/fog.checkin | 9 +- tests/checks/server-post-reporting.sh | 2 +- 4 files changed, 2 insertions(+), 205 deletions(-) delete mode 100755 Buildroot/board/FOG/FOS/rootfs_overlay/bin/fog.av diff --git a/Buildroot/board/FOG/FOS/rootfs_overlay/bin/fog b/Buildroot/board/FOG/FOS/rootfs_overlay/bin/fog index 6b03a4e..c82ee3b 100755 --- a/Buildroot/board/FOG/FOS/rootfs_overlay/bin/fog +++ b/Buildroot/board/FOG/FOS/rootfs_overlay/bin/fog @@ -53,9 +53,6 @@ if [[ -n $mode && $mode != +(*debug*) && -z $type ]]; then badblocks) fog.surfacetest ;; - clamav) - fog.av - ;; autoreg) fog.auto.reg ;; diff --git a/Buildroot/board/FOG/FOS/rootfs_overlay/bin/fog.av b/Buildroot/board/FOG/FOS/rootfs_overlay/bin/fog.av deleted file mode 100755 index 99c1151..0000000 --- a/Buildroot/board/FOG/FOS/rootfs_overlay/bin/fog.av +++ /dev/null @@ -1,193 +0,0 @@ -#!/bin/bash -. /usr/share/fog/lib/funcs.sh -. /bin/fog.checkin -clearScreen -displayBanner -disks="" -disk="" -hd="" -parts="" -part="" -sysuuid=$(dmidecode -s system-uuid) -sysuuid=${sysuuid,,} -dots "Mounting Clamav" -[[ ! -d /opt/fog/clamav ]] && mkdir -p /opt/fog/clamav >/dev/null 2>&1 -# -t nfs is load-bearing, see the comment in fog.mount. -mount -t nfs -o nolock,proto=tcp,rsize=32768,wsize=32768,intr,noatime $clamav /opt/fog/clamav >/tmp/mount-output 2>&1 -if [[ ! $? -eq 0 ]]; then - echo "Failed" - debugPause - handleError "Unable to mount location. ($0)\n Args Passed: $*\n Reason: $(cat /tmp/mount-output | tr -d \\0)" -fi -echo "Done" -debugPause -dots "Adding clamav to path" -if [[ -d /opt/fog/clamav/bin && -d /opt/fog/clamav/sbin ]]; then - export PATH="$PATH:/opt/fog/clamav/bin:/opt/fog/clamav/sbin" -else - echo "Failed" - debugPause - handleError "Cannot find clamav binaries to run task. ($0)\n Args Passed: $*" -fi -echo "Done" -debugPause -dots "Updating clamav" -freshclam >/dev/null 2>&1 -case $? in - 0) - echo "Done" - ;; - *) - echo "Failed" - debugPause - handleError "Unable to update clamav definitions. ($0)\n Args Passed: $*" - ;; -esac -debugPause -echo "Done" -debugPause -dots "Getting disks to scan" -getHardDisk 'true' -if [[ -z $disks ]]; then - echo "Failed" - debugPause - handleError "Unable to find any disks. ($0)\n Args Passed: $*" -fi -echo "Done" -debugPause -dots "Creating scan partition" -[[ ! -d /clamavscan ]] && mkdir -p /clamavscan >/dev/null 2>&1 -if [[ ! -d /clamavscan ]]; then - echo "Failed" - debugPause - handleError "Unable to create scan folder. ($0)\n Args Passed: $*" -fi -echo "Done" -debugPause -action="" -case $avmode in - [Ss]) - modename="Scan and Report" - ;; - [Qq]) - action="--move=/clamavscan/fog/infected" - modename="Scan and Quarantine" - ;; - *) - handleError "Unable to determine scanning mode! ($0)\n Args Passed: $*" - ;; -esac -for disk in $disks; do - dots "Using disk" - echo "$disk" - debugPause - getPartitions "$disk" - for part in $parts; do - isBitlockedPartition "$part" - fsTypeSetting "$part" - case $fstype in - [Nn][Tt][Ff][Ss]) - echo " * Mounting partition $part" - ntfs-3g -o remove_hiberfile,rw $part /clamavscan >/tmp/clamavscan-mount-output 2>&1 - ;; - [Ee][Xx][Tt][Ff][Ss]) - echo " * Mounting partition $part" - mount -o rw $part /clamavscan >/tmp/clamavscan-mount-output 2>&1 - ;; - *) - dots "Not scanning partition" - echo "$part" - debugPause - continue - ;; - esac - [[ ! $? -eq 0 ]] && handleError " * Could not mount partition ($0)\n Args Passed: $*\n Reason: $(cat /tmp/clamavscan-mount-output | tr -d \\0)" - debugPause - dots "Creating working directories" - mkdir -p /clamavscan/fog/{tmp,infected,log} >/dev/null 2>&1 - case $? in - 0) - echo "Done" - ;; - *) - echo "Failed" - debugPause - umount /clamavscan >/dev/null 2>&1 - continue - ;; - esac - debugPause - echo -n > /clamavscan/fog/log/log.txt - echo " * Scanning Partition $part" - debugPause - dots "Clam AV Mode" - echo "$modename" - debugPause - dots "Starting AV scan" - echo -e -n "\t" - clamscan -V >/dev/null 2&>1 - case $? in - 0) - echo "Done" - ;; - *) - echo "Failed" - debugPause - umount /clamavscan >/dev/null 2>&1 - continue - ;; - esac - debugPause - cd /clamavscan - dots "Scanning" - start=$(date +%s) - clamscan -r --tempdir=/clamavscan/fog/tmp $action --log=/clamavscan/fog/log/log.txt --no-summary --exclude-dir=/clamavscan/fog/* - case $? in - 0) - echo " * Scan complete, processing log file" - ;; - *) - echo "Failed" - debugPause - umount /clamavscan - cur=$(date +%s) - diff=$((cur - start)) - echo " * Clam AV failed" - echo " * This may be due to a problem with the virus database files" - echo " * Trying with the next partition" - debugPause - continue - ;; - esac - debugPause - output=$(cat /clamavscan/fog/log/log.txt | grep 'FOUND' | tr -d \\0) - oIFS=$IFS - IFS=$'\n' - cnt=0 - for line in $output; do - b64=$(echo $line | base64) - let cnt+=1 - echo " * File id: $cnt" - dots "Sending file id" - # Fire and forget: nothing reads a reply, so there is no reply to - # misreport and callServer would add nothing. - curl -Lks --data "sysuuid=${sysuuid}&mac=$mac&string=$b64&mode=$avmode" ${web}service/av.php 2>/dev/null - case $? in - 0) - echo "Done" - ;; - *) - echo "Failed" - debugPause - continue - ;; - esac - debugPause - cat /tmp/avstat - cat /dev/null > /tmp/avstat - done - IFS=$oIFS - umount /clamavscan >/dev/null 2>&1 - done -done -. /bin/fog.nonimgcomplete diff --git a/Buildroot/board/FOG/FOS/rootfs_overlay/bin/fog.checkin b/Buildroot/board/FOG/FOS/rootfs_overlay/bin/fog.checkin index 6a0de83..d670d17 100755 --- a/Buildroot/board/FOG/FOS/rootfs_overlay/bin/fog.checkin +++ b/Buildroot/board/FOG/FOS/rootfs_overlay/bin/fog.checkin @@ -86,12 +86,5 @@ case $mc in esac sysuuid=$(dmidecode -s system-uuid) sysuuid=${sysuuid,,} -case $mode in - clamav) - poststring="sysuuid=${sysuuid}&mac=$mac&avmode=$avmode" - ;; - ""|*) - poststring="sysuuid=${sysuuid}&mac=$mac&type=$type" - ;; -esac +poststring="sysuuid=${sysuuid}&mac=$mac&type=$type" [[ ! $capone -eq 1 ]] && checkin "$poststring" "$php_post" diff --git a/tests/checks/server-post-reporting.sh b/tests/checks/server-post-reporting.sh index 75a39fd..f5b0618 100755 --- a/tests/checks/server-post-reporting.sh +++ b/tests/checks/server-post-reporting.sh @@ -274,7 +274,7 @@ while read -r hit; do [[ -n $hit ]] || continue b=$(basename "${hit%%:*}") case "$b" in - funcs.sh|fog.statusreporter|fog.av|fog|secureboot-funcs.sh|S40network) continue ;; + funcs.sh|fog.statusreporter|fog|secureboot-funcs.sh|S40network) continue ;; esac err="$err $b" done < <(grep -rn '=\$(curl \|=`curl ' "$OVERLAY" 2>/dev/null)