From 9f7e5bf9eaba67d3c5cead196ef93be333700ea3af2ad130a57623c53a84b996 Mon Sep 17 00:00:00 2001 From: Reinhard Max Date: Mon, 25 Mar 2024 18:13:50 +0000 Subject: [PATCH] Accepting request 1161540 from home:rmax:branches:security - New version: 1.3.0: * Added support for extracting and scanning attachments found in Microsoft OneNote section files. OneNote parsing will be enabled by default, but may be optionally disabled. * Added file type recognition for compiled Python (`.pyc`) files. * Improved support for decrypting PDFs with empty passwords. * Fixed a warning when scanning some HTML files. * ClamOnAcc: Fixed an infinite loop when a watched directory does not exist. * ClamOnAcc: Fixed an infinite loop when a file has been deleted before a scan. - Use %patch -P N instead of deprecated %patchN. - New version: 1.2.0: * Added support for extracting Universal Disk Format (UDF) partitions. * Added an option to customize the size of ClamAV's clean file cache. * Raised the MaxScanSize limit so the total amount of data scanned when scanning a file or archive may exceed 4 gigabytes. * Added ability for Freshclam to use a client certificate PEM file and a private key PEM file for authentication to a private mirror. * Fix an issue extracting files from ISO9660 partitions where the files are listed in the plain ISO tree and there also exists an empty Joliet tree. * PID and socket are now located under /run/clamav/clamd.pid and /run/clamav/clamd.sock . * bsc#1211594: Fixed an issue where ClamAV does not abort the signature load process after partially loading an invalid signature. OBS-URL: https://build.opensuse.org/request/show/1161540 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=252 --- .gitattributes | 23 + .gitignore | 1 + _constraints | 10 + clamav-1.3.0.tar.gz | 3 + clamav-1.3.0.tar.gz.sig | 16 + clamav-conf.patch | 183 +++ clamav-document-maxsize.patch | 41 + clamav-fips.patch | 12 + clamav-format.patch | 165 +++ clamav-obsolete-config.patch | 16 + clamav-rpmlintrc | 4 + clamav-tmpfiles.conf | 2 + clamav.changes | 2271 +++++++++++++++++++++++++++++++++ clamav.keyring | 63 + clamav.spec | 370 ++++++ service.clamav-milter | 15 + service.clamd | 20 + service.clamonacc | 13 + service.freshclam | 12 + system-user-vscan.conf | 3 + timer.freshclam | 10 + 21 files changed, 3253 insertions(+) create mode 100644 .gitattributes create mode 100644 .gitignore create mode 100644 _constraints create mode 100644 clamav-1.3.0.tar.gz create mode 100644 clamav-1.3.0.tar.gz.sig create mode 100644 clamav-conf.patch create mode 100644 clamav-document-maxsize.patch create mode 100644 clamav-fips.patch create mode 100644 clamav-format.patch create mode 100644 clamav-obsolete-config.patch create mode 100644 clamav-rpmlintrc create mode 100644 clamav-tmpfiles.conf create mode 100644 clamav.changes create mode 100644 clamav.keyring create mode 100644 clamav.spec create mode 100644 service.clamav-milter create mode 100644 service.clamd create mode 100644 service.clamonacc create mode 100644 service.freshclam create mode 100644 system-user-vscan.conf create mode 100644 timer.freshclam diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..9b03811 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,23 @@ +## Default LFS +*.7z filter=lfs diff=lfs merge=lfs -text +*.bsp filter=lfs diff=lfs merge=lfs -text +*.bz2 filter=lfs diff=lfs merge=lfs -text +*.gem filter=lfs diff=lfs merge=lfs -text +*.gz filter=lfs diff=lfs merge=lfs -text +*.jar filter=lfs diff=lfs merge=lfs -text +*.lz filter=lfs diff=lfs merge=lfs -text +*.lzma filter=lfs diff=lfs merge=lfs -text +*.obscpio filter=lfs diff=lfs merge=lfs -text +*.oxt filter=lfs diff=lfs merge=lfs -text +*.pdf filter=lfs diff=lfs merge=lfs -text +*.png filter=lfs diff=lfs merge=lfs -text +*.rpm filter=lfs diff=lfs merge=lfs -text +*.tbz filter=lfs diff=lfs merge=lfs -text +*.tbz2 filter=lfs diff=lfs merge=lfs -text +*.tgz filter=lfs diff=lfs merge=lfs -text +*.ttf filter=lfs diff=lfs merge=lfs -text +*.txz filter=lfs diff=lfs merge=lfs -text +*.whl filter=lfs diff=lfs merge=lfs -text +*.xz filter=lfs diff=lfs merge=lfs -text +*.zip filter=lfs diff=lfs merge=lfs -text +*.zst filter=lfs diff=lfs merge=lfs -text diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..57affb6 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.osc diff --git a/_constraints b/_constraints new file mode 100644 index 0000000..d1ae7cd --- /dev/null +++ b/_constraints @@ -0,0 +1,10 @@ + + + + 6 + + + 8 + + + diff --git a/clamav-1.3.0.tar.gz b/clamav-1.3.0.tar.gz new file mode 100644 index 0000000..d46751a --- /dev/null +++ b/clamav-1.3.0.tar.gz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:0a86a6496320d91576037b33101119af6fd8d5b91060cd316a3a9c229e9604aa +size 54538457 diff --git a/clamav-1.3.0.tar.gz.sig b/clamav-1.3.0.tar.gz.sig new file mode 100644 index 0000000..b8a8ee6 --- /dev/null +++ b/clamav-1.3.0.tar.gz.sig @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIcBAABAgAGBQJlw5TIAAoJEMzg39Iewam/46MP/Rp0mkhaOzp9qx3YMEY1dcU2 +a3tIpHECBbfC0QD8PVQjV+Lavfx0S+o9orPfpuYm9tonl9wYjeX2sX9LMvKbMHrt +BeJXoUzyDPcx69H4ddDCdJyZtI/HKq4iAN+7mcDacTLSm2tpvGqIRkiK1GKV5r1+ +SPcrJLWee4mfVjwZcBMLKEWuWjDcPENcjpVB5Snn28X1QfENuivmlUDSN2kY8gzo +wPxB0ESsLVzWq9DZV5uy84OoKXxLfKzEdPzX5JxvZmuk6u4t65cK6zpMxnPkHr38 +EcC5EqZeeBz/DiHGtbH4mCNmlB4u3QjhCIE4JIpAnn4TA5ZBF8NqCPkTZNAbLZm+ +BFhZsMBx3U9HcYxPAZs7TsysV3nLIjgtnuQcs2QXqMtqwlY6PPIRRjpyfhhzO0fu +AkBU3cUBBJMC/rP4MgmxO+TGrp2DcnS2NTSvUlwHsYEFsPt2fUBu8i55MNcu6AOz +zlHJ4DcmRSjcGotDdhAbe4tNlKC08m76OKvvtWvMSZcBecfm3UsCBRJ7NJ5WhKhW +0lvQlUjN0Kl1PyE62lKXuD/SysTL/tFDmM8Nnnlo7YfN2o3XYnAZz6WFBoTNTd94 +rGsPjmuqGgjr03KwJXIv8zh/KIbAZQvItYi7xTSlwwtZkN8hrfRgTeRRAy9Le8Ji +YKX+qyxNgDeEddZZVrAH +=The4 +-----END PGP SIGNATURE----- diff --git a/clamav-conf.patch b/clamav-conf.patch new file mode 100644 index 0000000..8ba2411 --- /dev/null +++ b/clamav-conf.patch @@ -0,0 +1,183 @@ +--- etc/clamav-milter.conf.sample.orig ++++ etc/clamav-milter.conf.sample +@@ -1,11 +1,7 @@ + ## +-## Example config file for clamav-milter ++## config file for clamav-milter + ## + +-# Comment or remove the line below. +-Example +- +- + ## + ## Main options + ## +@@ -17,7 +13,7 @@ Example + # inet6:port@[hostname|ip-address] - to specify an ipv6 socket + # + # Default: no default +-#MilterSocket /run/clamav/clamav-milter.sock ++MilterSocket /run/clamav/clamav-milter.sock + #MilterSocket /tmp/clamav-milter.sock + #MilterSocket inet:7357 + +@@ -38,7 +34,7 @@ Example + # to work) + # + # Default: unset (don't drop privileges) +-#User clamav ++User vscan + + # Waiting for data from clamd will timeout after this time (seconds). + # Value of 0 disables the timeout. +@@ -65,7 +61,7 @@ Example + # also owned by root to keep other users from tampering with it. + # + # Default: disabled +-#PidFile /run/clamav/clamav-milter.pid ++PidFile /run/clamav/clamav-milter.pid + + # Optional path to the global temporary directory. + # Default: system specific (usually /tmp or /var/tmp). +@@ -93,7 +89,7 @@ Example + # + # Default: no default + #ClamdSocket tcp:scanner.mydomain:7357 +-#ClamdSocket unix:/run/clamav/clamd.sock ++ClamdSocket unix:/run/clamav/clamd.sock + + + ## +@@ -243,13 +239,13 @@ Example + # Use system logger (can work together with LogFile). + # + # Default: no +-#LogSyslog yes ++LogSyslog yes + + # Specify the type of syslog messages - please refer to 'man syslog' + # for facility names. + # + # Default: LOG_LOCAL6 +-#LogFacility LOG_MAIL ++LogFacility LOG_MAIL + + # Enable verbose logging. + # +--- etc/clamd.conf.sample.orig ++++ etc/clamd.conf.sample +@@ -1,12 +1,8 @@ + ## +-## Example config file for the Clam AV daemon ++## Config file for the Clam AV daemon + ## Please read the clamd.conf(5) manual before editing this file. + ## + +- +-# Comment or remove the line below. +-Example +- + # Uncomment this option to enable logging. + # LogFile must be writable for the user running daemon. + # A full path is required. +@@ -41,12 +37,12 @@ Example + + # Use system logger (can work together with LogFile). + # Default: no +-#LogSyslog yes ++LogSyslog yes + + # Specify the type of syslog messages - please refer to 'man syslog' + # for facility names. + # Default: LOG_LOCAL6 +-#LogFacility LOG_MAIL ++LogFacility LOG_MAIL + + # Enable verbose logging. + # Default: no +@@ -74,7 +70,7 @@ Example + # It is recommended that the directory where this file is stored is + # also owned by root to keep other users from tampering with it. + # Default: disabled +-#PidFile /run/clamav/clamd.pid ++PidFile /run/clamav/clamd.pid + + # Optional path to the global temporary directory. + # Default: system specific (usually /tmp or /var/tmp). +@@ -98,7 +94,7 @@ Example + + # Path to a local socket file the daemon will listen on. + # Default: disabled (must be specified by a user) +-#LocalSocket /run/clamav/clamd.sock ++LocalSocket /run/clamav/clamd.sock + #LocalSocket /tmp/clamd.sock + + # Sets the group ownership on the unix socket. +@@ -230,7 +226,7 @@ Example + + # Run as another user (clamd must be started by root for this option to work) + # Default: don't drop privileges +-#User clamav ++User vscan + + # Stop daemon when libclamav reports out of memory condition. + #ExitOnOOM yes +@@ -708,7 +704,7 @@ Example + # multiple OnAccessIncludePath directives but each directory must be added + # in a separate line. + # Default: disabled +-#OnAccessIncludePath /home ++OnAccessIncludePath /home + #OnAccessIncludePath /students + + # Set the exclude paths. All subdirectories are also excluded. +@@ -778,7 +774,7 @@ Example + # It has the same potential race condition limitations of the + # OnAccessExcludeUID option. + # Default: disabled +-#OnAccessExcludeUname clamav ++OnAccessExcludeUname vscan + + # Number of times the OnAccess client will retry a failed scan due to + # connection problems (or other issues). +--- etc/freshclam.conf.sample.orig ++++ etc/freshclam.conf.sample +@@ -1,12 +1,8 @@ + ## +-## Example config file for freshclam ++## Config file for freshclam + ## Please read the freshclam.conf(5) manual before editing this file. + ## + +- +-# Comment or remove the line below. +-Example +- + # Path to the database directory. + # WARNING: It must match clamd.conf's directive! + # Default: hardcoded (depends on installation options) +@@ -52,12 +48,12 @@ Example + # It is recommended that the directory where this file is stored is + # also owned by root to keep other users from tampering with it. + # Default: disabled +-#PidFile /run/clamav/freshclam.pid ++PidFile /run/clamav/freshclam.pid + + # By default when started freshclam drops privileges and switches to the + # "clamav" user. This directive allows you to change the database owner. + # Default: clamav (may depend on installation options) +-#DatabaseOwner clamav ++DatabaseOwner vscan + + # Use DNS to verify virus database version. FreshClam uses DNS TXT records + # to verify database and software versions. With this directive you can change +@@ -148,7 +144,7 @@ DatabaseMirror database.clamav.net + + # Send the RELOAD command to clamd. + # Default: no +-#NotifyClamd /path/to/clamd.conf ++NotifyClamd /etc/clamd.conf + + # Run command after successful database update. + # Use EXIT_1 to return 1 after successful database update. diff --git a/clamav-document-maxsize.patch b/clamav-document-maxsize.patch new file mode 100644 index 0000000..f28a6c9 --- /dev/null +++ b/clamav-document-maxsize.patch @@ -0,0 +1,41 @@ +--- docs/man/clamscan.1.in.orig ++++ docs/man/clamscan.1.in +@@ -8,6 +8,18 @@ clamscan [options] [file/directory/\-] + .SH "DESCRIPTION" + .LP + clamscan is a command line anti\-virus scanner. ++.SH "NOTE" ++.LP ++If a file or an archive is larger than the default or configured size (see \-\-max\-filesize and \-\-max-scansize options) scanning will abort at the limit, and the file will be marked as "OK". ++.TP ++The archive scan limits are currently set to 25MB or 100MB respectively. ++.TP ++There are more options that limit scanning, please check all the \-\-max\-something options. ++.TP ++To report files that are exceeding these limits, you need to specify \-\-alert\-exceeds\-max=yes option. This will then report a "Heuristics.Limits.Exceeded FOUND" for such files. ++ ++.TP ++Please note that such a FOUND message does not imply infection, and your tooling should be able to handle this. + .SH "OPTIONS" + .LP + Most of the options are simple switches which enable or disable some features. Options marked with [=yes/no(*)] can be optionally followed by =yes/=no; if they get called without the boolean argument the scanner will assume 'yes'. The asterisk marks the default internal setting for a given option. +--- docs/man/clamdscan.1.in.orig ++++ docs/man/clamdscan.1.in +@@ -8,6 +8,17 @@ clamdscan [options] [file/directory] + .SH "DESCRIPTION" + .LP + clamdscan is a clamd client which may be used as a clamscan replacement. It accepts all the options implemented in clamscan but most of them will be ignored because its scanning abilities only depend on clamd. ++.SH "NOTE" ++.LP ++If a file or an archive is larger than the default or configured size (see MaxFileSize and MaxScanSize options in clamd.conf) scanning will abort at the limit, and the file will be marked as "OK". ++.TP ++The archive scan limits are currently set to 25MB or 100MB respectively. ++.TP ++There are more options that limit scanning, please check all the MaxSomething options in clamd.conf. ++.TP ++To report files that are exceeding these limits, you need to specify AlertExceedsMax TRUE in clamd.conf. This will then report a "Heuristics.Limits.Exceeded FOUND" for such files. ++.TP ++Please note that such a FOUND message does not imply infection, and your tooling should be able to handle this. + .SH "OPTIONS" + .LP + diff --git a/clamav-fips.patch b/clamav-fips.patch new file mode 100644 index 0000000..796abc4 --- /dev/null +++ b/clamav-fips.patch @@ -0,0 +1,12 @@ +--- libclamav/crypto.c.orig ++++ libclamav/crypto.c +@@ -145,6 +145,9 @@ int cl_initialize_crypto(void) + ERR_load_crypto_strings(); + #endif + ++ /* avoid fips issues */ ++ EVP_add_digest(EVP_md5()); ++ + return 0; + } + diff --git a/clamav-format.patch b/clamav-format.patch new file mode 100644 index 0000000..e874146 --- /dev/null +++ b/clamav-format.patch @@ -0,0 +1,165 @@ +--- clamdscan/client.c.orig ++++ clamdscan/client.c +@@ -239,14 +239,14 @@ int16_t ping_clamd(const struct optstruc + if (i + 1 < attempts) { + if (optget(opts, "wait")->enabled) { + if (interval == 1) +- logg(LOGG_DEBUG, "Could not connect, will try again in %lu second\n", interval); ++ logg(LOGG_DEBUG, "Could not connect, will try again in %" PRIu64 " second\n", interval); + else +- logg(LOGG_DEBUG, "Could not connect, will try again in %lu seconds\n", interval); ++ logg(LOGG_DEBUG, "Could not connect, will try again in %" PRIu64 " seconds\n", interval); + } else { + if (interval == 1) +- logg(LOGG_INFO, "Could not connect, will PING again in %lu second\n", interval); ++ logg(LOGG_INFO, "Could not connect, will PING again in %" PRIu64 " second\n", interval); + else +- logg(LOGG_INFO, "Could not connect, will PING again in %lu seconds\n", interval); ++ logg(LOGG_INFO, "Could not connect, will PING again in %" PRIu64 " seconds\n", interval); + } + sleep(interval); + } +--- clamonacc/client/client.c.orig ++++ clamonacc/client/client.c +@@ -254,14 +254,14 @@ int16_t onas_ping_clamd(struct onas_cont + if (i + 1 < attempts) { + if (optget((*ctx)->opts, "wait")->enabled) { + if (interval == 1) +- logg(LOGG_DEBUG, "Will try again in %lu second\n", interval); ++ logg(LOGG_DEBUG, "Will try again in %" PRIu64 " second\n", interval); + else +- logg(LOGG_DEBUG, "Will try again in %lu seconds\n", interval); ++ logg(LOGG_DEBUG, "Will try again in %" PRIu64 " seconds\n", interval); + } else { + if (interval == 1) +- logg(LOGG_INFO, "PINGing again in %lu second\n", interval); ++ logg(LOGG_INFO, "PINGing again in %" PRIu64 " second\n", interval); + else +- logg(LOGG_INFO, "PINGing again in %lu seconds\n", interval); ++ logg(LOGG_INFO, "PINGing again in %" PRIu64 " seconds\n", interval); + } + sleep(interval); + } +--- clamonacc/fanotif/fanotif.c.orig ++++ clamonacc/fanotif/fanotif.c +@@ -141,7 +141,7 @@ cl_error_t onas_setup_fanotif(struct ona + /* Load other options. */ + (*ctx)->sizelimit = optget((*ctx)->clamdopts, "OnAccessMaxFileSize")->numarg; + if ((*ctx)->sizelimit) { +- logg(LOGG_DEBUG, "ClamFanotif: max file size limited to %lu bytes\n", (*ctx)->sizelimit); ++ logg(LOGG_DEBUG, "ClamFanotif: max file size limited to %" PRIu64 " bytes\n", (*ctx)->sizelimit); + } else { + logg(LOGG_DEBUG, "ClamFanotif: file size limit disabled\n"); + } +--- libclamav/mew.c.orig ++++ libclamav/mew.c +@@ -787,7 +787,7 @@ int unmew11(char *src, uint32_t off, uin + } + if (((size_t)(src + off) < (size_t)(src)) || + ((size_t)(src + off) < (size_t)(off))) { +- cli_dbgmsg("MEW: Buffer pointer (%08zx) + offset (%08zx) exceeds max size of pointer (%08lx)\n", ++ cli_dbgmsg("MEW: Buffer pointer (%08zx) + offset (%08zx) exceeds max size of pointer (%08zx)\n", + (size_t)src, (size_t)off, SIZE_MAX); + return -1; + } +--- libclamav/pe.c.orig ++++ libclamav/pe.c +@@ -5185,12 +5185,12 @@ cl_error_t cli_peheader(fmap_t *map, str + + /* If a section is truncated, adjust its size value */ + if (!CLI_ISCONTAINED_0_TO(fsize, section->raw, section->rsz)) { +- cli_dbgmsg("cli_peheader: PE Section %zu raw+rsz extends past the end of the file by %lu bytes\n", section_pe_idx, (section->raw + section->rsz) - fsize); ++ cli_dbgmsg("cli_peheader: PE Section %zu raw+rsz extends past the end of the file by %zu bytes\n", section_pe_idx, (section->raw + section->rsz) - fsize); + section->rsz = fsize - section->raw; + } + + if (!CLI_ISCONTAINED_0_TO(fsize, section->uraw, section->ursz)) { +- cli_dbgmsg("cli_peheader: PE Section %zu uraw+ursz extends past the end of the file by %lu bytes\n", section_pe_idx, (section->uraw + section->ursz) - fsize); ++ cli_dbgmsg("cli_peheader: PE Section %zu uraw+ursz extends past the end of the file by %zu bytes\n", section_pe_idx, (section->uraw + section->ursz) - fsize); + section->ursz = fsize - section->uraw; + } + } +--- libfreshclam/libfreshclam_internal.c.orig ++++ libfreshclam/libfreshclam_internal.c +@@ -226,7 +226,7 @@ fc_error_t load_freshclam_dat(void) + if (-1 == lseek(handle, strlen(MIRRORS_DAT_MAGIC), SEEK_SET)) { + char error_message[260]; + cli_strerror(errno, error_message, 260); +- logg(LOGG_ERROR, "Can't seek to %lu, error: %s\n", strlen(MIRRORS_DAT_MAGIC), error_message); ++ logg(LOGG_ERROR, "Can't seek to %zu, error: %s\n", strlen(MIRRORS_DAT_MAGIC), error_message); + goto done; + } + +--- unit_tests/check_clamav.c.orig ++++ unit_tests/check_clamav.c +@@ -1939,7 +1939,7 @@ void diff_file_mem(int fd, const char *r + + ck_assert_msg(!!buf, "unable to malloc buffer: %zu", len); + p = read(fd, buf, len); +- ck_assert_msg(p == len, "file is smaller: %lu, expected: %lu", p, len); ++ ck_assert_msg(p == len, "file is smaller: %zu, expected: %zu", p, len); + p = 0; + while (len > 0) { + c1 = ref[p]; +@@ -1950,10 +1950,10 @@ void diff_file_mem(int fd, const char *r + len--; + } + if (len > 0) +- ck_assert_msg(c1 == c2, "file contents mismatch at byte: %lu, was: %c, expected: %c", p, c2, c1); ++ ck_assert_msg(c1 == c2, "file contents mismatch at byte: %zu, was: %c, expected: %c", p, c2, c1); + free(buf); + p = lseek(fd, 0, SEEK_END); +- ck_assert_msg(p == reflen, "trailing garbage, file size: %ld, expected: %ld", p, reflen); ++ ck_assert_msg(p == reflen, "trailing garbage, file size: %zd, expected: %zd", p, reflen); + close(fd); + } + +@@ -1969,7 +1969,7 @@ void diff_files(int fd, int ref_fd) + + ck_assert_msg(lseek(ref_fd, 0, SEEK_SET) == 0, "lseek failed"); + nread = read(ref_fd, ref, siz); +- ck_assert_msg(nread == siz, "short read, expected: %ld, was: %ld", siz, nread); ++ ck_assert_msg(nread == siz, "short read, expected: %ld, was: %zd", siz, nread); + close(ref_fd); + diff_file_mem(fd, ref, siz); + free(ref); +--- unit_tests/check_clamd.c.orig ++++ unit_tests/check_clamd.c +@@ -363,7 +363,7 @@ START_TEST(test_stats) + + recvdata = (char *)recvfull(sockd, &len); + +- ck_assert_msg(len > strlen(STATS_REPLY), "Reply has wrong size: %lu, minimum %lu, reply: %s\n", ++ ck_assert_msg(len > strlen(STATS_REPLY), "Reply has wrong size: %zu, minimum %zu, reply: %s\n", + len, strlen(STATS_REPLY), recvdata); + + if (len > strlen(STATS_REPLY)) +@@ -416,7 +416,7 @@ START_TEST(test_instream) + recvdata = (char *)recvfull(sockd, &len); + + expect_len = strlen(EXPECT_INSTREAM); +- ck_assert_msg(len == expect_len, "Reply has wrong size: %lu, expected %lu, reply: %s\n", ++ ck_assert_msg(len == expect_len, "Reply has wrong size: %zu, expected %zu, reply: %s\n", + len, expect_len, recvdata); + + rc = memcmp(recvdata, EXPECT_INSTREAM, expect_len); +@@ -494,7 +494,7 @@ static void tst_fildes(const char *cmd, + ck_assert_msg(sscanf(recvdata, "fd[%u]", &rc) == 1, "Reply doesn't contain fd: %s\n", recvdata); + + len -= p - recvdata; +- ck_assert_msg(len == expect_len, "Reply has wrong size: %lu, expected %lu, reply: %s, expected: %s\n", ++ ck_assert_msg(len == expect_len, "Reply has wrong size: %zu, expected %zu, reply: %s, expected: %s\n", + len, expect_len, p, expect); + + rc = memcmp(p, expect, expect_len); +--- libclamav/others_common.c.orig ++++ libclamav/others_common.c +@@ -312,7 +312,7 @@ char *cli_strdup(const char *s) + } + + alloc = strdup(s); +- ++ + if (!alloc) { + perror("strdup_problem"); + cli_errmsg("cli_strdup(): Can't allocate memory (%u bytes).\n", (unsigned int)strlen(s)); diff --git a/clamav-obsolete-config.patch b/clamav-obsolete-config.patch new file mode 100644 index 0000000..587e55b --- /dev/null +++ b/clamav-obsolete-config.patch @@ -0,0 +1,16 @@ +--- common/optparser.c.orig ++++ common/optparser.c +@@ -598,6 +598,13 @@ const struct clam_option __clam_options[ + {"MailFollowURLs", "mail-follow-urls", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, -1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN | OPT_DEPRECATED, "", ""}, + {"AllowSupplementaryGroups", NULL, 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_FRESHCLAM | OPT_MILTER | OPT_DEPRECATED, "Initialize a supplementary group access (the process must be started by root).", "no"}, + {"ScanOnAccess", NULL, 0, CLOPT_TYPE_BOOL, MATCH_BOOL, -1, NULL, 0, OPT_CLAMD | OPT_DEPRECATED, "", ""}, ++ { "StatsHostID", "stats-host-id", 0, CLOPT_TYPE_STRING, NULL, -1, NULL, 0, OPT_FRESHCLAM | OPT_CLAMD | OPT_CLAMSCAN | OPT_DEPRECATED, "", "" }, ++ { "StatsEnabled", "enable-stats", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_FRESHCLAM | OPT_CLAMSCAN | OPT_DEPRECATED, "", "" }, ++ { "StatsPEDisabled", "disable-pe-stats", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN | OPT_DEPRECATED, "", "" }, ++ { "StatsTimeout", "stats-timeout", 0, CLOPT_TYPE_NUMBER, MATCH_NUMBER, -1, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN | OPT_FRESHCLAM | OPT_DEPRECATED, "", "" }, ++ { "SubmitDetectionStats", NULL, 0, CLOPT_TYPE_STRING, NULL, -1, NULL, 0, OPT_FRESHCLAM | OPT_DEPRECATED, "", "" }, ++ { "DetectionStatsCountry", NULL, 0, CLOPT_TYPE_STRING, NULL, -1, NULL, 0, OPT_FRESHCLAM | OPT_DEPRECATED, "", "" }, ++ { "DetectionStatsHostID", NULL, 0, CLOPT_TYPE_STRING, NULL, -1, NULL, 0, OPT_FRESHCLAM | OPT_DEPRECATED, "", "" }, + + /* Milter specific options */ + diff --git a/clamav-rpmlintrc b/clamav-rpmlintrc new file mode 100644 index 0000000..f538e42 --- /dev/null +++ b/clamav-rpmlintrc @@ -0,0 +1,4 @@ +addFilter("obsolete-not-provided") +addFilter("systemd-service-without-service_.* freshclam.service") +addFilter("missing-call-to-setgroups-before-setuid /usr/bin/clamscan") +addFilter("files-duplicated-waste") diff --git a/clamav-tmpfiles.conf b/clamav-tmpfiles.conf new file mode 100644 index 0000000..9004877 --- /dev/null +++ b/clamav-tmpfiles.conf @@ -0,0 +1,2 @@ +# clamav needs a directory in /run: +d /run/clamav 0755 vscan vscan - diff --git a/clamav.changes b/clamav.changes new file mode 100644 index 0000000..31c8f37 --- /dev/null +++ b/clamav.changes @@ -0,0 +1,2271 @@ +------------------------------------------------------------------- +Fri Mar 15 13:52:57 UTC 2024 - Reinhard Max + +- New version: 1.3.0: + * Added support for extracting and scanning attachments found in + Microsoft OneNote section files. OneNote parsing will be + enabled by default, but may be optionally disabled. + * Added file type recognition for compiled Python (`.pyc`) files. + * Improved support for decrypting PDFs with empty passwords. + * Fixed a warning when scanning some HTML files. + * ClamOnAcc: Fixed an infinite loop when a watched directory + does not exist. + * ClamOnAcc: Fixed an infinite loop when a file has been deleted + before a scan. + +------------------------------------------------------------------- +Mon Feb 26 10:47:55 UTC 2024 - Dominique Leuenberger + +- Use %patch -P N instead of deprecated %patchN. + +------------------------------------------------------------------- +Fri Aug 18 14:03:06 UTC 2023 - Reinhard Max + +- New version: 1.2.0: + * Added support for extracting Universal Disk Format (UDF) + partitions. + * Added an option to customize the size of ClamAV's clean file + cache. + * Raised the MaxScanSize limit so the total amount of data + scanned when scanning a file or archive may exceed 4 gigabytes. + * Added ability for Freshclam to use a client certificate PEM + file and a private key PEM file for authentication to a private + mirror. + * Fix an issue extracting files from ISO9660 partitions where the + files are listed in the plain ISO tree and there also exists an + empty Joliet tree. + * PID and socket are now located under /run/clamav/clamd.pid and + /run/clamav/clamd.sock . + * bsc#1211594: Fixed an issue where ClamAV does not abort the + signature load process after partially loading an invalid + signature. +- Renew clamav.keyring . + +------------------------------------------------------------------- +Fri May 26 15:08:45 UTC 2023 - Reinhard Max + +- New version 1.1.0: + * https://blog.clamav.net/2023/05/clamav-110-released.html + * Added the ability to extract images embedded in HTML CSS +