Mailing List Archive: [clamav-users] ClamAV 0.102.2 needs a "--without-systemd" option

[clamav-users] ClamAV 0.102.2 needs a "--without-systemd" option

Apr 19, 2020, 10:25 AM

Post #1 of 4 (229 views)

I finally built 0.102.2 a few days ago and was rather shocked that it was tightly integrated into systemd. In a point release, converting ClamAV into a mandatory server strikes me as weird, especially since there is no "--without-systemd" option.

I am not philosophically opposed to systemd (its partial ordering of dependencies is actually quite elegant), but I have never used ClamAV in conjunction with systemd (although I might consider it in the future).

Now for some details...

The way I always have built ClamAV is to install each new version in /opt under its version number. This allows me to try out the new version without needing to shut down the running version. Then I switch to the new version almost atomically by changing one symlink (e.g., /opt/clamav -> /opt/clamav.0.102.2) and restarting clamd. So if the new version has some problem, I can switch back (also almost atomically).

Luckily, my procedure was not totally wiped out by the systemd issue due to the fact that (for extra security) I never run "make install" as root. I always create the new ClamAV version directory in /opt owned by the build user and install as that user (followed by "chown -R 0.0" etc.). So the install failed without adding weird stuff to my systemd environment.

I then worked around the problem by studying the "configure" options and found that there was an option "--with-systemdsystemunitdir". So I pointed that to a harmless new directory (/opt/clamav.0.102.2/systemd) and reran "configure", "make", "make check" and "make install", which then all worked, and showed me what the new systemd files contained.

Thus I would strongly recommend adding a "--without-systemd" option to the new "configure". If I hadn't employed my workaround, "make install" (as root) would have added those 3 files to the standard systemd environment. This have totally broken the way I support multiple versions of ClamAV, as those files have *absolute* paths to the new version of ClamAV no matter where installed.

P.S. I run freshclam via cron and my own "getfreshclam" wrapper. This allows me to keep older signature files around in case a new version has a serious problem. (It was also quite useful in investigating the multi-hour out-of-date problem with Cloudflare's BOS mirror.)

Finally, note that simply using systemd and thus freshclam's builtin periodic update mechanism (instead of cron) wouldn't easily allow keeping previous signature files around as backups.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] ClamAV 0.102.2 needs a "--without-systemd" option [ In reply to ]

awillia2 at sourcefire

Apr 19, 2020, 12:17 PM

Post #2 of 4 (227 views)

Permalink

Paul,

You should be able to use `--with-systemdsystemunitdir=no` to make it so
that `make install` won't try to register clamd as a systemd service

-Andrew

On Sun, Apr 19, 2020 at 1:26 PM Paul Kosinski via clamav-users <
clamav-users@lists.clamav.net> wrote:

> I finally built 0.102.2 a few days ago and was rather shocked that it was
> tightly integrated into systemd. In a point release, converting ClamAV into
> a mandatory server strikes me as weird, especially since there is no
> "--without-systemd" option.
>
> I am not philosophically opposed to systemd (its partial ordering of
> dependencies is actually quite elegant), but I have never used ClamAV in
> conjunction with systemd (although I might consider it in the future).
>
> Now for some details...
>
> The way I always have built ClamAV is to install each new version in /opt
> under its version number. This allows me to try out the new version without
> needing to shut down the running version. Then I switch to the new version
> almost atomically by changing one symlink (e.g., /opt/clamav ->
> /opt/clamav.0.102.2) and restarting clamd. So if the new version has some
> problem, I can switch back (also almost atomically).
>
> Luckily, my procedure was not totally wiped out by the systemd issue due
> to the fact that (for extra security) I never run "make install" as root. I
> always create the new ClamAV version directory in /opt owned by the build
> user and install as that user (followed by "chown -R 0.0" etc.). So the
> install failed without adding weird stuff to my systemd environment.
>
> I then worked around the problem by studying the "configure" options and
> found that there was an option "--with-systemdsystemunitdir". So I pointed
> that to a harmless new directory (/opt/clamav.0.102.2/systemd) and reran
> "configure", "make", "make check" and "make install", which then all
> worked, and showed me what the new systemd files contained.
>
> Thus I would strongly recommend adding a "--without-systemd" option to the
> new "configure". If I hadn't employed my workaround, "make install" (as
> root) would have added those 3 files to the standard systemd environment.
> This have totally broken the way I support multiple versions of ClamAV, as
> those files have *absolute* paths to the new version of ClamAV no matter
> where installed.
>
> P.S. I run freshclam via cron and my own "getfreshclam" wrapper. This
> allows me to keep older signature files around in case a new version has a
> serious problem. (It was also quite useful in investigating the multi-hour
> out-of-date problem with Cloudflare's BOS mirror.)
>
> Finally, note that simply using systemd and thus freshclam's builtin
> periodic update mechanism (instead of cron) wouldn't easily allow keeping
> previous signature files around as backups.
>
> _______________________________________________
>
> clamav-users mailing list
> clamav-users@lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>

Re: [clamav-users] ClamAV 0.102.2 needs a "--without-systemd" option [ In reply to ]

clamav-users at lists

Apr 20, 2020, 10:25 AM

Post #3 of 4 (225 views)

Permalink

Andrew,

Yeah, per your posting, I tried running 'configure' specifying
`--with-systemdsystemunitdir=no` and it seemed to be suppress the
systemd tie-in. (I didn't actually run 'make'.)

It would be nice if this were documented somewhere. The "--help" info
from 'configure' only lists 'DIR' as an argument. The latest reference
to 'systemd' in NEWS.md is for version 0.99.2 (and the other ".md"
files have nothing), and I couldn't find anything about this new
approach in the documentation or faqs on GitHub. (Google doesn't turn
up anything definitive either.)

In any case, the systemd tie-in is a *major* change: it turns ClamAV
from a mere package into a run-at-startup *service*, and needs to be
presented as such.

-Paul

On Sun, 19 Apr 2020 15:17:51 -0400
Andrew Williams <awillia2@sourcefire.com> wrote:

> Paul,
>
> You should be able to use `--with-systemdsystemunitdir=no` to make it
> so that `make install` won't try to register clamd as a systemd
> service
>
> -Andrew
>
> On Sun, Apr 19, 2020 at 1:26 PM Paul Kosinski via clamav-users <
> clamav-users@lists.clamav.net> wrote:
>
> > I finally built 0.102.2 a few days ago and was rather shocked that
> > it was tightly integrated into systemd. In a point release,
> > converting ClamAV into a mandatory server strikes me as weird,
> > especially since there is no "--without-systemd" option.
> >
> > I am not philosophically opposed to systemd (its partial ordering of
> > dependencies is actually quite elegant), but I have never used
> > ClamAV in conjunction with systemd (although I might consider it in
> > the future).
> >
> > Now for some details...
> >
> > The way I always have built ClamAV is to install each new version
> > in /opt under its version number. This allows me to try out the new
> > version without needing to shut down the running version. Then I
> > switch to the new version almost atomically by changing one symlink
> > (e.g., /opt/clamav -> /opt/clamav.0.102.2) and restarting clamd. So
> > if the new version has some problem, I can switch back (also almost
> > atomically).
> >
> > Luckily, my procedure was not totally wiped out by the systemd
> > issue due to the fact that (for extra security) I never run "make
> > install" as root. I always create the new ClamAV version directory
> > in /opt owned by the build user and install as that user (followed
> > by "chown -R 0.0" etc.). So the install failed without adding weird
> > stuff to my systemd environment.
> >
> > I then worked around the problem by studying the "configure"
> > options and found that there was an option
> > "--with-systemdsystemunitdir". So I pointed that to a harmless new
> > directory (/opt/clamav.0.102.2/systemd) and reran "configure",
> > "make", "make check" and "make install", which then all worked, and
> > showed me what the new systemd files contained.
> >
> > Thus I would strongly recommend adding a "--without-systemd" option
> > to the new "configure". If I hadn't employed my workaround, "make
> > install" (as root) would have added those 3 files to the standard
> > systemd environment. This have totally broken the way I support
> > multiple versions of ClamAV, as those files have *absolute* paths
> > to the new version of ClamAV no matter where installed.
> >
> > P.S. I run freshclam via cron and my own "getfreshclam" wrapper.
> > This allows me to keep older signature files around in case a new
> > version has a serious problem. (It was also quite useful in
> > investigating the multi-hour out-of-date problem with Cloudflare's
> > BOS mirror.)
> >
> > Finally, note that simply using systemd and thus freshclam's builtin
> > periodic update mechanism (instead of cron) wouldn't easily allow
> > keeping previous signature files around as backups.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

Re: [clamav-users] ClamAV 0.102.2 needs a "--without-systemd" option [ In reply to ]

Bowie_Bailey at BUC

Apr 20, 2020, 11:50 AM

Post #4 of 4 (225 views)

Permalink

On 4/20/2020 1:25 PM, Paul Kosinski via clamav-users wrote:
> Andrew,
>
> Yeah, per your posting, I tried running 'configure' specifying
> `--with-systemdsystemunitdir=no` and it seemed to be suppress the
> systemd tie-in. (I didn't actually run 'make'.)
>
> It would be nice if this were documented somewhere. The "--help" info
> from 'configure' only lists 'DIR' as an argument. The latest reference
> to 'systemd' in NEWS.md is for version 0.99.2 (and the other ".md"
> files have nothing), and I couldn't find anything about this new
> approach in the documentation or faqs on GitHub. (Google doesn't turn
> up anything definitive either.)
>
> In any case, the systemd tie-in is a *major* change: it turns ClamAV
> from a mere package into a run-at-startup *service*, and needs to be
> presented as such.

While I agree that it should be documented if it is installing systemd stuff, I don't
think this is quite as bad as you think.

After reading this thread, I took a look at my own system. I use ClamAV via avfilter
for Courier, so I do not normally have the clamd daemon running. Since I recently
updated to ClamAV 0.102.2, I was curious if anything had changed based on what you
were seeing. I verified that the daemon is not running, but it did install a service
file that is disabled by default. So unless you activate the service via systemd, it
will not actually do anything.

The freshclam daemon is running on my system, but that is intentional. According to
systemd, freshclam is also disabled by default.

It looks like this change would not cause any issues in your case unless you are
actually using the systemd service to control the daemons.

--
Bowie

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml