Mailing List Archive

[clamav-users] Netapp hidden files
Hello,

When running a "clamscan /" the hidden NFS mounts from the Netapp are mounted and scanned. The NFS mounts are hidden snapshot file systems.

Has anyone experienced this happening? If we make the hidden file systems inaccessible then they do not get mounted. Is there a way to tell clamscan not to mount hidden files?

RHEL7.9 system - using redhat epel repository rpms - ClamAV 0.103.3



Thanks,
Jeff Hoevenaar
Re: [clamav-users] Netapp hidden files [ In reply to ]
Hi Jeff,
You would want to add those .snapshot paths to "ExcludePath" directives
in your clamd.conf file for clamd / clamdscan or use the "--exclude-dir"
option for clamscan.
You'll probably want to write a wrapper script for clamscan to build up
the list of .snapshot directories to ignore at the time of running though.

--Maarten

On Tue, Oct 5, 2021 at 10:09 AM Hoevenaar, Jeffrey (GE Aviation, US) via
clamav-users <clamav-users@lists.clamav.net> wrote:

> Hello,
>
>
>
> When running a “clamscan /” the hidden NFS mounts from the Netapp are
> mounted and scanned. The NFS mounts are hidden snapshot file systems.
>
>
>
> Has anyone experienced this happening? If we make the hidden file
> systems inaccessible then they do not get mounted. Is there a way to tell
> clamscan not to mount hidden files?
>
>
>
> RHEL7.9 system – using redhat epel repository rpms - ClamAV 0.103.3
>
>
>
>
>
>
>
> Thanks,
>
> Jeff Hoevenaar
>
>
>
> _______________________________________________
>
> clamav-users mailing list
> clamav-users@lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>
Re: [clamav-users] Netapp hidden files [ In reply to ]
Hi there,

On Tue, 5 Oct 2021, Hoevenaar, Jeffrey (GE Aviation, US) via clamav-users wrote:

> When running a "clamscan /"

Don't do that unless you really know what you're doing.

> the hidden NFS mounts from the Netapp are mounted and scanned. The
> NFS mounts are hidden snapshot file systems.

Apparently not terribly well hidden...

> Has anyone experienced this happening?

It's very rare that I scan a filesystem, and I never would have a
hidden snapshot of anything anywhere that it could possibly get
mounted by accident, so - no.

> If we make the hidden file systems inaccessible then they do not get
> mounted. Is there a way to tell clamscan not to mount hidden files?

You will probably find that it isn't clamscan that's mounting them.

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml