clamscan command from the java program gives the exit code 127

[ayushi_agrahari]

I am exploring the addon GitHub - fegorama/alfviral: Alfresco Virus Alert 

I am using the COMMAND mode to scan the files for virus.I have the following configuration in alfviral.properties file.

alfviral.mode=COMMAND

alfviral.command.exec=/usr/bin/clamscan

When the following code is executed 

ProcessBuilder pb = new ProcessBuilder(this.command);

Process process = pb.start();

res = process.waitFor();

   logger.debug(" ++++++the value of res is++++++++"+res);

and uploaded a file of mimetype application/x-dosexec,I got the following logs

2018-03-07 19:12:38,753 DEBUG com.fegor.alfresco.services.AntivirusServiceImpl: [Type: application/x-dosexec]
com.fegor.alfresco.services.AntivirusServiceImpl: [Mode: COMMAND]
2018-03-07 19:12:38,753 DEBUG  [security.antivirus.CommandScan] [http-apr-8080-exec-10] ++++++the value of res is++++++++127

So,when I have done a little bit of googling,I have understood that 127 is a special exit code which means that the command is not found.

I am surprised that logs are showing that the command is not found because when I have directly run the clamscan on a file,it is working perfectly and showing that the file is infected if the file is infected and clean if the file is not infected.

ayushi@ayushi-GA-78LMT-S2PT:~$ clamscan ~/Downloads/stepup.exe
/home/ayushi/Downloads/stepup.exe: OK

----------- SCAN SUMMARY -----------
Known viruses: 6431792
Engine version: 0.99.2
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 9.14 MB
Data read: 2.46 MB (ratio 3.72:1)
Time: 13.816 sec (0 m 13 s)

Also,when I have scanned the file with virustotal mode,it is working perfectly.

[janv]

For context of others, I see you've also recently posted related questions such as:

•  Different versions of files for rule and scheduler in antivirus action. (related to Antivirus ).
• clamdscan restricting the apparmor.d file to scan the files in /opt 
•  

It sounds as if you're getting closer to solving it - please let us know how you get on.

Regards,

Jan

[fegor]

Hi!

Please, test if the call /usr/bin/clamscan is fine!

if not, use:

whereis clamscan

for found this executable.

Best regards,

Fegor

[mikel_asla]

Also, test from command line using the same user as the Alfresco process

[ayushi_agrahari]

I have installed the amps in alfresco 5.2 and keep the following configuration in alfviral.properties file

alfviral.mode=COMMAND

alfviral.command.exec=/usr/bin/clamscan

when I run the clamscan command in terminal,it is working perfectly.

but when I have tried to run the command through java code,it is giving the exit code 127 which means that the command is not found

I have the following code in CommandScan.java class

ProcessBuilder pb = new ProcessBuilder(this.command);

Process process = pb.start();

res = process.waitFor();

   logger.debug(" ++++++the value of res is++++++++"+res);

and when I have uploaded a file of mimetype application/x-dosexec,I got the following logs

 
2018-03-07 19:12:38,753 DEBUG  [security.antivirus.CommandScan] [http-apr-8080-exec-10] ++++++the value of res is++++++++127

I am surprised that logs are showing that the command is not found because when I have directly run the clamscan on a file,it is working perfectly and showing that the file is infected if the file is infected and clean if the file is not infected.

Can anyone tell me why the clamscan command is giving the value 127(command not found) through the java class but running perfectly through the terminal.

[ayushi_agrahari]

Fernando González‌

ayushi@ayushi-GA-78LMT-S2PT:~$ whereis clamscan
clamscan: /usr/bin/clamscan /usr/share/man/man1/clamscan.1.gz
ayushi@ayushi-GA-78LMT-S2PT:~$ which clamscan
/usr/bin/clamscan

[fegor]

Please, in java code insert:

logger.debug(" ++++++ The value of command is: " + this.command);

And return this info.

Best regards,

Fegor

[fegor]

And, as Mkel say, which user runs Alfresco?

And finally, the best method to use Alfviral is through ICAP protocol ;-)

Best regards,

Fegor

[ayushi_agrahari]

when I put this

logger.debug(" ++++++ The value of command is: " + this.command);

the logs are

 2018-03-09 19:00:06,535  DEBUG [security.antivirus.CommandScan] [DefaultScheduler_Worker-10] ++++++ the value of command is[/usr/bin/clamscan, /home/alfresco_installation/Alfviral/alf_data/contentstore/2018/3/9/14/46/aeaa46c1-9af5-4d1d-9750-24656ad3da5b.bin]

[fegor]

Hi!

One, exist the bin file?, '/home/alfresco_installation/Alfviral/alf_data/contentstore/2018/3/9/14/46/aeaa46c1-9af5-4d1d-9750-24656ad3da5b.bin'

Two, can you prove without path?, only with clamscan.

Best regards,

Fegor