clamscan command from the java program gives the exit code 127

[fegor]

Hi!

I tested Alfviral with:

Ubuntu Linux 14.04 Server (VirtualBox)

Alfresco 5.2.3

Alfviral 1.4.0-SNAPSHOT

ClamAV 0.99.4

I have this parameters in alfviral.properties (in subsystems/Security/alfviral):

alfviral.command.exec=/usr/bin/clamscan

alfviral.mode=COMMAND

And work fine!

The log:

2018-03-25 18:41:45,955 INFO [web.site.EditionInterceptor] [http-apr-8080-exec-1] Successfully retrieved license information from Alfresco.
2018-03-25 18:41:49,453 DEBUG [alfresco.behavior.OnUpdateReadScan] [http-apr-8080-exec-2] NodeRef Id: d6e590c9-63b8-478f-9980-fc66418baad2
2018-03-25 18:41:49,464 ERROR [alfresco.services.AntivirusServiceImpl] [http-apr-8080-exec-2] Property alfviral.file.only_or_exceptions not is 'only' or 'exceptions'
2018-03-25 18:42:22,778 INFO [web.scripts.SyncModeConfig] [http-apr-8080-exec-1] Successfully retrieved Sync Mode configuration from Alfresco: OFF
2018-03-25 18:43:49,742 DEBUG [alfresco.behavior.OnUpdateReadScan] [http-apr-8080-exec-4] NodeRef Id: 51f48a46-2bc4-4088-88d8-fdea52837466
2018-03-25 18:43:49,744 DEBUG [alfresco.services.AntivirusServiceImpl] [http-apr-8080-exec-4] com.fegor.alfresco.services.AntivirusServiceImpl: [NodeRef: 51f48a46-2bc4-4088-88d8-fdea52837466]
2018-03-25 18:43:49,745 DEBUG [alfresco.services.AntivirusServiceImpl] [http-apr-8080-exec-4] com.fegor.alfresco.services.AntivirusServiceImpl: [File: /opt/alfresco-content-services/alf_data/contentstore/2018/3/25/18/43/14af3c32-b92d-42c3-8bd8-b6fee7045a2e.bin]
2018-03-25 18:43:49,746 DEBUG [alfresco.services.AntivirusServiceImpl] [http-apr-8080-exec-4] com.fegor.alfresco.services.AntivirusServiceImpl: [Type: application/octet-stream]
2018-03-25 18:43:49,746 DEBUG [alfresco.services.AntivirusServiceImpl] [http-apr-8080-exec-4] com.fegor.alfresco.services.AntivirusServiceImpl: [Mode: COMMAND]
2018-03-25 18:43:49,747 DEBUG [security.antivirus.CommandScan] [http-apr-8080-exec-4] Command: [/usr/bin/clamscan, /opt/alfresco-content-services/alf_data/contentstore/2018/3/25/18/43/14af3c32-b92d-42c3-8bd8-b6fee7045a2e.bin]
2018-03-25 18:43:49,759 INFO [security.antivirus.CommandScan] [http-apr-8080-exec-4] com.fegor.alfresco.security.antivirus.CommandScan: [Aspect SCANNED_FROM_COMMAND assigned for 51f48a46-2bc4-4088-88d8-fdea52837466]
2018-03-25 18:43:49,760 INFO [alfresco.services.AntivirusServiceImpl] [http-apr-8080-exec-4] com.fegor.alfresco.services.AntivirusServiceImpl: [ALERT File: store://2018/3/25/18/43/14af3c32-b92d-42c3-8bd8-b6fee7045a2e.bin is infected!]
2018-03-25 18:43:51,295 INFO [alfresco.services.AntivirusServiceImpl] [http-apr-8080-exec-4] com.fegor.alfresco.services.AntivirusServiceImpl: [Sending notify mail notify of infected to admin@alfresco.com]

Please, can you testing with a bash's script?

For example:

vim /usr/local/bin/custom-clamscan.sh

With:

/usr/bin/clamscan $1

chmod 744 /usr/local/bin/custom-clamscan.sh

And use this in:

alfviral.command.exec=/usr/local/bin/custom-clamscan.sh

Best regards,

Fegor

[ayushi_agrahari]

Fernando González‌

Hi fegor,

Thanks for testing this.I will test this with the script approach that u have told and let u know the results.can u also tell me why the clamscan is running on parameter $1 as I am new to scripting.

but can u also test it by uploading a file of mimetype application/x-dosexec which is not virus infected and putting the logs logger.debug("+++the value of res is+++"+res) and plz let me know the results.

Best regards

Ayushi Agrahari