chore: Update clamav 1 4 6 (#1947)

* chore: Update ClamAV to version 1.4.6 and adjust configurations

* feat: Add run.sh to stream ClamAV logs to stdout and update configuration files

* fix: make the configmap the source of truth

this change makes the helm's configmap the source of truth while still working locally with docker run testing

* chore: bump version for clamav chart

Author: jasonchung1871

clamav/Dockerfile

@@ -1,7 +1,7 @@
 FROM registry.access.redhat.com/ubi9/ubi
-ARG VERSION=1.4.5
+ARG VERSION=1.4.6
 
-LABEL name="ubi8-clamav" \
+LABEL name="ubi9-clamav" \
       vendor="Red Hat" \
       version="${VERSION}" \
       release="1" \
@@ -25,6 +25,10 @@ RUN chmod -R ug+rwx /opt/app-root/src
 COPY clamdcheck.sh /opt/app-root
 RUN chmod ug+rwx /opt/app-root/clamdcheck.sh
 
+# copy launcher script that tails log files to stdout
+COPY run.sh /opt/app-root/run.sh
+RUN chmod ug+rwx /opt/app-root/run.sh
+
 # # To fix check permissions error for clamAV
 RUN mkdir /var/log/clamav
 RUN touch /var/log/clamav/clamav.log
@@ -38,4 +42,4 @@ USER 1001
 
 EXPOSE 3310
 
-CMD freshclam && clamd
+CMD ["/opt/app-root/run.sh"]

clamav/charts/clamav/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: clamav
 description: Chart for deploying a Clam AV on kubernetes
 type: application
-version: 1.0.0
-appVersion: 1.0.5
+version: 1.0.1
+appVersion: 1.4.6
 keywords:
   - clamav
 maintainers:

clamav/charts/clamav/templates/configmap.yaml

@@ -19,7 +19,11 @@ data:
     # LogFile must be writable for the user running daemon.
     # A full path is required.
     # Default: disabled
-    LogFile /dev/stdout
+    # /dev/stdout is NOT used here: clamd's log-open logic fails to resolve
+    # it through OpenShift/CRI-O's symlink chain ("Too many levels of
+    # symbolic links"), crashing the container on startup. run.sh tails
+    # this file to stdout instead so logs remain visible in `oc logs`.
+    LogFile /var/log/clamav/clamav.log
 
     # By default the log file is locked for writing - the lock protects against
     # running clamd multiple times (if want to run another clamd, please
@@ -380,70 +384,70 @@ data:
     #
     # Default: no
     #HeuristicScanPrecedence yes
-    
-    
+
+
     ##
     ## Data Loss Prevention (DLP)
     ##
-    
+
     # Enable the DLP module
     # Default: No
     #StructuredDataDetection yes
-    
+
     # This option sets the lowest number of Credit Card numbers found in a file
     # to generate a detect.
     # Default: 3
     #StructuredMinCreditCardCount 5
-    
+
     # This option sets the lowest number of Social Security Numbers found
     # in a file to generate a detect.
     # Default: 3
     #StructuredMinSSNCount 5
-    
+
     # With this option enabled the DLP module will search for valid
     # SSNs formatted as xxx-yy-zzzz
     # Default: yes
     #StructuredSSNFormatNormal yes
-    
+
     # With this option enabled the DLP module will search for valid
     # SSNs formatted as xxxyyzzzz
     # Default: no
     #StructuredSSNFormatStripped yes
-    
-    
+
+
     ##
     ## HTML
     ##
-    
+
     # Perform HTML normalisation and decryption of MS Script Encoder code.
     # Default: yes
     # If you turn off this option, the original files will still be scanned, but
     # without additional processing.
     #ScanHTML yes
-    
-    
+
+
     ##
     ## Archives
     ##
-    
+
     # ClamAV can scan within archives and compressed files.
     # If you turn off this option, the original files will still be scanned, but
     # without unpacking and additional processing.
     # Default: yes
     #ScanArchive yes
-    
+
     # Mark encrypted archives as viruses (Encrypted.Zip, Encrypted.RAR).
     # Default: no
     #ArchiveBlockEncrypted no
-    
-    
+
+
     ##
     ## Limits
     ##
-    
+
     # The options below protect your system against Denial of Service attacks
     # using archive bombs.
-    
+
     # This option sets the maximum amount of data to be scanned for each input file.
     # Archives and other containers are recursively extracted and scanned up to this
     # value.
@@ -452,7 +456,7 @@ data:
     # to the system.
     # Default: 100M
     #MaxScanSize 150M
-    
+
     # Files larger than this limit won't be scanned. Affects the input file itself
     # as well as files contained inside it (when the input file is an archive, a
     # document or some other kind of container).
@@ -461,113 +465,113 @@ data:
     # to the system.
     # Default: 25M
     MaxFileSize {{.Values.clamav.limits.fileSize}}M
-    
+
     # Nested archives are scanned recursively, e.g. if a Zip archive contains a RAR
     # file, all files within it will also be scanned. This options specifies how
     # deeply the process should be continued.
     # Note: setting this limit too high may result in severe damage to the system.
     # Default: 16
     #MaxRecursion 10
-    
+
     # Number of files to be scanned within an archive, a document, or any other
     # container file.
     # Value of 0 disables the limit.
     # Note: disabling this limit or setting it too high may result in severe damage
     # to the system.
     # Default: 10000
     #MaxFiles 15000
-    
+
     # Maximum size of a file to check for embedded PE. Files larger than this value
     # will skip the additional analysis step.
     # Note: disabling this limit or setting it too high may result in severe damage
     # to the system.
     # Default: 10M
     #MaxEmbeddedPE 10M
-    
+
     # Maximum size of a HTML file to normalize. HTML files larger than this value
     # will not be normalized or scanned.
     # Note: disabling this limit or setting it too high may result in severe damage
     # to the system.
     # Default: 10M
     #MaxHTMLNormalize 10M
-    
+
     # Maximum size of a normalized HTML file to scan. HTML files larger than this
     # value after normalization will not be scanned.
     # Note: disabling this limit or setting it too high may result in severe damage
     # to the system.
     # Default: 2M
     #MaxHTMLNoTags 2M
-    
+
     # Maximum size of a script file to normalize. Script content larger than this
     # value will not be normalized or scanned.
     # Note: disabling this limit or setting it too high may result in severe damage
     # to the system.
     # Default: 5M
     #MaxScriptNormalize 5M
-    
+
     # Maximum size of a ZIP file to reanalyze type recognition. ZIP files larger
     # than this value will skip the step to potentially reanalyze as PE.
     # Note: disabling this limit or setting it too high may result in severe damage
     # to the system.
     # Default: 1M
     #MaxZipTypeRcg 1M
-    
+
     # This option sets the maximum number of partitions of a raw disk image to be scanned.
     # Raw disk images with more partitions than this value will have up to the value number
     # partitions scanned. Negative values are not allowed.
     # Note: setting this limit too high may result in severe damage or impact performance.
     # Default: 50
     #MaxPartitions 128
-    
+
     # This option sets the maximum number of icons within a PE to be scanned.
     # PE files with more icons than this value will have up to the value number icons scanned.
     # Negative values are not allowed.
     # WARNING: setting this limit too high may result in severe damage or impact performance.
     # Default: 100
     #MaxIconsPE 200
-    
+
     ##
     ## On-access Scan Settings
     ##
-    
+
     # Enable on-access scanning. Currently, this is supported via fanotify.
     # Clamuko/Dazuko support has been deprecated.
     # Default: no
     #ScanOnAccess yes
-    
+
     # Don't scan files larger than OnAccessMaxFileSize
     # Value of 0 disables the limit.
     # Default: 5M
     #OnAccessMaxFileSize 10M
-    
+
     # Set the include paths (all files inside them will be scanned). You can have
     # multiple OnAccessIncludePath directives but each directory must be added
     # in a separate line. (On-access scan only)
     # Default: disabled
     #OnAccessIncludePath /home
     #OnAccessIncludePath /students
-    
+
     # Set the exclude paths. All subdirectories are also excluded.
     # (On-access scan only)
     # Default: disabled
     #OnAccessExcludePath /home/bofh
-    
+
     # With this option you can whitelist specific UIDs. Processes with these UIDs
     # will be able to access all files.
     # This option can be used multiple times (one per line).
     # Default: disabled
     #OnAccessExcludeUID 0
-    
-    
+
+
     ##
     ## Bytecode
     ##
-    
+
     # With this option enabled ClamAV will load bytecode from the database.
     # It is highly recommended you keep this option on, otherwise you'll miss detections for many new viruses.
     # Default: yes
     #Bytecode yes
-    
+
     # Bytecode mode
     #
     # This option has been set to 'ForceInterpreter' in Fedora due to
@@ -577,7 +581,7 @@ data:
     #
     # Default: ForceInterpreter
     #ByteCodeMode ForceInterpreter
-    
+
     # Set bytecode security level.
     # Possible values:
     #       None - no security at all, meant for debugging. DO NOT USE THIS ON PRODUCTION SYSTEMS
@@ -591,34 +595,33 @@ data:
     #
     # Default: TrustSigned
     #BytecodeSecurity TrustSigned
-    
+
     # Set bytecode timeout in miliseconds.
     #
     # Default: 5000
     # BytecodeTimeout 1000
-    
+
     ##
     ## Statistics gathering and submitting
     ##
-    
+
     # Enable statistical reporting.
     # Default: no
     #StatsEnabled yes
-    
+
     # Disable submission of individual PE sections for files flagged as malware.
     # Default: no
     #StatsPEDisabled yes
-    
+
     # HostID in the form of an UUID to use when submitting statistical information.
     # Default: auto
     #StatsHostID auto
-    
+
     # Time in seconds to wait for the stats server to come back with a response
     # Default: 10
     #StatsTimeout 10
     TCPSocket 3310
 
-
   freshclam.conf: |
     ##
     ## Example config file for freshclam
@@ -635,7 +638,8 @@ data:
 
     # Path to the log file (make sure it has proper permissions)
     # Default: disabled
-    #UpdateLogFile /dev/stdout
+    # /dev/stdout is NOT used here, see clamd.conf's LogFile comment.
+    UpdateLogFile /var/log/clamav/freshclam.log
 
     # Maximum size of the log file.
     # Value of 0 disables the limit.

clamav/charts/clamav/values-dev.yaml

@@ -1,2 +1,6 @@
 nsp:
   environment: dev
+
+clamav:
+  # always re-pull :latest so helm upgrade can't reuse a stale cached image on the node
+  imagePullPolicy: Always

clamav/config/clamd.conf

@@ -10,7 +10,11 @@
 # LogFile must be writable for the user running daemon.
 # A full path is required.
 # Default: disabled
-LogFile /dev/stdout
+# /dev/stdout is NOT used here: clamd's log-open logic fails to resolve
+# it through OpenShift/CRI-O's symlink chain ("Too many levels of
+# symbolic links"), crashing the container on startup. run.sh tails
+# this file to stdout instead so logs remain visible in `oc logs`.
+LogFile /var/log/clamav/clamav.log
 
 # By default the log file is locked for writing - the lock protects against
 # running clamd multiple times (if want to run another clamd, please

clamav/config/freshclam.conf

@@ -13,7 +13,8 @@ DatabaseDirectory /opt/app-root/src
 
 # Path to the log file (make sure it has proper permissions)
 # Default: disabled
-#UpdateLogFile /dev/stdout
+# /dev/stdout is NOT used here, see clamd.conf's LogFile comment.
+UpdateLogFile /var/log/clamav/freshclam.log
 
 # Maximum size of the log file.
 # Value of 0 disables the limit.

clamav/run.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+set -e
+
+# Stream clamd/freshclam log files to stdout so they still show up in `oc logs`,
+# since writing directly to /dev/stdout crashes clamd (see clamd.conf).
+tail -F /var/log/clamav/clamav.log /var/log/clamav/freshclam.log &
+
+# Prefer Helm-mounted configs when present; fallback to image defaults for local runs.
+CLAMD_CONF=/etc/clamd.conf
+FRESHCLAM_CONF=/etc/freshclam.conf
+[ -f "$CLAMD_CONF" ] || CLAMD_CONF=/usr/local/etc/clamd.conf
+[ -f "$FRESHCLAM_CONF" ] || FRESHCLAM_CONF=/usr/local/etc/freshclam.conf
+
+freshclam --config-file="$FRESHCLAM_CONF"
+exec clamd --config-file="$CLAMD_CONF"