Re: [Dazuko-help] Dazuko doesn't fire in cron job?

[John Ogness]

On 2009-01-26, Kevin Keane <address@hidden> wrote:
>> Neither creating the file nor deleting it involve "accessing" the
>> contents.
>
> That surprises me a little, since I'm writing the exact 68 bytes to
> a file, so I am accessing - creating - the content.

When you create the empty file, this will trigger an event. But while
reading/writing, Dazuko is not interested. Think of it like the UNIX
permissions. They only play a role at the time the file is opened.

> BTW, I did configure Clamuko to check on both open and close:
> ClamukoScanOnOpen yes
> ClamukoScanOnClose yes

Although ClamAV might offer a scan-on-close option, Dazuko may not. It
depends on how Dazuko was configured/compiled.

> OnOpen obviously couldn't catch the virus, but I would have thought
> that the OnClose would catch the virus.

If Dazuko supports it, you are correct.

> Sorry, I gave you the wrong message. The actual message is
> "Operation not permitted".
>
> When I stop the clamd daemon, deleting the file succeeds, so I'm
> fairly confident that it is indeed Dazuko that fires, and ClamAV
> that prevents the deletion.

Dazuko can also be configured to support catching delete events. But I
doubt that is what we are seeing.

To be sure, I recommend running the example program included in the
Dazuko package. It is pretty easy to get it up and running:

$ wget http://dazuko.dnsalias.org/files/dazuko-2.3.5.tar.gz
$ tar xzvf dazuko-2.3.5.tar.gz
$ cd dazuko-2.3.5
$ ./configure --without-module
$ cd example_c
$ make
# ./example /some/test/directory

(Note the example program probably needs to run as root.)

Then, you can play with files in the test directory and observe what
kinds of events Dazuko is generating.

John Ogness

-- 
Dazuko Maintainer