clamav: avoiding false positives for large files

This document (000020324) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server 15 for SAP
SUSE Linux Enterprise Server 12 for SAP
CLAMAV

Situation

clamav by default is not scanning files exceeding various limits like sizes, or recursion depths, reporting them as OK.
A change of default is not easy, as clamav has no reporting of “SKIPPED” files during scans, only “OK” or “FOUND” (potentially) infected.

Resolution

SUSE is working with upstream to implement better reporting of "SKIPPED" files.

Cause

The current default settings for the clamav virus scan engine in the clamscan commandline tool and the clamd scan daemon are set in a way that:

Files and archives are scanned, but only up to the configured or default limits for size, nesting level, scan time, etc.
The scan engine reports these files as being "OK"
This could potentially allow attackers to bypass the virus scanning

The reason for the size and other limitations are that such files could cause a denial of service against the virus scanner.
The reason clamav is showing "OK" is that the clamav interfaces do not have a concept of "skipped" or "ignored" files at this time.

Alerts can be enabled for these cases:

using --alert-exceeds-max=yes in the clamscan commandline
via "AlertExceedsMax TRUE" in clamd.conf for daemon based scans.

However setting this option will cause a FOUND report of status type "Heuristics.Limits.Exceeded" to be reported for files exceeding the limits, which will need to be handled differently in front-ends or processing of reports. So before enabling the alert, ensure that front-ends will not suddenly quarantine or remove those files, which can include ISOs, databases, etc.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

Document ID:000020324
Creation Date: 08-Jul-2021
Modified Date:09-Jul-2021
- SUSE Linux Enterprise Desktop
- SUSE Linux Enterprise Server
- SUSE Linux Enterprise Server for SAP Applications

< Back to Support Search

For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com