procmail
[Top] [All Lists]

Re: [pro] Re: Real Virus Scanner

2004-02-13 11:07:09
On Fri, Feb 13, 2004 at 04:58:00PM +0100, Kai Weber wrote:
* Dallman Ross <dman(_at_)nomotek(_dot_)com>:

:0 wb
* 9876543210^0  ^Content-Type:.*(attachment|multipart)
* 9876543210^0  ^Content-.*[.]
 SC_OUT=| clamscan --disable-summary --infected --stdout -

I tried to test you recipe. I don't understand, why variable SC_OUT is
assigned to nothing:

procmail: Executing 
"/usr/bin/clamscan,--disable-summary,--infected,--stdout,-"
procmail: Assigning "SC_OUT="

The following recipe works. Any hints? Has it something todo with the w
and b flags?

:0
SC_OUT=| clamscan --disable-summary --infected --stdout -

It would be the b flag.  I bet your recipe *doesn't* work, though.
I suspect it is running through clamscan, but coming up as
no infection, because you are not using the --mbox option,
yet you are feeding the pipe a mail message with a header.

On the command line (where I can run clamscan with fewer
problems on my system for testing), running clamscan on
a mail message without specifying the --mbox options give
an exit code of zero; however, viruses will not be seen.
Clamscan is actually only looking at the header in that case,
and ignoring the body.

My tentative conclusions are that clamscan is very sensitive
about compile issues and does not always work properly on
all systems when it is fed stdin.  Try this, as a test:

 :0 w  # go ahead and try the w flag
 SC_OUT=| clamscan --disable-summary --mbox --infected --stdout -
#....................................^^^^^^
  
-- 
dman

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail