TheHive-Project / TheHive-Project/Cortex-Analyzers
[Bug] cortexneurons/clamav_fileinfo no clamd installed
@jeromeleonard is already working on this.
Since Jan 26, 2022.
- Dominant language
- Python
- Stars
- 490
- Forks
- 405
- Avg merge
- 2d 43m
- Merged PRs (30d)
- 8
Description
Describe the bug
The dockerized cortexneurons/clamav_fileinfo fails to scan with ClamAV. The error indicates either ClamD is not running or installed.
root@057dc1cabc74:/opt/cortex# docker run -it --rm --entrypoint bash cortexneurons/clamav_fileinfo:1
root@be1203e87504:/worker# /bin/sh -c ClamAV/pyclam_analyzer.py
Traceback (most recent call last):
File "/worker/ClamAV/pyclam_analyzer.py", line 7, in <module>
cd = pyclamd.ClamdUnixSocket()
File "/usr/local/lib/python3.10/site-packages/pyclamd/pyclamd.py", line 709, in __init__
raise ConnectionError('Could not find clamd unix socket from /etc/clamav/clamd.conf or /etc/clamd.conf')
pyclamd.pyclamd.ConnectionError: Could not find clamd unix socket from /etc/clamav/clamd.conf or /etc/clamd.conf
To Reproduce
Steps to reproduce the behavior:
- configure cortex to use docker analyzers
- enable the the clamav Analyzer
- try to scan a file.
Complementary information
Is there a way to resolve this locally on the dockerized container and have the changes stick? As it seems that If i try and resolve this (by installing ClamD and configuring) directly on the container, the changes get wiped when re-running the analyzer. (i assume this is due to it pulling a fresh server each time)
Also, what would be the best approach to using custom signature files when using the dockerized container? would it be best to simply map the signature location to the host? or would it be to add them on a customized clamav docker container?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.