TheHive-Project / TheHive-Project/Cortex-Analyzers

[Bug] cortexneurons/clamav_fileinfo no clamd installed

Open
#1,079 3 comments 0 reactions 1 assignee View on GitHub

@jeromeleonard is already working on this.

Since Jan 26, 2022.

category:bug category:enhancement help wanted
Dominant language
Python
Stars
490
Forks
405
Avg merge
2d 43m
Merged PRs (30d)
8

Description

Describe the bug

The dockerized cortexneurons/clamav_fileinfo fails to scan with ClamAV. The error indicates either ClamD is not running or installed.

root@057dc1cabc74:/opt/cortex# docker run -it --rm --entrypoint bash cortexneurons/clamav_fileinfo:1
root@be1203e87504:/worker# /bin/sh -c ClamAV/pyclam_analyzer.py
Traceback (most recent call last):
  File "/worker/ClamAV/pyclam_analyzer.py", line 7, in <module>
    cd = pyclamd.ClamdUnixSocket()
  File "/usr/local/lib/python3.10/site-packages/pyclamd/pyclamd.py", line 709, in __init__
    raise ConnectionError('Could not find clamd unix socket from /etc/clamav/clamd.conf or /etc/clamd.conf')
pyclamd.pyclamd.ConnectionError: Could not find clamd unix socket from /etc/clamav/clamd.conf or /etc/clamd.conf

To Reproduce
Steps to reproduce the behavior:

  1. configure cortex to use docker analyzers
  2. enable the the clamav Analyzer
  3. try to scan a file.

Complementary information
Is there a way to resolve this locally on the dockerized container and have the changes stick? As it seems that If i try and resolve this (by installing ClamD and configuring) directly on the container, the changes get wiped when re-running the analyzer. (i assume this is due to it pulling a fresh server each time)

Also, what would be the best approach to using custom signature files when using the dockerized container? would it be best to simply map the signature location to the host? or would it be to add them on a customized clamav docker container?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.