bastian+security.clamav at collax
Aug 11, 2008, 4:42 AM
Post #1 of 1
Origins of "VirusEvent" events
I have a need to differentiate between "regular scanning" and "dazuko" events
for scripts run through the "VirusEvent" mechanism. The C function that is
finally called, "virusaction()", does currently not know about its
The attached (trivial) patch adds an additional argument "initiator" to
virusaction(); all calling instances pass an informative string (dir, file,
multifile, stream, dazuko) which is put in the environment
I'm unsure about good names for various entities, especially about the name
for the env var (_INITIATOR, _ORIGIN, _TYPE, _SCANNER, ...?).
Feel free to use.
Patch applies to 0.93.3
Collax GmbH . Burkheimer Straße 3 . 79111 Freiburg . Germany
p: +49 (0) 761-45684-24
f: +49 (0) 761-45684-10 www.collax.com
Geschäftsführer: William K. Hite / Boris Nalbach
AG München HRB 158898 . Ust.-IdNr: DE 814464942
\ The Majority is never right unless it includes me.