ClamdScanOnAccess.wrapper

#!/bin/sh
#
# MacPorts daemondo support script
#

#
# Init
#
prefix=/opt/local

pidfile="${prefix}/var/run/clamav/clamdscanonaccess.pid"

# Default: use clamdscan if clamd is running; otherwise:
# clamscan with an explicit configuration imported from ${prefix}/etc/clamd.conf
CLAMD_CONF="${prefix}/etc/clamd.conf"
IFS=$'\n'
CROSS_FS=(`/usr/bin/egrep -e '^[[:space:]]*CrossFilesystems\b' $CLAMD_CONF | /usr/bin/sed -E -e 's/^[[:space:]]*CrossFilesystems[[:space:]]+/--cross-fs=/'`)
FOLLOW_DIR_SYMLINKS=(`/usr/bin/egrep -e '^[[:space:]]*FollowDirectorySymlinks\b' $CLAMD_CONF | /usr/bin/sed -E -e 's/^[[:space:]]*FollowDirectorySymlinks[[:space:]]+/--follow-dir-symlinks=/'`)
FOLLOW_FILE_SYMLINKS=(`/usr/bin/egrep -e '^[[:space:]]*FollowFileSymlinks\b' $CLAMD_CONF | /usr/bin/sed -E -e 's/^[[:space:]]*FollowFileSymlinks[[:space:]]+/--follow-file-symlinks=/'`)
EXCLUDE_PATH=(`/usr/bin/egrep -e '^[[:space:]]*ExcludePath\b' $CLAMD_CONF | /usr/bin/sed -E -e 's/^[[:space:]]*ExcludePath[[:space:]]+/--exclude=/'`)
DETECT_PUA=(`/usr/bin/egrep -e '^[[:space:]]*DetectPUA\b' $CLAMD_CONF | /usr/bin/sed -E -e 's/^[[:space:]]*DetectPUA[[:space:]]+/--detect-pua=/'`)
EXCLUDE_PUA=(`/usr/bin/egrep -e '^[[:space:]]*ExcludePUA\b' $CLAMD_CONF | /usr/bin/sed -E -e 's/^[[:space:]]*ExcludePUA[[:space:]]+/--exclude-pua=/'`)
INCLUDE_PUA=(`/usr/bin/egrep -e '^[[:space:]]*IncludePUA\b' $CLAMD_CONF | /usr/bin/sed -E -e 's/^[[:space:]]*IncludePUA[[:space:]]+/--include-pua=/'`)

#
# Start
#
Start()
{
    CLAMDSCAN_QUARANTINE=/opt/Quarantine
    CLAMDSCANONACCESS_LOG=${prefix}/var/log/clamav/clamdscanonaccess.log
    IFS=$'\n'
    USER_HOMEDIRS=(`/usr/bin/dscacheutil -q user | /usr/bin/grep -A 3 -B 2 -E -e '^uid: (?:\d*5\d\d|\d{4,})' | ${prefix}/bin/pcregrep -B 5 -e '^shell: (?!/usr/bin/false).*' | ${prefix}/bin/pcregrep -A 5 -e '^name: (?!_).*' | /usr/bin/grep -e '^dir: .*/Users/' | /usr/bin/sed -e 's/^dir: //'`)
    USER_DOWNLOADSDIRS=(`for d in ${USER_HOMEDIRS[@]}; do echo $d"/Downloads" ; done`)
    USER_DESKTOPDIRS=(`for d in ${USER_HOMEDIRS[@]}; do echo $d"/Desktop" ; done`)

    [ -d $CLAMDSCAN_QUARANTINE ] || /bin/mkdir -p $CLAMDSCAN_QUARANTINE
    [ -d ${CLAMDSCANONACCESS_LOG%/*} ] || /bin/mkdir -p ${CLAMDSCANONACCESS_LOG%/*}
    ( echo "Launch daemon org.macports.clamdscanonaccess started on `/bin/date` …" ; echo "Watched directories:" ) >> $CLAMDSCANONACCESS_LOG
    ( for d in ${USER_DOWNLOADSDIRS[@]}; do echo "\t$d"; done ) >> $CLAMDSCANONACCESS_LOG
    ( for d in ${USER_DESKTOPDIRS[@]}; do echo "\t$d"; done ) >> $CLAMDSCANONACCESS_LOG
    echo $$ > ${pidfile}
    ${prefix}/bin/fswatch -0 -l 3 -e '/.DS_Store$' -r "${USER_DOWNLOADSDIRS[@]}" "${USER_DESKTOPDIRS[@]}" \
        | while read -d "" event ; \
          do \
              echo "Scanning $event on `/bin/date`…" >> $CLAMDSCANONACCESS_LOG ; \
              ! [ "`/usr/bin/pgrep -u root clamd`" == "" ] \
                && ( /usr/bin/nice -n 5 ${prefix}/bin/clamdscan --multiscan --quiet --fdpass --move=$CLAMDSCAN_QUARANTINE --log=$CLAMDSCANONACCESS_LOG "$event" \
                         && echo "Done clamdscan $event on `/bin/date`." >> $CLAMDSCANONACCESS_LOG \
                             || echo "clamdscan exited with error code $? on `/bin/date`." >> $CLAMDSCANONACCESS_LOG ) \
                || ( /usr/bin/nice -n 5 ${prefix}/bin/clamscan --infected --quiet --move=$CLAMDSCAN_QUARANTINE --log=$CLAMDSCANONACCESS_LOG \
                             "${CROSS_FS[@]}" "${FOLLOW_DIR_SYMLINKS[@]}" "${FOLLOW_FILE_SYMLINKS[@]}" "${EXCLUDE_PATH[@]}" "${DETECT_PUA[@]}" "${EXCLUDE_PUA[@]}" "${INCLUDE_PUA[@]}" "$event" \
                         && echo "Done clamscan $event on `/bin/date`." >> $CLAMDSCANONACCESS_LOG \
                             || echo "clamscan exited with error code $? on `/bin/date`." >> $CLAMDSCANONACCESS_LOG ) ; \
          done
}

#
# Stop
#
Stop()
{
    if [ -f ${pidfile} ]; then
	/usr/bin/kill `cat ${pidfile}` && /bin/rm -f ${pidfile}
    else
        /usr/bin/kill -SIGUSR1 `/usr/bin/pgrep -u root fswatch` 2>/dev/null
    fi
}

#
# Restart
#
Restart()
{
    Stop
    Start
}

#
# Run
#
Run()
{
case $1 in
  start  ) Start   ;;
  stop   ) Stop    ;;
  restart) Restart ;;
  *      ) echo "$0: unknown argument: $1";;
esac
}

#
# Run a phase based on the selector
#
Run $1