inotify.c

   1 /*
   2  * inoclam - Inotify+ClamAV virus scanner
   3  * Copyright (C) 2007 Vermont Department of Taxes
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program; if not, write to the Free Software
  17  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  18  *
  19  * Contributor(s):
  20  *   Tom Cort <tom.cort@state.vt.us>
  21  */
  22
  23 #include <errno.h>
  24 #include <idn-int.h>
  25 #include <inotifytools/inotifytools.h>
  26 #include <inotifytools/inotify.h>
  27 #include <libdaemon/dlog.h>
  28 #include <stdlib.h>
  29 #include <string.h>
  30
  31 #include "inotify.h"
  32 #include "sig.h"
  33
  34 int __inotify_init(char *basedir)
  35 {
  36         if (!inotifytools_initialize() || !inotifytools_watch_recursively(basedir, IN_ALL_EVENTS)) {
  37                 daemon_log(LOG_ERR, "(%s:%u) Failed init inotify: %s", __FILE__, __LINE__, strerror(inotifytools_error()));
  38                 return -1;
  39         } else {
  40                 /* daemon_log(LOG_DEBUG, "(%s:%u) init inotify", __FILE__, __LINE__); */
  41                 return 1;
  42         }
  43 }
  44
  45 int __inotify_exit()
  46 {
  47         inotifytools_cleanup();
  48         return 1;
  49 }
  50
  51 /**
  52  * Watch the specified directory for changes and call contains_virus()
  53  * @param basedir the directory to watch.
  54  */
  55 void inotify_main(char *basedir)
  56 {
  57         struct inotify_event *event;
  58         char *filename;
  59         int length;
  60
  61         event = NULL;
  62         filename = NULL;
  63         length = 0;
  64
  65         if (basedir == NULL || __inotify_init(basedir) == -1) {
  66                 exit_now = 1;
  67                 return;
  68         }
  69
  70         daemon_log(LOG_INFO, "(%s:%u) inotify watching '%s'", __FILE__, __LINE__, basedir);
  71
  72         while (!exit_now && (event = inotifytools_next_event(-1))) {
  73                 if (event && event->name && event->wd) {
  74                         length = strlen(inotifytools_filename_from_wd(event->wd)) + strlen(event->name) + 2;
  75                         filename = (char *) malloc(sizeof(char) * length);
  76                         if (!filename) {
  77                                 daemon_log(LOG_ERR, "(%s:%u) malloc() Failed: %s", __FILE__, __LINE__, strerror(errno));
  78                                 exit_now = 1;
  79                                 return;
  80                         }
  81                         memset(filename, '\0', length);
  82
  83                         snprintf(filename, length - 1, "%s%s", inotifytools_filename_from_wd(event->wd), event->name);
  84
  85                         if ((event->mask & (IN_CLOSE_WRITE | IN_MOVED_TO)) && !(event->mask & IN_ISDIR)) {
  86                                 /*
  87                                  * Scan writtable files that are being closed.
  88                                  * Scan files that have been moved to a watched directory.
  89                                  * TODO: run the switch statement and scan in a new thread. (make sure filename is safely free()'d).
  90                                  * TODO: optional e-mail notification when viruses are found.
  91                                  * TODO: make unlink() optional.
  92                                  */
  93                                 switch (contains_virus(filename)) {
  94                                 case 1:
  95                                         /* virus found */
  96                                         unlink(filename);       /* remove without prejudice */
  97                                         break;
  98                                 case 0:
  99                                         /* no virus detected */
 100                                         break;
 101                                 default:
 102                                         daemon_log(LOG_ERR, "(%s:%u) Scan Failed", __FILE__, __LINE__);
 103                                         break;
 104                                 }
 105                         } else if ((event->mask & (IN_CREATE | IN_MOVED_TO | IN_DELETE)) && (event->mask & IN_ISDIR)) {
 106                                 /*
 107                                  * If the directory structure has changed, reload the watch list.
 108                                  * Benchmark this to determine if this is too much of a performance hit.
 109                                  */
 110                                 __inotify_exit();
 111                                 __inotify_init(basedir);
 112                         }
 113
 114                         if (filename) {
 115                                 free(filename);
 116                                 filename = NULL;
 117                         }
 118                 }
 119         }
 120
 121         __inotify_exit();
 122 }