inotify.cxx

   1 /*
   2  * inoclam - Inotify+ClamAV virus scanner
   3  * Copyright (C) 2007 Vermont Department of Taxes
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program; if not, write to the Free Software
  17  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  18  *
  19  * Contributor(s):
  20  *   Tom Cort <tom.cort@state.vt.us>
  21  */
  22
  23 #include <errno.h>
  24 #include <idn-int.h>
  25 #include <inotifytools/inotifytools.h>
  26 #include <inotifytools/inotify.h>
  27 #include <libdaemon/dlog.h>
  28 #include <stdlib.h>
  29 #include <string.h>
  30 #include <unistd.h>
  31
  32 #include "clam.hxx"
  33 #include "inotify.hxx"
  34 #include "signal.hxx"
  35 #include "smtp.hxx"
  36
  37 /**
  38  * The directory that inoclam should watch
  39  */
  40 char *watch_dir;
  41
  42 /**
  43  * Grant permission to inoclam to delete infected files by setting this
  44  * to true or false
  45  */
  46 cfg_bool_t virus_removal_enabled;
  47
  48 /**
  49  * Initializes inotify and tells it to 'watch' basedir.
  50  * @param basedir the directory to watch.
  51  * @return 1 for OK, -1 for failure.
  52  */
  53 static int __inotify_init(char *basedir)
  54 {
  55         if (!inotifytools_initialize() || !inotifytools_watch_recursively(basedir, IN_ALL_EVENTS)) {
  56                 if (inotifytools_error() == ENOENT) {
  57                         daemon_log(LOG_ERR, "(%s:%u) watch_dir '%s' does not exist. Check /etc/inoclam.conf", __FILE__, __LINE__, watch_dir);
  58                 } else {
  59                         daemon_log(LOG_ERR, "(%s:%u) Failed init inotify: %s", __FILE__, __LINE__, strerror(inotifytools_error()));
  60                 }
  61                 return -1;
  62         } else {
  63                 /* daemon_log(LOG_DEBUG, "(%s:%u) init inotify", __FILE__, __LINE__); */
  64                 return 1;
  65         }
  66 }
  67
  68 /**
  69  * Free resources used by inotify
  70  */
  71 static void __inotify_exit()
  72 {
  73         inotifytools_cleanup();
  74 }
  75
  76 /**
  77  * Watch the specified directory for changes and call contains_virus()
  78  * @param basedir the directory to watch.
  79  */
  80 void inotify_main(char *basedir)
  81 {
  82         struct inotify_event *event;
  83         char *filename;
  84         int length;
  85
  86         event = NULL;
  87         filename = NULL;
  88         length = 0;
  89
  90         if (basedir == NULL || __inotify_init(basedir) == -1) {
  91                 exit_now = 1;
  92                 return;
  93         }
  94
  95         daemon_log(LOG_INFO, "(%s:%u) inotify watching '%s'", __FILE__, __LINE__, basedir);
  96
  97         while (!exit_now && (event = inotifytools_next_event(-1))) {
  98                 if (event && event->name && event->wd) {
  99                         length = strlen(inotifytools_filename_from_wd(event->wd)) + strlen(event->name) + 2;
 100                         filename = (char *) malloc(sizeof(char) * length);
 101                         if (!filename) {
 102                                 daemon_log(LOG_ERR, "(%s:%u) malloc() Failed: %s", __FILE__, __LINE__, strerror(errno));
 103                                 exit_now = 1;
 104                                 return;
 105                         }
 106                         memset(filename, '\0', length);
 107
 108                         snprintf(filename, length - 1, "%s%s", inotifytools_filename_from_wd(event->wd), event->name);
 109
 110                         if ((event->mask & (IN_CLOSE_WRITE | IN_MOVED_TO)) && !(event->mask & IN_ISDIR)) {
 111                                 /*
 112                                  * Scan writtable files that are being closed.
 113                                  * Scan files that have been moved to a watched directory.
 114                                  * TODO: run the switch statement and scan in a new thread. (make sure filename is safely free()'d).
 115                                  */
 116                                 switch (contains_virus(filename)) {
 117                                 case 1:
 118                                         /* virus found */
 119                                         if (virus_removal_enabled == cfg_true) {
 120                                                 unlink(filename);
 121                                         }
 122
 123                                         if (smtp_enabled == cfg_true) {
 124                                                 /* TODO: add more message text. what virus was found, date/time, user */
 125                                                 smtp_send(filename);
 126                                         }
 127                                         break;
 128                                 case 0:
 129                                         /* no virus detected */
 130                                         break;
 131                                 default:
 132                                         daemon_log(LOG_ERR, "(%s:%u) Scan Failed", __FILE__, __LINE__);
 133                                         break;
 134                                 }
 135                         } else if ((event->mask & (IN_CREATE | IN_MOVED_TO | IN_DELETE)) && (event->mask & IN_ISDIR)) {
 136                                 /*
 137                                  * If the directory structure has changed, reload the watch list.
 138                                  * Benchmark this to determine if this is too much of a performance hit.
 139                                  */
 140                                 __inotify_exit();
 141                                 __inotify_init(basedir);
 142                         }
 143
 144                         if (filename) {
 145                                 free(filename);
 146                                 filename = NULL;
 147                         }
 148                 }
 149         }
 150
 151         __inotify_exit();
 152 }