[clamav-users] Quarantine Copy

[G.W. Haywood]

Hi there,

On Fri, 10 Mar 2017, Brad Scalio wrote:

> Is there a way to copy to quarantine directory if and only if the file to
> be copied and identified as a match against the VSD does not exist in the
> quarantine directory already either matching a hash or name or size?
> ...
> Sure we can exclude the quarantine path from clamscan but if someone knows
> that they can simply put things there to avoid the virus scanner.

Rather than adding more code (and potential ways to break everything) would
it not be better simply to restrict permissions on the quarantine directory
and - as you suggest - exclude it from the scan?  If a miscreant can write
to the locked-down quarantine directory then you _already_ have a problem,
with or without ClamAV, which needs to be fixed.

> Thanks much!!  And have a great Friday (or Saturday).

HTH.  You too.

-- 

73,
Ged.