[clamav-users] ClamAV 0.100.1 - clamd signal 11, leaves unix domain socket behind?

[Karl Pielorz]

--On 24 September 2018 11:31 +0100 Mark Fortescue 
<mark.lists at thurning-instruments.co.uk> wrote:

> Hi Micah,
>
> Can you not have a two part demon process. Part one fork's the real demon
> and then waits for it to die (with 'wait()').
> On death of the child, it cleans up and exits. Yes I know it is not quite
> as simple as that. It will have to have signal handlers etc. to kill the
> child etc. and should also have logging.

Anything which fixes the issue (and this sounds like it would) gets my 
vote. I think it's compounded by the fact that clamd doesn't offer up any 
connection 'banner' or anything - i.e. for the local unix domain socket you 
connect, and push data - that's it. It's not like you connect, wait for 
'greeting' - then send data.

This also makes it hard to implement timeouts.  I'm currently looking at 
something that will check clamd is running, before the connect (i.e. PID 
wise) - but that, or "running it from another script" are all kind of 
band-aids - compared to something like the above...

fwiw - Hacking a sigsegv handler into it to remove the file, seemed to work 
- but that's a very specific "hack", again, compared to the above (and 
means we have to build from source + patch, not pkg on FreeBSD)

-Kp