amadan
scanner-host: run the first freshclam with its packaged config (AppArmor denies any other)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2 files changed,
+18
−5
infra/modules/scanner-host/scanner-init.sh.tftpl+6 −5infra/modules/scanner-host/tests/scanner_host.tftest.hcl+12 −0
diff --git a/infra/modules/scanner-host/scanner-init.sh.tftpl b/infra/modules/scanner-host/scanner-init.sh.tftpl| index 2d8bad14a..0d4a3572f 100644 |
| --- a/infra/modules/scanner-host/scanner-init.sh.tftpl |
| +++ b/infra/modules/scanner-host/scanner-init.sh.tftpl |
| @@ -131,17 +131,18 @@ systemctl daemon-reload |
| # ---- 4. first signatures --------------------------------------------------- |
| say "4/6 first signatures" |
| -# NotifyClamd would complain that no clamd is running yet. It is not. |
| -sed '/^NotifyClamd/d' /etc/clamav/freshclam.conf > /run/freshclam-first.conf |
| +# The packaged config, unchanged. Debian's AppArmor profile confines freshclam |
| +# to its config under /etc/clamav, so a copy anywhere else cannot be read. With |
| +# clamd not running yet, the NotifyClamd step only warns, and freshclam still |
| +# exits 0. |
| # ClamAV's mirror often rate-limits a new address. Three tries, a minute apart. |
| tries=1 |
| -until freshclam --config-file=/run/freshclam-first.conf; do |
| - [ $tries -lt 3 ] || fail "first freshclam failed 3 times, 60s apart (rate-limited by ClamAV's mirror?)" |
| +until freshclam; do |
| + [ $tries -lt 3 ] || fail "first freshclam failed 3 times, 60s apart (rate-limited by ClamAV's mirror? an AppArmor denial shows in: journalctl -k | grep freshclam)" |
| say "freshclam try $tries failed, retrying in 60s" |
| tries=$((tries + 1)) |
| sleep 60 |
| done |
| -rm -f /run/freshclam-first.conf |
| for db in main daily bytecode; do |
| ls /var/lib/clamav/$db.c[vl]d >/dev/null 2>&1 || fail "no $db signature database after freshclam" |
| done |
diff --git a/infra/modules/scanner-host/tests/scanner_host.tftest.hcl b/infra/modules/scanner-host/tests/scanner_host.tftest.hcl| index 18047639f..4a2ae416c 100644 |
| --- a/infra/modules/scanner-host/tests/scanner_host.tftest.hcl |
| +++ b/infra/modules/scanner-host/tests/scanner_host.tftest.hcl |
| @@ -237,6 +237,18 @@ run "logging_cannot_kill_init" { |
| } |
| } |
| +run "freshclam_uses_its_packaged_config" { |
| + command = plan |
| + assert { |
| + condition = !strcontains(local.init_script, "freshclam --config-file") && !strcontains(local.init_script, "/run/freshclam") |
| + error_message = "Debian's AppArmor profile confines freshclam to its config under /etc/clamav: a config passed from anywhere else cannot be read and freshclam fails at once" |
| + } |
| + assert { |
| + condition = strcontains(local.init_script, "until freshclam; do") |
| + error_message = "the first signatures must come from plain freshclam with the packaged config" |
| + } |
| +} |
| + |
| run "another_vpc_needs_a_subnet" { |
| command = plan |
| override_data { |