include much needed antivirus products in FC2

[Enrico Scholz]

steve at silug.org (Steven Pritchard) writes:

>>   http://www.fedora.us/wiki/PackageDynamicUserCreationConsideredBad
> ...
> So the argument is that packages create new user accounts, then remove
> them when the package is installed, leaving files that could be owned
> by some other user later, right?

Since I am working a lot with chroot environments and shared filesystems
the second point there is a big problem also. It is annoying to have the
same user with different uids on a system...


> Well *why* would you remove a system user account?

Most packagess are doing it and it seems to be reasonably for package
management (same system state before and after package installation +
removal). I know statements from Red Hat that users should not be
deleted, but

a) their own packages are doing it
b) there are no official policies (which can e.g. be used to argument
   bugreports for a) packages)


>> Hey... when I install a '-server' subpackage, I expect that I have to
>> learn how it works and which security implications it has. So 30-60
>> minutes should be planned for it.
>
> I expect that a -server package can be enabled with "chkconfig --level
> 2345 $service on".  Besides, in this case, all you need to do is let
> clamd run as its own user, with a writable socket file.

Writable for whom? For 'clamd' only would not make sense, world-writable
is a huge security risk: user A could gain information about user B by
scanning his files. DOS attacks are possible also: users should not be
able to shutdown system services with a simple 'QUIT' command.

I played some time with a group-writable socket, but got lost in a
bunch of conflicting group-definitions. Perhaps ACL's can solve this,
but they are not available yet. The security problems mentioned above
are a problem also (e.g. squid-service should not be able to read
mailserver files).

Therefore, one clamd server per service (mailscanner, squid, ...) is
the only installation which makes sense; a system-wide clamd is not
possible.



Enrico