Scan files with clamdscan #77

Anna Sirota · 2024-04-11T19:31:32+02:00

Anna Sirota commented

2024-04-11 19:31:32 +02:00

What this does

Internally

scans each newly created file with clamavd client (requires clamavd daemon running);
saves the result as a FileValidation record;

clamdscan is called in a background task, so no scanning will happen unless ./manage.py process_tasks is running.

In the admin

shows all scan results in the files.File admin;
allows filtering "OK" and "not OK" files in the admin as marked by the result of the scan;
allows manually triggering the scan for selected files with admin action;

In the front-end

displays an alert to moderators and to staff accounts with "view File" (files.view_file) permission;
additionally, displays a link to the File admin page for staff accounts with relevant permissions (being in moderators group is not enough).

Screenshots

Scan statuses in admin's list of files:

Scan results inlined in File's admin:

Custom action in the admin

Warning shown to staff accounts with a "view File" permission:

Flag in the approval queue

Also only shown to staff accounts with a "view File" permission

TODO

run in a background task
show a visually alarming flag in the approval queue, when scanner finds something
playbooks for configuring clamavd

### What this does #### Internally * scans each newly created file with clamavd client (requires clamavd daemon running); * saves the result as a `FileValidation` record; `clamdscan` is called in a background task, so no scanning will happen unless `./manage.py process_tasks` is running. #### In the admin * shows all scan results in the `files.File` admin; * allows filtering "OK" and "not OK" files in the admin as marked by the result of the scan; * allows manually triggering the scan for selected files with admin action; #### In the front-end * displays an alert to moderators and to staff accounts with "view File" (`files.view_file`) permission; * additionally, displays a link to the `File` admin page for staff accounts with relevant permissions (being in moderators group is not enough). ### Screenshots #### Scan statuses in admin's list of files: ![3](https://projects.blender.org/attachments/efa61313-f5df-4b7e-ab70-8365d1a11938) ![2](https://projects.blender.org/attachments/d8a03f82-bc10-4568-a4e1-352928e05317) #### Scan results inlined in File's admin: ![4](https://projects.blender.org/attachments/ff4adc4b-43d7-4004-ba31-9676770e4c4b) #### Custom action in the admin ![2222](https://projects.blender.org/attachments/c0b4dec5-aef2-4b0f-824b-4ec30fc87ad2) #### Warning shown to staff accounts with a "view File" permission: ![1](https://projects.blender.org/attachments/8acc4b25-edd9-4380-9e18-e1ff8fce8790) #### Flag in the approval queue Also only shown to staff accounts with a "view File" permission ![1111](https://projects.blender.org/attachments/5b2db65d-4066-42f0-9c40-be0b03c5f39b) #### TODO - [x] run in a background task - [x] show a visually alarming flag in the approval queue, when scanner finds something - [x] playbooks for configuring clamavd

2024-04-12-170326_1528x626_scrot.png

109 KiB

2024-04-12-172519_1920x1080_scrot_.png

272 KiB

2024-04-12-170214_1532x627_scrot.png

109 KiB

2024-04-12-173658_1371x312_scrot.png

51 KiB

2024-04-12-174423_1920x1080_scrot.png

66 KiB

2024-04-12-170145_1236x350_scrot.png

44 KiB

Anna Sirota added 1 commit 2024-04-11 19:31:37 +02:00

Scan a file with clamdscan b1441511b6

Anna Sirota added the

Type

Enhancement

label 2024-04-11 19:32:55 +02:00

Anna Sirota added 1 commit 2024-04-12 12:27:44 +02:00

Background tasks for the scan 9f7c917e23

Anna Sirota added 1 commit 2024-04-12 12:30:21 +02:00

Minor changes da1522599e

Anna Sirota added 3 commits 2024-04-12 14:25:23 +02:00

More logging d04ce7b3ad

Admin action for scanning selected files bd1d6acc52

Playbooks: packages for clamav daemon and client fc8100b9ae

Use
    ./ansible.sh -i environments/staging install.yaml --diff --tags=deps
    ./ansible.sh -i environments/production install.yaml --diff --tags=deps

to install these on staging/production.

Anna Sirota added 3 commits 2024-04-12 17:53:15 +02:00

Wording 21b74c28af

Remove unused utility copy-pasta b143091ccf

Show scan-related alerts in various places 57bc866b2f

Anna Sirota changed title from ~~WIP: Scan a file with clamdscan~~ to Scan a file with clamdscan

2024-04-12 17:53:42 +02:00

Anna Sirota added 1 commit 2024-04-12 17:54:30 +02:00

Merge branch 'main' into scan-file cd09243567

Anna Sirota added 1 commit 2024-04-12 17:58:47 +02:00

Remove unused property 3a1877cb7e

Anna Sirota added 1 commit 2024-04-12 18:07:02 +02:00

Name task accordingly 1cdabee214