pax_global_header 0000666 0000000 0000000 00000000064 14501645623 0014520 g ustar 00root root 0000000 0000000 52 comment=4733b638bbec1becd264a28f42cab85130381c6d
pg_snakeoil-1.4/ 0000775 0000000 0000000 00000000000 14501645623 0013657 5 ustar 00root root 0000000 0000000 pg_snakeoil-1.4/.github/ 0000775 0000000 0000000 00000000000 14501645623 0015217 5 ustar 00root root 0000000 0000000 pg_snakeoil-1.4/.github/workflows/ 0000775 0000000 0000000 00000000000 14501645623 0017254 5 ustar 00root root 0000000 0000000 pg_snakeoil-1.4/.github/workflows/regression.yml 0000664 0000000 0000000 00000002125 14501645623 0022157 0 ustar 00root root 0000000 0000000 name: Build
on: [push, pull_request]
jobs:
build:
runs-on: ubuntu-latest
defaults:
run:
shell: sh
strategy:
matrix:
pgversion:
- 16
- 15
- 14
- 13
- 12
- 11
- 10
env:
PGVERSION: ${{ matrix.pgversion }}
steps:
- name: checkout
uses: actions/checkout@v3
- name: install pg
run: |
sudo apt-get install -y libclamav-dev
sudo /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh -v $PGVERSION -p -i
sudo -u postgres createuser -s "$USER"
chmod --verbose go+rx $HOME # drwxr-x--- runner docker /home/runner
sudo pg_conftool $PGVERSION main set pg_snakeoil.signature_dir $PWD/testfiles
sudo service postgresql restart # reload isn't enough for PGC_SU_BACKEND
- name: build
run: |
make PROFILE="-Werror"
sudo -E make install
- name: test
run: |
make installcheck
- name: show regression diffs
if: ${{ failure() }}
run: |
cat regression.diffs
pg_snakeoil-1.4/.gitignore 0000664 0000000 0000000 00000000257 14501645623 0015653 0 ustar 00root root 0000000 0000000 # Generated subdirectories
/log/
/results/
/tmp_check/
*.o
*.bc
*.so
*.typedefs
regression.diffs
regression.out
debian/.debhelper/*
debian/files
debian/postgresql-*-snakeoil*
pg_snakeoil-1.4/.travis.yml 0000664 0000000 0000000 00000001460 14501645623 0015771 0 ustar 00root root 0000000 0000000 # run the testsuite on travis-ci.com
---
# versions to run on
env:
- PG_SUPPORTED_VERSIONS=9.2
- PG_SUPPORTED_VERSIONS=9.3
- PG_SUPPORTED_VERSIONS=9.4
- PG_SUPPORTED_VERSIONS=9.5
- PG_SUPPORTED_VERSIONS=9.6
- PG_SUPPORTED_VERSIONS=10
- PG_SUPPORTED_VERSIONS=11
- PG_SUPPORTED_VERSIONS=12
- PG_SUPPORTED_VERSIONS=13
language: C
dist: xenial
before_install:
- sudo apt-get update -qq
install:
# upgrade postgresql-common for new apt.postgresql.org.sh
- sudo apt-get install -y postgresql-common libclamav-dev
- sudo /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh -p -v $PG_SUPPORTED_VERSIONS -i
script:
- make
- sudo make install
- pg_virtualenv -o "pg_snakeoil.signature_dir=$PWD/testfiles" make installcheck
- if test -s regression.diffs; then cat regression.diffs; fi
pg_snakeoil-1.4/LICENSE 0000664 0000000 0000000 00000002044 14501645623 0014664 0 ustar 00root root 0000000 0000000 pg_snakeoil, The PostgreSQL Antivirus
Copyright (c) 2018-2019, Alexander Sosna
Copyright (c) 2018-2019, credativ GmbH
Permission to use, copy, modify, and distribute this software and its
documentation for any purpose, without fee, and without a written agreement
is hereby granted, provided that the above copyright notice and this
paragraph and the following two paragraphs appear in all copies.
IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE TO ANY PARTY FOR
DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, INCLUDING
LOST PROFITS, ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS
DOCUMENTATION, EVEN IF CREDATIV HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
THE COPYRIGHT HOLDERS AND CONTRIBUTORS SPECIFICALLY DISCLAIMS ANY WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. THE SOFTWARE PROVIDED HEREUNDER IS
ON AN "AS IS" BASIS, AND CREDATIV HAS NO OBLIGATIONS TO
PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
pg_snakeoil-1.4/Makefile 0000664 0000000 0000000 00000000730 14501645623 0015317 0 ustar 00root root 0000000 0000000 # pg_snakeoil/Makefile
MODULE_big = pg_snakeoil
OBJS = pg_snakeoil.o
EXTENSION = pg_snakeoil
DATA = pg_snakeoil--0.4--1.sql \
pg_snakeoil--1.sql
PGFILEDESC = "pg_snakeoil - clamav antivirus integration"
REGRESS = pg_snakeoil
# Only works when using pgxs
PG_CONFIG = pg_config
PGXS := $(shell $(PG_CONFIG) --pgxs)
include $(PGXS)
PG_LIBS=-lclamav
SHLIB_LINK=-lclamav
typedefs:
sh gen_typedefs
pgindent:
pgindent --typedefs=$(MODULE_big).typedefs $(MODULE_big).c pg_snakeoil-1.4/README.md 0000664 0000000 0000000 00000010420 14501645623 0015133 0 ustar 00root root 0000000 0000000 # pg_snakeoil - The PostgreSQL Antivirus
Running typical on-access antivirus software on a PostgreSQL server has severe
drawbacks such as severely affecting performance or making the filesystem
unreliable. The failure modes are extremely problematic when a
non-PostgreSQL-aware scanner blocks access to a file due to viruses, or even
false-positives and bugs in the scanner software.
We typically recommend not to run such software on PostgreSQL servers, as
PostgreSQL knows how to discern between code and data and will not execute any
viruses stored in a database. However, running anti-virus software is sometimes
required by local policy.
pg_snakeoil provides ClamAV scanning of all data in PostgreSQL in a way that
does not interfere with the proper functioning of PostgreSQL and does not cause
collateral damage or unnecessary downtimes.
## Usage
### SQL Functions
pg_snakeoil provides SQL functions to scan given data for viruses. The
functions can be used manually or automatically, e.g. via triggers or check
constraints. The following functions are implemented:
#### so_is_infected (text) RETURNS bool
Returns true if the given data matches a signature in the virus database.
#### so_virus_name (text) RETURNS text
Returns virus name if the given data matches a signature in the virus database, empty string otherwise.
#### so_is_infected (bytea) RETURNS bool
Returns true if the given data matches a signature in the virus database.
#### so_virus_name (bytea) RETURNS text
Returns virus name if the given data matches a signature in the virus database,
NULL otherwise.
#### so_update_signatures () RETURNS bool
Update signatures, returns true if signatures changed, false otherwise.
## Installation
### Dependencies
* libclamav
* freshclam (recommended to keep signatures current)
### Compile
```bash
make PG_CONFIG=/path/to/pg_config
sudo make install
```
### Testing
In postgresql.conf, set `pg_snakeoil.signature_dir = '/path/to/pg_snakeoil.git/testfiles'`.
```bash
make installcheck
```
### Preload
pg_snakeoil is loaded by each PostgreSQL backend when needed.
An instance of the ClamAV engine is started for every new backend.
This takes several seconds for the first function call after connecting.
If backends (connections) do not persist and are only used for a single query, it might be interesting to avoid the overhead for the first function call by adding pg_snakeoil to `shared_preload_libraries` in
`postgresql.conf`:
```
shared_preload_libraries = 'pg_snakeoil'
```
When loaded this way, the ClamAV engine will use the signatures loaded while PostgreSQL was started.
Newer signatures will not be loaded automatically.
If the extension is not in `shared_preload_libraries`, new signatures will be used for new connections automatically.
The engine can also be reloaded manually with new signatures via `SELECT so_update_signatures ();`, but this only affects the current backend (connection).
### Create Extension
In each database where pg_snakeoil is to be used, execute:
```SQL
CREATE EXTENSION pg_snakeoil;
```
## Examples
### Functions
### Ad-hoc checks
```SQL
postgres=# SELECT so_is_infected('Not a virus!');
so_is_infected
----------------
f
(1 row)
postgres=# SELECT so_is_infected('X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*');
so_is_infected
----------------
t
(1 row)
postgres=# SELECT so_virus_name('X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*');
so_virus_name
----------------------
Eicar-Test-Signature
(1 row)
```
#### On Access Check
```SQL
CREATE EXTENSION pg_snakeoil;
CREATE DOMAIN safe_text AS text CHECK (NOT so_is_infected(value));
CREATE TABLE t1(safe safe_text);
INSERT INTO t1 VALUES ('This text is safe!');
INSERT
INSERT INTO t1 VALUES('X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*');
NOTICE: Virus found: Eicar-Test-Signature
ERROR: value for domain safe_text violates check constraint "safe_text_check"
```
## Future Ideas
### Scan via pg_recvlogical
`pg_recvlogical` could be used to acquire the data entering the server
instead of file system access, allowing offloading of the CPU-time
required for scanning to another server. The reaction to a positive
ClamAV result is fully customizable from asynchronous notification of
pg_snakeoil-1.4/debian/ 0000775 0000000 0000000 00000000000 14501645623 0015101 5 ustar 00root root 0000000 0000000 pg_snakeoil-1.4/debian/changelog 0000664 0000000 0000000 00000003276 14501645623 0016763 0 ustar 00root root 0000000 0000000 pg-snakeoil (1.4-1) unstable; urgency=medium
* Upload for PostgreSQL 16.
* Use ${postgresql:Depends}.
-- Christoph Berg Sun, 17 Sep 2023 20:50:10 +0200
pg-snakeoil (1.3-4) unstable; urgency=medium
* Upload for PostgreSQL 15.
* debian/watch: Look at GitHub tags instead of releases.
-- Christoph Berg Fri, 21 Oct 2022 11:01:50 +0200
pg-snakeoil (1.3-3) unstable; urgency=medium
* Upload for PostgreSQL 14.
-- Christoph Berg Fri, 15 Oct 2021 15:25:34 +0200
pg-snakeoil (1.3-2) unstable; urgency=medium
[ Debian Janitor ]
* Bump debhelper from deprecated 9 to 10.
* Set upstream metadata fields: Bug-Database, Bug-Submit, Repository,
Repository-Browse.
[ Christoph Berg ]
* Upload for PostgreSQL 13.
* Use dh --with pgxs.
* R³: no.
* DH 13.
* debian/tests: Use 'make' instead of postgresql-server-dev-all.
-- Christoph Berg Mon, 19 Oct 2020 11:45:56 +0200
pg-snakeoil (1.3-1) unstable; urgency=medium
* Make signature directory configurable via pg_snakeoil.signature_dir.
(Closes: #946359)
-- Christoph Berg Wed, 18 Dec 2019 10:42:59 +0100
pg-snakeoil (1.2-1) unstable; urgency=medium
* Upload for PostgreSQL 12.
-- Christoph Berg Tue, 29 Oct 2019 13:40:03 +0100
pg-snakeoil (1.1-1) unstable; urgency=medium
* New upstream version, fixes compatibility with clamav 0.101.
* Attribute Alexander Sosna's copyright.
-- Christoph Berg Mon, 04 Feb 2019 10:37:34 +0100
pg-snakeoil (1.0-1) unstable; urgency=medium
* Initial release.
-- Christoph Berg Mon, 28 Jan 2019 14:06:57 +0100
pg_snakeoil-1.4/debian/control 0000664 0000000 0000000 00000001351 14501645623 0016504 0 ustar 00root root 0000000 0000000 Source: pg-snakeoil
Section: database
Priority: optional
Maintainer: Debian PostgreSQL Maintainers
Uploaders: Christoph Berg
Build-Depends:
debhelper-compat (= 13),
libclamav-dev,
postgresql-all (>= 217~),
Standards-Version: 4.6.2
Rules-Requires-Root: no
Vcs-Browser: https://github.com/df7cb/pg_snakeoil
Vcs-Git: https://github.com/df7cb/pg_snakeoil.git
Package: postgresql-16-snakeoil
Architecture: any
Depends:
${postgresql:Depends},
${misc:Depends},
${shlibs:Depends},
Recommends:
clamav-freshclam | clamav-data,
Description: PostgreSQL anti-virus scanner based on ClamAV
pg_snakeoil provides functions scanning PostgreSQL data for viruses using the
ClamAV anti-virus engine.
pg_snakeoil-1.4/debian/control.in 0000664 0000000 0000000 00000001437 14501645623 0017116 0 ustar 00root root 0000000 0000000 Source: pg-snakeoil
Section: database
Priority: optional
Maintainer: Debian PostgreSQL Maintainers
Uploaders: Christoph Berg
Build-Depends:
debhelper-compat (= 13),
libclamav-dev,
postgresql-all (>= 217~),
Standards-Version: 4.6.2
Rules-Requires-Root: no
Homepage: https://github.com/df7cb/pg_snakeoil
Vcs-Browser: https://github.com/df7cb/pg_snakeoil
Vcs-Git: https://github.com/df7cb/pg_snakeoil.git
Package: postgresql-PGVERSION-snakeoil
Architecture: any
Depends:
${postgresql:Depends},
${misc:Depends},
${shlibs:Depends},
Recommends:
clamav-freshclam | clamav-data,
Description: PostgreSQL anti-virus scanner based on ClamAV
pg_snakeoil provides functions scanning PostgreSQL data for viruses using the
ClamAV anti-virus engine.
pg_snakeoil-1.4/debian/copyright 0000664 0000000 0000000 00000002302 14501645623 0017031 0 ustar 00root root 0000000 0000000 Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: pg_snakeoil
Source: https://github.com/credativ/pg_snakeoil
Files: *
Copyright:
Copyright (c) 2018, Alexander Sosna
Copyright (c) 2018, credativ GmbH
License: snakeoil
Permission to use, copy, modify, and distribute this software and its
documentation for any purpose, without fee, and without a written agreement
is hereby granted, provided that the above copyright notice and this
paragraph and the following two paragraphs appear in all copies.
.
IN NO EVENT SHALL THE COPYRIGHT HOLDERS AND CONTRIBUTORS BE LIABLE TO ANY PARTY FOR
DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, INCLUDING
LOST PROFITS, ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS
DOCUMENTATION, EVEN IF CREDATIV HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
.
THE COPYRIGHT HOLDERS AND CONTRIBUTORS SPECIFICALLY DISCLAIMS ANY WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS FOR A PARTICULAR PURPOSE. THE SOFTWARE PROVIDED HEREUNDER IS
ON AN "AS IS" BASIS, AND CREDATIV HAS NO OBLIGATIONS TO
PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
pg_snakeoil-1.4/debian/pgversions 0000664 0000000 0000000 00000000004 14501645623 0017215 0 ustar 00root root 0000000 0000000 all
pg_snakeoil-1.4/debian/rules 0000775 0000000 0000000 00000000343 14501645623 0016161 0 ustar 00root root 0000000 0000000 #!/usr/bin/make -f
override_dh_installdocs:
dh_installdocs --all README.*
override_dh_pgxs_test:
pg_buildext -o "pg_snakeoil.signature_dir=$(CURDIR)/testfiles" installcheck . . postgresql-%v-snakeoil
%:
dh $@ --with pgxs
pg_snakeoil-1.4/debian/source/ 0000775 0000000 0000000 00000000000 14501645623 0016401 5 ustar 00root root 0000000 0000000 pg_snakeoil-1.4/debian/source/format 0000664 0000000 0000000 00000000014 14501645623 0017607 0 ustar 00root root 0000000 0000000 3.0 (quilt)
pg_snakeoil-1.4/debian/tests/ 0000775 0000000 0000000 00000000000 14501645623 0016243 5 ustar 00root root 0000000 0000000 pg_snakeoil-1.4/debian/tests/control 0000664 0000000 0000000 00000000100 14501645623 0017635 0 ustar 00root root 0000000 0000000 Depends: @, make
Tests: installcheck
Restrictions: allow-stderr
pg_snakeoil-1.4/debian/tests/installcheck 0000775 0000000 0000000 00000000122 14501645623 0020630 0 ustar 00root root 0000000 0000000 #!/bin/sh
pg_buildext -o "pg_snakeoil.signature_dir=$PWD/testfiles" installcheck
pg_snakeoil-1.4/debian/upstream/ 0000775 0000000 0000000 00000000000 14501645623 0016741 5 ustar 00root root 0000000 0000000 pg_snakeoil-1.4/debian/upstream/metadata 0000664 0000000 0000000 00000000357 14501645623 0020451 0 ustar 00root root 0000000 0000000 Bug-Database: https://github.com/credativ/pg_snakeoil/issues
Bug-Submit: https://github.com/credativ/pg_snakeoil/issues/new
Repository: https://github.com/credativ/pg_snakeoil.git
Repository-Browse: https://github.com/credativ/pg_snakeoil
pg_snakeoil-1.4/debian/watch 0000664 0000000 0000000 00000000104 14501645623 0016125 0 ustar 00root root 0000000 0000000 version=4
https://github.com/df7cb/pg_snakeoil/tags .*/v(.*).tar.gz
pg_snakeoil-1.4/expected/ 0000775 0000000 0000000 00000000000 14501645623 0015460 5 ustar 00root root 0000000 0000000 pg_snakeoil-1.4/expected/pg_snakeoil.out 0000664 0000000 0000000 00000003054 14501645623 0020506 0 ustar 00root root 0000000 0000000 CREATE EXTENSION pg_snakeoil;
-- ------------------------------------------------------------------------
-- Management Functions
-- ------------------------------------------------------------------------
SELECT so_update_signatures();
so_update_signatures
----------------------
f
(1 row)
-- ------------------------------------------------------------------------
-- Text Functions
-- ------------------------------------------------------------------------
SELECT so_is_infected('the quick brown fox jumps over the lazy dog');
so_is_infected
----------------
t
(1 row)
SELECT so_virus_name('the quick brown fox jumps over the lazy dog');
so_virus_name
--------------------------------
The Quick Brown Fox.UNOFFICIAL
(1 row)
SELECT so_is_infected('Hello World!');
so_is_infected
----------------
f
(1 row)
SELECT so_virus_name('Hello World!');
so_virus_name
---------------
(1 row)
-- ------------------------------------------------------------------------
-- bytea Functions
-- ------------------------------------------------------------------------
SELECT so_is_infected('the quick brown fox jumps over the lazy dog'::bytea);
so_is_infected
----------------
t
(1 row)
SELECT so_virus_name('the quick brown fox jumps over the lazy dog'::bytea);
so_virus_name
--------------------------------
The Quick Brown Fox.UNOFFICIAL
(1 row)
SELECT so_is_infected('Hello World!'::bytea);
so_is_infected
----------------
f
(1 row)
SELECT so_virus_name('Hello World!'::bytea);
so_virus_name
---------------
(1 row)
pg_snakeoil-1.4/gen_typedefs 0000775 0000000 0000000 00000000472 14501645623 0016264 0 ustar 00root root 0000000 0000000 #!/bin/sh
objdump -W pg_snakeoil.so |\
egrep -A3 DW_TAG_typedef |\
perl -e ' while (<>) { chomp; @flds = split;next unless (1 < @flds);\
next if $flds[0] ne "DW_AT_name" && $flds[1] ne "DW_AT_name";\
next if $flds[-1] =~ /^DW_FORM_str/;\
print $flds[-1],"\n"; }' |\
sort | uniq > pg_snakeoil.typedefs
pg_snakeoil-1.4/images/ 0000775 0000000 0000000 00000000000 14501645623 0015124 5 ustar 00root root 0000000 0000000 pg_snakeoil-1.4/images/pg_snakeoil_logo.png 0000664 0000000 0000000 00000332300 14501645623 0021146 0 ustar 00root root 0000000 0000000 PNG
IHDR 5 | #zTXtRaw profile type exif xڭid)p
-yX8`hYS=2+2!?c.'>߃?^wݾ~|O|O_u^_}~FOaғ#?|(n|]7/?wo߹b.盛$FzzcQJoc _ߗ}Я#
?/b痵w{gv3WVI}OKe|uh,&/saސ3pws<=FS#JW#F1QK%<';cf+ݫ
:+*"y
J$|_D[_[~VzqN'C_7`xva0!_IPo1XN|)EB)qwMJgsMア@(H#4#Ms!Z, <*J/̚jڪ0jr+zms/{}8VF͍>ƘNn=z9W\iUV]m54Dz֬۰Nu7{pHO98k7|˭~ǝ??"Q_QS{_5^nApR3"s M b{9*r(절|B,7k\OqSB9}EqK|^TZS.NO?now3o[m'3YA-7bX=RYO34b ^Yf;8Pl nbZwՍinWV-onVY#G|» ѹ/)6Nm.