diff --git a/clamscan/manager.c b/clamscan/manager.c index 139dc2506..4d2034d38 100644 --- a/clamscan/manager.c +++ b/clamscan/manager.c @@ -624,6 +624,17 @@ int scanmanager(const struct optstruct *opts) return 2; } + if(optget(opts, "yara-rules")->enabled) { + char *p = optget(opts, "yara-rules")->strarg; + if(strcmp(p, "yes")) { + if(!strcmp(p, "only")) + dboptions |= CL_DB_YARA_ONLY; + else if (!strcmp(p, "no")) + dboptions |= CL_DB_YARA_EXCLUDE; + } + + } + if(optget(opts, "phishing-sigs")->enabled) dboptions |= CL_DB_PHISHING; diff --git a/libclamav/clamav.h b/libclamav/clamav.h index 696375c3c..3f69749f2 100644 --- a/libclamav/clamav.h +++ b/libclamav/clamav.h @@ -135,6 +135,8 @@ typedef enum { #define CL_DB_BYTECODE_STATS 0x20000 #define CL_DB_ENHANCED 0x40000 #define CL_DB_PCRE_STATS 0x80000 +#define CL_DB_YARA_EXCLUDE 0x100000 +#define CL_DB_YARA_ONLY 0x200000 /* recommended db settings */ #define CL_DB_STDOPT (CL_DB_PHISHING | CL_DB_PHISHING_URLS | CL_DB_BYTECODE) diff --git a/libclamav/readdb.c b/libclamav/readdb.c index 8f79c36ec..c8ec7f75a 100644 --- a/libclamav/readdb.c +++ b/libclamav/readdb.c @@ -4262,6 +4262,14 @@ int cli_load(const char *filename, struct cl_engine *engine, unsigned int *signo else dbname = filename; +#ifdef HAVE_YARA + if(options & CL_DB_YARA_ONLY) { + if(cli_strbcasestr(dbname, ".yar") || cli_strbcasestr(dbname, ".yara")) + ret = cli_loadyara(fs, engine, signo, options, dbio, filename); + else + skipped = 1; + } else +#endif if(cli_strbcasestr(dbname, ".db")) { ret = cli_loaddb(fs, engine, signo, options, dbio, dbname); @@ -4360,7 +4368,10 @@ int cli_load(const char *filename, struct cl_engine *engine, unsigned int *signo ret = cli_loadopenioc(fs, dbname, engine, options); #ifdef HAVE_YARA } else if(cli_strbcasestr(dbname, ".yar") || cli_strbcasestr(dbname, ".yara")) { - ret = cli_loadyara(fs, engine, signo, options, dbio, filename); + if(!(options & CL_DB_YARA_EXCLUDE)) + ret = cli_loadyara(fs, engine, signo, options, dbio, filename); + else + skipped = 1; #endif } else if(cli_strbcasestr(dbname, ".pwdb")) { ret = cli_loadpwdb(fs, engine, options, 0, dbio); diff --git a/shared/optparser.c b/shared/optparser.c index 2b15a92a4..8698fbd11 100644 --- a/shared/optparser.c +++ b/shared/optparser.c @@ -218,6 +218,8 @@ const struct clam_option __clam_options[] = { { "OfficialDatabaseOnly", "official-db-only", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "Only load the official signatures published by the ClamAV project.", "no" }, + { "YaraRules", "yara-rules", 0, CLOPT_TYPE_STRING, NULL, 0, NULL, 0, OPT_CLAMSCAN, "By default, yara rules will be loaded. This option allows you to exclude yara rules when scanning and also to scan only using yara rules. Valid options are yes|no|only", "yes"}, + { "LocalSocket", NULL, 0, CLOPT_TYPE_STRING, NULL, -1, NULL, 0, OPT_CLAMD, "Path to a local socket file the daemon will listen on.", "/tmp/clamd.socket" }, { "LocalSocketGroup", NULL, 0, CLOPT_TYPE_STRING, NULL, -1, NULL, 0, OPT_CLAMD, "Sets the group ownership on the unix socket.", "virusgroup" },