nordisk/holger

scripts/clamd-sandbox.sh

#!/usr/bin/env bash
# clamd in its own sandbox container (lane SANDBOX-SCAN).
#
#   scripts/clamd-sandbox.sh start <name> <socket-dir> [<database-dir>]
#   scripts/clamd-sandbox.sh stop  <name>
#
# --network none, a read-only root, --cap-drop all, no-new-privileges, the clamav
# user (uid 100), memory and pids limits, a tmpfs /tmp. The signature database is
# the pinned image's own, or <database-dir> read-only (the one the USB stick
# carried). The socket appears as <socket-dir>/clamd.sock; point
# `promotion.intake.inspect.clamav.socket` at it. Holger streams the bytes to it.
set -euo pipefail
REPO=$(cd "$(dirname "$0")/.." && pwd)
CLAMAV_IMAGE="${CLAMAV_IMAGE:-docker.io/clamav/clamav:1.5.4@sha256:e19130cdebaeacc71fa46eab3ed6f69941f2f22aa5e08d55e9197f8edf43ce5e}"
cmd=${1:?start|stop}; name=${2:?a container name}
case "$cmd" in
  start)
    dir=${3:?a socket directory}
    mkdir -p "$dir"; chmod 0777 "$dir"
    db=()
    if [ -n "${4:-}" ]; then db=(-v "$4:/var/lib/clamav:ro"); fi
    podman run -d --name "$name" --pull=never --network none --read-only --cap-drop all \
      --security-opt no-new-privileges --user 100:101 --memory 4g --memory-swap 4g --pids-limit 256 \
      --tmpfs /tmp:rw,size=1g,mode=1777 -v "$dir:/run/clamd:rw" "${db[@]}" \
      -v "$REPO/server/lib/src/sandbox/clamd.conf:/etc/clamav/clamd-sandbox.conf:ro" \
      --entrypoint clamd "$CLAMAV_IMAGE" --config-file=/etc/clamav/clamd-sandbox.conf >/dev/null
    for _ in $(seq 1 360); do
      [ -S "$dir/clamd.sock" ] && python3 -I -c 'import socket,sys
s=socket.socket(socket.AF_UNIX);s.settimeout(2);s.connect(sys.argv[1]);s.sendall(b"zPING\0");sys.exit(0 if s.recv(16).startswith(b"PONG") else 1)' "$dir/clamd.sock" 2>/dev/null && { echo "clamd up: $dir/clamd.sock"; exit 0; }
      sleep 0.5
    done
    podman logs "$name" 2>&1 | tail -20 >&2
    echo "clamd did not come up" >&2; exit 1 ;;
  stop) podman rm -f "$name" >/dev/null 2>&1 || true ;;
  *) echo "usage: $0 start|stop <name> ..." >&2; exit 2 ;;
esac