server/lib/src/sandbox/clamd.conf
# clamd in its own sandbox (lane SANDBOX-SCAN): Holger streams the bytes to this
# socket and unpacks nothing itself; clamd unpacks them here, with no network,
# a read-only root, no capabilities and its signature database read-only.
LocalSocket /run/clamd/clamd.sock
LocalSocketMode 666
Foreground yes
LogTime yes
DatabaseDirectory /var/lib/clamav
TemporaryDirectory /tmp
MaxScanSize 1024M
MaxFileSize 512M
MaxRecursion 16
MaxFiles 100000
StreamMaxLength 1024M
# What clamd cannot scan whole (past a limit above) is FOUND (Heuristics.Limits.Exceeded),
# so the intake blocks it rather than passing it unscanned (NCSC P1, lane HOL-NCSC).
AlertExceedsMax yes