Well you can... provided you mimic the mount of the partition!
At a low level, mounting a partition is no more that reading the raw partition to discover and load its different system tables (allocation table, root folder, etc.). From that point, the system is able to give you access to the individual files.
If for any reason you do not want the kernel to mount the partition, your application must have enough knowledge on the internals of its file system to be able to:
- find and read the root folder (and any other folder once you can find it)
- identify all active (plain) files and folders inside a folder
- load a file from a folder
As you just want to pass clamav there, you can safely ignore all special files (devices, symlinks, unix domain sockets) and only process plain files and folders. Also, you can ignore any file attributes.
Then, you recursively walk the folders, read individually all files and pass their content to clamav
But the question is now: what is the security gain/loss regarding a normal mount of the partition?
- no risk of accidentally executing anything from the partition
- no risk of hitting a security flaw in the file system driver(*) (note that you can mediate that with a FUSE driver if there is one, or by running the analysis on a virtual machine)
- no risk that a third party process can access any file from the partition
- you must implement securely all the low level structures and accesses of a file system
- you must trust more your code that the (highly tested) kernel and driver code
- you must ensure that your code will follow all possible evolutions of the file system
- you must implement all file systems that you want to be able to clamax
That being said, that is exactly what the
fsck utility does: it reads a raw partition and walk along its hierarchy to discover and fix low level errors. But it is a low level system tool...
TL/DR: unless you are a file system expert, I am not sure that the security gain is worth it. IMHO the following procedure should be secure enough:
- fsck the partition - if it is supported by fsck
- mount it to a subdirectory of a directory with permissions 700 to make sure that no non root process can access it, with the
- pass clamav on it
mount man page ends with
It is possible for a corrupted file system to cause a crash.