0

I was wondering if antiviruses could scan /var or if it was off limits i am trying to understand how antiviruses work and there impact on the file system and any limitations imposed on scanning ability

  • 1
    What makes you think they can't? – MechMK1 Jul 6 at 9:16
  • @MechMK1 As he mentioned, he's trying to understand how antivirus scanners work ;) – Jeroen Jul 6 at 9:19
1

First, you must understand what /var is. It's not a different kind of file system, but a location in the Filesystem Hierarchy Standard (FHS) for storing...

Variable files—files whose content is expected to continually change during normal operation of the system—such as logs, spool files, and temporary e-mail files.

/var
    |- log/ - System log files
    |- mail ->spool/mail/
    |- run/
    +- spool/ - for programs in which data files are stored
        |- at/
        |- cron/
        |- mail/
    |- tmp/

There's no limitations preventing an antivirus from scanning in /var, but it would not be wise to scan log files etc. On the other hand there might be several locations that could be meaningful to scan, e.g.

  • If the mail spool is Maildir based, it's possible to scan mail for viruses on filesystem level and take immediate action. On the other hand removing viruses from mbox based system might break something.

  • If there are public web sites stored in /var/www, scanning that location might prevent a web server from distributing malware.

  • Can someone store a text file or C program in /var ? i have tested this out by creating a Python script and copying it over to /var however it required root to copy so my guess is you can however wanting to verify – Joe Jul 6 at 9:39
  • @Joe Yes, of course. echo "This is a text file." >/var/tmp/hello.txt – Gilles 'SO- stop being evil' Jul 6 at 9:41
  • 1
    @Giles So /var is just another directory in the file system and can be used to store anything ranging from a file with hello in it to a C program but why does it require you to have root privileges in order to copy whatever? I figured this was for all directories however i tested it with /tmp and it copies over without root why is this? Sorry for being such a bother just trying to get my head wrapped around this – Joe Jul 6 at 9:43
0

I was wondering if antiviruses could scan /var

As antivirus programs either run as a kernel mode driver or as a privileged file system filter driver, it is be able to scan the /var directory on the file system.

I am trying to understand how antiviruses work and their impact on the file system

Most antivirus software will scan upon file write operations. Performance depends on the file size that is being written to disk.

It also depends on the configuration of the antivirus software itself, such as heuristic scanning, compressed file scanning and file type exclusions as these functionalities might consume more or less processing power and memory, depending on their settings.

  • If i am understanding you correctly as long as the antivirus has the proper permissions it can scan /var or any other directory/file? does this apply to system directories and files as well? also what do you mean by "upon file write operations" ? – Joe Jul 6 at 9:49
  • That's correct. What mean by "upon file write operations" is when a file gets written to disk, it will first be scanned by the antivirus software. – Jeroen Jul 9 at 11:34
0

I suspect the key piece of understanding you're missing here is the general concept of file permissions.

In the simplest case, imagine a PC, whether it's running Windows or Linux or any other OS, with a single hard disk (or, these days, SSD). That disk contains a hierarchy of directories and files, including those critical to the running of the system, user-installed programs, configuration files, log files, and whatever else the user creates.

To make it harder to accidentally or maliciously damage the system, or affect other user's files on a multi-user system, the OS will enforce different permissions on different parts of that hierarchy. For instance, each user may have a "home directory" which they "own", and have the ability to write to at will, but which is "off limits" for other users. Core files needed to operate the system will only be accessible by privileged users (e.g. "Administrator" or "root"), or in special security contexts (e.g. "UAC" or "sudo").

These different sets of files won't generally be hard-coded in the OS, they will just be permissions stored against every directory and file in the system. There is generally no single definition of "system files", there are just files with restrictive permissions because changes to them could have serious consequences.

The next thing to understand is that as far as the OS is concerned, every program is being run by a particular user, or in a particular security context, but that is not necessarily a context you can run things in manually.

So to get to your specific example:

  • /var is a directory which, by convention, is used for various log files and temporary system state on Unix-like systems. Like any other directory, it has permissions specifying who can list its contents, read from, and write to it. The files and sub-directories within it likewise have permissions. Other than that, there is nothing inherently different about it.
  • /tmp is a different directory, used by convention for disposable temporary files, which has different permissions. Specifically, it has unusual permissions which allow users to create files there, but not read each other's files. It's not technically "special", though, as any directory could have those same permissions.
  • It happens to be useful for most systems to set the permissions such that "ordinary users" can write new files in /tmp, but not in /var.
  • An antivirus program, by the nature of its purpose, needs access to anywhere in the system that a malicious program might be, or where malicious activity might happen. It is therefore likely that it will run in a security context which allows it access to all parts of the file system. This doesn't generally require changes to how the file system or security system normally operate, but does mean that the antivirus program will be more "trusted" than other programs on the system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.