I was wondering if antiviruses could scan /var or if it was off limits i am trying to understand how antiviruses work and there impact on the file system and any limitations imposed on scanning ability
First, you must understand what
/var is. It's not a different kind of file system, but a location in the Filesystem Hierarchy Standard (FHS) for storing...
Variable files—files whose content is expected to continually change during normal operation of the system—such as logs, spool files, and temporary e-mail files.
/var |- log/ - System log files |- mail ->spool/mail/ |- run/ +- spool/ - for programs in which data files are stored |- at/ |- cron/ |- mail/ |- tmp/
There's no limitations preventing an antivirus from scanning in
/var, but it would not be wise to scan log files etc. On the other hand there might be several locations that could be meaningful to scan, e.g.
If the mail spool is Maildir based, it's possible to scan mail for viruses on filesystem level and take immediate action. On the other hand removing viruses from mbox based system might break something.
If there are public web sites stored in
/var/www, scanning that location might prevent a web server from distributing malware.
I was wondering if antiviruses could scan /var
As antivirus programs either run as a kernel mode driver or as a privileged file system filter driver, it is be able to scan the /var directory on the file system.
I am trying to understand how antiviruses work and their impact on the file system
Most antivirus software will scan upon file write operations. Performance depends on the file size that is being written to disk.
It also depends on the configuration of the antivirus software itself, such as heuristic scanning, compressed file scanning and file type exclusions as these functionalities might consume more or less processing power and memory, depending on their settings.
I suspect the key piece of understanding you're missing here is the general concept of file permissions.
In the simplest case, imagine a PC, whether it's running Windows or Linux or any other OS, with a single hard disk (or, these days, SSD). That disk contains a hierarchy of directories and files, including those critical to the running of the system, user-installed programs, configuration files, log files, and whatever else the user creates.
To make it harder to accidentally or maliciously damage the system, or affect other user's files on a multi-user system, the OS will enforce different permissions on different parts of that hierarchy. For instance, each user may have a "home directory" which they "own", and have the ability to write to at will, but which is "off limits" for other users. Core files needed to operate the system will only be accessible by privileged users (e.g. "Administrator" or "root"), or in special security contexts (e.g. "UAC" or "sudo").
These different sets of files won't generally be hard-coded in the OS, they will just be permissions stored against every directory and file in the system. There is generally no single definition of "system files", there are just files with restrictive permissions because changes to them could have serious consequences.
The next thing to understand is that as far as the OS is concerned, every program is being run by a particular user, or in a particular security context, but that is not necessarily a context you can run things in manually.
So to get to your specific example:
/varis a directory which, by convention, is used for various log files and temporary system state on Unix-like systems. Like any other directory, it has permissions specifying who can list its contents, read from, and write to it. The files and sub-directories within it likewise have permissions. Other than that, there is nothing inherently different about it.
/tmpis a different directory, used by convention for disposable temporary files, which has different permissions. Specifically, it has unusual permissions which allow users to create files there, but not read each other's files. It's not technically "special", though, as any directory could have those same permissions.
- It happens to be useful for most systems to set the permissions such that "ordinary users" can write new files in
/tmp, but not in
- An antivirus program, by the nature of its purpose, needs access to anywhere in the system that a malicious program might be, or where malicious activity might happen. It is therefore likely that it will run in a security context which allows it access to all parts of the file system. This doesn't generally require changes to how the file system or security system normally operate, but does mean that the antivirus program will be more "trusted" than other programs on the system.