Antivirus: Protection for for Professionals

import os
import time
import tempfile
import psutil
import statistics
from pathlib import Path

def benchmark_av_latency(
    file_sizes: list[int] = [1024, 10240, 1048576],  # 1KB, 10KB, 1MB
    iterations: int = 100,
    output_dir: str = tempfile.gettempdir()
) -> dict:
    """
    Benchmarks file write latency with on-access AV scanning enabled.
    Measures time from file creation to write completion, accounting for AV scan overhead.

    Args:
        file_sizes: List of file sizes in bytes to test
        iterations: Number of write iterations per file size
        output_dir: Directory to write test files (use temp dir to avoid user path issues)

    Returns:
        Dict mapping file size to list of latency measurements in ms
    """
    results = {size: [] for size in file_sizes}
    process = psutil.Process(os.getpid())

    # Ensure output directory exists
    Path(output_dir).mkdir(parents=True, exist_ok=True)

    for size in file_sizes:
        print(f"Benchmarking {size} byte files ({iterations} iterations)...")
        for i in range(iterations):
            # Generate random binary data matching target size
            test_data = os.urandom(size)
            test_path = os.path.join(output_dir, f"av_bench_{size}_{i}.tmp")

            try:
                # Start CPU and time measurement
                start_time = time.perf_counter()
                initial_cpu = process.cpu_percent(interval=None)

                # Write file (triggers on-access AV scan)
                with open(test_path, "wb") as f:
                    f.write(test_data)
                    f.flush()
                    os.fsync(f.fileno())  # Ensure write is committed to disk

                end_time = time.perf_counter()
                final_cpu = process.cpu_percent(interval=None)

                # Calculate latency in ms
                latency_ms = (end_time - start_time) * 1000
                results[size].append(latency_ms)

                # Clean up test file
                os.unlink(test_path)

            except PermissionError as e:
                print(f"Permission error writing to {test_path}: {e}")
                continue
            except OSError as e:
                print(f"OS error during benchmark: {e}")
                continue

    # Calculate summary statistics
    summary = {}
    for size, latencies in results.items():
        if not latencies:
            summary[size] = {"error": "No valid measurements"}
            continue
        summary[size] = {
            "mean_ms": round(statistics.mean(latencies), 2),
            "median_ms": round(statistics.median(latencies), 2),
            "p99_ms": round(statistics.quantiles(latencies, n=100)[98], 2),
            "samples": len(latencies)
        }

    return summary

if __name__ == "__main__":
    # Run benchmark with default parameters
    print("Starting AV latency benchmark...")
    try:
        benchmark_results = benchmark_av_latency()
        print("\nBenchmark Results:")
        for size, stats in benchmark_results.items():
            print(f"File Size: {size} bytes")
            for k, v in stats.items():
                print(f"  {k}: {v}")
    except Exception as e:
        print(f"Benchmark failed: {e}")

package main

import (
    "context"
    "fmt"
    "log"
    "os"
    "os/exec"
    "path/filepath"
    "strings"
    "time"
)

// ClamAVConfig holds configuration for on-access scanning setup
type ClamAVConfig struct {
    ClamDPath    string   // Path to clamd binary
    OnAccessDirs []string // Directories to scan on access
    ExcludeDirs  []string // Directories to exclude (e.g., build outputs)
    MaxFileSize  int64    // Max file size to scan in bytes (0 for unlimited)
    ScanOnOpen   bool     // Scan files when opened for read
    ScanOnClose  bool     // Scan files when closed after write
}

// SetupClamAVOnAccess configures clamd for on-access scanning optimized for CI runners
func SetupClamAVOnAccess(ctx context.Context, cfg ClamAVConfig) error {
    // Validate clamd exists
    if _, err := os.Stat(cfg.ClamDPath); os.IsNotExist(err) {
        return fmt.Errorf("clamd not found at %s: %w", cfg.ClamDPath, err)
    }

    // Build clamd configuration arguments
    args := []string{
        "-c", "/etc/clamav/clamd.conf",  // Base config path
        "--on-access",                   // Enable on-access scanning
        "--on-access-dirs", strings.Join(cfg.OnAccessDirs, ","),
        "--max-filesize", fmt.Sprintf("%d", cfg.MaxFileSize),
    }

    // Add exclude directories
    for _, dir := range cfg.ExcludeDirs {
        absDir, err := filepath.Abs(dir)
        if err != nil {
            return fmt.Errorf("failed to resolve absolute path for %s: %w", dir, err)
        }
        args = append(args, "--exclude-dir", absDir)
    }

    // Configure scan triggers
    if cfg.ScanOnOpen {
        args = append(args, "--scan-on-open")
    }
    if cfg.ScanOnClose {
        args = append(args, "--scan-on-close")
    }

    // Check if clamd is already running
    pidPath := "/var/run/clamav/clamd.pid"
    if _, err := os.Stat(pidPath); err == nil {
        log.Println("clamd is already running, reloading configuration...")
        reloadCmd := exec.CommandContext(ctx, "clamdscan", "--reload")
        if err := reloadCmd.Run(); err != nil {
            return fmt.Errorf("failed to reload clamd: %w", err)
        }
        return nil
    }

    // Start clamd with configured arguments
    log.Println("Starting clamd with on-access scanning...")
    cmd := exec.CommandContext(ctx, cfg.ClamDPath, args...)
    cmd.Stdout = os.Stdout
    cmd.Stderr = os.Stderr

    // Run in background for CI environments
    if err := cmd.Start(); err != nil {
        return fmt.Errorf("failed to start clamd: %w", err)
    }

    // Wait for clamd to initialize (max 30s)
    initTimeout := time.After(30 * time.Second)
    ticker := time.NewTicker(1 * time.Second)
    defer ticker.Stop()

    for {
        select {
        case <-initTimeout:
            return fmt.Errorf("clamd failed to initialize within 30 seconds")
        case <-ticker.C:
            // Check if clamd is responding to ping
            pingCmd := exec.CommandContext(ctx, "clamdscan", "--ping")
            if err := pingCmd.Run(); err == nil {
                log.Println("clamd initialized successfully")
                return nil
            }
        }
    }
}

func main() {
    // Configuration for a typical Go CI runner
    cfg := ClamAVConfig{
        ClamDPath:    "/usr/bin/clamd",
        OnAccessDirs: []string{"/home/ci/go/src", "/var/lib/ci/builds"},
        ExcludeDirs:  []string{"/home/ci/go/src/github.com/example/project/vendor", "/var/lib/ci/builds/output"},
        MaxFileSize:  10485760, // 10MB max scan size
        ScanOnOpen:   true,
        ScanOnClose:  true,
    }

    ctx, cancel := context.WithTimeout(context.Background(), 1*time.Minute)
    defer cancel()

    if err := SetupClamAVOnAccess(ctx, cfg); err != nil {
        log.Fatalf("Failed to setup ClamAV: %v", err)
    }

    // Verify on-access scanning is active
    verifyCmd := exec.CommandContext(ctx, "clamdscan", "--on-access-status")
    verifyCmd.Stdout = os.Stdout
    verifyCmd.Stderr = os.Stderr
    if err := verifyCmd.Run(); err != nil {
        log.Fatalf("Failed to verify on-access scanning: %v", err)
    }
}

#!/bin/bash

set -euo pipefail  # Exit on error, undefined vars, pipe failures

# Configuration
LOG_FILE="/var/log/av_exclusions.log"
DEV_TOOLS=(
    "/usr/bin/gcc"
    "/usr/bin/go"
    "/usr/bin/node"
    "/usr/bin/npm"
    "/usr/bin/docker"
    "/opt/visual-studio-code/bin/code"
    "/home/*/go/src"
    "/home/*/node_modules"
    "/var/lib/jenkins/workspace"
)

# Log function with timestamp
log() {
    echo "[$(date +'%Y-%m-%dT%H:%M:%S%z')] $1" | tee -a "$LOG_FILE"
}

# Check if running as root
check_root() {
    if [[ $EUID -ne 0 ]]; then
        log "ERROR: This script must be run as root"
        exit 1
    fi
}

# Add Windows Defender exclusions (Windows only)
add_windows_defender_exclusions() {
    if ! command -v powershell.exe &> /dev/null; then
        log "WARNING: powershell.exe not found, skipping Windows Defender exclusions"
        return
    fi

    log "Adding Windows Defender exclusions..."
    for tool in "${DEV_TOOLS[@]}"; do
        # Expand wildcards for Windows paths
        expanded_paths=$(powershell.exe -Command "Get-Item -Path '$tool' | Select-Object -ExpandProperty FullName" 2>/dev/null || true)
        if [[ -z "$expanded_paths" ]]; then
            log "WARNING: No paths found for $tool, skipping"
            continue
        fi

        while IFS= read -r path; do
            if [[ -z "$path" ]]; then
                continue
            fi
            # Convert Windows path to WSL path if needed
            if [[ "$path" == *"\"* ]]; then
                path=$(wslpath -u "$path" 2>/dev/null || echo "$path")
            fi
            log "Adding Windows Defender exclusion for $path"
            powershell.exe -Command "Add-MpPreference -ExclusionPath '$path'" 2>&1 | tee -a "$LOG_FILE"
            if [[ $? -ne 0 ]]; then
                log "ERROR: Failed to add exclusion for $path"
            fi
        done <<< "$expanded_paths"
    done
}

# Add ClamAV exclusions (Linux only)
add_clamav_exclusions() {
    if ! command -v clamdscan &> /dev/null; then
        log "WARNING: clamdscan not found, skipping ClamAV exclusions"
        return
    fi

    CLAMAV_CONF="/etc/clamav/clamd.conf"
    if [[ ! -f "$CLAMAV_CONF" ]]; then
        log "ERROR: ClamAV config not found at $CLAMAV_CONF"
        return
    fi

    log "Adding ClamAV exclusions..."
    for tool in "${DEV_TOOLS[@]}"; do
        # Expand wildcards for Linux paths
        expanded_paths=$(find / -path "$tool" 2>/dev/null || true)
        if [[ -z "$expanded_paths" ]]; then
            log "WARNING: No paths found for $tool, skipping"
            continue
        fi

        while IFS= read -r path; do
            if [[ -z "$path" ]]; then
                continue
            fi
            log "Adding ClamAV exclusion for $path"
            # Check if exclusion already exists
            if grep -q "ExcludePath $path" "$CLAMAV_CONF"; then
                log "Exclusion for $path already exists, skipping"
                continue
            fi
            echo "ExcludePath $path" >> "$CLAMAV_CONF"
            if [[ $? -ne 0 ]]; then
                log "ERROR: Failed to add ClamAV exclusion for $path"
            fi
        done <<< "$expanded_paths"
    done

    # Reload ClamAV configuration
    log "Reloading ClamAV configuration..."
    clamdscan --reload 2>&1 | tee -a "$LOG_FILE"
}

# Main execution
main() {
    log "Starting AV exclusion setup for development tools..."
    check_root

    # Detect OS
    OS_TYPE=$(uname -s)
    case "$OS_TYPE" in
        Linux*)
            add_clamav_exclusions
            ;;
        Darwin*)
            log "macOS detected: Manual exclusions required for XProtect (no CLI support)"
            ;;
        MINGW*|MSYS*|CYGWIN*)
            add_windows_defender_exclusions
            ;;
        *)
            log "ERROR: Unsupported OS type: $OS_TYPE"
            exit 1
            ;;
    esac

    log "AV exclusion setup completed successfully"
}

main

echo "ExcludePath /home/ci/go/src/example-project/vendor" >> /etc/clamav/clamd.conf
echo "ExcludePath /var/lib/jenkins/workspace" >> /etc/clamav/clamd.conf
clamdscan --reload

- rule: Write to Sensitive Container Path
  desc: Detect writes to /etc or /usr/bin in containers
  condition: container.id != "" and fd.directory in ("/etc", "/usr/bin") and evt.type=write
  output: "Sensitive write in container (user=%user.name command=%proc.cmdline file=%fd.name)"
  priority: WARNING

resource "aws_guardduty_filter" "ci_exclusions" {
  detector_id = aws_guardduty_detector.main.id
  name        = "ci-build-exclusions"
  action      = "NOOP"
  rank        = 1
  finding_criteria {
    criterion {
      field = "resource.instanceDetails.instanceId"
      equals = ["i-1234567890abcdef0", "i-0987654321fedcba0"]
    }
    criterion {
      field = "resource.s3BucketDetails.name"
      equals = ["ci-build-artifacts"]
    }
  }
}