Configuration Parameters

The component uses configuration parameters specified in the [LinuxSpider] section of the unified configuration file of Dr.Web Security Space.

Parameter

Description

LogLevel

{logging level}

Logging level of the component.

If a parameter value is not specified, the DefaultLogLevel parameter value from the [Root] section is used.

Default value: Notice

Log

{log type}

Logging method of the component.

Default value: Auto

ExePath

{path to file}

Component executable path.

Default value: /opt/drweb.com/bin/drweb-spider

Start

{boolean}

The component is started by the Dr.Web ConfigD configuration management daemon.

Setting this parameter to Yes instructs the configuration management daemon to start the component immediately, and setting this parameter to No—to shut down the component immediately.

Default value: Depends on the Dr.Web product as part of which the component is supplied.

Mode

{LKM | FANOTIFY | AUTO}

SpIDer Guard operation mode.

Allowed values:

•LKM—use the Dr.Web LKM module installed in the operating system kernel (LKM — Loadable Kernel Module);

•FANOTIFY—use the fanotify monitoring interface;

•AUTO—select an optimal operation mode automatically.

This parameter value should be changed with extreme caution because Linux kernels support both operation modes to a different degree. It is strongly recommended that you set this parameter value to AUTO, as in this case the best mode will be selected for integration with the file system manager at startup. At that, the component will attempt to enable the FANOTIFY mode and, on failure,—LKM. If none of the modes can be set, the component shuts down.

If necessary, you can build the Dr.Web LKM module from source code and install this module by following the instructions in the Appendix F. Building Kernel Module for SpIDer Guard section.

Default value: AUTO

DebugAccess

{boolean}

Log or do not log detailed information on file access attempts at the debug level (with LogLevel = DEBUG).

Default value: No

ExcludedProc

{path to file or path list}

List of processes which file activity is not monitored. If a file operation was initiated by one of the processes specified in the parameter value, the modified or created file will not be scanned.

Multiple values can be specified as a list. List values must be comma-separated and put in quotation marks. The parameter can be specified more than once in the section (in this case, all its values are combined into one list).

Example: Add the wget and curl processes to the list.

•Adding the values with the drweb-ctl cfset command:

# drweb-ctl cfset LinuxSpider.ExcludedProc -a /usr/bin/wget
# drweb-ctl cfset LinuxSpider.ExcludedProc -a /usr/bin/curl

•Adding values to the configuration file.

oTwo values per line:

[LinuxSpider]
ExcludedProc = "/usr/bin/wget", "/usr/bin/curl"

oTwo lines (one value per line):

[LinuxSpider]
ExcludedProc = /usr/bin/wget
ExcludedProc = /usr/bin/curl

To apply the changes, reload the Dr.Web Security Space configuration using the command:

# drweb-ctl reload

Default value: (not specified)

ExcludedFilesystem

{file system name}

File system accessing the files of which will not be monitored.

This option is available only in FANOTIFY mode.

Example: Add the cifs and nfs file systems to the list.

•Adding values with the drweb-ctl cfset command:

# drweb-ctl cfset LinuxSpider.ExcludedFilesystem -a cifs
# drweb-ctl cfset LinuxSpider.ExcludedFilesystem -a nfs

•Adding values to the configuration file.

oTwo values per line:

[LinuxSpider]
ExcludedFilesystem = "cifs", "nfs"

oTwo lines (one value per line):

[LinuxSpider]
ExcludedFilesystem = cifs
ExcludedFilesystem = nfs

To apply the changes, reload the Dr.Web Security Space configuration using the command:

# drweb-ctl reload

Default value: cifs

BlockBeforeScan

{Off | Executables | All}

Block files while being accessed until they are scanned by the monitor (an enhanced or “paranoid” monitoring mode).

Allowed values:

•Off—do not block access to files even if they were not scanned.

•Executables—block access to executable files (PE and ELF files and scripts containing the #! preamble) not scanned by the monitor.

•All—block access to all files not scanned by the monitor.

Files are blocked only in FANOTIFY mode.

Default value: Off

[*] ExcludedPath

{path to file or directory}

Path to an object (file or directory) to be excluded from file monitoring. Either an individual file or an entire directory can be specified. If a directory is specified, all files and subdirectories (including nested ones) will be skipped. You can use file masks (containing characters ? and * as well as character classes [ ], [! ] and [^ ]).

Example: Add the /etc/file1 file and the /usr/bin directory to the list.

•Adding values with the drweb-ctl cfset command:

# drweb-ctl cfset LinuxSpider.ExcludedPath -a /etc/file1
# drweb-ctl cfset LinuxSpider.ExcludedPath -a /usr/bin

•Adding values to the configuration file.

oTwo values per line:

[LinuxSpider]
ExcludedPath = "/etc/file1", "/usr/bin"

oTwo lines (one value per line):

[LinuxSpider]
ExcludedPath = /etc/file1
ExcludedPath = /usr/bin

To apply the changes, reload the Dr.Web Security Space configuration using the command:

# drweb-ctl reload

There is no point in providing paths to symbolic links here as only a direct path to a file is analyzed while scanning it.

Default value: /proc, /sys

[*] OnKnownVirus

{action}

Action to be applied upon detection of a known threat (a virus and so on) in the scanned file.

Allowed values: CURE, QUARANTINE, DELETE.

Default value: CURE

[*] OnIncurable

{action}

Action to be applied upon detection of an incurable threat.

Allowed values: QUARANTINE, DELETE.

Default value: QUARANTINE

[*] OnSuspicious

{action}

Action to be applied upon detection of an unknown threat (or a suspicious object) in the scanned file by using heuristic analysis.