Today I finally upgraded by personal root server from Debian Jessie to Stretch, thereby upgrading Exim from 4.84 to 4.89.
After the upgrade, I observed the following errors in mainlog:
2018-05-31 08:02:03 +0000 1fOIX5-0001rg-AM malware acl condition: cmdline : scanner returned error code: 36096 2018-05-31 08:02:03 +0000 1fOIX5-0001rg-AM H=([IPv6:2a00:6020:1efc:ee20:8857:7824:6a49:8368]) [2a00:6020:1efc:ee20:8857:7824:6a49:8368]:48523 I=[2a01:4f8:141:429::2]:465 Warning: ACL "warn" statement skipped: condition test deferred 2018-05-31 08:02:04 +0000 1fOIX5-0001rg-AM malware acl condition: cmdline : scanner returned error code: 13 2018-05-31 08:02:04 +0000 1fOIX5-0001rg-AM H=([IPv6:2a00:6020:1efc:ee20:8857:7824:6a49:8368]) [2a00:6020:1efc:ee20:8857:7824:6a49:8368]:48523 I=[2a01:4f8:141:429::2]:465 Warning: ACL "warn" statement skipped: condition test deferred 2018-05-31 08:02:05 +0000 1fOIX5-0001rg-AM malware acl condition: cmdline : scanner returned error code: 13 2018-05-31 08:02:05 +0000 1fOIX5-0001rg-AM H=([IPv6:2a00:6020:1efc:ee20:8857:7824:6a49:8368]) [2a00:6020:1efc:ee20:8857:7824:6a49:8368]:48523 I=[2a01:4f8:141:429::2]:465 Warning: ACL "warn" statement skipped: condition test deferred
Each of the three cmdline scanners caused an error, as shown above.
It seems there was a change in Exim from upstream, as reported by another user. Somehow it seems that if you define a cmdline scanner that uses a chain of commands, when there was an error return code encountered in the middle of the chain, the whole chain is considered failed.
To “fix” this issue (or rather work-around it), I changed the three ACL clauses as follows:
warn message = This message contains malware ($malware_name)
set acl_m0 = cmdline:\
- /usr/lib/AntiVir/guard/avscan -s --batch --scan-mode=all %s; /bin/echo -e \N"\navira_retval $?"\N:\
+ /usr/local/bin/avscan_wrapper %s:\
\N^avira_retval 1$\N:\
\N^.*ALERT::[ \t]+([^;]*)[ \t]+;.*$\N
malware = *
I created a “wrapper” that effectively hides error return codes, and forces a return code of 0. The above wrapper looks like this:
#!/bin/bash
ARG="$1"
/usr/lib/AntiVir/guard/avscan -s --batch --scan-mode=all "${ARG}"
/bin/echo -e "\navira_retval $?"
exit 0
To make sure I didn’t break the malware scanning by my changes, I downloaded the EICAR test virus and sent it to myself. Exim caught the “virus” and ditched it.