clamav-clamonnacc fails (seemingly randomly) on certain OnAccessExcludePath directory contents and ignores all further OnAccessExcludePath settings then
Describe the bug
Using OnAccessExcludePath in clamd.conf for clamav-clamonacc, it often fails on seemingly random (sub)directories of the given exclude, and stops parsing any further existing OnAccessExcludePath when this happens.
when running strace it just seems to exit0
strace -f -e trace=inotify_add_watch,inotify_rm_watch clamonacc -F --verbose --config-file /etc/clamav/clamd.conf --fdpass
ClamClient: client setup to scan via fd passing
Clamonacc: daemon is local
strace: Process 1975727 attached
ClamFanotif: kernel-level blocking feature enabled ... preventing malicious files access attempts
ClamScanQueue: initializing event queue consumer ... (5) threads in thread pool
ClamFanotif: max file size limited to 5242880 bytes
strace: Process 1975728 attached
strace: Process 1975729 attached
ClamInotif: starting inotify event loop ...
strace: Process 1975730 attached
Clamonacc: beginning event loops
strace: Process 1975731 attached
ClamFanotif: starting fanotify event loop with process id (1975726) ...
strace: Process 1975732 attached
strace: Process 1975733 attached
ClamInotif: dynamically determining directory hierarchy...
ClamScanQueue: waiting to consume events ...
ClamInotif: watching '/root' (and all sub-directories)
ClamInotif: watching '/opt' (and all sub-directories)
ClamInotif: watching '/tmp' (and all sub-directories)
ClamInotif: watching '/var/tmp' (and all sub-directories)
ClamInotif: watching '/mnt' (and all sub-directories)
ClamInotif: watching '/media' (and all sub-directories)
ClamInotif: watching '/srv' (and all sub-directories)
ClamInotif: watching '/boot' (and all sub-directories)
ClamInotif: watching '/home' (and all sub-directories)
ClamInotif: excluding '/tmp/exclude/META-INF/services' (and all sub-directories)
ClamInotif: excluding '/tmp/exclude/META-INF/versions' (and all sub-directories)
ERROR: ClamInotif: can't exclude '/tmp/exclude/META-INF/versions/11'
[pid 1975728] +++ exited with 0 +++How to reproduce the problem
Adding an OnAccessIncludePath (/tmp/exclude) and in the above case, I just extracted the contents from a java jar file (https://repo1.maven.org/maven2/org/bouncycastle/bcprov-jdk18on/1.84/bcprov-jdk18on-1.84.jar) into /tmp/exclude -> restarting clamav-clamonacc breaks on the directory listed in the strace. This also happens on numerous other dirs in general (puppet folders seem very prone to this as well). there seems to be no real pattern. The files and contents are normal, no special permissions or issues. It also seems from the strace that it doesnt even attempt to talk to the kernel but simply fails immediately.
there seems nothing special for this directory:
# ls -ldZ /tmp/exclude/META-INF/versions/11 2>/dev/null || ls -ld /tmp/exclude/META-INF/versions/11
drwxr-xr-x. 4 root root unconfined_u:object_r:user_tmp_t:s0 4096 Jun 23 08:48 /tmp/exclude/META-INF/versions/11
# stat /tmp/exclude/META-INF/versions/11
File: /tmp/exclude/META-INF/versions/11
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: fd0fh/64783d Inode: 131253 Links: 4
Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)
Context: unconfined_u:object_r:user_tmp_t:s0
Access: 2026-06-23 08:48:43.846485960 +0200
Modify: 2026-06-23 08:48:40.970474959 +0200
Change: 2026-06-23 08:48:40.970474959 +0200
Birth: 2026-06-23 08:34:49.662295184 +0200The directory "/tmp" is included in clamd.conf: OnAccessIncludePath /tmp
the directoy "/tmp/exclude" is excluded in clamd.conf: OnAccessExcludePath /tmp/exclude
Restarting clamav-clamonacc breaks on a /tmp/exclude/META-INF/versions/11 and then stops parsing all other OnAccessExcludePath This issue has persisted for a long time.
max_user_watches is set to a high value, but this seems not relevant since it doesnt even talk to inotify it seems:
cat /proc/sys/fs/inotify/max_user_watches
524288This is the clamav version from https://www.clamav.net/downloads (https://www.clamav.net/downloads/production/clamav-1.5.2.linux.x86_64.rpm)
clamconf -n -c /etc/clamav/ Checking configuration files in /etc/clamav/
Config file: clamd.conf
CacheSize = "262144" ExtendedDetectionInfo = "yes" PidFile = "/var/run/clamd.pid" TemporaryDirectory = "/opt/clamav-tmp" DatabaseDirectory = "/var/lib/clamav" CVDCertsDirectory = "/etc/clamav/certs" LocalSocket = "/run/clamav/clamd.ctl" LocalSocketGroup = "clamav" LocalSocketMode = "666" ExcludePath = "^/proc/", "^/sys/", "^/dev/" ConcurrentDatabaseReload disabled VirusEvent = "/etc/clamav/detected.sh" User = "clamav" OnAccessIncludePath = "/root", "/opt", "/tmp", "/var/tmp", "/mnt", "/media", "/srv", "/boot", "/home" OnAccessExcludePath = "/opt/clamav-tmp", "/opt/quarantine", "/tmp/exclude", "/tmp/anotherexclude", "/opt/aide", "/usr/openv", "/opt/puppetlabs", "/boot/efi" OnAccessExcludeRootUID disabled OnAccessExcludeUname = "clamav", "icinga" OnAccessPrevention = "yes" OnAccessExtraScanning = "yes"
Config file: freshclam.conf
LogFileMaxSize = "2097152" LogTime = "yes" LogRotate = "yes" PidFile = "/var/run/freshclam.pid" DatabaseDirectory = "/var/lib/clamav" CVDCertsDirectory = "/etc/clamav/certs" UpdateLogFile = "/var/log/clamav/freshclam.log" Checks = "24" PrivateMirror = "http://clamav-update.internaldomain.tld:8080/" ScriptedUpdates disabled NotifyClamd = "/etc/clamav/clamd.conf"
clamav-milter.conf not found
Software settings
Version: 1.5.2 Optional features supported: MEMPOOL AUTOIT_EA06 ICONV
Database information
Database directory: /var/lib/clamav bytecode.cvd: version 339, sigs: 80, built on Thu Sep 11 14:29:19 2025 daily.cvd: version 28039, sigs: 355472, built on Mon Jun 22 08:24:57 2026 main.cvd: version 63, sigs: 3287027, built on Wed Dec 17 00:18:22 2025 Total number of signatures: 3642579
Platform information
uname: Linux 4.18.0-553.124.1.el8_10.x86_64 #1 SMP Mon May 11 07:30:18 EDT 2026 x86_64 OS: Linux, ARCH: x86_64, CPU: x86_64 Full OS version: "Red Hat Enterprise Linux release 8.10 (Ootpa)" zlib version: 1.3.2 (1.3.2), compile flags: a9 platform id: 0x0a21e8e80800000002080500
Build information
GNU C: 8.5.0 20210514 (Red Hat 8.5.0-28) (8.5.0) sizeof(void*) = 8 Engine flevel: 232, dconf: 232
Attachments
Source: Cisco-Talos/clamav