NS8 Mail: third-party ClamAV signature rating is not applied to user.conf

Bug
,
1

Summary

On NS8 Mail 1.7.12, changing the third-party ClamAV signature rating from the UI/API is saved correctly in the module environment, but it is not applied to the active clamav-unofficial-sigs configuration.

For example, NS8 reports the configured rating as low and stores:

CLAMAV_CUS_RATING=LOW

However, the active configuration remains:

default_dbs_rating="MEDIUM"

This was reproduced on a production NS8 Mail instance using read-only checks.

Environment

  • NS8 Mail version: 1.7.12

  • ClamAV image: ghcr.io/nethserver/mail-clamav:1.7.12

  • Alpine version inside image: 3.21.7

  • Architecture: x86_64

  • Configuration mode: default volatile CUS configuration (CLAMAV_CUSCFG_VOLUME_FLAGS=O)

No custom ClamAV container files or systemd units are installed.

Expected result

When CLAMAV_CUS_RATING=LOW is configured through the supported NS8 Mail UI/API, the active CUS configuration should become:

default_dbs_rating="LOW"

The selected rating should also survive normal container recreation through the module configuration mechanism.

Actual result

The module environment contains:

CLAMAV_CUS_RATING=LOW

But inside the running container:

CLAMAV_CUS_RATING=unset

The active configuration remains:

default_dbs_rating="MEDIUM"

Reproduction and evidence

The host-side module state contains the expected value:

grep '^CLAMAV_CUS_RATING=' ~/.config/state/environment

Result:

CLAMAV_CUS_RATING=LOW

A normal exec into the container does not receive the variable:

podman exec clamav sh -c \
  'printf "CLAMAV_CUS_RATING=%s\n" "${CLAMAV_CUS_RATING-unset}"'

Result:

CLAMAV_CUS_RATING=unset

The unofficial-signature service currently runs:

ExecStart=podman exec clamav download-sigs cus -s

It does not forward CLAMAV_CUS_RATING to the exec process.

When the environment is explicitly forwarded for a read-only test:

podman exec --env=CLAMAV_* clamav sh -c \
  'printf "CLAMAV_CUS_RATING=%s\n" "$CLAMAV_CUS_RATING"; set-cus-rating | grep "^default_dbs_rating="'

The helper renders:

CLAMAV_CUS_RATING=LOW
default_dbs_rating="LOW"

However, the file remains unchanged:

podman exec clamav grep '^default_dbs_rating=' \
  /etc/clamav-unofficial-sigs/user.conf

Result:

default_dbs_rating="MEDIUM"

Suspected causes

There appear to be two independent problems.

1. Environment variable is not forwarded

clamav-unofficial-sigs.service invokes plain podman exec, so the module-level CLAMAV_CUS_RATING variable is not available to download-sigs.

The wrapper therefore skips this block:

if [ -n "${CLAMAV_CUS_RATING}" ]; then
    set-cus-rating "${CLAMAV_CUS_RATING}"
fi

2. set-cus-rating does not write the result

The current script runs:

sed "/^default_dbs_rating=/ c \default_dbs_rating=\"${CLAMAV_CUS_RATING:?}\"" \
    /etc/clamav-unofficial-sigs/user.conf

There is no -i, redirection, or atomic replacement, so the transformed configuration is written only to stdout.

Also, the documentation says that the rating is passed as the first command argument, but the script ignores $1 and reads only the environment variable.

Relevant source:

The same implementation is still present on the current main branch.

Suggested resolution

Please consider:

  1. Forwarding the module’s ClamAV environment variables when running the unofficial-signature updater, for example through an explicit --env option.

  2. Updating set-cus-rating so it safely and atomically modifies user.conf.

  3. Making the helper consistently use either its positional argument or the environment variable.

  4. Adding an automated test that:

    • configures LOW/MEDIUM/HIGH through the module action;

    • runs the updater;

    • verifies the active value in user.conf;

    • verifies the setting after container recreation.

Operational impact

The UI/API reports low, while ClamAV continues using the default MEDIUM CUS database rating.

This can load more unofficial signatures than the administrator intended and can increase memory consumption during ClamAV database reloads.

2

Thank you for the bug report, I will try to reproduce it.

Edit: bug confirmed ClamAV third-party signatures rating not applied · Issue #8115 · NethServer/dev · GitHub