Some updates and more information:
We created a sftp-server. A user is able to upload files over sftp. When a file is uploaded to a certain directory, it must be scanned 'on access'.
As I mentioned in my previous post, we did a preload for the libeset_pac.so library when the ssh daemon in started. We changed the way we do this. First is was with the environment parameter, now we change
ExecStart=/usr/sbin/sshd $OPTIONS
into
ExecStart=/bin/bash -c "LD_PRELOAD=/opt/eset/esets/lib64/libesets_pac.so /usr/sbin/sshd $OPTIONS"
We can see that the library is preloaded:
lsof -p <pid>:
sshd <pid> root mem REG 253,0 318792 555738 /opt/eset/esets/lib64/libesets_pac.so
In the configuration file of eset, the actions and directory for [pac] are set. However, the on access scan is still not performed.
When performing an strace on the pid of sshd (there are multiple, but in some of the children we can find this):
stat("/opt/eset/esets/sbin/esets_daemon", {st_mode=S_IFREG|0755, st_size=1446464, ...}) = 0
shmget(0x32009ce1, 0, 0) = -1 EACCES (Permission denied)
It seems like information is requested about the esets daemon, and some shared memory is accessed, but permission to this shared memory is denied.
When looking at the shared memory segments:
------ Shared Memory Segments --------
key shmid owner perms bytes nattch status
0x32009ce1 1671168 root 644 512 2
0x0113beff 1212417 root 600 1000 7
------ Shared Memory Creator/Last-op PIDs --------
shmid owner cpid lpid
1671168 root 32011 32013
1212417 root 20140 20140
and 32011 is the pid of the eset daemon.
root 32011 1 0 16:08 ? 00:00:00 /opt/eset/esets/sbin/esets_daemon
To conclude, we think that the libesets_pac.so library is loaded correctly, and when a call to open() is made, the function in this library is used. To perform the on access scan the ssh daemon process tries to read from a certain shared memory from the esets daemon, but is not allowed. Following that the scan is not performed. We checked the namespaces of the sshd and eset and they are both the same.
Does anyone has any idea what can be wrong? Or any suggestions for additional tests?
Thank you in advance for your reply.
