devshield-scanner 0.2.0__tar.gz → 0.2.1__tar.gz

{devshield_scanner-0.2.0/devshield_scanner.egg-info → devshield_scanner-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devshield-scanner
-Version: 0.2.0
+Version: 0.2.1
 Summary: Linux host/Docker inspection with opt-in response for detected process executables
 License-Expression: MIT
 Classifier: Development Status :: 3 - Alpha
@@ -14,13 +14,15 @@ Dynamic: license-file
 
 # DevShield for Linux
 
+0.2.1 fixes custom scan-limit propagation: `--max-filesize-mb`, `--max-scansize-mb`, and `--max-files` now apply to running-process snapshots as well as filesystem/container scans. Use `--remediate-running --skip-host --skip-docker` to run only the process stage. This remains an opt-in mode that can interrupt services.
+
 ## Process-first response (0.2.0)
 
 `sudo /opt/devshield/bin/devshield --remediate-running` first snapshots and scans running executables, sends SIGKILL to signature-detected processes, and attempts to move matching host executables into `/var/lib/devshield/quarantine`. It then scans host files and Docker data. Without this flag, scanning remains read-only. This is an experimental opt-in response mode and can interrupt production services. Process response currently requires root and Python/Linux pidfd support (normally Python 3.9+ and Linux 5.3+).
 
 Heuristic, PUA, encrypted-content, scan-limit and EICAR test alerts never trigger automatic process response. Evidence copies and action records are saved before termination. PID 1, DevShield and its ancestors are excluded. Original-file moves require a matching inode and a same-filesystem rename; failures are reported rather than falling back to destructive copy/delete. Container executables are not moved: rebuild affected containers from trusted images. Supervisors may restart terminated processes. Script interpreters, injected code, memory-only malware and persistence are not comprehensively inspected, and files found during the subsequent host/container scan are not automatically removed. Quarantine samples must not be executed. Quarantine is excluded from later scans.
 
-`--max-files 200000` raises the archive member-count limit when needed. Example for the large container export discussed during validation: `devshield --remediate-running --max-files 200000 --max-filesize-mb 1536 --max-scansize-mb 2048`. Limits do not apply to process snapshots, which retain ClamAV defaults with limit alerts. Increasing limits raises resource use. A privileged attacker can still evade or interfere with live-host inspection. There is no guarantee of complete malware removal.
+`--max-files 200000` raises the archive member-count limit when needed. Increasing limits raises resource use. A privileged attacker can still evade or interfere with live-host inspection. There is no guarantee of complete malware removal.
 
 An installable Python CLI package is included. The Python distribution is `devshield-scanner`; the command is `devshield`. See **INSTALL.md** for isolated installation under `/opt/devshield`. `devshield --version` displays the CLI version.
 

{devshield_scanner-0.2.0 → devshield_scanner-0.2.1}/README.md

@@ -1,12 +1,14 @@
 # DevShield for Linux
 
+0.2.1 fixes custom scan-limit propagation: `--max-filesize-mb`, `--max-scansize-mb`, and `--max-files` now apply to running-process snapshots as well as filesystem/container scans. Use `--remediate-running --skip-host --skip-docker` to run only the process stage. This remains an opt-in mode that can interrupt services.
+
 ## Process-first response (0.2.0)
 
 `sudo /opt/devshield/bin/devshield --remediate-running` first snapshots and scans running executables, sends SIGKILL to signature-detected processes, and attempts to move matching host executables into `/var/lib/devshield/quarantine`. It then scans host files and Docker data. Without this flag, scanning remains read-only. This is an experimental opt-in response mode and can interrupt production services. Process response currently requires root and Python/Linux pidfd support (normally Python 3.9+ and Linux 5.3+).
 
 Heuristic, PUA, encrypted-content, scan-limit and EICAR test alerts never trigger automatic process response. Evidence copies and action records are saved before termination. PID 1, DevShield and its ancestors are excluded. Original-file moves require a matching inode and a same-filesystem rename; failures are reported rather than falling back to destructive copy/delete. Container executables are not moved: rebuild affected containers from trusted images. Supervisors may restart terminated processes. Script interpreters, injected code, memory-only malware and persistence are not comprehensively inspected, and files found during the subsequent host/container scan are not automatically removed. Quarantine samples must not be executed. Quarantine is excluded from later scans.
 
-`--max-files 200000` raises the archive member-count limit when needed. Example for the large container export discussed during validation: `devshield --remediate-running --max-files 200000 --max-filesize-mb 1536 --max-scansize-mb 2048`. Limits do not apply to process snapshots, which retain ClamAV defaults with limit alerts. Increasing limits raises resource use. A privileged attacker can still evade or interfere with live-host inspection. There is no guarantee of complete malware removal.
+`--max-files 200000` raises the archive member-count limit when needed. Increasing limits raises resource use. A privileged attacker can still evade or interfere with live-host inspection. There is no guarantee of complete malware removal.
 
 An installable Python CLI package is included. The Python distribution is `devshield-scanner`; the command is `devshield`. See **INSTALL.md** for isolated installation under `/opt/devshield`. `devshield --version` displays the CLI version.
 

{devshield_scanner-0.2.0 → devshield_scanner-0.2.1}/devshield_linux.py

@@ -15,6 +15,17 @@ import time
 from devshield_processes import inspect_running
 
 
+def clamav_limits(args):
+    options = []
+    if args.max_filesize_mb is not None:
+        options.append(f'--max-filesize={args.max_filesize_mb}M')
+    if args.max_scansize_mb is not None:
+        options.append(f'--max-scansize={args.max_scansize_mb}M')
+    if args.max_files is not None:
+        options.append(f'--max-files={args.max_files}')
+    return options
+
+
 def coverage_warnings(log_path):
     """Read logs incrementally; a zero exit code alone does not establish coverage."""
     warnings = set()
@@ -36,7 +47,7 @@ def coverage_warnings(log_path):
 
 def main():
     parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument('--version', action='version', version='DevShield 0.2.0')
+    parser.add_argument('--version', action='version', version='DevShield 0.2.1')
     parser.add_argument('--remediate-running', action='store_true', help='FIRST scan process executables; kill signature-detected processes and quarantine host binaries. Can interrupt services.')
     parser.add_argument('--quarantine', default='/var/lib/devshield/quarantine', help='Root-owned 0700 quarantine directory')
     parser.add_argument('--max-files', type=int, help='ClamAV maximum archive member count')
@@ -49,6 +60,7 @@ def main():
     parser.add_argument('--temp-dir', help='Scratch filesystem with enough space for container exports')
     parser.add_argument('--heartbeat', type=int, default=10)
     args = parser.parse_args()
+    scan_options = clamav_limits(args)
     if not sys.platform.startswith('linux'):
         parser.error('Run this script on Linux.')
     if args.heartbeat < 1:
@@ -110,12 +122,7 @@ def main():
     def scan(path, label, excludes=()):
         command = ['clamscan', '--recursive=yes', '--infected', '--verbose', '--scan-archive=yes',
                    '--cross-fs=yes', '--follow-dir-symlinks=0', '--follow-file-symlinks=0', '--alert-exceeds-max=yes']
-        if args.max_filesize_mb is not None:
-            command.append(f'--max-filesize={args.max_filesize_mb}M')
-        if args.max_scansize_mb is not None:
-            command.append(f'--max-scansize={args.max_scansize_mb}M')
-        if args.max_files is not None:
-            command.append(f'--max-files={args.max_files}')
+        command.extend(scan_options)
         command.extend('--exclude-dir=^' + re.escape(str(Path(p).resolve())) + r'(/|$)' for p in excludes)
         rc, log = run([*command, '--', str(path)], label)
         warnings = coverage_warnings(log)
@@ -136,7 +143,7 @@ def main():
         report['engine'] = version.stdout.strip()
         save()
         if args.remediate_running:
-            inspect_running(run, issue, save, report, scratch.name, args.quarantine, coverage_warnings)
+            inspect_running(run, issue, save, report, scratch.name, args.quarantine, coverage_warnings, scan_options)
         if not args.skip_host:
             if not Path(args.host_root).is_dir():
                 issue('Host root is not a directory: ' + args.host_root)

{devshield_scanner-0.2.0 → devshield_scanner-0.2.1}/devshield_processes.py

@@ -7,6 +7,10 @@ import signal
 import stat
 
 
+def process_scan_command(snapshot, scan_options=()):
+    return ['clamscan', '--infected', '--alert-exceeds-max=yes', *scan_options, '--', str(snapshot)]
+
+
 def signature_names(log_path):
     names = []
     with open(log_path, encoding='utf-8', errors='replace') as stream:
@@ -56,7 +60,7 @@ def move_original(source, before, destination):
         os.close(parentfd)
 
 
-def inspect_running(run, issue, save, report, scratch, quarantine, coverage_warnings):
+def inspect_running(run, issue, save, report, scratch, quarantine, coverage_warnings, scan_options=()):
     """Scan immutable copies, pin process identities, preserve evidence before SIGKILL."""
     if os.geteuid() != 0:
         issue('Running-process response requires root; stage skipped.')
@@ -97,7 +101,7 @@ def inspect_running(run, issue, save, report, scratch, quarantine, coverage_warn
                             target.write(block)
                     with snapshot.open('rb') as target:
                         snapshot_hash = digest(target)
-                    rc, log = run(['clamscan', '--infected', '--alert-exceeds-max=yes', '--', str(snapshot)], f'Process executable PID {pid}')
+                    rc, log = run(process_scan_command(snapshot, scan_options), f'Process executable PID {pid}')
                     for warning in coverage_warnings(log):
                         issue(f'PID {pid}: {warning} See {log}')
                     names = signature_names(log) if rc == 1 else []

{devshield_scanner-0.2.0 → devshield_scanner-0.2.1/devshield_scanner.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devshield-scanner
-Version: 0.2.0
+Version: 0.2.1
 Summary: Linux host/Docker inspection with opt-in response for detected process executables
 License-Expression: MIT
 Classifier: Development Status :: 3 - Alpha
@@ -14,13 +14,15 @@ Dynamic: license-file
 
 # DevShield for Linux
 
+0.2.1 fixes custom scan-limit propagation: `--max-filesize-mb`, `--max-scansize-mb`, and `--max-files` now apply to running-process snapshots as well as filesystem/container scans. Use `--remediate-running --skip-host --skip-docker` to run only the process stage. This remains an opt-in mode that can interrupt services.
+
 ## Process-first response (0.2.0)
 
 `sudo /opt/devshield/bin/devshield --remediate-running` first snapshots and scans running executables, sends SIGKILL to signature-detected processes, and attempts to move matching host executables into `/var/lib/devshield/quarantine`. It then scans host files and Docker data. Without this flag, scanning remains read-only. This is an experimental opt-in response mode and can interrupt production services. Process response currently requires root and Python/Linux pidfd support (normally Python 3.9+ and Linux 5.3+).
 
 Heuristic, PUA, encrypted-content, scan-limit and EICAR test alerts never trigger automatic process response. Evidence copies and action records are saved before termination. PID 1, DevShield and its ancestors are excluded. Original-file moves require a matching inode and a same-filesystem rename; failures are reported rather than falling back to destructive copy/delete. Container executables are not moved: rebuild affected containers from trusted images. Supervisors may restart terminated processes. Script interpreters, injected code, memory-only malware and persistence are not comprehensively inspected, and files found during the subsequent host/container scan are not automatically removed. Quarantine samples must not be executed. Quarantine is excluded from later scans.
 
-`--max-files 200000` raises the archive member-count limit when needed. Example for the large container export discussed during validation: `devshield --remediate-running --max-files 200000 --max-filesize-mb 1536 --max-scansize-mb 2048`. Limits do not apply to process snapshots, which retain ClamAV defaults with limit alerts. Increasing limits raises resource use. A privileged attacker can still evade or interfere with live-host inspection. There is no guarantee of complete malware removal.
+`--max-files 200000` raises the archive member-count limit when needed. Increasing limits raises resource use. A privileged attacker can still evade or interfere with live-host inspection. There is no guarantee of complete malware removal.
 
 An installable Python CLI package is included. The Python distribution is `devshield-scanner`; the command is `devshield`. See **INSTALL.md** for isolated installation under `/opt/devshield`. `devshield --version` displays the CLI version.
 

{devshield_scanner-0.2.0 → devshield_scanner-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "devshield-scanner"
-version = "0.2.0"
+version = "0.2.1"
 description = "Linux host/Docker inspection with opt-in response for detected process executables"
 readme = "README.md"
 requires-python = ">=3.8"