@@ -85,13 +85,7 @@ static int onas_fan_scanfile(int fan_fd, const char *fname, struct fanotify_even

 	    logg("ScanOnAccess: %s: %s FOUND\n", fname, virname);

 	virusaction(fname, virname, tharg->opts);

-	if(!optget(tharg->opts, "OnAccessPreventRead")->enabled && fmd->mask & FAN_ACCESS_PERM) {

-		res.response = FAN_ALLOW;

-	} else if(!optget(tharg->opts, "OnAccessPreventOpen")->enabled && fmd->mask & FAN_OPEN_PERM) {

-		res.response = FAN_ALLOW;

-	} else {

-		res.response = FAN_DENY;

-	}

+	res.response = FAN_DENY;

     }

     if(fmd->mask & FAN_ALL_PERM_EVENTS) {

@@ -112,7 +106,7 @@ void *onas_fan_th(void *arg)

 	short int scan;

 	int sizelimit = 0, extinfo;

 	STATBUF sb;

-        uint64_t fan_mask = FAN_OPEN_PERM | FAN_ACCESS_PERM | FAN_EVENT_ON_CHILD;

+        uint64_t fan_mask = FAN_ACCESS_PERM | FAN_OPEN_PERM | FAN_EVENT_ON_CHILD;

         fd_set rfds;

 	char buf[4096];

 	ssize_t bread;

@@ -167,7 +161,18 @@ void *onas_fan_th(void *arg)

 	    fan_mask |= FAN_OPEN; 

     }

-    if (!optget(tharg->opts, "OnAccessDisableDDD")->enabled) {

+    if ((pt = optget(tharg->opts, "OnAccessMountPath"))->enabled) {

+	    while(pt) {

+		    if(fanotify_mark(onas_fan_fd, FAN_MARK_ADD | FAN_MARK_MOUNT,

+					    FAN_OPEN | FAN_ACCESS | FAN_EVENT_ON_CHILD, onas_fan_fd, pt->strarg) != 0) {

+			    logg("!ScanOnAccess: Can't include mountpoint '%s'\n", pt->strarg);

+			    return NULL;

+		    } else

+			    logg("ScanOnAccess: Protecting '%s' and rest of mount.\n", pt->strarg);

+		    pt = (struct optstruct *) pt->nextarg;

+	    }

+

+    } else if (!optget(tharg->opts, "OnAccessDisableDDD")->enabled) {

 	    do {

 		    if(pthread_attr_init(&ddd_attr)) break;

 		    pthread_attr_setdetachstate(&ddd_attr, PTHREAD_CREATE_JOINABLE);

@@ -556,6 +556,14 @@ Example

 # Default: no

 #ScanOnAccess yes

+# Set the  mount point to be scanned. The mount point specified, or the mount point 

+# containing the specified directory will be watched. If any directories are specified, 

+# this option will preempt the DDD system. This will notify only. It can be used multiple times.

+# (On-access scan only)

+# Default: disabled

+#OnAccessMountPath /

+#OnAccessMountPath /home/user

+

 # Don't scan files larger than OnAccessMaxFileSize

 # Value of 0 disables the limit.

 # Default: 5M

@@ -392,6 +392,8 @@ const struct clam_option __clam_options[] = {

     /* OnAccess settings */

     { "ScanOnAccess", NULL, 0, CLOPT_TYPE_BOOL, MATCH_BOOL, -1, NULL, 0, OPT_CLAMD, "This option enables on-access scanning (Linux only)", "no" },

+    { "OnAccessMountPath", NULL, 0, CLOPT_TYPE_STRING, NULL, -1, NULL, FLAG_MULTIPLE, OPT_CLAMD, "This option specifies a directory or mount point which should be scanned on access. The mount point specified, or the mount point containing the specified directory will be watched, but only notifications will occur. If any directories are specified, this option will preempt the DDD system. It can also be used multiple times.", "/\n/home/user" },

+

     { "OnAccessIncludePath", "on-access-include", 0, CLOPT_TYPE_STRING, NULL, -1, NULL, FLAG_MULTIPLE, OPT_CLAMD, "This option specifies a directory (including all files and directories\ninside it), which should be scanned on access. This option can\nbe used multiple times.", "/home\n/students" },

     { "OnAccessExcludePath", NULL, 0, CLOPT_TYPE_STRING, NULL, -1, NULL, FLAG_MULTIPLE, OPT_CLAMD, "This option allows excluding directories from on-access scanning. It can\nbe used multiple times. Only works with DDD system.", "/home/bofh\n/root" },

@@ -400,7 +402,7 @@ const struct clam_option __clam_options[] = {

     { "OnAccessMaxFileSize", NULL, 0, CLOPT_TYPE_SIZE, MATCH_SIZE, 5242880, NULL, 0, OPT_CLAMD, "Files larger than this value will not be scanned in on access.", "5M" },

-    { "OnAccessDisableDDD", "disable-ddd", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD, "This option toggles the dynamic directory determination system for on-access scanning (Linux only)", "no" },

+    { "OnAccessDisableDDD", "disable-ddd", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD, "This option toggles the dynamic directory determination system for on-access scanning (Linux only).", "no" },

     { "OnAccessPreventRead", NULL, 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 1, NULL, 0, OPT_CLAMD, "This option specifies is fanotify will prevent read attempts on malicious files (Linux only)", "yes" },