@@ -391,7 +391,7 @@ int scanfd(

     context.filename = fdstr;

     context.virsize  = 0;

     context.scandata = NULL;

-    ret              = cl_scandesc_callback(fd, NULL, &virname, scanned, engine, options, &context);

+    ret              = cl_scandesc_callback(fd, conn->filename, &virname, scanned, engine, options, &context);

     thrmgr_setactivetask(NULL, NULL);

     if (thrmgr_group_need_terminate(conn->group)) {

@@ -564,7 +564,7 @@ int scanstream(

         context.filename = peer_addr;

         context.virsize  = 0;

         context.scandata = NULL;

-        ret              = cl_scandesc_callback(tmpd, NULL, &virname, scanned, engine, options, &context);

+        ret              = cl_scandesc_callback(tmpd, tmpname, &virname, scanned, engine, options, &context);

         thrmgr_setactivetask(NULL, NULL);

     } else {

         ret = -1;

@@ -160,10 +160,11 @@ struct cl_scan_options {

 };

 /* general */

-#define CL_SCAN_GENERAL_ALLMATCHES                  0x1 /* scan in all-match mode */

-#define CL_SCAN_GENERAL_COLLECT_METADATA            0x2 /* collect metadata (--gen-json) */

-#define CL_SCAN_GENERAL_HEURISTICS                  0x4 /* option to enable heuristic alerts */

-#define CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE        0x8 /* allow heuristic match to take precedence. */

+#define CL_SCAN_GENERAL_ALLMATCHES                  0x1  /* scan in all-match mode */

+#define CL_SCAN_GENERAL_COLLECT_METADATA            0x2  /* collect metadata (--gen-json) */

+#define CL_SCAN_GENERAL_HEURISTICS                  0x4  /* option to enable heuristic alerts */

+#define CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE        0x8  /* allow heuristic match to take precedence. */

+#define CL_SCAN_GENERAL_UNPRIVILEGED                0x10 /* scanner will not have read access to files. */

 /* parsing capabilities options */

 #define CL_SCAN_PARSE_ARCHIVE                       0x1

@@ -493,6 +493,7 @@ extern int have_rar;

 #define SCAN_COLLECT_METADATA (ctx->options->general & CL_SCAN_GENERAL_COLLECT_METADATA)

 #define SCAN_HEURISTICS (ctx->options->general & CL_SCAN_GENERAL_HEURISTICS)

 #define SCAN_HEURISTIC_PRECEDENCE (ctx->options->general & CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE)

+#define SCAN_UNPRIVILEGED (ctx->options->general & CL_SCAN_GENERAL_UNPRIVILEGED)

 #define SCAN_PARSE_ARCHIVE (ctx->options->parse & CL_SCAN_PARSE_ARCHIVE)

 #define SCAN_PARSE_ELF (ctx->options->parse & CL_SCAN_PARSE_ELF)

@@ -276,6 +276,9 @@ static cl_error_t cli_scanrar(const char *filepath, int desc, cli_ctx *ctx)

         if (unrar_ret == UNRAR_EMEM) {

             status = CL_EMEM;

             goto done;

+        } else if (unrar_ret == UNRAR_EOPEN) {

+            status = CL_EOPEN;

+            goto done;

         } else {

             status = CL_EFORMAT;

             goto done;

@@ -2871,11 +2874,15 @@ static int cli_scanraw(cli_ctx *ctx, cli_file_t type, uint8_t typercg, cli_file_

                             cli_set_container(ctx, CL_TYPE_RAR, csize);

                             cli_dbgmsg("RAR/RAR-SFX signature found at %u\n", (unsigned int)fpt->offset);

-                            if ((ctx->sub_filepath == NULL) || (fpt->offset != 0)) {

+#ifdef _WIN32

+                            if ((fpt->offset != 0) || (SCAN_UNPRIVILEGED) || (NULL == ctx->sub_filepath) || (0 != _access_s(ctx->sub_filepath, R_OK))) {

+#else

+                            if ((fpt->offset != 0) || (SCAN_UNPRIVILEGED) || (NULL == ctx->sub_filepath) || (0 != access(ctx->sub_filepath, R_OK))) {

+#endif

                                 /*

-                             * If map is not file-backed, or offset is not at the start of the file...

-                             * ...have to dump to file for scanrar.

-                             */

+                                 * If map is not file-backed, or offset is not at the start of the file...

+                                 * ...have to dump to file for scanrar.

+                                 */

                                 nret = fmap_dump_to_file(map, ctx->sub_filepath, ctx->engine->tmpdir, &tmpname, &tmpfd, fpt->offset, fpt->offset + csize);

                                 if (nret != CL_SUCCESS) {

                                     cli_dbgmsg("cli_scanraw: failed to generate temporary file.\n");

@@ -2894,6 +2901,25 @@ static int cli_scanraw(cli_ctx *ctx, cli_file_t type, uint8_t typercg, cli_file_

                             /* scan file */

                             nret = cli_scanrar(filepath, fd, ctx);

+                            if ((NULL == tmpname) && (CL_EOPEN == nret)) {

+                                /*

+                                 * Failed to open the file using the original filename.

+                                 * Try writing the file descriptor to a temp file and try again.

+                                 */

+                                nret = fmap_dump_to_file(map, ctx->sub_filepath, ctx->engine->tmpdir, &tmpname, &tmpfd, fpt->offset, fpt->offset + csize);

+                                if (nret != CL_SUCCESS) {

+                                    cli_dbgmsg("cli_scanraw: failed to generate temporary file.\n");

+                                    ret        = nret;

+                                    break_loop = 1;

+                                    break;

+                                }

+                                filepath = tmpname;

+                                fd       = tmpfd;

+

+                                /* try to scan again */

+                                nret = cli_scanrar(filepath, fd, ctx);

+                            }

+

                             if (tmpfd != -1) {

                                 /* If dumped tempfile, need to cleanup */

                                 close(tmpfd);

@@ -3521,7 +3547,11 @@ static int magic_scandesc(cli_ctx *ctx, cli_file_t type)

                 char *tmpname = NULL;

                 int tmpfd     = -1;

-                if (ctx->sub_filepath == NULL) {

+#ifdef _WIN32

+                if ((SCAN_UNPRIVILEGED) || (NULL == ctx->sub_filepath) || (0 != _access_s(ctx->sub_filepath, R_OK))) {

+#else

+                if ((SCAN_UNPRIVILEGED) || (NULL == ctx->sub_filepath) || (0 != access(ctx->sub_filepath, R_OK))) {

+#endif

                     /* If map is not file-backed have to dump to file for scanrar. */

                     ret = fmap_dump_to_file(*ctx->fmap, ctx->sub_filepath, ctx->engine->tmpdir, &tmpname, &tmpfd, 0, SIZE_MAX);

                     if (ret != CL_SUCCESS) {

@@ -3539,6 +3569,23 @@ static int magic_scandesc(cli_ctx *ctx, cli_file_t type)

                 /* scan file */

                 ret = cli_scanrar(filepath, fd, ctx);

+                if ((NULL == tmpname) && (CL_EOPEN == ret)) {

+                    /*

+                     * Failed to open the file using the original filename.

+                     * Try writing the file descriptor to a temp file and try again.

+                     */

+                    ret = fmap_dump_to_file(*ctx->fmap, ctx->sub_filepath, ctx->engine->tmpdir, &tmpname, &tmpfd, 0, SIZE_MAX);

+                    if (ret != CL_SUCCESS) {

+                        cli_dbgmsg("cli_scanraw: failed to generate temporary file.\n");

+                        break;

+                    }

+                    filepath = tmpname;

+                    fd       = tmpfd;

+

+                    /* try to scan again */

+                    ret = cli_scanrar(filepath, fd, ctx);

+                }

+

                 if (tmpfd != -1) {

                     /* If dumped tempfile, need to cleanup */

                     close(tmpfd);

@@ -4265,17 +4312,7 @@ static cl_error_t scan_common(int desc, cl_fmap_t *map, const char *filepath, co

         }

     }

-    /* Best effort to determine the filename if not provided.

-     * May still be NULL if filename could not be determined. */

-    if (filepath == NULL) {

-        char *fpath = NULL;

-

-        if (desc >= 0) {

-            (void)cli_get_filepath_from_filedesc(desc, &fpath);

-        }

-

-        ctx.target_filepath = fpath;

-    } else {

+    if (filepath != NULL) {

         ctx.target_filepath = strdup(filepath);

     }

@@ -135,6 +135,7 @@ static cl_unrar_error_t unrar_retcode(int retcode)

         }

         case ERAR_EOPEN: {

             unrar_dbgmsg("unrar_retcode: Volume open error.\n");

+            status = UNRAR_EOPEN;

             break;

         }

         case ERAR_ECREATE: {

@@ -50,7 +50,8 @@ typedef enum cl_unrar_error_tag {

     UNRAR_BREAK,

     UNRAR_ENCRYPTED,

     UNRAR_EMEM,

-    UNRAR_ERR

+    UNRAR_ERR,

+    UNRAR_EOPEN

 } cl_unrar_error_t;

 typedef struct unrar_metadata_tag {