@@ -310,7 +310,8 @@ void *onas_ddd_th(void *arg) {

 				if(onas_ht_add_hierarchy(ddd_ht, pt->strarg)) {

 					logg("!ScanOnAccess: Can't include path '%s'\n", pt->strarg);

 					return NULL;

-				}

+				} else

+					logg("ScanOnAccess: Protecting directory '%s' (and all sub-directories)\n", pt->strarg);

 			}

 			pt = (struct optstruct *) pt->nextarg;

@@ -328,7 +329,8 @@ void *onas_ddd_th(void *arg) {

 				if(onas_ht_rm_hierarchy(ddd_ht, pt->strarg, ptlen, 0)) {

 					logg("!ScanOnAccess: Can't exclude path '%s'\n", pt->strarg);

 					return NULL;

-				}

+				} else

+					logg("ScanOnAccess: Excluding  directory '%s' (and all sub-directories)\n", pt->strarg);

 			}

 			pt = (struct optstruct *) pt->nextarg;

@@ -144,24 +144,41 @@ void *onas_fan_th(void *arg)

 	return NULL;

     }

-    do {

-	    if(pthread_attr_init(&ddd_attr)) break;

-	    pthread_attr_setdetachstate(&ddd_attr, PTHREAD_CREATE_JOINABLE);

-

-	    if(!(ddd_tharg = (struct ddd_thrarg *) malloc(sizeof(struct ddd_thrarg)))) break;

-

-	    ddd_tharg->fan_fd = onas_fan_fd;

-	    ddd_tharg->fan_mask = fan_mask;

-	    ddd_tharg->opts = tharg->opts;

-	    ddd_tharg->engine = tharg->engine;

-	    ddd_tharg->options = tharg->options;

-

-	    if(!pthread_create(&ddd_pid, &ddd_attr, onas_ddd_th, ddd_tharg)) break;

-

-	    free(ddd_tharg);

-	    ddd_tharg=NULL;

-    } while(0);

-    if (!tharg) logg("!Unable to start dynamic directory determination.\n");

+    if (!optget(tharg->opts, "OnAccessDisableDDD")->enabled) {

+	    do {

+		    if(pthread_attr_init(&ddd_attr)) break;

+		    pthread_attr_setdetachstate(&ddd_attr, PTHREAD_CREATE_JOINABLE);

+

+		    if(!(ddd_tharg = (struct ddd_thrarg *) malloc(sizeof(struct ddd_thrarg)))) break;

+

+		    ddd_tharg->fan_fd = onas_fan_fd;

+		    ddd_tharg->fan_mask = fan_mask;

+		    ddd_tharg->opts = tharg->opts;

+		    ddd_tharg->engine = tharg->engine;

+		    ddd_tharg->options = tharg->options;

+

+		    if(!pthread_create(&ddd_pid, &ddd_attr, onas_ddd_th, ddd_tharg)) break;

+

+		    free(ddd_tharg);

+		    ddd_tharg=NULL;

+	    } while(0);

+	    if (!tharg) logg("!Unable to start dynamic directory determination.\n");

+

+    } else {

+	    if((pt = optget(tharg->opts, "OnAccessIncludePath"))->enabled) {

+		    while(pt) {

+			    if(fanotify_mark(onas_fan_fd, FAN_MARK_ADD, fan_mask, onas_fan_fd, pt->strarg) != 0) {

+				    logg("!ScanOnAccess: Can't include path '%s'\n", pt->strarg);

+				    return NULL;

+			    } else

+				    logg("ScanOnAccess: Protecting directory '%s'\n", pt->strarg);

+			    pt = (struct optstruct *) pt->nextarg;

+		    }

+	    } else {

+		    logg("!ScanOnAccess: Please specify at least one path with OnAccessIncludePath\n");

+		    return NULL;

+	    }

+    }

     /* Load other options. */

     sizelimit = optget(tharg->opts, "OnAccessMaxFileSize")->numarg;

@@ -579,6 +579,11 @@ Example

 # Default: disabled

 #OnAccessExcludeUID 0

+# Toggles dynamic directory determination. Allows for recursively watching include paths.

+# (On-access scan only)

+# Default: no

+#OnAccessDisableDDD yes

+

 ##

 ## Bytecode

@@ -400,6 +400,8 @@ const struct clam_option __clam_options[] = {

     { "OnAccessMaxFileSize", NULL, 0, CLOPT_TYPE_SIZE, MATCH_SIZE, 5242880, NULL, 0, OPT_CLAMD, "Files larger than this value will not be scanned in on access.", "5M" },

+    { "OnAccessDisableDDD", "disable-ddd", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD, "This option toggles the dynamic directory determination system for on-access scanning (Linux only)", "no" },

+

     /* FIXME: mark these as private and don't output into clamd.conf/man */

     { "DevACOnly", "dev-ac-only", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, -1, NULL, FLAG_HIDDEN, OPT_CLAMD | OPT_CLAMSCAN, "", "" },