Clamscan vs clamdscan

Ask Fedora
, , ,
2

clamscan

  • An app to scan fils/dirs directly.
  • Runs with user permissions, can be elevated.
  • Uses unconfined SELinux context.
  • Loads the DB each time it starts.
  • Performs single-threaded scanning.

clamdscan

  • A client interface for the scanning service.
  • Runs with service permissions, configurable.
  • Uses confined SELinux context.
  • Keeps the DB in memory.
  • Allows multi-threaded scanning.

Additional notes for clamdscan:

  • The user should join the virusgroup to use the tool.
  • Requires the clamd service to run and listen on the socket.
  • Scanning the whole filesystem:
    • Requires an explicit config change to elevate the privileges.
    • Requires an explicit SELinux boolean modification.
    • Apparently triggers some dontaudit rules:
      • Still fails to access certain files without denials.
      • Works in permissive SELinux mode.

See also: Use clamdscan on workstation F38 - #3 by vgaetera