(#5032) Enable ClamAV for MEO

composer.json

@@ -48,6 +48,7 @@
         "drupal/admin_toolbar": "^3.4",
         "drupal/akamai": "^5.0@RC",
         "drupal/autologout": "^1.4",
+        "drupal/clamav": "^2.1",
         "drupal/config_perms": "^2.1",
         "drupal/core-composer-scaffold": "~10.4.5",
         "drupal/core-recommended": "~10.4.5",

docker/web/Dockerfile

@@ -68,6 +68,7 @@ RUN DEBIAN_FRONTEND=noninteractive \
   php8.3-zip \
   mysql-client-8.0 \
   git \
+  clamav \
   imagemagick \
   vim \
   zip \
@@ -78,6 +79,9 @@ RUN DEBIAN_FRONTEND=noninteractive \
   xvfb \
   libgtk-3-0
 
+# Update ClamAV
+RUN freshclam
+
 # Copy up the available sites config. The startup script
 # manipulates this file based on env vars.
 COPY ./build/000-default.conf /etc/apache2/sites-available/000-default.conf

docroot/profiles/custom/cgov_site/modules/custom/cgov_core/cgov_core.info.yml

@@ -6,6 +6,7 @@ core_version_requirement: '^9.4 || ^10'
 dependencies:
   - 'cgov_adobe:cgov_adobe'
   - 'cgov_core:cgov_core'
+  - 'clamav:clamav'
   - 'config_perms:config_perms'
   - 'drupal:block'
   - 'drupal:block_content'

docroot/profiles/custom/cgov_site/modules/custom/cgov_core/cgov_core.install

@@ -278,3 +278,30 @@ function cgov_core_update_10014() {
     $installer->install(['nci_ckeditor5_enhancements']);
   }
 }
+
+/**
+ * Update for Clam AV. (Issue #3755)
+ */
+function cgov_core_update_10015() {
+  // Enable clam_av, but only on MEO.
+  if (!\Drupal::moduleHandler()->moduleExists('clamav') && getenv('AH_ENVIRONMENT_TYPE') === "meo") {
+    $installer = \Drupal::service('module_installer');
+    $installer->install(['clamav']);
+
+    // Make extra sure all our settings are in place.
+    $config = \Drupal::configFactory()->getEditable('clamav.settings');
+    // Specifically enable clamscan scanning only via update hook.
+    // This prevents scanning from running on lower-tier environments
+    // at the moment until they are on Acquia Cloud Next.
+    $config->set('enabled', TRUE);
+    $config->set('outage_action', 1);
+    $config->set('scan_mode', 1);
+    $config->set('verbosity', 0);
+    $config->set('mode_executable', [
+      'executable_path' => '/usr/bin/clamscan',
+      'executable_parameters' => '',
+    ]);
+    $config->save();
+
+  }
+}

docroot/profiles/custom/cgov_site/modules/custom/cgov_core/config/install/clamav.settings.yml

@@ -0,0 +1,13 @@
+enabled: false
+outage_action: 1
+overridden_schemes: {  }
+scan_mode: 1
+verbosity: 0
+mode_executable:
+  executable_path: /usr/bin/clamscan
+  executable_parameters: ''
+mode_daemon_tcpip:
+  hostname: localhost
+  port: 3310
+mode_daemon_unixsocket:
+  unixsocket: /var/clamav/clamd