ESET FILE SECURITY - 6.1. Handle Object Policy; 6.2. User Specific Configuration

22
ESET File Security
6.1. Handle Object Policy
TheHandleObjectPolicy(seegure6-1)mechanismprovideslteringofscannedobjects
basedontheirstatus.Thisfunctionalityisbasedonthefollowingcongurationoptions:‘action_
av‘,‘action_av_infected‘,‘action_av_notscanned‘,‘action_av_deleted‘.Fordetailedinformationon
these options, please refer to the esets.cfg(5) man page.
Figure 6-1. Scheme of Handle Object Policy mechanism.
Every object processed is rst handled according to the conguration of the‘action_av‘
option. If this option is set to ‘accept‘ (or ‘defer‘, ‘discard‘, ‘reject‘) the object is accepted (or deferred,
discarded,rejected).Iftheoptionissetto‘scan‘theobjectisscannedforvirusinltrations,andif
the‘av_clean_mode‘optionissetto'yes',theobjectisalsocleaned.Inaddition,theconguration
options  ‘action_av_infected‘, ‘action_av_notscanned‘ and ‘action_av_deleted‘ are taken into
account to further evaluate handling of the object. If an ‘accept‘ action has been taken as a result
of these three action options, the object is accepted. Otherwise, the object is blocked.
6.2. User Specic Conguration
The purpose of the User Specic Conguration mechanism is to provide a higher degree
ofcustomizationandfunctionality.ItallowsthesytemadministratortodeneESETS antivirus
scannerparametersbasedontheuserwhoisaccessinglesystemobjects.
Adetaileddescriptionofthisfunctionalitycanbefoundintheesets.cfg(5)manpage;inthis
sectionwewillprovideonlyashortexampleofauser-specicconguration.
In this example, the goal is to use the esets_dacmoduletocontroltheON_OPENandON_
EXEC access events for an external disc mounted under the ”/home” directory. The module can
beconguredinthe[dac]sectionoftheESETScongurationle.Seebelow:
[dac]
agent_enabled = yes
event_mask = ”open”
ctl_incl = ”/home”
action_av = ”scan”
Tospecifyscansettingsforanindividualuser,the‘user_cong’parametermustspecifythe
accept
defer, discard, reject
action_av
object not accepted
accept defer, discard, reject
action_av_infected
action_av_notscanned
action_av_deleted
object not accepted
object accepted
scan