pg_snakeoil
pg_snakeoil
pg_snakeoil : The PostgreSQL Antivirus
Overview
| ID | Extension | Package | Version | Category | License | Language |
|---|---|---|---|---|---|---|
| 7380 | pg_snakeoil | pg_snakeoil | 1.4 | SEC | PostgreSQL | C |
| Attribute | Has Binary | Has Library | Need Load | Has DDL | Relocatable | Trusted |
|---|---|---|---|---|---|---|
--sLd-r | No | Yes | Yes | Yes | yes | no |
| Relationships | |
|---|---|
| See Also | pg_crash pg_cheat_funcs pg_dirtyread pg_savior pg_surgery pageinspect pg_catcheck amcheck |
require clamV libs
Packages
| Type | Repo | Version | PG Major Compatibility | Package Pattern | Dependencies |
|---|---|---|---|---|---|
| EXT | MIXED | 1.4 | 18 17 16 15 14 | pg_snakeoil | - |
| RPM | PIGSTY | 1.4 | 18 17 16 15 14 | pg_snakeoil_$v | - |
| DEB | PGDG | 1.4 | 18 17 16 15 14 | postgresql-$v-snakeoil | - |
| Linux / PG | PG18 | PG17 | PG16 | PG15 | PG14 |
|---|---|---|---|---|---|
el8.x86_64 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 |
el8.aarch64 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 |
el9.x86_64 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 |
el9.aarch64 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 |
el10.x86_64 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 |
el10.aarch64 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 | PIGSTY 1.4 |
d12.x86_64 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 |
d12.aarch64 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 |
d13.x86_64 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 |
d13.aarch64 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 |
u22.x86_64 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 |
u22.aarch64 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 |
u24.x86_64 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 |
u24.aarch64 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 | PGDG 1.4 |
Source
pig build pkg pg_snakeoil; # build rpmInstall
Make sure PGDG and PIGSTY repo available:
pig repo add pgsql -u # add both repo and update cacheInstall this extension with pig:
pig install pg_snakeoil; # install via package name, for the active PG version
pig install pg_snakeoil -v 18; # install for PG 18
pig install pg_snakeoil -v 17; # install for PG 17
pig install pg_snakeoil -v 16; # install for PG 16
pig install pg_snakeoil -v 15; # install for PG 15
pig install pg_snakeoil -v 14; # install for PG 14Config this extension to shared_preload_libraries:
shared_preload_libraries = 'pg_snakeoil';Create this extension with:
CREATE EXTENSION pg_snakeoil;Usage
pg_snakeoil provides ClamAV virus scanning of data stored in PostgreSQL without interfering with normal database operations.
CREATE EXTENSION pg_snakeoil;Functions
| Function | Returns | Description |
|---|---|---|
so_is_infected(text) | bool | Check if text data matches a virus signature |
so_is_infected(bytea) | bool | Check if bytea data matches a virus signature |
so_virus_name(text) | text | Return virus name if infected, empty string otherwise |
so_virus_name(bytea) | text | Return virus name if infected, NULL otherwise |
so_update_signatures() | bool | Reload virus signatures, true if changed |
Ad-hoc Scanning
SELECT so_is_infected('Not a virus!');
-- f
SELECT so_is_infected('X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*');
-- t
SELECT so_virus_name('X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*');
-- Eicar-Test-SignatureOn-Access Protection with Domains
CREATE DOMAIN safe_text AS text CHECK (NOT so_is_infected(value));
CREATE TABLE t1 (safe safe_text);
INSERT INTO t1 VALUES ('This text is safe!');
-- INSERT
INSERT INTO t1 VALUES('X5O!P%@AP...');
-- NOTICE: Virus found: Eicar-Test-Signature
-- ERROR: value for domain safe_text violates check constraint "safe_text_check"On-Access Protection with Triggers
CREATE OR REPLACE FUNCTION check_virus() RETURNS trigger AS $$
BEGIN
IF so_is_infected(NEW.content) THEN
RAISE EXCEPTION 'Virus detected: %', so_virus_name(NEW.content);
END IF;
RETURN NEW;
END;
$$ LANGUAGE plpgsql;
CREATE TRIGGER virus_check BEFORE INSERT OR UPDATE ON uploads
FOR EACH ROW EXECUTE FUNCTION check_virus();Last updated on