EVOLUTION-MANAGER
Edit File: Steps-macOS.html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta http-equiv="Content-Style-Type" content="text/css" /> <meta name="generator" content="pandoc" /> <title></title> <style type="text/css">code{white-space: pre;}</style> <link rel="stylesheet" href="/en/github.css" type="text/css" /> </head> <body> <h1 id="installation-on-macos-mac-os-x">Installation on macOS (Mac OS X)</h1> <p>Below are the steps for installing ClamAV from source on Apple macOS.</p> <hr /> <h2 id="install-prerequisites">Install prerequisites</h2> <p>The easiest way to install prerequisites on macOS is to use <a href="https://brew.sh/">Homebrew</a></p> <ol> <li><p>Install Homebrew<br /> <pre><br /> /usr/bin/ruby -e "$(curl -fsSL <a href="https://raw.githubusercontent.com/Homebrew/install/master/install" class="uri">https://raw.githubusercontent.com/Homebrew/install/master/install</a>)"<br /> </pre></p></li> <li>Install ClamAV dependencies <ol> <li>Install XCode's Command Line Tools<br /> <pre><br /> xcode-select --install<br /> </pre></li> <li>Install library dependencies<br /> <pre><br /> brew install openssl zlib pcre2 json-c<br /> </pre></li> </ol></li> <li><p>Install the unit testing dependencies<br /> <pre><br /> brew install valgrind check check-devel<br /> </pre></p> <p><em>Tip</em>: Valgrind may not be available in Homebrew for the latest version of macOS.</p></li> </ol> <p><em>Note</em>: LLVM is also an optional dependency. LLVM will not provide any additional features, but is an alternative method for executing bytecode signatures versus using the built-in bytecode interpreter. Limited performance testing between LLVM and the bytecode interpreter did not yield conclusive evidence that one is "better" than the other. For the sake of simplicity, it is not recommended to install LLVM.</p> <hr /> <h2 id="download-the-latest-stable-release">Download the latest stable release</h2> <ol> <li>Open a browser and navigate to <a href="http://www.clamav.net/downloads">the ClamAV downloads page</a></li> <li>Click <code>clamav-<version>.tar.gz</code> link to download the latest stable release.</li> </ol> <hr /> <h2 id="extract-the-source-archive">Extract the source archive</h2> <pre> cd ~/Downloads tar xzf clamav-[ver].tar.gz cd clamav-[ver] </pre> <hr /> <h2 id="configure-the-build">Configure the build</h2> <p>Homebrew installs libraries and applications under <code>/usr/local/Cellar/<app>/<ver>/</code>.</p> <p>To configure the ClamAV build using our homebrew-installed dependencies, you may need to reference some of them explicitly. Others may be detected automatically.</p> <hr /> <h3 id="typical-.configure-usage">Typical <code>./configure</code> usage</h3> <p>*<em>Note</em>: Your Homebrew-installed package version directories may differ slightly.</p> <pre> ./configure --with-openssl=/usr/local/Cellar/openssl/1.0.2l --with-zlib=/usr/local/Cellar/zlib/1.2.11/ --with-libjson=yes --enable-check </pre> <p>Once <code>./configure</code> completes, it will print a summary. Verify that the packages you installed are in fact being detected.</p> <p>Example configure summary output:</p> <pre> configure: Summary of detected features follows OS : darwin17.2.0 pthreads : yes () configure: Summary of miscellaneous features check : -L/usr/local/lib -lcheck -R/usr/local/lib (auto) fanotify : no (disabled) fdpassing : 1 IPv6 : yes configure: Summary of optional tools clamdtop : -lncurses (auto) milter : yes (disabled) clamsubmit : yes (libjson-c-dev found at /usr/local), libcurl-devel found at /usr) configure: Summary of engine performance features release mode: yes llvm : no (disabled) mempool : yes configure: Summary of engine detection features bzip2 : ok zlib : /usr unrar : yes preclass : yes (libjson-c-dev found at /usr/local) pcre : /usr/local/Cellar/pcre2/10.32 libmspack : yes (Internal) libxml2 : yes, from /usr yara : yes fts : yes (libc) </pre> <p>If you experience an error wherein <code>configure</code> output claims that <code>gcc</code> is unable to build an executable -- please see the <a href="#configure----gcc-failed-to-build-executable">Troubleshooting section at the bottom</a>.</p> <hr /> <h3 id="additional-popular-.configure-options">Additional popular <code>./configure</code> options</h3> <ul> <li><code>--sysconfdir</code> - Install the configuration files to <code>/etc</code> instead of <code>/usr/local/etc</code>:<br /> <pre><br /> ./configure -–sysconfdir=/etc<br /> </pre></li> <li><code>--prefix</code> - Install ClamAV to a directory other than <code>/usr/local/</code>: <ul> <li>Example 1: Install to a local <code>./install</code> directory.<br /> <pre><br /> ./configure --prefix=<code>pwd</code>/install<br /> </pre></li> <li>Example 2: Install ClamAV locally on an unprivileged shell account.<br /> <pre><br /> ./configure --prefix=$HOME/clamav --disable-clamav<br /> </pre></li> </ul></li> <li><code>--disable-clamav</code> - <em>Don't</em> drop super-user priveleges to run <code>freshclam</code> or <code>clamd</code> as the <code>clamav</code>* user.<br /> <pre><br /> ./configure --disable-clamav<br /> </pre><br /> *<em>Tip</em>: Using this <code>--disable-clamav</code> means that <code>freshclam</code> and <code>clamd</code> will run with <em>root privleges</em> if invoked using <code>sudo</code>. Running <code>clamd</code> or <code>clamscan</code> as root is <strong>not recommended</strong>. Instead of using this option, you can configure <code>freshclam</code> or <code>clamd</code> to drop to any other user by: <ul> <li>setting the <code>DatabaseOwner</code> option in <code>freshclam.conf</code> and</li> <li>setting the <code>User</code> option in <code>clamd.conf</code>.</li> </ul></li> </ul> <p>Please see the <code>./configure --help</code> for additional options.</p> <hr /> <h2 id="compile-clamav">Compile ClamAV</h2> <p>Compile ClamAV with:<br /> <pre><br /> make -j2<br /> </pre></p> <p>If you experience error messages wherein the compiler is unable to find the correct openssl header or library files, you may need to reconfigure and provide explicit header and library paths. See the <a href="#make----failed-to-find-correct-openssl-header-or-library-files">Troubleshooting section below for details</a>.</p> <hr /> <h2 id="run-clamav-unit-tests-optional">Run ClamAV Unit Tests (Optional)</h2> <p>For peace of mind, it can be helpful to run a small suite of unit and system tests.</p> <p>Run:<br /> <pre><br /> make check<br /> </pre></p> <p>All tests should pass.* Output will look something like this:</p> <pre> ... PASS: check_clamav PASS: check_freshclam.sh PASS: check_sigtool.sh PASS: check_unit_vg.sh PASS: check1_clamscan.sh PASS: check2_clamd.sh PASS: check3_clamd.sh PASS: check4_clamd.sh PASS: check5_clamd_vg.sh PASS: check6_clamd_vg.sh SKIP: check7_clamd_hg.sh PASS: check8_clamd_hg.sh PASS: check9_clamscan_vg.sh ... ============================================================================ Testsuite summary for ClamAV 0.100.2 ============================================================================ # TOTAL: 13 # PASS: 12 # SKIP: 1 # XFAIL: 0 # FAIL: 0 # XPASS: 0 # ERROR: 0 </pre> <p><em>Notes</em>:</p> <ul> <li>The <code>*.vg.sh</code> tests will be skipped unless you run <code>make check VG=1</code>.</li> <li><em>Under macOS</em>, <code>*.vg.sh</code> (valgrind) tests <em>will fail</em> due to false alerts.</li> <li>Valgrind may not be available via Homebrew for the latest version of macOS.</li> <li>The <code>check7_clamd.hg.sh</code> (helgrind) is presently disabled and will be skipped.</li> <li>For details, see: <a href="https://github.com/Cisco-Talos/clamav-devel/commit/2a5d51809a56be9a777ded02969a7427a3c26713">the Git commit</a></li> </ul> <p>If you have a failure or an error in the unit tests, it could be that you are missing one or more of the prerequisites or that there is miss-match in the header files after upgrading to a newer version of macOS. If the latter, please see the <a href="#make-check----unit-tests-failed-for-seemingly-no-reason">Troubleshooting section at the bottom</a>.</p> <p>If you are investigating a failure, please do the following:</p> <p><code>cd unit_tests</code></p> <p>Use <code>less</code> to read the log for the failed test.<br /> Example:</p> <pre> less check4_clamd.sh.log` </pre> <p>To submit a bug report regarding unit text failures, please follow these <a href="../../UserManual/Installation-Unix.html#Reporting-a-unit-test-failure-bug">bug reporting steps</a>.</p> <hr /> <h2 id="install-clamav">Install ClamAV</h2> <p>Install ClamAV with:<br /> <pre><br /> make install<br /> </pre></p> <p><em>Tip</em>: If installing to the default or other system-owned directory, you may need to use <code>sudo</code>.</p> <hr /> <h2 id="first-time-set-up">First time set-up</h2> <p><em>Note</em>: The following instructions assume you used the default install paths (i.e. <code>/usr/local</code>). If you modified the install locations using <code>--prefix</code> or <code>--sysconfdir</code> options, replace <code>/usr/local</code> with your chosen install path.</p> <hr /> <h3 id="freshclam-config"><code>freshclam</code> config</h3> <p>Before you can use <code>freshclam</code> to download updates, you need to create a <code>freshclam</code> config. A sample config is provided for you.</p> <ol> <li>Copy the sample config. You may need to use <code>sudo</code>:<br /> <pre><br /> cp /usr/local/etc/freshclam.conf.sample /usr/local/etc/freshclam.conf<br /> </pre></li> <li>Modify the config file using your favourite text editor. Again, you may need to use <code>sudo</code>. <ul> <li>At a minimum, remove the <code>Example</code> line so <code>freshclam</code> can use the config.</li> </ul> <p>Take the time to look through the options. You can enable the sample options by deleting the <code>#</code> comment characters.</p> <p>Some popular options to enable include:</p> <ul> <li><code>LogTime</code></li> <li><code>LogRotate</code></li> <li><code>NotifyClamd</code></li> <li><code>DatabaseOwner</code></li> </ul></li> <li><p>Create the database directory. *Tip: <em>You may need to use <code>sudo</code>.</em><br /> <pre><br /> mkdir /usr/local/share/clamav<br /> </pre></p></li> </ol> <hr /> <h3 id="clamd-config-optional"><code>clamd</code> config (optional)</h3> <p>You can run <code>clamscan</code> without setting the config options for <code>clamd</code>. However, the <code>clamd</code> scanning daemon allows you to use <code>clamdscan</code> to perform faster a-la-carte scans, allows you to run multi-threaded scans, and allows you to use <code>clamav-milter</code> if you want to use ClamAV as a mail filter if you host an email server.</p> <ol> <li>Copy the sample config. You may need to use <code>sudo</code>:<br /> <pre><br /> cp /usr/local/etc/clamd.conf.sample /usr/local/etc/clamd.conf<br /> </pre></li> <li>Modify the config file using your favourite text editor. Again, you may need to use <code>sudo</code>. <ul> <li>At a minimum, remove the <code>Example</code> line so <code>freshclam</code> can use the config.</li> <li>You also <em>need</em> to select a Socket option for <code>clamd</code> so <code>clamdscan</code> and other utilities can communicate with <code>clamd</code>. You must enable <em>one</em> of the following. <ul> <li><code>LocalSocket</code></li> <li><code>TCPSocket</code></li> </ul></li> </ul> <p>Take the time to look through the options. You can enable the sample options by deleting the <code>#</code> comment characters.</p> <p>Some popular options to enable include:</p> <ul> <li><code>LogTime</code></li> <li><code>LogClean</code></li> <li><code>LogRotate</code></li> <li><code>User</code></li> </ul></li> </ol> <hr /> <h3 id="download-update-the-signature-database">Download / Update the signature database</h3> <p>Before you can run a scan, you'll need to download the signature databases. Once again, you may need to run with <code>sudo</code>/root privileges.</p> <p>If you installed to a location in your system PATH:<br /> <pre><br /> freshclam<br /> </pre></p> <p>If you installed to another location:<br /> <pre><br /> /{path}/{to}/{clamav}/bin/freshclam<br /> </pre></p> <hr /> <h3 id="users-and-on-user-privileges">Users and on user privileges</h3> <p>If you are running <code>freshclam</code> and <code>clamd</code> as root or with <code>sudo</code>, and you did not explicitely configure with <code>--disable-clamav</code>, you will want to ensure that the <code>DatabaseOwner</code> user specified in <code>freshclam.conf</code> owns the database directory so it can download signature udpates.</p> <p>The user that <code>clamd</code>, <code>clamdscan</code>, and <code>clamscan</code> run as may be the same user, but if it isn't -- it merely needs <em>read</em> access to the database directory.</p> <p>If you choose to use the default <code>clamav</code> user to run <code>freshclam</code> and <code>clamd</code>, you'll need to create the clamav group and the clamav user account the first time you install ClamAV.</p> <p>Prep by identifying an unused group id (gid), and an unused user UniqueID.</p> <p>This command will display all current group PrimaryGroupIDs:<br /> <pre><br /> dscl . list /Groups PrimaryGroupID | tr -s ' ' | sort -n -t ' ' -k2,2<br /> </pre></p> <p>This command will display all current user UniqueIDs:<br /> <pre><br /> dscl . list /Users UniqueID | tr -s ' ' | sort -n -t ' ' -k2,2<br /> </pre></p> <p>Then, these commands can be used to create the <code>clamav</code> group and <code>clamav</code> user.<br /> <pre><br /> sudo dscl . create /Groups/clamav<br /> sudo dscl . create /Groups/clamav RealName "Clam Antivirus Group"<br /> sudo dscl . create /Groups/clamav gid 799 # Ensure this is unique!<br /> sudo dscl . create /Users/clamav<br /> sudo dscl . create /Users/clamav RealName "Clam Antivirus User"<br /> sudo dscl . create /Users/clamav UserShell /bin/false<br /> sudo dscl . create /Users/clamav UniqueID 599 # Ensure this is unique!<br /> sudo dscl . create /Users/clamav PrimaryGroupID 799 # Must match the above gid!<br /> </pre></p> <p>Finally, you will want to set user ownership of the database directory.<br /> For example:<br /> <pre><br /> sudo chown -R clamav:clamav /usr/local/share/clamav<br /> </pre></p> <hr /> <h2 id="usage">Usage</h2> <p>You should be all set up to run scans.</p> <p>Take a look at our <a href="../../UserManual/Usage.html">usage documentation</a> to learn about how to use ClamAV each of the utilities.</p> <hr /> <h2 id="troubleshooting">Troubleshooting</h2> <hr /> <h3 id="configure----gcc-failed-to-build-executable">Configure -- <code>gcc</code> failed to build executable</h3> <p>It is possible that <code>gcc</code>/<code>clang</code> is misconfigured. This is particularly likely after an upgrade to a newer versions of macOS (e.g after an upgrade from macOS High Sierra to macOS Mojave).</p> <p>Open Terminal, and run the following:</p> <pre> xcode-select --install </pre> <p>This will download and install xcode developer tools and fix the problem. <em>You will be prompted (in the macOS GUI) to accept the license agreement before it will continue.</em><br /> As a follow on step, you <em>may</em> need to reset the path to Xcode if you have several versions or want the command line tools to run without Xcode.</p> <pre> xcode-select --switch /Applications/Xcode.app xcode-select --switch /Library/Developer/CommandLineTools </pre> <blockquote> <p>Solution shamelessly lifted from <a href="https://apple.stackexchange.com/questions/254380/macos-mojave-invalid-active-developer-path">apple stackexchange</a></p> </blockquote> <hr /> <h3 id="make----failed-to-find-correct-openssl-header-or-library-files">Make -- failed to find correct openssl header or library files</h3> <p>Homebrew provides symlinks in <code>/usr/local/opt</code> to aid in the linking process:</p> <pre> $ ls -l /usr/local/opt/openssl* lrwxr-xr-x 1 gary admin 24B Aug 21 12:39 /usr/local/opt/openssl@ -> ../Cellar/openssl/1.0.2p lrwxr-xr-x 1 gary admin 24B Aug 21 12:39 /usr/local/opt/openssl@1.0@ -> ../Cellar/openssl/1.0.2p lrwxr-xr-x 1 gary admin 28B Nov 20 2017 /usr/local/opt/openssl@1.1@ -> ../Cellar/openssl@1.1/1.1.0g </pre> <p>If they aren't automatically detected you may experience issues linking openssl. You can work around this by explicitly listing the include <code>-I</code> and library <code>-L</code> paths.</p> <p>For example:</p> <pre> ./configure --with-openssl=/usr/local/Cellar/openssl/1.0.2l --with-libjson=yes --enable-check CPPFLAGS="-I/usr/local/opt/openssl@1.0/include" LDFLAGS="-L/usr/local/opt/openssl@1.0/lib/" </pre> <hr /> <h3 id="make-check----unit-tests-failed-for-seemingly-no-reason">Make check -- unit tests failed for seemingly no reason</h3> <p>Similar to the above issue, it is possible for a mismatch in your development header files resulting in a working build that may fail the <code>check</code> test suite.</p> <p>If you're seeing one or more failed tests on a stable release of ClamAV on macOS, the following may resolve the issue:</p> <p>Open Terminal, and run the following:</p> <pre> sudo installer -pkg /Library/Developer/CommandLineTools/Packages/macOS_SDK_headers_for_macOS_10.14.pkg -target / </pre> <blockquote> <p>Solution shamelessly lifted from <a href="https://github.com/pyenv/pyenv/issues/1219">the pyenv github issue tracker</a></p> </blockquote> </body> </html>