From 77fad53655aac2e3a28d826400a8c02a65ae21af Mon Sep 17 00:00:00 2001
From: boban <boban.blaskovic@gmail.com>
Date: Sun, 26 Apr 2026 21:52:02 +0200
Subject: [PATCH] Fix: ClamAV-Socket false-positive + --check-only als root +
 Backup sudoers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ClamAV: nur systemd-Probe – Socket-Datei bleibt nach Stop erhalten.
--check-only: git ls-remote als root statt www-data (keine Credentials).
Backup: /etc/sudoers.d/mailwolt immer anlegen, unabhängig von certbot/dkim.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 config/woltguard.php |  4 ++--
 scripts/update.sh    | 21 +++++++++++++--------
 2 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/config/woltguard.php b/config/woltguard.php
index 88a45b5..129cfa6 100644
--- a/config/woltguard.php
+++ b/config/woltguard.php
@@ -25,8 +25,8 @@ return [
             'label' => 'ClamAV', 'hint' => 'Virenscanner',
             'optional' => true,
             'sources' => [
-                'systemd:clamav-daemon', 'systemd:clamav-daemon@scan', 'systemd:clamd',
-                'socket:/run/clamav/clamd.ctl', 'pid:/run/clamav/clamd.pid', 'tcp:127.0.0.1:3310',
+                // Nur systemd – Socket-Datei bleibt nach dem Stoppen erhalten (false positive)
+                'systemd:clamav-daemon',
             ],
         ],
 
diff --git a/scripts/update.sh b/scripts/update.sh
index c4dfe6d..93087d0 100644
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -12,9 +12,9 @@ ALLOW_DIRTY="${ALLOW_DIRTY:-0}"
 # -------- --check-only: nur Remote-Tags holen, Version schreiben, sicher beenden ---
 # (wird von CheckUpdates via sudo aufgerufen — kein Update, nur Versionsprüfung)
 if [[ "${1:-}" == "--check-only" ]]; then
-  LATEST="$(sudo -u "$APP_USER" bash -c \
-    "git -C '${APP_DIR}' ls-remote --tags --sort=-v:refname origin 'v*' 2>/dev/null \
-     | grep -v '\^{}' | head -1 | sed 's|.*refs/tags/||'" 2>/dev/null || true)"
+  # Als root ausführen – www-data hat keine Git-Credentials für private Repos
+  LATEST="$(git -C "${APP_DIR}" ls-remote --tags --sort=-v:refname origin 'v*' 2>/dev/null \
+    | grep -v '\^{}' | head -1 | sed 's|.*refs/tags/||' || true)"
   if [[ -n "$LATEST" ]]; then
     mkdir -p /var/lib/mailwolt
     printf '%s\n' "$LATEST" > /var/lib/mailwolt/version_remote
@@ -207,13 +207,18 @@ ensure_system(){
   _sbin_install "${APP_DIR}/scripts/update.sh"              /usr/local/sbin/mailwolt-update
   _sbin_install "${APP_DIR}/scripts/mailwolt-clamav"        /usr/local/sbin/mailwolt-clamav
   _sbin_install "${APP_DIR}/scripts/mailwolt-backup"        /usr/local/sbin/mailwolt-backup
-  # Sudoers-Regeln nachrüsten
+  # Sudoers-Regeln: dediziertes File – unabhängig von certbot/dkim
+  local MW_SUDO="/etc/sudoers.d/mailwolt"
+  if [[ ! -f "$MW_SUDO" ]]; then touch "$MW_SUDO"; chmod 440 "$MW_SUDO"; fi
+  _sudoers_add "$MW_SUDO" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-fetch-tags'
+  _sudoers_add "$MW_SUDO" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-update --check-only'
+  _sudoers_add "$MW_SUDO" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-clamav'
+  _sudoers_add "$MW_SUDO" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-backup'
+  _sudoers_add "$MW_SUDO" 'www-data ALL=(root) NOPASSWD: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/*/fullchain.pem'
+  # Legacy-Files ebenfalls nachrüsten (falls vorhanden)
   for f in /etc/sudoers.d/mailwolt-certbot /etc/sudoers.d/mailwolt-dkim; do
-    _sudoers_add "$f" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-fetch-tags'
-    _sudoers_add "$f" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-update --check-only'
-    _sudoers_add "$f" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-clamav'
+    [[ -f "$f" ]] || continue
     _sudoers_add "$f" 'www-data ALL=(root) NOPASSWD: /usr/local/sbin/mailwolt-backup'
-    _sudoers_add "$f" 'www-data ALL=(root) NOPASSWD: /usr/bin/openssl x509 -enddate -noout -in /etc/letsencrypt/live/*/fullchain.pem'
   done
   # Laravel Scheduler cron (schedule:run muss jede Minute laufen)
   local cron_file="/etc/cron.d/mailwolt"