Sophos Anti-Virus for Linux & disturbs mounting containter with VeraCrypt

Hello Moerkey,

maybe DouglasLeeder can give some advice.

Christian

Should I ask him directly or will he be informed about this by mentioning him?

Hello Moerkey,

Douglas is notified that I've mentioned him.

Christian

If you are using auditd and veracrypt uses fuse, you've probably hit the deadlock between Talpa/auditd/fuse.

You could try using fanotify instead, but that has various limitations.

Okai, could you help me to verify/debug that?

You can use:

auditctl -l

to print any audit rules that are active.

Use can use:

mount

(when you have an appropriate location mounted), to see whether anything is using fuse.

You can switch to fanotify by following the KBA:

https://community.sophos.com/kb/en-us/118216#Enabling%20fanotify%20as%20the%20default%20kernel%20interface

I switched to fanotify and it works BUT which limitations do you speak of?

These?

• NFSv4 access is blocked when scanning with fanotify (except in RHEL 7.2 +) – This is a filesystem issue.
  • Workaround - Use Talpa with NFSv4 instead of fanotify, or switch to NFSv3
  • It may also be possible to exclude nfs4 filesystems with: /opt/sophos-av/bin/savconfig add ExcludeFilesystems nfs4
• 30s delay of file create and Operation not permitted errors with fanotify and cifs – This is a known kernel issue.
  • Workaround – Disable CIFS oplocks, exclude the CIFS share from on-access scanning, or use Talpa instead of fanotify

I missed to add the info.

There are some audit rules active and VeraCrypt uses fuse.