Sophos Anti-Virus for Linux & disturbs mounting containter with VeraCrypt

If you are using auditd and veracrypt uses fuse, you've probably hit the deadlock between Talpa/auditd/fuse.

You could try using fanotify instead, but that has various limitations.

Okai, could you help me to verify/debug that?

You can use:

auditctl -l

to print any audit rules that are active.

Use can use:

mount

(when you have an appropriate location mounted), to see whether anything is using fuse.

You can switch to fanotify by following the KBA:

https://community.sophos.com/kb/en-us/118216#Enabling%20fanotify%20as%20the%20default%20kernel%20interface

You can use:

auditctl -l

to print any audit rules that are active.

Use can use:

mount

(when you have an appropriate location mounted), to see whether anything is using fuse.

You can switch to fanotify by following the KBA:

https://community.sophos.com/kb/en-us/118216#Enabling%20fanotify%20as%20the%20default%20kernel%20interface

I switched to fanotify and it works BUT which limitations do you speak of?

These?

• NFSv4 access is blocked when scanning with fanotify (except in RHEL 7.2 +) – This is a filesystem issue.
  • Workaround - Use Talpa with NFSv4 instead of fanotify, or switch to NFSv3
  • It may also be possible to exclude nfs4 filesystems with: /opt/sophos-av/bin/savconfig add ExcludeFilesystems nfs4
• 30s delay of file create and Operation not permitted errors with fanotify and cifs – This is a known kernel issue.
  • Workaround – Disable CIFS oplocks, exclude the CIFS share from on-access scanning, or use Talpa instead of fanotify

I missed to add the info.

There are some audit rules active and VeraCrypt uses fuse.