Handling Heuristics.OLE2.ContainsMacros in amavis policy banks

[Engels, Jan]

Hi Damian,

thanks a lot for your suggestion. It works!! :))

Cheers
Jan

----- Original Message -----
| From: "Damian" <amavis at arcsin.de>
| To: amavis-users at amavis.org
| Sent: Friday, September 27, 2019 6:34:03 PM
| Subject: Re: Handling Heuristics.OLE2.ContainsMacros in amavis policy banks

| How about
| 
|> $policy_bank{'FROM_INTERNAL'} = {
|>   ...
|>   virus_name_to_spam_score_maps => [
|>     @virus_name_to_spam_score_maps,
|>     new_RE([ qr'^Heuristics\.OLE2\.ContainsMacros' => 0.001 ])
|>   ],
|> }
| 
| Am 26.09.19 um 19:03 schrieb Engels, Jan:
|> Hi everyone,
|>
|> has anyone aby idea on how to solve this? :|
|>
|> Inbetween I found a workaround by overwriting the
|> "virus_name_to_spam_score_maps" in my
|> policy_bank, e.g.:
|>
|> $policy_bank{'FROM_INTERNAL'} = {
|> ...
|> virus_name_to_spam_score_maps =>
|>  [new_RE(
|>    [ qr'^Heuristics\.OLE2\.ContainsMacros' => 0.001 ],
|> )],
|> };
|>
|> However, I do not like this solution because the virus_name_to_spam_score_maps
|> variable is
|> defined in the amavisd main script, you can check this as follows:
|>
|> grep -A50 'virus_name_to_spam_score_maps =' /usr/sbin/amavisd
|>
|>
|> Unfortunately I could not find a way how to only append that single line to the
|> variable, so
|> this means I would have to copy & paste the whole contents of the variable into
|> my custom
|> policy bank. This is something I would really like to avoid since it means that
|> I would
|> always have to check the contents of the "virus_name_to_spam_score_maps"
|> variable whenever
| > the amavisd-new package gets upgraded...
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2211 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.amavis.org/pipermail/amavis-users/attachments/20190930/850b32ef/attachment.bin>