Dynamic Configuration Settings - ClamAV Documentation
Description: An open source malware detection toolkit and antivirus engine.

# Dynamic Configuration (DCONF)

ClamAV supports a limited set of configuration options that may be enabled or disabled via settings in the `*.cfg` database. At this time, these settings are distributed in `daily.cfg`.

The goal of DCONF is to enable the ClamAV team to rapidly disable new or experimental features for specific ClamAV versions if a significant defect is discovered after release.

This database is small, and the settings are largely vestigial. The team has not had a need to disable many features in a long time, and so the ClamAV versions in the settings at this time should no longer be in use.

The strings and values referenced in `daily.cfg` are best cross-referenced with the macros and structures defined here:

- https://github.com/Cisco-Talos/clamav/blob/main/libclamav/dconf.h#L49
- https://github.com/Cisco-Talos/clamav/blob/main/libclamav/dconf.c#L54

The format for a DCONF signature is:

    Category:Flags:StartFlevel:EndFlevel

`Category` may be one of:

- PE
- ELF
- MACHO
- ARCHIVE
- DOCUMENT
- MAIL
- OTHER
- PHISHING
- BYTECODE
- STATS
- PCRE

`Flags`:

Every feature that may be configured via DCONF is listed in `struct dconf_module modules` in `libclamav/dconf.c`. Any given feature may be default-on or default-off. Default-on features have the 4th field set to a `1` and default off are set to `0`. The `Flags` field for a given `Category` overrides the defaults for all of the options listed under that category.

A settings of `0x0`, for example, means that all options the category be disabled.

The macros listed in `libclamav/dconf.h` will help you identify which bits to set to get the desired results.

`StartFlevel`:

This is the FLEVEL of the minimum ClamAV engine for which you want the settings to be in effect.

`EndFlevel`:

This is the FLEVEL of the maximum ClamAV engine for which you want the settings to be in effect. You may wish to select `255` to override the defaults of future releases.

## Example

Consider the `OTHER_CONF_PDFNAMEOBJ` option in the `category` `OTHER`.

    #define OTHER_CONF_UUENC        0x1     // Default: 1
    #define OTHER_CONF_SCRENC       0x2     // Default: 1
    #define OTHER_CONF_RIFF         0x4     // Default: 1
    #define OTHER_CONF_JPEG         0x8     // Default: 1
    #define OTHER_CONF_CRYPTFF      0x10    // Default: 1
    #define OTHER_CONF_DLP          0x20    // Default: 1
    #define OTHER_CONF_MYDOOMLOG    0x40    // Default: 1
    #define OTHER_CONF_PREFILTERING 0x80    // Default: 1
    #define OTHER_CONF_PDFNAMEOBJ   0x100   // Default: 1
    #define OTHER_CONF_PRTNINTXN    0x200   // Default: 1
    #define OTHER_CONF_LZW          0x400   // Default: 1

All of the `OTHER` options, including `OTHER_CONF_PDFNAMEOBJ` are default-on. To disable the option for ClamAV v0.100.X but leave the other options in their default settings, we would need to set the flags to:

    0110 1111 1111
       ^pdfnameobj off

Or in hex: `0x6FF`

The example setting to place in `daily.cfg` then woudl be:

    OTHER:0x6FF:90:99