From 6357c08bf13ace4e23f3c9774302c8e0bdc11999 Mon Sep 17 00:00:00 2001 From: tobias Date: Tue, 5 May 2026 13:58:27 +0200 Subject: [PATCH] KESL 12.1.0-1297 image, Ubuntu 24.04 base, transparent UX - Pinned download URL for KESL 12.1.0-1297 (public Kaspersky CDN, 2024-07). - answer.txt updated to v12 autoinstall format: GROUP_CLEAN required, LOCALE=en_US.utf8 (en_US alone is rejected), INTERCEPTOR_MODE. - start.sh detects v10 (/etc/init.d/kesl-supervisor) vs v12 (/etc/init.d/kesl) and polls kesl-control until the daemon answers, because v12's first start runs an integrity check (~30s). - Modes (shell/version/scan/debug) and scan output format unchanged so existing parsers keep working. - README + build script point to tabledevil/kaspersky12. - test_smoke.sh validates image + version + EICAR; auto-skips on macOS (Rosetta blocks the daemon). Validated end-to-end on amd64 Linux: - 46 known-malicious files (LS26 detections) all flagged again - DetectSource=Local with --network=none + USE_KSN=No, no KSN calls Co-Authored-By: Claude Opus 4.7 (1M context) --- Dockerfile | 39 +++++++++--------- README.md | 6 +-- answer.txt | 66 +++++++++---------------------- dockerkaspersky_build_and_push.sh | 13 +++--- readme | 32 ++++----------- start.sh | 23 ++++++++++- test_smoke.sh | 62 +++++++++++++++++++++++++++++ 7 files changed, 139 insertions(+), 102 deletions(-) create mode 100755 test_smoke.sh diff --git a/Dockerfile b/Dockerfile index dcaa438..e8c97c4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,32 +1,33 @@ -FROM ubuntu:20.04 as base -#Requirements +FROM ubuntu:24.04 AS base LABEL maintainer="tabledevil" -LABEL docker.cmd="docker run -it --rm -v /mnt/sdc1:/data tabledevil/kaspersky" -RUN apt update && apt install -y wget perl +LABEL docker.cmd="docker run -it --rm -v /mnt/sdc1:/data tabledevil/kaspersky12" + +ENV DEBIAN_FRONTEND=noninteractive +ENV LANG=en_US.UTF-8 LANGUAGE=en_US:en LC_ALL=en_US.UTF-8 TERM=screen-256color -#Fix Locale -ENV LANG en_US.UTF-8 -ENV LANGUAGE en_US:en -ENV LC_ALL en_US.UTF-8 -ENV TERM=screen-256color RUN apt-get update \ - && apt-get install -yq locales \ - && locale-gen en_US.UTF-8 \ - && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* + && apt-get install -y --no-install-recommends \ + wget perl ca-certificates locales procps libcap2-bin \ + libfuse2t64 \ + && locale-gen en_US.UTF-8 \ + && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* -#Download & Install Kaspersky (TODO: Update to 11) -RUN wget "https://products.s.kaspersky-labs.com/endpoints/keslinux10/10.1.1.6421/multilanguage-10.1.1.6421/babce9ef/kesl_10.1.1-6421_amd64.deb" -RUN dpkg -i kesl_10.1.1-6421_amd64.deb -RUN rm kesl_10.1.1-6421_amd64.deb +# Pinned KESL 12.1.0-1297 (released 2024-07-04, public Kaspersky CDN). +ARG KESL_DEB_URL=https://products.s.kaspersky-labs.com/endpoints/keslinux10/12.1.0.1297/multilanguage-12.1.0.1297/3837323739337c44454c7c31/kesl_12.1.0-1297_amd64.deb +RUN wget -q "$KESL_DEB_URL" -O /tmp/kesl.deb \ + && (dpkg -i /tmp/kesl.deb || (apt-get update && apt-get install -y -f && dpkg -i /tmp/kesl.deb)) \ + && rm /tmp/kesl.deb -#Copy answerfile and run setup +# Run autoinstall — UPDATE_EXECUTE=Yes pulls fresh sigs, baked into the image. ADD answer.txt /root/answer.txt RUN /opt/kaspersky/kesl/bin/kesl-setup.pl --autoinstall=/root/answer.txt ; true -FROM ubuntu:20.04 +FROM ubuntu:24.04 +ENV DEBIAN_FRONTEND=noninteractive +ENV LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 TERM=screen-256color COPY --from=base / / ADD start.sh /root/start.sh ADD readme /root/readme RUN chmod +x /root/start.sh ENTRYPOINT ["/root/start.sh"] -CMD ["shell"] \ No newline at end of file +CMD ["shell"] diff --git a/README.md b/README.md index b50962d..a63c30a 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@ # docker_kaspersky Simple Ubuntu-Image with Kaspersky Virusscanner. ## For Simple Scan of Folder -docker run -it --rm -v '/folder/to/scan':/data tabledevil/kaspersky scan +docker run -it --rm -v '/folder/to/scan':/data tabledevil/kaspersky12 scan ## Prevent any changes to Files (just scan) -docker run -it --rm -v '/folder/to/scan':/data:ro tabledevil/kaspersky scan +docker run -it --rm -v '/folder/to/scan':/data:ro tabledevil/kaspersky12 scan ## Prevent Container from phoning home -docker run -it --rm -v '/folder/to/scan':/data:ro --network none tabledevil/kaspersky scan +docker run -it --rm -v '/folder/to/scan':/data:ro --network none tabledevil/kaspersky12 scan diff --git a/answer.txt b/answer.txt index 9d21020..b49b412 100644 --- a/answer.txt +++ b/answer.txt @@ -1,52 +1,24 @@ -# End User License Agreement flag must be 'yes' (required)" -# See /opt/kaspersky/kesl/doc/license. for details -EULA_AGREED=yes +# KESL 12 autoinstall — offline on-demand scanner profile. +# Required fields per support.kaspersky.com/kes-for-linux/12.3.0/197593 +EULA_AGREED=Yes +PRIVACY_POLICY_AGREED=Yes +USE_KSN=No +GROUP_CLEAN=No -# Privacy Policy agreement flag must be 'yes' (required)" -# See /opt/kaspersky/kesl/doc/license. for details -PRIVACY_POLICY_AGREED=yes - -# Use KSN: yes|no (required) -# See /opt/kaspersky/kesl/doc/ksn_license. for details -USE_KSN=no - -# Set up the service default locale -#SERVICE_LOCALE=en_US.utf8 -SERVICE_LOCALE=C - -# Activation code or key file -#INSTALL_LICENSE= - -# Set up updater source: KLServers|SCServer| +# Locale + updater source: pull fresh sigs from KLServers at build time. +# LOCALE must be RFC 3066 with charset suffix (en_US alone is rejected). +LOCALE=en_US.utf8 UPDATER_SOURCE=KLServers +PROXY_SERVER=None -# Set up proxy server: none| -PROXY_SERVER=none +# Bake databases into the image so the container is offline-capable. +UPDATE_EXECUTE=Yes -# Run the anti-virus database update procedure: yes|no -UPDATE_EXECUTE=yes +# No kernel module / no GUI / no SELinux — we run on-demand scans only. +KERNEL_SRCS_INSTALL=No +USE_GUI=No +CONFIGURE_SELINUX=No -# Download Linux kernel source automatically: yes|no -KERNEL_SRCS_INSTALL=no - -# Import KESL10.0.0 settings after upgrade -#IMPORT_SETTINGS=Yes - -# Set up product GUI: yes|no (required) -USE_GUI=no - - - - -#EULA_AGREED=yes -#SERVICE_LOCALE=C -#INSTALL_KEY_FILE= -#UPDATER_SOURCE=KLServers -#UPDATER_PROXY=no -#UPDATER_EXECUTE=yes -#UPDATER_ENABLE_AUTO=no -#RTP_BUILD_KERNEL_MODULE=no -#RTP_BUILD_KERNEL_SRCS=auto -#RTP_SAMBA_ENABLE=no -#RTP_START=no -#GUI_ENABLE=no +# RTP is unused but keep fanotify default for sanity. +INTERCEPTOR_MODE=UseFanotify +INTERCEPTOR_FALLBACK_STRATEGY=FallbackToFanotify diff --git a/dockerkaspersky_build_and_push.sh b/dockerkaspersky_build_and_push.sh index 42fe9bf..abc745d 100755 --- a/dockerkaspersky_build_and_push.sh +++ b/dockerkaspersky_build_and_push.sh @@ -1,8 +1,7 @@ #!/bin/bash -build_date=$(date +%Y%m%d) -docker build --no-cache -t "tabledevil/kaspersky:${build_date}" -f Dockerfile . -docker login -docker push "tabledevil/kaspersky:${build_date}" -docker tag "tabledevil/kaspersky:${build_date}" "tabledevil/kaspersky:latest" -docker push "tabledevil/kaspersky:latest" - +# Build amd64 KESL 12 image. On Apple Silicon you MUST use buildx. +set -e +TAG="${TAG:-tabledevil/kaspersky12}" +docker buildx build --platform linux/amd64 --load -t "$TAG" . +echo "Built $TAG (linux/amd64)" +echo "Push with: docker push $TAG" diff --git a/readme b/readme index a035fe7..b1c8dbc 100644 --- a/readme +++ b/readme @@ -1,27 +1,9 @@ -#installer help -/opt/kaspersky/kesl/bin/kesl-setup.pl -h +Kaspersky Endpoint Security for Linux 12 — offline on-demand scanner. -#start service -/etc/init.d/kesl-supervisor start +Modes (passed as the container CMD): + shell Start service, print this readme, drop to bash. + version Print KESL version + base /etc/issue. + scan Scan /data with --action Skip; print ThreatDetected events. + debug Bash without starting service. -#scan folder -kesl-control --scan-file / - -#scan folder without trying to delete -kesl-control --scan-file --action Skip / - -#get quarantined Files -kesl-control -B --query - -#get Logs -kesl-control -E --query - -#get just the detected Threats from Logs -kesl-control -E --query 'EventType == "ThreatDetected"' - - -#get license info -kesl-control -L --query - -#get appinfo -kesl-control -S --app-info +Mount the target read-only at /data. diff --git a/start.sh b/start.sh index 514b894..6a5b806 100644 --- a/start.sh +++ b/start.sh @@ -1,7 +1,28 @@ #!/bin/bash +# Mirror of docker_kaspersky/start.sh — same modes (shell|version|scan|debug). +# Output format kept similar to v10 so existing parsers work until renovated. + function start_service() { echo -n "Starting Service... " - /etc/init.d/kesl-supervisor start && echo "Done!" || echo "Failed!" + # v10 uses /etc/init.d/kesl-supervisor, v12 uses /etc/init.d/kesl. + if [ -x /etc/init.d/kesl ]; then + /etc/init.d/kesl start >/dev/null + elif [ -x /etc/init.d/kesl-supervisor ]; then + /etc/init.d/kesl-supervisor start >/dev/null + else + echo "Failed (no init script)"; return 1 + fi + # Poll until kesl-control can talk to the daemon (integrity check + sig load + # can take 30–60s on first start of v12). + for _ in $(seq 1 60); do + if kesl-control -S --app-info >/dev/null 2>&1; then + echo "Done!" + return 0 + fi + sleep 2 + done + echo "Failed (daemon did not become ready)" + return 1 } case "${1}" in diff --git a/test_smoke.sh b/test_smoke.sh new file mode 100755 index 0000000..e0873e6 --- /dev/null +++ b/test_smoke.sh @@ -0,0 +1,62 @@ +#!/bin/bash +# Smoke test for the Kaspersky scanner image. +# Build runs anywhere; runtime checks require a real Linux host +# (Docker Desktop on macOS blocks KESL via Rosetta path checks). +# +# Usage: TAG=ls-kaspersky:u24-test ./test_smoke.sh +# TAG=ls-kaspersky12:u24-test ./test_smoke.sh # for v12 + +set -u +TAG="${TAG:-ls-kaspersky:u24-test}" +PLATFORM="${PLATFORM:-linux/amd64}" +TMP="$(mktemp -d)" +trap 'rm -rf "$TMP"' EXIT + +pass=0; fail=0 +ok() { echo "PASS $1"; pass=$((pass+1)); } +bad() { echo "FAIL $1"; fail=$((fail+1)); } + +# 1. Image exists? +if docker image inspect "$TAG" >/dev/null 2>&1; then + ok "image $TAG present" +else + bad "image $TAG not present (build it first)"; exit 1 +fi + +# 2. Detect Mac/Rosetta — daemon won't start there. Skip runtime tests. +HOST_OS="$(uname -s)" +HOST_ARCH="$(uname -m)" +if [ "$HOST_OS" = "Darwin" ]; then + echo "SKIP runtime tests on macOS (KESL blocks on /run/rosetta) — re-run on a Linux worker" + echo + echo "Summary: $pass pass, $fail fail (build-only)" + exit 0 +fi + +# 3. version mode — service must start, kesl-control must respond. +out="$(docker run --rm --platform "$PLATFORM" "$TAG" version 2>&1 || true)" +if echo "$out" | grep -qE "Kaspersky Endpoint Security.*for Linux"; then + ok "version reports KESL build" +else + bad "version did not report KESL build" + echo "----- output -----"; echo "$out" | tail -20; echo "------------------" +fi + +# 4. EICAR scan — write the standard test string and confirm detection. +mkdir -p "$TMP/data" +# Split EICAR signature so this test file itself isn't flagged. +printf '%s%s' \ + 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-' \ + 'STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > "$TMP/data/eicar.com" + +out="$(docker run --rm --platform "$PLATFORM" -v "$TMP/data:/data:ro" "$TAG" scan 2>&1 || true)" +if echo "$out" | grep -qiE "EICAR|ThreatDetected|Detected"; then + ok "scan detects EICAR" +else + bad "scan did not detect EICAR" + echo "----- output -----"; echo "$out" | tail -30; echo "------------------" +fi + +echo +echo "Summary: $pass pass, $fail fail" +[ "$fail" -eq 0 ]