[Fix] cron.daily flock lock leaked to backgrounded scans; switched to

      CLOEXEC command form (flock -n FILE "$0") so children never
      inherit the lock fd
[Fix] cron.watchdog version update now runs regardless of sigup result
[Fix] README.md md5v2.dat format corrected to HASH:SIZE:{MD5}sig.name.N
[New] SHA-256 checksum verification for YARA-X binary in Dockerfile.yara-x
[New] test coverage for clean() YARA rescan and YARA(cav) display (3 tests)
[New] watchdog sigup-failure resilience test; cron CLOEXEC lock test
[Change] Rocky Linux 10 added to CI matrix (9-target); Dockerfile.rocky10
      fixed for rockylinux/rockylinux:10 base image and package conflicts

Author: rfxn

.github/workflows/smoke-test.yml

@@ -11,7 +11,7 @@ jobs:
     timeout-minutes: 15
     strategy:
       matrix:
-        os: [debian12, centos6, centos7, rocky8, rocky9, ubuntu2004, ubuntu2404, yara-x]
+        os: [debian12, centos6, centos7, rocky8, rocky9, rocky10, ubuntu2004, ubuntu2404, yara-x]
       fail-fast: false
     steps:
       - uses: actions/checkout@v4

CHANGELOG

@@ -1,4 +1,21 @@
 v2.0.1 | Feb 22 2026:
+[Fix] cron.daily flock lock leaked to backgrounded maldet -b scans via
+      inherited fd, preventing next day's cron.daily from running; switched
+      from fd-based locking (exec 9>/flock -n 9) to flock command form
+      (flock -n FILE "$0") which uses CLOEXEC so children never inherit
+      the lock fd
+[New] SHA-256 checksum verification for YARA-X binary download in
+      Dockerfile.yara-x
+[Fix] cron.watchdog version update (maldet -d) now runs regardless of
+      signature update result; previously gated on sigup success
+[Fix] README.md md5v2.dat format corrected to HASH:SIZE:{MD5}sig.name.N;
+      SIZE field (file size in bytes) was missing from description
+[New] test coverage for clean() YARA rescan path and YARA(cav) signature
+      count display label (3 tests)
+[Change] Rocky Linux 10 added to CI matrix, Makefile, and run-tests.sh;
+      9-target CI matrix (was 8); Dockerfile.rocky10 fixed: base image
+      changed to rockylinux/rockylinux:10, --allowerasing for coreutils
+      conflict, optional inotify-tools/yara separated from required packages
 [Change] scan_stage_yara() code duplication eliminated: extracted
       _yara_scan_rules() helper to consolidate text rules and compiled
       rules scan/parse blocks (~80 duplicate lines removed)
@@ -182,7 +199,7 @@ v2.0.1 | Feb 22 2026:
       MD5 scanning, HEX scanning, quarantine, ignore files, config options, cron,
       reporting, signatures, file list generation, string length analysis, logging,
       purge, compat.conf migrations, hook scanning, resource control, and version
-[New] GitHub Actions CI workflow with 8-target matrix: CentOS 6/7, Rocky 8/9,
+[New] GitHub Actions CI workflow with 9-target matrix: CentOS 6/7, Rocky 8/9/10,
       Ubuntu 20.04/24.04, Debian 12, YARA-X
 [New] test coverage for clean operations, ClamAV integration, cron daily, and
       alerting (4 new test files, ~40 tests)

CHANGELOG.RELEASE

@@ -1,4 +1,21 @@
 v2.0.1 | Feb 22 2026:
+[Fix] cron.daily flock lock leaked to backgrounded maldet -b scans via
+      inherited fd, preventing next day's cron.daily from running; switched
+      from fd-based locking (exec 9>/flock -n 9) to flock command form
+      (flock -n FILE "$0") which uses CLOEXEC so children never inherit
+      the lock fd
+[New] SHA-256 checksum verification for YARA-X binary download in
+      Dockerfile.yara-x
+[Fix] cron.watchdog version update (maldet -d) now runs regardless of
+      signature update result; previously gated on sigup success
+[Fix] README.md md5v2.dat format corrected to HASH:SIZE:{MD5}sig.name.N;
+      SIZE field (file size in bytes) was missing from description
+[New] test coverage for clean() YARA rescan path and YARA(cav) signature
+      count display label (3 tests)
+[Change] Rocky Linux 10 added to CI matrix, Makefile, and run-tests.sh;
+      9-target CI matrix (was 8); Dockerfile.rocky10 fixed: base image
+      changed to rockylinux/rockylinux:10, --allowerasing for coreutils
+      conflict, optional inotify-tools/yara separated from required packages
 [Change] scan_stage_yara() code duplication eliminated: extracted
       _yara_scan_rules() helper to consolidate text rules and compiled
       rules scan/parse blocks (~80 duplicate lines removed)
@@ -173,7 +190,7 @@ v2.0.1 | Feb 22 2026:
       MD5 scanning, HEX scanning, quarantine, ignore files, config options, cron,
       reporting, signatures, file list generation, string length analysis, logging,
       purge, compat.conf migrations, hook scanning, resource control, and version
-[New] GitHub Actions CI workflow with 8-target matrix: CentOS 6/7, Rocky 8/9,
+[New] GitHub Actions CI workflow with 9-target matrix: CentOS 6/7, Rocky 8/9/10,
       Ubuntu 20.04/24.04, Debian 12, YARA-X
 [New] test coverage for clean operations, ClamAV integration, cron daily, and
       alerting (4 new test files, ~40 tests)

PLAN.md

@@ -3,7 +3,7 @@
 Organized by phase. Each phase is independent and can be shipped separately.
 Items marked ~~RESOLVED~~ are completed and kept for reference.
 
-**Status:** Phases 1-4 complete. 4 open items in Phase 5.
+**Status:** Phases 1-5 complete. All items resolved.
 
 ---
 
@@ -38,37 +38,22 @@ unused yarac discovery removal (4.4).
 
 # Phase 5 — CI / Infrastructure
 
-Test and documentation improvements. 4 open items, all Low severity.
+Test and documentation improvements. All items resolved.
 
-## 5.1 rocky10 and ubuntu2204 Dockerfiles not in CI/Makefile
+## ~~5.1 rocky10 and ubuntu2204 Dockerfiles not in CI/Makefile~~ RESOLVED
 
-**Severity:** Low
-**Problem:** `Dockerfile.rocky10` and `Dockerfile.ubuntu2204` exist but are absent
-from CI matrix, Makefile, and `run-tests.sh`.
+Rocky Linux 10 added to CI matrix, Makefile, and run-tests.sh (9-target matrix).
+Ubuntu 22.04 intentionally excluded.
 
-**Fix:** Add to all three, or remove Dockerfiles if support is not intended.
+## ~~5.2 No SHA-256 checksum for YARA-X binary in Dockerfile.yara-x~~ RESOLVED
 
-**Location:** `.github/workflows/smoke-test.yml`, `tests/Makefile`, `tests/run-tests.sh`
+Added `sha256sum -c` verification after downloading YARA-X v1.13.0 binary.
 
-## 5.2 No SHA-256 checksum for YARA-X binary in Dockerfile.yara-x
+## ~~5.3 No test coverage for clean() YARA rescan or YARA(cav) display~~ RESOLVED
 
-**Severity:** Low
-**Problem:** Pre-built binary downloaded from GitHub without checksum verification.
-CI-only blast radius but poor optics for a malware scanner project.
-
-**Fix:** Add `sha256sum -c` verification after download.
-
-**Location:** `tests/Dockerfile.yara-x`
-
-## 5.3 No test coverage for clean() YARA rescan or YARA(cav) display
-
-**Severity:** Low
-**Problem:** No test exercises the `clean()` YARA rescan path. No test verifies
-`YARA(cav)` label when `scan_yara=0`.
-
-**Fix:** Add tests now that Phase 1 fixes have landed.
-
-**Location:** `tests/23-yara.bats`
+Added 3 tests to `tests/23-yara.bats`: clean() YARA rescan path exercised,
+YARA(cav) label verified when scan_yara=0, plain YARA label verified when
+scan_yara=1.
 
 ## ~~5.4 No test coverage for import_custsigs_yara_url validation~~ RESOLVED
 
@@ -81,17 +66,9 @@ Added 3 tests to `tests/23-yara.bats`: corrupt compiled.yarc skipped with
 warning, valid compiled.yarc used in scan (yarac skip guard), scan completes
 normally without compiled.yarc.
 
-## 5.6 README.md md5v2.dat format description missing SIZE field
-
-**Severity:** Low
-**Problem:** Section 8 signature table says md5v2.dat format is
-`HASH:{MD5}sig.name.N` but actual format is `HASH:SIZE:{MD5}sig.name.N`. The
-SIZE field (file size in bytes) is missing from the description. Pre-existing
-error from the original README.md creation.
-
-**Fix:** Correct format column to `HASH:SIZE:{MD5}sig.name.N`.
+## ~~5.6 README.md md5v2.dat format description missing SIZE field~~ RESOLVED
 
-**Location:** `README.md` section 8, line 439
+Corrected format column to `HASH:SIZE:{MD5}sig.name.N` in README.md section 8.
 
 ---
 

README.md

@@ -436,7 +436,7 @@ LMD ships with three signature types:
 
 | Type | File | Format | Count |
 |------|------|--------|-------|
-| MD5 hashes | `sigs/md5v2.dat` | `HASH:{MD5}sig.name.N` | ~14,801 |
+| MD5 hashes | `sigs/md5v2.dat` | `HASH:SIZE:{MD5}sig.name.N` | ~14,801 |
 | HEX patterns | `sigs/hex.dat` | `HEXSTRING:{HEX}sig.name.N` | ~2,054 |
 | YARA rules | `sigs/rfxn.yara` | YARA syntax | ~783 rules |
 | Compiled YARA | `sigs/compiled.yarc` | `yarac` output | optional |

cron.daily

@@ -4,13 +4,13 @@ export LMDCRON=1
 inspath='/usr/local/maldetect'
 intcnf="$inspath/internals/internals.conf"
 
-# prevent overlapping cron runs
+# prevent overlapping cron runs — use flock command form so the lock fd is
+# CLOEXEC and never inherited by backgrounded maldet -b scans
 LOCKFILE="$inspath/tmp/.cron.lock"
-if command -v flock >/dev/null 2>&1; then
-	exec 9>"$LOCKFILE"
-	if ! flock -n 9; then
-		exit 0
-	fi
+if command -v flock >/dev/null 2>&1 && [ -z "$_CRON_FLOCK" ]; then
+	export _CRON_FLOCK=1
+	flock -n "$LOCKFILE" "$0" "$@" || :
+	exit 0
 fi
 
 if [ -f "$intcnf" ]; then

cron.watchdog

@@ -47,9 +47,8 @@ echo "$(date) maldet-watchdog: signatures are ${sig_age_days}d old (threshold: $
 $inspath/maldet -u 2>&1 | tail -5 >> "$event_log"
 sig_update_rc=${PIPESTATUS[0]}
 
-# If sig update succeeded, also try version update
-if [ "$sig_update_rc" -eq 0 ]; then
-    $inspath/maldet -d 2>&1 | tail -5 >> "$event_log"
-fi
+# Run version update regardless of signature update result
+$inspath/maldet -d 2>&1 | tail -5 >> "$event_log"
+ver_update_rc=${PIPESTATUS[0]}
 
-echo "$(date) maldet-watchdog: emergency update completed (sigup rc=$sig_update_rc)" >> "$event_log"
+echo "$(date) maldet-watchdog: emergency update completed (sigup rc=$sig_update_rc, verup rc=$ver_update_rc)" >> "$event_log"

tests/20-cron.bats

@@ -153,6 +153,15 @@ MOCK
     exec 8>&-
 }
 
+@test "cron lock uses CLOEXEC command form (no fd leak)" {
+    # Verify cron.daily uses flock command form (_CRON_FLOCK guard)
+    run grep '_CRON_FLOCK' /etc/cron.daily/maldet
+    assert_success
+    # Verify no exec 9> fd-based locking (old pattern that leaked to children)
+    run grep 'exec 9>' /etc/cron.daily/maldet
+    assert_failure
+}
+
 @test "cron sources custom config file" {
     lmd_set_config cron_daily_scan 0
     mkdir -p "$LMD_INSTALL/cron"

tests/22-updates.bats

@@ -524,10 +524,38 @@ run_cron_daily() {
     run bash /etc/cron.weekly/maldet-watchdog
 
     assert_success
-    # Should have called maldet -u
+    # Should have called both maldet -u and maldet -d
     [ -f "$CRON_MALDET_LOG" ]
     run grep "MALDET_CALL:.*-u" "$CRON_MALDET_LOG"
     assert_success
+    run grep "MALDET_CALL:.*-d" "$CRON_MALDET_LOG"
+    assert_success
+}
+
+@test "watchdog runs version update even when signature update fails" {
+    [ -f /etc/cron.weekly/maldet-watchdog ] || skip "watchdog not installed"
+    touch -d '10 days ago' "$LMD_INSTALL/sigs/maldet.sigs.ver"
+    # Install mock maldet that fails on -u but succeeds on -d
+    cp "$LMD_INSTALL/maldet" "$LMD_INSTALL/maldet.real"
+    cat > "$LMD_INSTALL/maldet" <<'MOCK'
+#!/usr/bin/env bash
+echo "MALDET_CALL: $@" >> /tmp/cron-maldet.log
+case "$1" in
+    -u) exit 1 ;;
+    *)  exit 0 ;;
+esac
+MOCK
+    chmod 755 "$LMD_INSTALL/maldet"
+
+    run bash /etc/cron.weekly/maldet-watchdog
+
+    assert_success
+    [ -f "$CRON_MALDET_LOG" ]
+    # Both -u and -d should have been called despite -u failure
+    run grep "MALDET_CALL:.*-u" "$CRON_MALDET_LOG"
+    assert_success
+    run grep "MALDET_CALL:.*-d" "$CRON_MALDET_LOG"
+    assert_success
 }
 
 @test "watchdog logs staleness warning to event_log" {

tests/23-yara.bats

@@ -416,3 +416,44 @@ EOF
     run grep "failed validation" "$LMD_INSTALL/logs/event_log"
     assert_failure
 }
+
+# ── Group 9: clean() YARA Rescan & YARA(cav) Display ──
+
+@test "YARA: clean() invokes YARA rescan after cleaning" {
+    # HEX sig matching infected-base64.php with clean script name
+    echo "6576616c286261736536345f6465636f646528:base64.inject.unclassed.99" \
+        > "$LMD_INSTALL/sigs/custom.hex.dat"
+    # Suppress builtin sigs that match the same pattern but have no clean script
+    echo "php.base64.inject" > "$LMD_INSTALL/ignore_sigs"
+    lmd_set_config quarantine_hits 1
+    lmd_set_config quarantine_clean 1
+    lmd_set_config scan_yara 1
+    cp "$SAMPLES_DIR/infected-base64.php" "$TEST_SCAN_DIR/"
+    > "$LMD_INSTALL/logs/event_log"
+    maldet -a "$TEST_SCAN_DIR" || true
+    # clean() should have logged rescanning entries
+    run grep "{clean}" "$LMD_INSTALL/logs/event_log"
+    assert_success
+    # Verify the YARA rescan message specifically
+    run grep "{clean} rescanning" "$LMD_INSTALL/logs/event_log"
+    assert_success
+}
+
+@test "YARA: signature count shows YARA(cav) when scan_yara=0" {
+    lmd_set_config scan_yara 0
+    cp "$SAMPLES_DIR/clean-file.txt" "$TEST_SCAN_DIR/"
+    run maldet -a "$TEST_SCAN_DIR"
+    assert_success
+    assert_output --partial "YARA(cav)"
+}
+
+@test "YARA: signature count shows YARA (not cav) when scan_yara=1" {
+    source /opt/tests/helpers/create-yara-sigs.sh
+    lmd_set_config scan_yara 1
+    cp "$SAMPLES_DIR/clean-file.txt" "$TEST_SCAN_DIR/"
+    run maldet -a "$TEST_SCAN_DIR"
+    assert_success
+    # Should show plain YARA label, not YARA(cav)
+    refute_output --partial "YARA(cav)"
+    assert_output --partial "YARA |"
+}