On 2020-06-11 10:04, Niki W. Waibel wrote:
> hi,
>
>
>
> is sthg like this possible with the malware scanner(s)?
>
>
>
> hope i was clear enough, as i am quite new to exim.
>
> thank you in advance, niki
>
Assuming that AV scanner returns an error to Exim (that is non-zero exit
code):
###
warn
set acl_m9 = not_scanned
malware = *
logwrite = This message was detected as possible malware
($malware_name).
set acl_m9 = scanned
###
Initially acl_m9 is set to "not_scanned". If AV scanner failed then
"malware = *" condition is not met, so acl_m9 is not set to "scanned".
Later you can use acl_m9 and malware_name values in another ACL
statements to deny/defer/accept message.
PS. Tested on Exim 4.94.2
