update-definitions

name	update-definitions
description	Refresh signature databases and definition files for every installed scanner — freshclam (ClamAV), rkhunter --update, lynis update info, AIDE differential check (does NOT promote a new baseline), debsecan suite refresh. Reads installed flags from plugin config and skips tools that aren't present. Triggers on "update AV definitions", "refresh signatures", "update clamav".

Update Definitions

Refresh signatures / databases for every installed scanner. Skips tools the config marks as not installed.

Config

${CLAUDE_USER_DATA:-${XDG_DATA_HOME:-$HOME/.local/share}/claude-plugins}/linux-av-manager/config.json

Read installed.* flags. For each tool present, run its update path:

Tool	Command	Notes
ClamAV	sudo systemctl stop clamav-freshclam && sudo freshclam && sudo systemctl start clamav-freshclam	Stop the service first to avoid lock contention.
rkhunter	sudo rkhunter --update	Updates property/signature data. Do not automatically run --propupd here — that re-baselines and would mask real changes.
Lynis	sudo lynis update info	Reports whether a newer Lynis is available; apt upgrade lynis if so.
chkrootkit	apt/dnf/pacman upgrade for the package	No separate signature feed.
AIDE	sudo aide --check and report deltas	This is a check, not an update. Surface deltas; only promote with explicit user instruction.
debsecan	sudo apt update && debsecan --suite $(lsb_release -sc) --format detail	Refresh apt index then list outstanding CVEs.

Output

Print a one-line per-tool status line:

clamav    ✓ updated  (main.cvd 6.x → 7.x; daily.cvd refreshed)
rkhunter  ✓ updated
lynis     ✓ no update available
aide      ⚠ 14 file deltas — review before promoting (sudo aide --update)
debsecan  ✓ 3 CVEs reported — see <scans_dir>/debsecan/<timestamp>.txt

Save AIDE/debsecan output (the only ones with real per-run findings) into <scans_dir>/<tool>/<timestamp>.txt so a later scan or audit can reference them.

Notes

• Never auto-promote AIDE's new baseline.
• Never auto-run rkhunter --propupd.
• Do batch the refreshes — they're independent — but stream output as each finishes so the user sees progress.