#2 move infected file allowed

[Pascal]

On clamfs directory everything works fine :
impossible to read, execute copy infected file
but rename this file from move command is possible

Linux debian 2.6.26-2-686 #1 SMP Wed Nov 4 20:45:37 UTC 2009 i686 GNU/Linux
clamfs : Version : 0.9.1-3
/etc/fstab : /dev/hda9 /home_unprotected ext3 defaults 0 2
clamfs.xml : <filesystem root="/home_unprotected" mountpoint="/home" public="yes" nonempty="yes" />

test directory
/home/plegrand

[root@debian] ~ # ls -al /home/plegrand/
total 12
drwxr-xr-x 2 plegrand plegrand 4096 nov 25 11:04 .
drwxr-xr-x 3 root root 4096 nov 25 08:05 ..
-rw-r--r-- 1 plegrand plegrand 68 jui 4 2008 eicar.com

Command
[root@debian] ~ # cat /home/plegrand/eicar.com
cat: /home/plegrand/eicar.com: Opération non permise

[root@debian] ~ # file /home/plegrand/eicar.com
/home/plegrand/eicar.com: writable, regular file, no read permission

[root@debian] ~ # cp /home/plegrand/eicar.com /home/plegrand/eicar.com.new
cp: Ne peut ouvrir `/home/plegrand/eicar.com' en lecture: Opération non permise

[root@debian] ~ # mv /home/plegrand/eicar.com /home/plegrand/eicar.com.new

logs
11:06:02 (clamfs.cxx:531) (cat:7970) (root:0) /plegrand/eicar.com: forced anti-virus scan because extension blacklisted
11:06:02 (clamav.cxx:135) (cat:7970) (root:0) /home_unprotected/plegrand/eicar.com: Eicar-Test-Signature FOUND
11:06:05 (clamfs.cxx:531) (file:7973) (root:0) /plegrand/eicar.com: forced anti-virus scan because extension blacklisted
11:06:05 (clamav.cxx:135) (file:7973) (root:0) /home_unprotected/plegrand/eicar.com: Eicar-Test-Signature FOUND
11:06:25 (clamfs.cxx:531) (cp:7976) (root:0) /plegrand/eicar.com: forced anti-virus scan because extension blacklisted
11:06:25 (clamav.cxx:135) (cp:7976) (root:0) /home_unprotected/plegrand/eicar.com: Eicar-Test-Signature FOUND

move this infected file is allowed (nothing in the logs and file is renamed