Mailing List Archive

Re: [SUSPECTED SPAM] [Feature request] Support Linux symlinks for all configuration and database folders
Hello!

Apologies for the delay getting back to you. I also saw this report: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1920615/

I tried to reproduce the issue you described but was unable. I tried moving the ssl directory and moving the clamav directory and then created symlinks to each. Eg:

root@117df8bca60f:/# ls -la /var/lib/
total 64
...
lrwxrwxrwx 1 root root 22 Mar 27 23:38 clamav -> /var/lib/clamav_moved/

and

root@117df8bca60f:/# ls -la /etc/
...
lrwxrwxrwx 1 root root 15 Mar 27 23:37 ssl -> /etc/ssl_moved/

I had no problems running freshclam with these symlinks set up. I don't think there is a bug here. I suspect that perhaps the permissions or ownership of your replacement directories or symlinks are causing the issue. When freshclam is run by sudo, it switches users to run as the "clamav" user. The database directory must be owned by the "clamav" user. The config files, ssl files must be accessible to the clamav user.

If you want to share your exact layout, ownership and permissions of these files and directories I can try to help more.

-Micah


> -----Original Message-----
> From: clamav-devel <clamav-devel-bounces@lists.clamav.net> On Behalf Of
> jean-christophe manciot
> Sent: Monday, March 22, 2021 6:30 AM
> To: clamav-devel@lists.clamav.net
> Subject: [SUSPECTED SPAM] [Clamav-devel] [Feature request] Support Linux
> symlinks for all configuration and database folders
>
> On Ubuntu, freshclam 0.103.0+dfsg-3.1 does not support symlinks for any of
> the following:
> - /etc/clamav
> - /etc/ssl
> - /etc/ssl/certs
> - /var/lib/clamav
>
> If any of the aforementioned folders is a symlink, no database update by
> freshclam is possible.
> Cf. bug report
> https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1920615.
> _______________________________________________
>
> clamav-devel mailing list
> clamav-devel@lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-devel
>
> Please submit your patches to our Github: https://github.com/Cisco-
> Talos/clamav-devel/pulls
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
_______________________________________________

clamav-devel mailing list
clamav-devel@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-devel

Please submit your patches to our Github: https://github.com/Cisco-Talos/clamav-devel/pulls

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [SUSPECTED SPAM] [Feature request] Support Linux symlinks for all configuration and database folders [ In reply to ]
Hello again!

TL;DR for this: I came to the conclusion just now that the clamav package's apparmor profile is preventing freshclam from following symlinks to other locations. My initial testing on docker worked fine because there was no apparmor to block it.

I did my initial testing with an `ubuntu:latest` docker container and did the same basic steps you did, but without using systemctl:

root@73282cc0fdd0:/# mv /etc/clamav/ /etc/clamav-sav/
root@73282cc0fdd0:/# ln -s /etc/clamav-sav/ /etc/clamav
root@73282cc0fdd0:/# ls -la /etc/clamav
lrwxrwxrwx 1 root root 16 Mar 28 16:56 /etc/clamav -> /etc/clamav-sav/
root@73282cc0fdd0:/# freshclam
Sun Mar 28 16:56:30 2021 -> ClamAV update process started at Sun Mar 28 16:56:30 2021
Sun Mar 28 16:56:30 2021 -> daily database available for download (remote version: 26123)
Time: 5.2s, ETA: 0.0s [=============================>] 100.63MiB/100.63MiB
Sun Mar 28 16:56:37 2021 -> Testing database: '/var/lib/clamav/tmp.0300c/clamav-a52b68eeaedacca470206a9e64d75b61.tmp-daily.cvd' ...
Sun Mar 28 16:56:44 2021 -> Database test passed.
Sun Mar 28 16:56:44 2021 -> daily.cvd updated (version: 26123, sigs: 3966434, f-level: 63, builder: raynman)
Sun Mar 28 16:56:44 2021 -> main database available for download (remote version: 59)
Time: 6.5s, ETA: 0.0s [=============================>] 112.40MiB/112.40MiB
Sun Mar 28 16:56:53 2021 -> Testing database: '/var/lib/clamav/tmp.0300c/clamav-9650f62b7145d02d11deba097e796ab7.tmp-main.cvd' ...
Sun Mar 28 16:56:56 2021 -> Database test passed.
Sun Mar 28 16:56:56 2021 -> main.cvd updated (version: 59, sigs: 4564902, f-level: 60, builder: sigmgr)
Sun Mar 28 16:56:56 2021 -> bytecode database available for download (remote version: 333)
Time: 0.3s, ETA: 0.0s [=============================>] 286.79KiB/286.79KiB
Sun Mar 28 16:56:57 2021 -> Testing database: '/var/lib/clamav/tmp.0300c/clamav-f01c8381097dc0fec61ba95a42a3cf49.tmp-bytecode.cvd' ...
Sun Mar 28 16:56:57 2021 -> Database test passed.
Sun Mar 28 16:56:57 2021 -> bytecode.cvd updated (version: 333, sigs: 92, f-level: 63, builder: awillia2)
Sun Mar 28 16:56:57 2021 -> !NotifyClamd: Can't find or parse configuration file /etc/clamav/clamd.conf

As you can see, this worked fine which is why I sent my previous email. But after speaking with Utkarsh Gupta, I decided to re-read your instructions and follow them more closely. I set up an ubuntu 20.04 VM and ran the following:

micah@ubuntu20:~$ sudo mv -f /etc/clamav/ /etc/clamav.sav
micah@ubuntu20:~$ sudo ln -fsv /etc/clamav.sav /etc/clamav
'/etc/clamav' -> '/etc/clamav.sav'
micah@ubuntu20:~$ sudo systemctl restart clamav-freshclam
micah@ubuntu20:~$ sudo systemctl status clamav-freshclam
● clamav-freshclam.service - ClamAV virus database updater
Loaded: loaded (/lib/systemd/system/clamav-freshclam.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Mon 2021-03-29 01:33:29 UTC; 9s ago
Docs: man:freshclam(1)
man:freshclam.conf(5)
https://www.clamav.net/documents
Process: 3593 ExecStart=/usr/bin/freshclam -d --foreground=true (code=exited, status=2)
Main PID: 3593 (code=exited, status=2)

Mar 29 01:33:29 ubuntu20 systemd[1]: Started ClamAV virus database updater.
Mar 29 01:33:29 ubuntu20 freshclam[3593]: ERROR: Can't open/parse the config file /etc/clamav/freshclam.conf
Mar 29 01:33:29 ubuntu20 systemd[1]: clamav-freshclam.service: Main process exited, code=exited, status=2/IN>
Mar 29 01:33:29 ubuntu20 systemd[1]: clamav-freshclam.service: Failed with result 'exit-code'.

This resulted in the same issue you reported. I also tried just running it without systemctl:

micah@ubuntu20:~$ sudo freshclam
ERROR: Can't open/parse the config file /etc/clamav/freshclam.conf

So, same problem you described. It seems strange to me that it followed the symlink okay in the docker container but not on the VM.

Still on the VM, I tried uninstalling clamav (sudo apt uninstall clamav) and then installing with cmake from source:

git clone https://github.com/Cisco-Talos/clamav-devel.git
cd clamav-devel/
mkdir build && cd build
sudo apt install -y ninja-build gcc python3 python3-pip check libbz2-dev libcurl4-openssl-dev libjson-c-dev libmilter-dev libncurses5-dev libpcre2-dev libssl-dev libxml2-dev zlib1g-dev
python3 -m pip install --user cmake
echo "export PATH=/home/micah/.local/bin:$PATH" > ~/.bashrc
source ~/.bashrc
cmake .. -G Ninja && ninja && sudo ninja install
sudo cp /usr/local/etc/freshclam.conf.sample /usr/local/etc/freshclam.conf
sudo vim /usr/local/etc/freshclam.conf # <-- removed the "Example" line
sudo freshclam # worked
sudo mv /usr/local/etc/ /usr/local/etc.sav
sudo ln -s /usr/local/etc.sav/ /usr/local/etc
sudo freshclam # also worked

Here's a copy-paste from those last few commands:

micah@ubuntu20:~/clamav-devel/build$ ls /usr/local/etc/
clamav-milter.conf.sample clamd.conf.sample freshclam.conf freshclam.conf.sample
micah@ubuntu20:~/clamav-devel/build$ sudo mv /usr/local/etc/ /usr/local/etc.sav
micah@ubuntu20:~/clamav-devel/build$ sudo ln -s /usr/local/etc.sav/ /usr/local/etc
micah@ubuntu20:~/clamav-devel/build$ sudo freshclam
ClamAV update process started at Mon Mar 29 01:56:19 2021
daily database available for download (remote version: 26123)
Time: 3.6s, ETA: 0.0s [========================>] 100.63MiB/100.63MiB
Testing database: '/usr/local/share/clamav/tmp.dc65adbc0c/clamav-6f3994d5fd9cd918e7c07311c03f4da7.tmp-daily.cvd' ...
^CUpdate process terminated

So I'm not sure what's going on here. It did seem to follow the symlink for the freshclam.conf file when installed from source on the Ubuntu VM.
I imagine we could get around the problem by using this "cli_realpath()" function before trying to access these files: https://github.com/Cisco-Talos/clamav-devel/blob/dev/0.104/libclamav/others.h#L982

You said you also saw the issue with:
- /etc/ssl
- /etc/ssl/certs

I was also able to reproduce this issue when using the clamav package on the ubuntu VM:

micah@ubuntu20:~$ sudo mv /etc/ssl /etc/ssl.sav
micah@ubuntu20:~$ sudo ln -s /etc/ssl.sav /etc/ssl
micah@ubuntu20:~$ sudo freshclam
Mon Mar 29 02:21:07 2021 -> ClamAV update process started at Mon Mar 29 02:21:07 2021
Mon Mar 29 02:21:07 2021 -> daily database available for download (remote version: 26123)
Mon Mar 29 02:21:07 2021 -> ^Download failed (77) Mon Mar 29 02:21:07 2021 -> ^ Message: Problem with the SSL CA cert (path? access rights?)
Mon Mar 29 02:21:07 2021 -> ^getcvd: Can't download daily.cvd from https://database.clamav.net/daily.cvd
Mon Mar 29 02:21:07 2021 -> Trying again in 5 secs...

Without removing the ssl -> /etc/ssl.sav Symlink, I removed the "clamav" package again and reinstalled clamav from source and configured freshclam.conf again. I ran freshclam again and it worked okay:

micah@ubuntu20:~/clamav-devel/build$ sudo freshclam
ClamAV update process started at Mon Mar 29 02:24:51 2021
daily.cvd database is up to date (version: 26123, sigs: 3966434, f-level: 63, builder: raynman)
main database available for download (remote version: 59)
Time: 4.0s, ETA: 0.0s [========================>] 112.40MiB/112.40MiB
Testing database: '/usr/local/share/clamav/tmp.6595bb7d72/clamav-d96b8da019a765975d9b6d25cdba11a7.tmp-main.cvd' ...

So in the end, I was only able to reproduce the issue with the Ubuntu clamav package on the VM (vs docker).

This got me to thinking that it's probably the apparmor profile preventing freshclam from opening these files: /etc/apparmor.d/usr.bin.freshclam
The apparmor profile lists which directories freshclam is allowed to access and with what permissions. I'm not skilled with apparmor and wouldn't know how to change it to be more permissive with symlinks to other locations.
I'll pass my findings on to Utkarsh Gupta as well.

Regards,
Micah


> -----Original Message-----
> From: clamav-devel <clamav-devel-bounces@lists.clamav.net> On Behalf Of
> Micah Snyder (micasnyd)
> Sent: Saturday, March 27, 2021 4:54 PM
> To: ClamAV Development <clamav-devel@lists.clamav.net>
> Subject: Re: [Clamav-devel] [SUSPECTED SPAM] [Feature request] Support
> Linux symlinks for all configuration and database folders
>
> Hello!
>
> Apologies for the delay getting back to you. I also saw this report:
> https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1920615/
>
> I tried to reproduce the issue you described but was unable. I tried moving the
> ssl directory and moving the clamav directory and then created symlinks to
> each. Eg:
>
> root@117df8bca60f:/# ls -la /var/lib/
> total 64
> ...
> lrwxrwxrwx 1 root root 22 Mar 27 23:38 clamav -> /var/lib/clamav_moved/
>
> and
>
> root@117df8bca60f:/# ls -la /etc/
> ...
> lrwxrwxrwx 1 root root 15 Mar 27 23:37 ssl -> /etc/ssl_moved/
>
> I had no problems running freshclam with these symlinks set up. I don't think
> there is a bug here. I suspect that perhaps the permissions or ownership of your
> replacement directories or symlinks are causing the issue. When freshclam is
> run by sudo, it switches users to run as the "clamav" user. The database
> directory must be owned by the "clamav" user. The config files, ssl files must
> be accessible to the clamav user.
>
> If you want to share your exact layout, ownership and permissions of these files
> and directories I can try to help more.
>
> -Micah
>
>
> > -----Original Message-----
> > From: clamav-devel <clamav-devel-bounces@lists.clamav.net> On Behalf
> > Of jean-christophe manciot
> > Sent: Monday, March 22, 2021 6:30 AM
> > To: clamav-devel@lists.clamav.net
> > Subject: [SUSPECTED SPAM] [Clamav-devel] [Feature request] Support
> > Linux symlinks for all configuration and database folders
> >
> > On Ubuntu, freshclam 0.103.0+dfsg-3.1 does not support symlinks for
> > any of the following:
> > - /etc/clamav
> > - /etc/ssl
> > - /etc/ssl/certs
> > - /var/lib/clamav
> >
> > If any of the aforementioned folders is a symlink, no database update
> > by freshclam is possible.
> > Cf. bug report
> > https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1920615.
> > _______________________________________________
> >
> > clamav-devel mailing list
> > clamav-devel@lists.clamav.net
> > https://lists.clamav.net/mailman/listinfo/clamav-devel
> >
> > Please submit your patches to our Github: https://github.com/Cisco-
> > Talos/clamav-devel/pulls
> >
> > Help us build a comprehensive ClamAV guide:
> > https://github.com/vrtadmin/clamav-faq
> >
> > http://www.clamav.net/contact.html#ml
> _______________________________________________
>
> clamav-devel mailing list
> clamav-devel@lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-devel
>
> Please submit your patches to our Github: https://github.com/Cisco-
> Talos/clamav-devel/pulls
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
_______________________________________________

clamav-devel mailing list
clamav-devel@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-devel

Please submit your patches to our Github: https://github.com/Cisco-Talos/clamav-devel/pulls

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [SUSPECTED SPAM] [Feature request] Support Linux symlinks for all configuration and database folders [ In reply to ]
Hi Micah,

Thanks for your very detailed answer.
I'm not an apparmor expert either, but I doubt it is related to apparmor:
- the clamd & freshclam profiles authorizes the access to:
+ /etc/clamav/clamd.conf r,
+ /etc/clamav/freshclam.conf r,
+ /var/lib/clamav/ r,
+ /var/lib/clamav/** krw,
- there is no specific dedicated access right for symlinks in
http://manpages.ubuntu.com/manpages/hirsute/man5/apparmor.d.5.html nor
in the capabilities
http://manpages.ubuntu.com/manpages/hirsute/man7/capabilities.7.html,
so it seems fair to assume that 'r - Read mode' and 'w - Write mode'
allow symlinks accesses.
- apparmor logs the access error(s) when a process tries to access a
resource for which it is not authorized.
In this case, there is not such apparmor error in the logs:

# grep apparmor /var/log/syslog
# journalctl -xe|grep -i apparmor
# grep clam /var/log/syslog
Mar 29 10:21:08 host clamd[15160]: ERROR: Can't open/parse the config
file /etc/clamav/clamd.conf
Mar 29 10:21:08 host systemd[1]: clamav-daemon.service: Main process
exited, code=exited, status=1/FAILURE
Mar 29 10:21:08 host systemd[1]: clamav-daemon.service: Failed with
result 'exit-code'.
Mar 29 10:21:09 host freshclam[15655]: ERROR: Can't open/parse the
config file /etc/clamav/freshclam.conf
Mar 29 10:21:09 host systemd[1]: clamav-freshclam.service: Main
process exited, code=exited, status=2/INVALIDARGUMENT
Mar 29 10:21:09 host systemd[1]: clamav-freshclam.service: Failed with
result 'exit-code'.
# journalctl -xe|grep -i clam
#
_______________________________________________

clamav-devel mailing list
clamav-devel@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-devel

Please submit your patches to our Github: https://github.com/Cisco-Talos/clamav-devel/pulls

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [SUSPECTED SPAM] [Feature request] Support Linux symlinks for all configuration and database folders [ In reply to ]
On 3/29/21 1:08 PM, jean-christophe manciot wrote:
> Hi Micah,
>
> Thanks for your very detailed answer.
> I'm not an apparmor expert either, but I doubt it is related to apparmor:
> - the clamd & freshclam profiles authorizes the access to:
> + /etc/clamav/clamd.conf r,
> + /etc/clamav/freshclam.conf r,
> + /var/lib/clamav/ r,
> + /var/lib/clamav/** krw,
> - there is no specific dedicated access right for symlinks in
> http://manpages.ubuntu.com/manpages/hirsute/man5/apparmor.d.5.html nor
> in the capabilities
> http://manpages.ubuntu.com/manpages/hirsute/man7/capabilities.7.html,
> so it seems fair to assume that 'r - Read mode' and 'w - Write mode'
> allow symlinks accesses.

Micah is right and above assumption is wrong. This is how apparmor works.
If you need those symlinks and don't want to modify apparmor config for
clamav, you can add aliases to /etc/apparmor.d/tunables/alias

Regards,
Jacek
_______________________________________________

clamav-devel mailing list
clamav-devel@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-devel

Please submit your patches to our Github: https://github.com/Cisco-Talos/clamav-devel/pulls

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [SUSPECTED SPAM] [Feature request] Support Linux symlinks for all configuration and database folders [ In reply to ]
Hello,

Could you remove me from the list please ....
-------------------------
Best Regards
Sinimal Freddy


Le lun. 29 mars 2021 13:05, jean-christophe manciot <
actionmystique@gmail.com> a crit :

> Hi Micah,
>
> Thanks for your very detailed answer.
> I'm not an apparmor expert either, but I doubt it is related to apparmor:
> - the clamd & freshclam profiles authorizes the access to:
> + /etc/clamav/clamd.conf r,
> + /etc/clamav/freshclam.conf r,
> + /var/lib/clamav/ r,
> + /var/lib/clamav/** krw,
> - there is no specific dedicated access right for symlinks in
> http://manpages.ubuntu.com/manpages/hirsute/man5/apparmor.d.5.html nor
> in the capabilities
> http://manpages.ubuntu.com/manpages/hirsute/man7/capabilities.7.html,
> so it seems fair to assume that 'r - Read mode' and 'w - Write mode'
> allow symlinks accesses.
> - apparmor logs the access error(s) when a process tries to access a
> resource for which it is not authorized.
> In this case, there is not such apparmor error in the logs:
>
> # grep apparmor /var/log/syslog
> # journalctl -xe|grep -i apparmor
> # grep clam /var/log/syslog
> Mar 29 10:21:08 host clamd[15160]: ERROR: Can't open/parse the config
> file /etc/clamav/clamd.conf
> Mar 29 10:21:08 host systemd[1]: clamav-daemon.service: Main process
> exited, code=exited, status=1/FAILURE
> Mar 29 10:21:08 host systemd[1]: clamav-daemon.service: Failed with
> result 'exit-code'.
> Mar 29 10:21:09 host freshclam[15655]: ERROR: Can't open/parse the
> config file /etc/clamav/freshclam.conf
> Mar 29 10:21:09 host systemd[1]: clamav-freshclam.service: Main
> process exited, code=exited, status=2/INVALIDARGUMENT
> Mar 29 10:21:09 host systemd[1]: clamav-freshclam.service: Failed with
> result 'exit-code'.
> # journalctl -xe|grep -i clam
> #
> _______________________________________________
>
> clamav-devel mailing list
> clamav-devel@lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-devel
>
> Please submit your patches to our Github:
> https://github.com/Cisco-Talos/clamav-devel/pulls
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>
_______________________________________________

clamav-devel mailing list
clamav-devel@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-devel

Please submit your patches to our Github: https://github.com/Cisco-Talos/clamav-devel/pulls

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [SUSPECTED SPAM] [Feature request] Support Linux symlinks for all configuration and database folders [ In reply to ]
Thank you for writing in.

Go to this URL to change user options or unsubscribe:
https://lists.ClamAV.net/mailman/listinfo/ClamAV-devel

or by sending an email to ClamAV-devel-leave@lists.ClamAV.net

Thanks!

On Mar 29, 2021, at 8:06 AM, Sinimal Freddy <sinimalefreddy@gmail.com<mailto:sinimalefreddy@gmail.com>> wrote:

Hello,

Could you remove me from the list please ....
-------------------------
Best Regards
Sinimal Freddy


Le lun. 29 mars 2021 13:05, jean-christophe manciot <
actionmystique@gmail.com<mailto:actionmystique@gmail.com>> a crit :

Hi Micah,

Thanks for your very detailed answer.
I'm not an apparmor expert either, but I doubt it is related to apparmor:
- the clamd & freshclam profiles authorizes the access to:
+ /etc/clamav/clamd.conf r,
+ /etc/clamav/freshclam.conf r,
+ /var/lib/clamav/ r,
+ /var/lib/clamav/** krw,
- there is no specific dedicated access right for symlinks in
http://manpages.ubuntu.com/manpages/hirsute/man5/apparmor.d.5.html nor
in the capabilities
http://manpages.ubuntu.com/manpages/hirsute/man7/capabilities.7.html,
so it seems fair to assume that 'r - Read mode' and 'w - Write mode'
allow symlinks accesses.
- apparmor logs the access error(s) when a process tries to access a
resource for which it is not authorized.
In this case, there is not such apparmor error in the logs:

# grep apparmor /var/log/syslog
# journalctl -xe|grep -i apparmor
# grep clam /var/log/syslog
Mar 29 10:21:08 host clamd[15160]: ERROR: Can't open/parse the config
file /etc/clamav/clamd.conf
Mar 29 10:21:08 host systemd[1]: clamav-daemon.service: Main process
exited, code=exited, status=1/FAILURE
Mar 29 10:21:08 host systemd[1]: clamav-daemon.service: Failed with
result 'exit-code'.
Mar 29 10:21:09 host freshclam[15655]: ERROR: Can't open/parse the
config file /etc/clamav/freshclam.conf
Mar 29 10:21:09 host systemd[1]: clamav-freshclam.service: Main
process exited, code=exited, status=2/INVALIDARGUMENT
Mar 29 10:21:09 host systemd[1]: clamav-freshclam.service: Failed with
result 'exit-code'.
# journalctl -xe|grep -i clam
#
_______________________________________________

clamav-devel mailing list
clamav-devel@lists.clamav.net<mailto:clamav-devel@lists.clamav.net>
https://lists.clamav.net/mailman/listinfo/clamav-devel

Please submit your patches to our Github:
https://github.com/Cisco-Talos/clamav-devel/pulls

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

_______________________________________________

clamav-devel mailing list
clamav-devel@lists.clamav.net<mailto:clamav-devel@lists.clamav.net>
https://lists.clamav.net/mailman/listinfo/clamav-devel

Please submit your patches to our Github: https://github.com/Cisco-Talos/clamav-devel/pulls

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml

_______________________________________________

clamav-devel mailing list
clamav-devel@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-devel

Please submit your patches to our Github: https://github.com/Cisco-Talos/clamav-devel/pulls

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml
Re: [SUSPECTED SPAM] [Feature request] Support Linux symlinks for all configuration and database folders [ In reply to ]
Thanks Jacek for chiming in.
It turns out you're right: creating the right aliases allows both
systemd services to start successfully.
Thanks.

On Mon, Mar 29, 2021 at 3:01 PM Joel Esler (jesler) <jesler@cisco.com> wrote:
>
> Thank you for writing in.
>
> Go to this URL to change user options or unsubscribe:
> https://lists.ClamAV.net/mailman/listinfo/ClamAV-devel
>
> or by sending an email to ClamAV-devel-leave@lists.ClamAV.net
>
> Thanks!
>
> On Mar 29, 2021, at 8:06 AM, Sinimal Freddy <sinimalefreddy@gmail.com<mailto:sinimalefreddy@gmail.com>> wrote:
>
> Hello,
>
> Could you remove me from the list please ....
> -------------------------
> Best Regards
> Sinimal Freddy
>
>
> Le lun. 29 mars 2021 13:05, jean-christophe manciot <
> actionmystique@gmail.com<mailto:actionmystique@gmail.com>> a crit :
>
> Hi Micah,
>
> Thanks for your very detailed answer.
> I'm not an apparmor expert either, but I doubt it is related to apparmor:
> - the clamd & freshclam profiles authorizes the access to:
> + /etc/clamav/clamd.conf r,
> + /etc/clamav/freshclam.conf r,
> + /var/lib/clamav/ r,
> + /var/lib/clamav/** krw,
> - there is no specific dedicated access right for symlinks in
> http://manpages.ubuntu.com/manpages/hirsute/man5/apparmor.d.5.html nor
> in the capabilities
> http://manpages.ubuntu.com/manpages/hirsute/man7/capabilities.7.html,
> so it seems fair to assume that 'r - Read mode' and 'w - Write mode'
> allow symlinks accesses.
> - apparmor logs the access error(s) when a process tries to access a
> resource for which it is not authorized.
> In this case, there is not such apparmor error in the logs:
>
> # grep apparmor /var/log/syslog
> # journalctl -xe|grep -i apparmor
> # grep clam /var/log/syslog
> Mar 29 10:21:08 host clamd[15160]: ERROR: Can't open/parse the config
> file /etc/clamav/clamd.conf
> Mar 29 10:21:08 host systemd[1]: clamav-daemon.service: Main process
> exited, code=exited, status=1/FAILURE
> Mar 29 10:21:08 host systemd[1]: clamav-daemon.service: Failed with
> result 'exit-code'.
> Mar 29 10:21:09 host freshclam[15655]: ERROR: Can't open/parse the
> config file /etc/clamav/freshclam.conf
> Mar 29 10:21:09 host systemd[1]: clamav-freshclam.service: Main
> process exited, code=exited, status=2/INVALIDARGUMENT
> Mar 29 10:21:09 host systemd[1]: clamav-freshclam.service: Failed with
> result 'exit-code'.
> # journalctl -xe|grep -i clam
> #
> _______________________________________________
>
> clamav-devel mailing list
> clamav-devel@lists.clamav.net<mailto:clamav-devel@lists.clamav.net>
> https://lists.clamav.net/mailman/listinfo/clamav-devel
>
> Please submit your patches to our Github:
> https://github.com/Cisco-Talos/clamav-devel/pulls
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>
> _______________________________________________
>
> clamav-devel mailing list
> clamav-devel@lists.clamav.net<mailto:clamav-devel@lists.clamav.net>
> https://lists.clamav.net/mailman/listinfo/clamav-devel
>
> Please submit your patches to our Github: https://github.com/Cisco-Talos/clamav-devel/pulls
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>
> _______________________________________________
>
> clamav-devel mailing list
> clamav-devel@lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-devel
>
> Please submit your patches to our Github: https://github.com/Cisco-Talos/clamav-devel/pulls
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml



--
Jean-Christophe
_______________________________________________

clamav-devel mailing list
clamav-devel@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-devel

Please submit your patches to our Github: https://github.com/Cisco-Talos/clamav-devel/pulls

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml