Mailing List Archive: Clamav 1.0.1 and email scan failed

Clamav 1.0.1 and email scan failed

Jul 31, 2023, 7:55 AM

Post #1 of 6 (209 views)

Hi there,
I have a Debian 12 VM, clamav installed at version 1.0.1.
I configured it to work with Postfix.
When email is received and it's passed to ClamaV, this is the error
received:
Sun Jul 30 23:37:29 2023 -> WARNING: File path check failure for:
/var/spool/amavis/tmp/maia-20230730T233718-2282052/parts

It isn't a permission problem, it seems that the message cannot be
divided into its parts: nothing is created under parts directory.

Any idea please ?

Thank you and regards

Fiorenza
----------------------------------------------

Fiorenza Meini/Spazio Web

Via Dante Alighieri, 10 - 13900 - BIELLA
tel. +39 015 2431982-2 - fax 015 2522600
https://esseweb.eu
--
Questo messaggio e i suoi allegati ai sensi del Regolamento (UE)
2016/679 sono indirizzati esclusivamente alle persone indicate.
La diffusione, copia o qualsiasi altra azione derivante dalla conoscenza
di queste informazioni sono rigorosamente vietate.
Qualora abbiate ricevuto questo documento per errore siete pregati di
darne immediata comunicazione al mittente e provvedere alla sua distruzione.
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

Re: [ext] Clamav 1.0.1 and email scan failed [ In reply to ]

clamav-users at lists

Jul 31, 2023, 8:02 AM

Post #2 of 6 (209 views)

Permalink

* Fiorenza Meini via clamav-users <clamav-users@lists.clamav.net>:
>
> Hi there,
> I have a Debian 12 VM, clamav installed at version 1.0.1.
> I configured it to work with Postfix.
> When email is received and it's passed to ClamaV, this is the error
> received:
> Sun Jul 30 23:37:29 2023 -> WARNING: File path check failure for: /var/spool/amavis/tmp/maia-20230730T233718-2282052/parts

That is just a warning.

> It isn't a permission problem, it seems that the message cannot be divided
> into its parts: nothing is created under parts directory.

That would be an amavis issue (since amavis does the unpacking)

More logging is needed for the message in question.

--
Ralf Hildebrandt
Charité - Universitätsmedizin Berlin
Geschäftsbereich IT | Abteilung Netzwerk

Campus Benjamin Franklin (CBF)
Haus I | 1. OG | Raum 105
Hindenburgdamm 30 | D-12203 Berlin

Tel. +49 30 450 570 155
ralf.hildebrandt@charite.de
https://www.charite.de
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

Re: [ext] Clamav 1.0.1 and email scan failed [ In reply to ]

clamav-users at lists

Jul 31, 2023, 8:10 AM

Post #3 of 6 (209 views)

Permalink

Il 31/07/23 17:02, Ralf Hildebrandt via clamav-users ha scritto:
> * Fiorenza Meini via clamav-users <clamav-users@lists.clamav.net>:
>>
>> Hi there,
>> I have a Debian 12 VM, clamav installed at version 1.0.1.
>> I configured it to work with Postfix.
>> When email is received and it's passed to ClamaV, this is the error
>> received:
>> Sun Jul 30 23:37:29 2023 -> WARNING: File path check failure for: /var/spool/amavis/tmp/maia-20230730T233718-2282052/parts
>
> That is just a warning.
>
Sure, it's a warning.

>> It isn't a permission problem, it seems that the message cannot be divided
>> into its parts: nothing is created under parts directory.
>
> That would be an amavis issue (since amavis does the unpacking)
>
To exclude amavis problem, I installed Clamav on a separate VM and I
configured it to listen to TCP port 3310.
Then I configured amavis on another VM so that it has to contact CLamav
through TCP connection to the VM where Clamav is installed.
But the error is the same.

To me is a bug or some function not enabled in Clamav...

> More logging is needed for the message in question.
>

Regards
Fiorenza

----------------------------------------------

Fiorenza Meini/Spazio Web

Via Dante Alighieri, 10 - 13900 - BIELLA
tel. +39 015 2431982-2 - fax 015 2522600
https://esseweb.eu
--
Questo messaggio e i suoi allegati ai sensi del Regolamento (UE)
2016/679 sono indirizzati esclusivamente alle persone indicate.
La diffusione, copia o qualsiasi altra azione derivante dalla conoscenza
di queste informazioni sono rigorosamente vietate.
Qualora abbiate ricevuto questo documento per errore siete pregati di
darne immediata comunicazione al mittente e provvedere alla sua distruzione.
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

Re: [ext] Clamav 1.0.1 and email scan failed [ In reply to ]

clamav-users at lists

Jul 31, 2023, 9:06 AM

Post #4 of 6 (209 views)

Permalink

> Then I configured amavis on another VM so that it has to contact
> CLamav through TCP connection to the VM where Clamav is installed.
> But the error is the same.

I am not aware that an Amavis-to-ClamAV content stream includes file
paths. So if the error message of the remote ClamAV contains an amavis
spool path, your debug-setup is probably not what you intended.

Try an "strace -f -e trace=file --failed-only -p $local_clamav_pid" instead.

Re: [ext] Clamav 1.0.1 and email scan failed [ In reply to ]

clamav-users at lists

Aug 1, 2023, 9:09 AM

Post #5 of 6 (208 views)

Permalink

Il 31/07/23 18:06, Damian via clamav-users ha scritto:
>> Then I configured amavis on another VM so that it has to contact
>> CLamav through TCP connection to the VM where Clamav is installed.
>> But the error is the same.
>
> I am not aware that an Amavis-to-ClamAV content stream includes file
> paths. So if the error message of the remote ClamAV contains an amavis
> spool path, your debug-setup is probably not what you intended.
>
> Try an "strace -f -e trace=file --failed-only -p $local_clamav_pid" instead.
>
>

Hi, the problem was apparmor clamav's profile.
I didn't succeded in configuring it properly, so I disabled apparmor
itself. I'll try to have clamav working with apparmor.

Regards
Fiorenza

----------------------------------------------

Fiorenza Meini/Spazio Web

Via Dante Alighieri, 10 - 13900 - BIELLA
tel. +39 015 2431982-2 - fax 015 2522600
https://esseweb.eu
--
Questo messaggio e i suoi allegati ai sensi del Regolamento (UE)
2016/679 sono indirizzati esclusivamente alle persone indicate.
La diffusione, copia o qualsiasi altra azione derivante dalla conoscenza
di queste informazioni sono rigorosamente vietate.
Qualora abbiate ricevuto questo documento per errore siete pregati di
darne immediata comunicazione al mittente e provvedere alla sua distruzione.
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

Re: [ext] Clamav 1.0.1 and email scan failed [ In reply to ]

clamav-users at lists

Aug 1, 2023, 9:44 AM

Post #6 of 6 (208 views)

Permalink

On August 1, 2023 4:09:44 PM UTC, Fiorenza Meini via clamav-users <clamav-users@lists.clamav.net> wrote:
>
>
>Il 31/07/23 18:06, Damian via clamav-users ha scritto:
>>> Then I configured amavis on another VM so that it has to contact CLamav through TCP connection to the VM where Clamav is installed.
>>> But the error is the same.
>>
>> I am not aware that an Amavis-to-ClamAV content stream includes file paths. So if the error message of the remote ClamAV contains an amavis spool path, your debug-setup is probably not what you intended.
>>
>> Try an "strace -f -e trace=file --failed-only -p $local_clamav_pid" instead.
>>
>>
>
>Hi, the problem was apparmor clamav's profile.
>I didn't succeded in configuring it properly, so I disabled apparmor itself. I'll try to have clamav working with apparmor.
>
This is a Debian system, right? Once you figure it out, please file a bug against the Debian clamav package so we can incorporate the change.

Scott K
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat