168716 2007-02-28 12:38 0000 mail-filter/clamassassin-1.2.3 sandbox violation 2007-04-11 18:38:21 0000 1 1 1 Unclassified Gentoo Linux Applications unspecified All Linux CLOSED TEST-REQUEST P2 normal --- 1 gentoo-bugs.f@umsar.org slarti@gentoo.org net-mail@gentoo.org rich0@gentoo.org xavier.parizet@gmail.com gentoo-bugs.f@umsar.org 2007-02-28 12:38:07 0000 configure: ClamAV version 0.90 detected. configure: Using scanner /usr/bin/clamdscan configure: Using scanner options --disable-summary --stdout configure: Using virus signature file dir /var/lib/clamav configure: Signature version reporting is off. configure: Scanner name adding is on. configure: Using temporary directory /var/tmp/portage/mail-filter/clamassassin-1.2.3/temp configure: Subject header rewriting is on: *****VIRUS***** configure: creating ./config.status config.status: creating clamassassin config.status: creating Makefile >>> Source compiled. --------------------------- ACCESS VIOLATION SUMMARY --------------------------- LOG FILE = "/var/log/sandbox/sandbox-mail-filter_-_clamassassin-1.2.3-26024.log" open_wr: /var/lib/clamav/.dbLock open_wr: /var/lib/clamav/.dbLock -------------------------------------------------------------------------------- #emerge --info Portage 2.1.2-r9 (default-linux/x86/2006.0, gcc-4.1.1, glibc-2.5-r0, 2.6.18-gentoo-r6 i686) ================================================================= System uname: 2.6.18-gentoo-r6 i686 AMD Athlon(tm) XP 1800+ Gentoo Base System release 1.12.9 Timestamp of tree: Wed, 28 Feb 2007 01:50:01 +0000 distcc 2.18.3 i686-pc-linux-gnu (protocols 1 and 2) (default port 3632) [enabled] ccache version 2.4 [enabled] dev-java/java-config: 1.3.7, 2.0.31 dev-lang/python: 2.4.3-r4 dev-python/pycrypto: 2.0.1-r5 dev-util/ccache: 2.4-r6 sys-apps/sandbox: 1.2.17 sys-devel/autoconf: 2.13, 2.61 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10 sys-devel/binutils: 2.16.1-r3 sys-devel/gcc-config: 1.3.14 sys-devel/libtool: 1.5.22 virtual/os-headers: 2.6.17-r2 ACCEPT_KEYWORDS="x86" AUTOCLEAN="yes" CBUILD="i686-pc-linux-gnu" CFLAGS="-march=athlon-xp -O2 -pipe -fomit-frame-pointer" CHOST="i686-pc-linux-gnu" CONFIG_PROTECT="/etc /opt/openjms/config" CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/java-config/vms/ /etc/revdep-rebuild /etc/terminfo" CXXFLAGS="-march=athlon-xp -O2 -pipe -fomit-frame-pointer" DISTDIR="/usr/portage/distfiles" FEATURES="autoconfig buildpkg ccache collision-protect distcc distlocks fixpackages metadata-transfer parallel-fetch sandbox sfperms strict userfetch userpriv usersandbox" GENTOO_MIRRORS="http://ftp.club-internet.fr/pub/mirrors/gentoo/ http://mirror.ovh.net/gentoo-distfiles/ http://ftp.belnet.be/mirror/rsync.gentoo.org/gentoo/ http://distfiles.gentoo.org http://www.ibiblio.org/pub/Linux/distributions/gentoo/" LANG="en_US.ISO-8859-15" MAKEOPTS="-j3" PKGDIR="/usr/portage/packages" PORTAGE_RSYNC_EXTRA_OPTS="--human-readable" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/portage /usr/portage/local/layman/sunrise" SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage" USE="apache2 apm arts bash-completion berkdb bitmap-fonts bzip2 caps clamd cli cracklib crypt cups curl dri eds emboss encode enscript esd expat fam foomaticdb fortran gd gdbm gif gmp gstreamer gtk2 iconv imlib isdnlog javamail jbig jms jmx jpeg libg++ libwww logrotate mad maildir midi mikmod mp3 mpeg ncurses nls nptl nptlonly ogg opengl oss pam pcre pic png pppd python qt3 qt4 quicktime readline reflection ruby sasl session spl sqlite ssl tcpd threads tiff truetype truetype-fonts type1-fonts vhosts vorbis x86 xml xml2 xorg xv zlib" ALSA_CARDS="emu10k1" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" USERLAND="GNU" VIDEO_CARDS="nvidia" Unset: CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, LDFLAGS, LINGUAS xavier.parizet@gmail.com 2007-03-23 19:04:06 0000 Same bug here... My emerge --info : Portage 2.1.2.2 (default-linux/amd64/2006.1/desktop, gcc-4.1.2, glibc-2.5-r1, 2.6.20-gentoo-r3 x86_64) ================================================================= System uname: 2.6.20-gentoo-r3 x86_64 Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz Gentoo Base System release 1.12.9 Timestamp of tree: Fri, 23 Mar 2007 18:20:01 +0000 distcc 2.18.3 x86_64-pc-linux-gnu (protocols 1 and 2) (default port 3632) [disabled] dev-java/java-config: 1.3.7, 2.0.31-r5 dev-lang/python: 2.4.4 dev-python/pycrypto: 2.0.1-r5 sys-apps/sandbox: 1.2.18.1 sys-devel/autoconf: 2.13, 2.61 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10 sys-devel/binutils: 2.17 sys-devel/gcc-config: 1.3.15-r1 sys-devel/libtool: 1.5.23b virtual/os-headers: 2.6.20-r2 ACCEPT_KEYWORDS="amd64 x86 ~amd64 ~x86" AUTOCLEAN="yes" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config /var/bind" CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/java-config/vms/ /etc/php/apache1-php5/ext-active/ /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/terminfo /etc/texmf/web2c" CXXFLAGS="-O2 -pipe" DISTDIR="/usr/portage/distfiles" FEATURES="autoconfig buildpkg distlocks metadata-transfer sandbox sfperms strict" GENTOO_MIRRORS="http://ftp.belnet.be/mirror/rsync.gentoo.org/gentoo/ ftp://ftp.belnet.be/mirror/rsync.gentoo.org/gentoo/ http://gentoo.modulix.net/gentoo/ http://ftp.club-internet.fr/pub/mirrors/gentoo ftp://gentoo.imj.fr/pub/gentoo/ ftp://ftp.free.fr/mirrors/ftp.gentoo.org/ " LANG="fr_FR.UTF-8" LC_ALL="fr_FR.UTF-8" LINGUAS="fr" MAKEOPTS="-j3" PKGDIR="/usr/portage/packages" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/portage/local/layman/marineam-xen /usr/portage/local/layman/aross /usr/local/portage" SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage" USE="X acpi alsa amd64 apache2 bcmath berkdb bitmap-fonts bzip2 cairo calendar cdr cli cracklib crypt ctype cups dbus doc dri dvd dvdr dvdread eds emboss encode esd fam ffmpeg filter firefox fortran ftp gd gdbm gif gpm gstreamer gtk2 hal iconv imap inifile ipv6 isdnlog java jpeg kde lame libg++ libwww mad maildir midi mikmod mp3 mpeg mplayer mpm-threadpool mysql mysqli ncurses nls nptl nptlonly nsplugin ogg opengl oss pam pcntl pcre pdf perl png posix ppds pppd python qt3 qt4 quicktime readline reflection sasl sdl sensord session simplexml sockets spell spl sqlite ssl tcpd threads tidy truetype truetype-fonts type1-fonts unicode vda vorbis wifi xine xml xmlreader xmlrpc xmlwriter xorg xsl xv xvid zip zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="fr" USERLAND="GNU" VIDEO_CARDS="fglrx radeon" Unset: CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LDFLAGS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS xavier.parizet@gmail.com 2007-03-23 20:55:01 0000 Created an attachment (id=114181) Patch which correct the sandbox violation This patch correct the sandbox violation by disabling the verification of the current virus database of ClamAV, which cause the violation trying to access the database in /var/lib bypassing the sandbox. xavier.parizet@gmail.com 2007-03-23 20:55:42 0000 Created an attachment (id=114182) Ebuild to merge clamassassin with the patch I submit ticho@gentoo.org 2007-03-23 21:41:32 0000 Seems to me that "addpredict" could be better than a patch in this case. Correct path to the lock file needs to be extracted from clamd.conf though (directive DatabaseDirectory). After stracing clamscan, I can see that it continues to scan even if the lock file can't be created (run by regular user, who doesn't have write access to DatabaseDirectory). I guess using "adddeny" would be even better here, so the merge process doesn't touch the live system. Tom? xavier.parizet@gmail.com 2007-03-23 23:17:30 0000 I don't understand... Under the sandboxshell, there is no violation, even if I call src_compile as emerge do. Any idea ? rich0@gentoo.org 2007-04-09 00:27:58 0000 I get the same problem on amd64. I'm not sure it should be keyworded stable on amd64 with this issue. ticho@gentoo.org 2007-04-09 11:42:40 0000 I've added code which gets correct DatabaseDirectory from clamd.conf, and adds an appropriate addpredict call, so sandbox doesn't bomb out because of this. Please sync in few hours and give the new 1.2.3 a try. gentoo-bugs.f@umsar.org 2007-04-11 12:30:15 0000 (In reply to comment #7) > I've added code which gets correct DatabaseDirectory from clamd.conf, and adds > an appropriate addpredict call, so sandbox doesn't bomb out because of this. I still get a sandbox violation, but for /var/lib/clamav/main.inc/.dbLock (open_wr). # md5sum /usr/portage/mail-filter/clamassassin/clamassassin-1.2.3.ebuild b766dd71620ac287719834db8fcc28cb ticho@gentoo.org 2007-04-11 12:49:22 0000 Hm, interesting - I didn't know that more locations are tried. Anyway, I've added an addpredict call for whole DatabaseDirectory, so it should catch every attempt now. gentoo-bugs.f@umsar.org 2007-04-11 14:05:07 0000 resolved fixed i think :) ticho@gentoo.org 2007-04-11 17:08:30 0000 Great! :) gentoo-bugs.f@umsar.org 2007-04-11 17:55:13 0000 Should'nt it be RESOLVED FIXED instead of CLOSED TEST-REQUEST ? (not that i realy care... but it sound weird to me;) ticho@gentoo.org 2007-04-11 18:38:21 0000 Yes, it should, but noone really cares, and the only important thing is that both RESOLVED and CLOSED bugs disappear from results of saved searches developers set up - for example, this bug no longer shows up on my "net-mail bugs" search. :) 114181 2007-03-23 20:55 0000 Patch which correct the sandbox violation clamassassin.patch text/plain ZGlmZiAtTmF1ciBjbGFtYXNzYXNzaW4tMS4yLjMubmV3L2NvbmZpZ3VyZS5hYyBjbGFtYXNzYXNz aW4tMS4yLjMvY29uZmlndXJlLmFjCi0tLSBjbGFtYXNzYXNzaW4tMS4yLjMubmV3L2NvbmZpZ3Vy ZS5hYwkyMDA2LTAxLTEwIDA2OjAyOjQyLjAwMDAwMDAwMCArMDEwMAorKysgY2xhbWFzc2Fzc2lu LTEuMi4zL2NvbmZpZ3VyZS5hYwkyMDA3LTAzLTIzIDIxOjE5OjA1LjAwMDAwMDAwMCArMDEwMApA QCAtMTU4LDIwICsxNTgsMTEgQEAKIHRoZW4KICAgQUNfU1VCU1QoQ09ORl9DTEFNU0NBTk9QVCwi LS1kaXNhYmxlLXN1bW1hcnkgLS1zdGRvdXQiKQogZWxzZQotICBBQ19TVUJTVChDT05GX0NMQU1T Q0FOT1BULCItLW5vLXN1bW1hcnkgLS1zdGRvdXQgLS1tYm94IikKKyAgQUNfU1VCU1QoQ09ORl9D TEFNU0NBTk9QVCwiLS1uby1zdW1tYXJ5IC0tc3Rkb3V0IikKIGZpCiAKIEFDX01TR19OT1RJQ0Uo W1VzaW5nIHNjYW5uZXIgb3B0aW9ucyAke0NPTkZfQ0xBTVNDQU5PUFR9XSkKIAotU0lHTE9DPWAk e0NPTkZfQ0xBTVNDQU59IC0tZGVidWcgLS10ZW1wZGlyPS9kZXYvbnVsbCAvZGV2L251bGwgMj4m MSB8ICR7Q09ORl9TRUR9IC1lICIvXkxpYkNsYW1BViBkZWJ1ZzogTG9hZGluZyBkYXRhYmFzZXMg ZnJvbSAvIWQiIC1lICJzLy4qIC8vIiAtZSBxYAotaWYgdGVzdCAiJFNJR0xPQyIgPSAiIgotdGhl bgotICBBQ19NU0dfRVJST1IoW0Nhbm5vdCBkZXRlcm1pbmUgdmlydXMgc2lnbmF0dXJlIGZpbGUg ZGlyZWN0b3J5XSkKLWVsc2UKLSAgQUNfTVNHX05PVElDRShbVXNpbmcgdmlydXMgc2lnbmF0dXJl IGZpbGUgZGlyICR7U0lHTE9DfV0pCi0gIEFDX1NVQlNUKENPTkZfU0lHTE9DLCR7U0lHTE9DfSkK LWZpCi0KIEFDX0FSR19FTkFCTEUoc2lnbmF0dXJlLXZlcnNpb24sCiBbICAtLWVuYWJsZS1zaWdu YXR1cmUtdmVyc2lvbgogCVR1cm5zIG9uIHNpZ25hdHVyZSB2ZXJzaW9uIHJlcG9ydGluZyAoZGVm YXVsdCBmb3IgQ2xhbUFWIGJlbG93IDAuODApCg== 114182 2007-03-23 20:55 0000 Ebuild to merge clamassassin with the patch I submit clamassassin-1.2.3-r2.ebuild text/plain IyBDb3B5cmlnaHQgMTk5OS0yMDA2IEdlbnRvbyBGb3VuZGF0aW9uCiMgRGlzdHJpYnV0ZWQgdW5k ZXIgdGhlIHRlcm1zIG9mIHRoZSBHTlUgR2VuZXJhbCBQdWJsaWMgTGljZW5zZSB2MgojICRIZWFk ZXI6IC92YXIvY3Zzcm9vdC9nZW50b28teDg2L21haWwtZmlsdGVyL2NsYW1hc3Nhc3Npbi9jbGFt YXNzYXNzaW4tMS4yLjMuZWJ1aWxkLHYgMS4yIDIwMDYvMDMvMTMgMTQ6MjI6NDIgdGljaG8gRXhw ICQKCmluaGVyaXQgZXV0aWxzIGF1dG90b29scwoKREVTQ1JJUFRJT049ImNsYW1hc3Nhc3NpbiBp cyBhIHNpbXBsZSBzY3JpcHQgZm9yIHZpcnVzIHNjYW5uaW5nICh0aHJvdWdoIGNsYW1hdikgYW4g ZS1tYWlsIG1lc3NhZ2UgYXMgYQpmaWx0ZXIgKGxpa2Ugc3BhbWFzc2Fzc2luKSIKSE9NRVBBR0U9 Imh0dHA6Ly9kcml2ZWwuY29tL2NsYW1hc3Nhc3Npbi8iClNSQ19VUkk9Imh0dHA6Ly9kcml2ZWwu Y29tL2NsYW1hc3Nhc3Npbi8ke1B9LnRhci5neiIKTElDRU5TRT0iQlNEIgpTTE9UPSIwIgpLRVlX T1JEUz0ifmFtZDY0IH5wcGMgfnNwYXJjIHg4NiIKSVVTRT0ic3ViamVjdC1yZXdyaXRlIGNsYW1k IgpERVBFTkQ9Ij49YXBwLWFudGl2aXJ1cy9jbGFtYXYtMC43NS4xCgkJc3lzLWFwcHMvZGViaWFu dXRpbHMKCQlzeXMtYXBwcy93aGljaAoJCW1haWwtZmlsdGVyL3Byb2NtYWlsIgoKc3JjX2NvbXBp bGUoKSB7CgllcGF0Y2ggIiR7RklMRVNESVJ9L2NsYW1hc3Nhc3Npbi5wYXRjaCIKCWVhdXRvcmVj b25mIHx8IGRpZQoJZWNvbmYgXAoJCSQodXNlX2VuYWJsZSBzdWJqZWN0LXJld3JpdGUpIFwKCQkk KHVzZV9lbmFibGUgY2xhbWQgY2xhbWRzY2FuKSBcCgkgfHwgZGllCgkjIEZpeCBwcm9ibGVtcyB3 aXRoIFBvcnRhZ2UgZXhwb3J0aW5nIFRNUCBhbmQgYnJlYWtpbmcgY2xhbWFzc2Fzc2luLiAjNjE4 MDYKCXNlZCAtaSAtZSAiczoke1RNUH06L3RtcDoiIGNsYW1hc3Nhc3Npbgp9CgpzcmNfaW5zdGFs bCgpIHsKCWRvYmluIGNsYW1hc3Nhc3NpbgoJZG9kb2MgQ0hBTkdFTE9HIExJQ0VOU0UgUkVBRE1F Cn0K