I did a small fix that changed clamav-milters socket permissions from srwxr-xr-x to srwxrwxrwx Reproducible: Always I don't know if this patch is actually correct or if it should be pushed, all i can say is that it fixed my issue when running clamav-milter with postfix.
Created attachment 167958 [details, diff] The patch itself I use a local static variable to clean up after myself.
If clamav-milter ran as the same user as postfix, the original stricter permissions should work fine. What was the owner of the socket, and what user does your postfix process run as? Making a socket world-writable is not a good idea for security...
ClamAV runs as clamav while postfix runs as postfix. I just made it emulate clamd: srwxrwxrwx 1 clamav clamav 0 11 okt 01.32 clamd.sock srwxrwxrwx 1 clamav clamav 0 11 okt 01.32 clmilter.sock afair there is currently no support for switching the user. And since the data comes from postfix which i doubt does any prechecking, i don't see the point of securing it locally. clmilter is more of a wrapper for clamd anyways.
(In reply to comment #3) > ClamAV runs as clamav while postfix runs as postfix. > > I just made it emulate clamd: > srwxrwxrwx 1 clamav clamav 0 11 okt 01.32 clamd.sock > srwxrwxrwx 1 clamav clamav 0 11 okt 01.32 clmilter.sock > > afair there is currently no support for switching the user. > And since the data comes from postfix which i doubt does any prechecking, i > don't see the point of securing it locally. > > clmilter is more of a wrapper for clamd anyways. > did you report this upstream? imho socket permissions are somewhat specific to different setups, having a that socket world writable doesn't sound like a good idea to me ...
I really don't see the problem, this is the socket youre usually dumping unknown maildata to... And it looks like it just acts like a wrapper for clamav, which has those permissions by default. No, i haven't reported it upstream yet.
Ok, so i got a reply from clamav where they state that it shouldn't be world writable and that clamav-milter should be run as the same user as your 'sendmail' install. I'll post a summary here when something has been concluded.
(In reply to comment #6) > Ok, so i got a reply from clamav where they state that it shouldn't be world > writable and that clamav-milter should be run as the same user as your > 'sendmail' install. > > I'll post a summary here when something has been concluded. > As a agree with that reply you got from upstream I'm marking this bug as wontfix for now. Feel free to reopen if upstream says it's ok to change the socket permissions as suggested.
Created attachment 171665 [details, diff] The actual patch i indented for ppl to use.
I never intended it to be a world writable socket, i just got confused that that was the major issue. This patch opens it as a group socket thing. The problem with running this as postfix is that you either have to change the owner for all of clamav or botch your own init scripts since gentoo doesn't support running clamav-milter as another user. Adding group writable is a easy fix however, since you only have to add postfix to the clamav group.
