Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 708560 - >=app-antivirus/clamav-102.2 with mail-filter/amavisd-new: clamd cannot access /var/amavis/tmp/amavis-*/parts - Permission denied.
Summary: >=app-antivirus/clamav-102.2 with mail-filter/amavisd-new: clamd cannot acces...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Antivirus Team
URL:
Whiteboard:
Keywords:
: 708734 (view as bug list)
Depends on:
Blocks:
 
Reported: 2020-02-07 07:23 UTC by Tomáš Mózes
Modified: 2020-03-01 20:15 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Tomáš Mózes 2020-02-07 07:23:50 UTC
Now that app-antivirus/clamav pulls in acct-{group,user}/clamav we have a problem with amavisd-new integration. Amavisd-new uses clamd as it's antivirus scanner, however the temporary directories under /var/amavis/tmp/amavis* are set with permissions 750 (amavis:amavis). A possible solution is to append the amavis group to clamav so that clamav will have access to the files:
# usermod -a -G amavis clamav

This will not work as the clamav user/group ebuilds will clear the settings and it will fail.

Maybe we should an amavis USE flag to acct-user/clamav that will replace the usermod call? Something like acct-user/git/git-0.ebuild.
Comment 1 Michael Orlitzky gentoo-dev 2020-02-07 15:17:57 UTC
Allowing the clamav daemon to read the files of everyone that it wants to perform virus scans for is not a great way to set things up, even though it has been the "default" in amavis for a while (the documentation just suggests this first and most prominently).

I recommend you leave the groups alone, and have amavisd-new pass a file descriptor to clamdscan rather than telling it which file to scan:

  https://gitlab.com/amavis/amavis/issues/59
Comment 2 Tomáš Mózes 2020-02-08 20:19:30 UTC
*** Bug 708734 has been marked as a duplicate of this bug. ***
Comment 3 Tomáš Mózes 2020-02-08 20:33:52 UTC
Thanks Michael, I hope it gets to the official documentation.
Comment 4 Ralph Seichter 2020-02-08 22:37:46 UTC
Addressed in https://gitlab.com/amavis/amavis/-/merge_requests/37 which needs just one more approval.
Comment 5 Ralph Seichter 2020-02-12 01:26:00 UTC
I just mergend Michael's changes to both documentation and example configuration into Amavis' repository (https://gitlab.com/amavis/amavis/-/merge_requests/38). Thank you for your work, Michael.
Comment 6 Michael Orlitzky gentoo-dev 2020-03-01 20:15:23 UTC
This is done I think. In the future, people will see the easy option first in amavisd.conf.