Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 582110 - app-antivirus/clamav: systemd socket permissions prevent group members from connecting
Summary: app-antivirus/clamav: systemd socket permissions prevent group members from c...
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Antivirus Team
Depends on:
Reported: 2016-05-04 19:55 UTC by Olliver Schinagl
Modified: 2021-07-17 21:13 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Olliver Schinagl 2016-05-04 19:55:47 UTC
After switching to systemd using the default socket, /var/run/clamav/clamd.sock with amavis and clamav, amavis gets greeted with permission denied errors on the clamd socket, even though it is srw-rw-rw-. /var/run is with systemd symlinked to /run which is tmpfs mounted (tmpfs on /run type tmpfs (rw,nosuid,nodev,mode=755)).
Even changing to /tmp/clamd.sock (also tmpfs) the socket still fails.

Changing the socket to /var/lib/clamav/clamd.sock works as a work around, as that normally is a normally mounted filesystem.

I'm not sure if it is an amavis, clamd or systemd(well a mount) bug, but patching both temporarly to /var/lib/clamav/clamd.sock prevents problems until upstream sorts this.

Reproducible: Always
Comment 1 Alex Xu (Hello71) 2016-05-08 19:03:33 UTC
please paste the output of "stat /run".
Comment 2 Olliver Schinagl 2016-05-09 09:55:07 UTC

  File: ‘/run’
  Size: 900             Blocks: 0          IO Block: 4096   directory
Device: 13h/19d Inode: 1140        Links: 28
Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2016-05-06 10:57:17.039999946 +0200
Modify: 2016-05-06 16:48:21.102187339 +0200
Change: 2016-05-06 16:48:21.102187339 +0200
 Birth: -

for completness sake:
  File: ‘/var/lib/clamav/’
  Size: 156             Blocks: 0          IO Block: 4096   directory
Device: 25h/37d Inode: 536         Links: 1
Access: (0755/drwxr-xr-x)  Uid: (  104/  clamav)   Gid: (  997/  clamav)
Access: 2016-05-01 17:11:34.000000000 +0200
Modify: 2016-05-09 10:00:49.053277956 +0200
Change: 2016-05-09 10:00:49.053277956 +0200
 Birth: -

which is where i keep my socket for now.
  File: ‘/var/lib/clamav/clamd.sock’
  Size: 0               Blocks: 0          IO Block: 4096   socket
Device: 25h/37d Inode: 920397      Links: 1
Access: (0666/srw-rw-rw-)  Uid: (  104/  clamav)   Gid: (  997/  clamav)
Access: 2016-05-06 10:57:47.379998898 +0200
Modify: 2016-05-06 10:57:47.379998898 +0200
Change: 2016-05-06 10:57:47.379998898 +0200
 Birth: -
Comment 3 Olliver Schinagl 2016-05-09 12:11:19 UTC
Also a directory is made for clamav under /run:
  File: ‘/run/clamav/’
  Size: 80              Blocks: 0          IO Block: 4096   directory
Device: 13h/19d Inode: 3045        Links: 2
Access: (0710/drwx--x---)  Uid: (  104/  clamav)   Gid: (  997/  clamav)
Access: 2016-05-06 10:57:19.049999877 +0200
Modify: 2016-05-06 10:57:47.399998897 +0200
Change: 2016-05-06 10:57:47.399998897 +0200
 Birth: -
Comment 4 Alex Xu (Hello71) 2016-05-22 22:40:58 UTC
it won't work for sure if you put it in /tmp because the unit has PrivateTmp=true. you could try stracing amavis or socat UNIX-CONNECT when it's in /run though.
Comment 5 Simon Siemonsma 2016-06-01 19:35:11 UTC
Just had the same problem few minutes ago.
chmod 755 /var/run/clamav
The essential part is that the x bit is set in the directory.
(it also works with 711).
Comment 6 Simon Siemonsma 2016-06-16 17:40:05 UTC
seems chmod on the /var/run/clamav directory doesn't survive a reboot.
Elsewhere it is recommended to make clamav member of the amavis group and amavis member of the clamav group.
This doesn't seem to help.
Comment 7 Michael Orlitzky gentoo-dev 2018-10-13 02:14:11 UTC
This is because the clamav tmpfiles.d entry makes /run/clamav mode 710 every time the machine starts:

  d /run/clamav 0710 clamav clamav

That should probably be 750 instead. Then adding the amavis user to the "clamav" group would allow it to enter that directory and access the socket.

It works in OpenRC because the permissions on that directory get adjusted to 755 on-the-fly, but in my opinion, that's a mistake.
Comment 8 Michael Orlitzky gentoo-dev 2019-03-26 20:22:28 UTC
Assigning to antivirus@ because I think this needs to be fixed in clamav. Please see my previous comment. Most likely, /run/clamav should be mode 750 under both systemd and OpenRC.

NOTE: both the tmpfiles.d and OpenRC init script need to be updated, if you believe me. The tmpfiles.d entry makes the permissions too strict (710), and OpenRC leaves them too loose (755).
Comment 9 Thomas Raschbacher gentoo-dev 2019-08-21 20:05:12 UTC
I will have a look at this soon. But what you (@mjo) say seems to make sense.
Comment 10 Michael Orlitzky gentoo-dev 2021-07-17 21:13:10 UTC
There was a bug in amavis that prevented multiple groups from working correctly:

When the next version of amavis is released, we can finally fix these socket permissions and have things Just Work out of the box.