touch-packages team mailing list archive

[Hartwig Kolbe <kolbeb@xxxxxxxxx>]

clamd starts with:
1. aa-complain clamd
2. invoke-rc.d clamav-daemon restart

No clamd entries in syslog.
audit.log after starting clamd:
type=USER_AUTH msg=audit(1428468600.638:193): pid=8314 uid=1000 auid=4294967295 ses=4294967295 msg='op=PAM:authentication acct="hartwig" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/18 res=success'
type=USER_ACCT msg=audit(1428468600.638:194): pid=8314 uid=1000 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="hartwig" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/18 res=success'
type=USER_START msg=audit(1428468600.658:195): pid=8314 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/18 res=success'
type=AVC msg=audit(1428468604.378:196): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/sbin/clamd" pid=8319 comm="apparmor_parser"
type=SYSCALL msg=audit(1428468604.378:196): arch=40000003 syscall=4 success=yes exit=26185 a0=3 a1=9c6677c a2=6649 a3=bfbf36c4 items=0 ppid=8315 pid=8319 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts18 ses=4294967295 comm="apparmor_parser" exe="/sbin/apparmor_parser" key=(null)
type=USER_END msg=audit(1428468604.450:197): pid=8314 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/18 res=success'

But - Eicar file can be copied, no error msg, no log entry

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1404762

Title:
  apparmor profile usr.sbin.clamd does not allow ScanOnAccess via
  fanotify

Status in apparmor package in Ubuntu:
  Confirmed

Bug description:
  I tried to enable the ScanOnAccess option in /etc/clamav.conf to get
  on-access scanning.

  Doing so, /var/log/clamav/clamav.log tells me:
  ERROR: ScanOnAccess: fanotify_init failed: Operation not permitted
  ScanOnAccess: clamd must be started by root

  Setting User to root in /etc/clamav/clamd.conf
  makes the clamav-daemon to fail with

  service clamav-daemon start
   * Starting ClamAV daemon clamd
  ERROR: initgroups() failed.

  I had to disable the apparmor.profile with a
  cd /etc/apparmor.d/disable
  ln -s ./../usr.sbin.clamd

  Then, the "ERROR: initgroups() failed." disappears.

  The apparmor itself came via apt-get packages. I did not edit it.

  Description:	Ubuntu 14.04.1 LTS
  Release:	14.04

  apt-cache policy apparmor-profiles
  apparmor-profiles:
    Installiert:           (keine)
    Installationskandidat: 2.8.95~2430-0ubuntu5.1
    Versionstabelle:
       2.8.95~2430-0ubuntu5.1 0
          500 http://de.archive.ubuntu.com/ubuntu/ trusty-updates/main amd64 Packages
          500 http://security.ubuntu.com/ubuntu/ trusty-security/main amd64 Packages
       2.8.95~2430-0ubuntu5 0
          500 http://de.archive.ubuntu.com/ubuntu/ trusty/main amd64 Packages

  ProblemType: Bug
  DistroRelease: Ubuntu 14.04
  Package: apparmor-profiles (not installed)
  ProcVersionSignature: Ubuntu 3.13.0-43.72-generic 3.13.11.11
  Uname: Linux 3.13.0-43-generic x86_64
  ApportVersion: 2.14.1-0ubuntu3.6
  Architecture: amd64
  Date: Mon Dec 22 01:23:04 2014
  InstallationDate: Installed on 2014-11-29 (22 days ago)
  InstallationMedia: Ubuntu 14.04.1 LTS "Trusty Tahr" - Release amd64 (20140722.2)
  ProcEnviron:
   LANGUAGE=de_DE
   TERM=xterm
   PATH=(custom, no user)
   LANG=de_DE.UTF-8
   SHELL=/bin/bash
  ProcKernelCmdline: BOOT_IMAGE=/@/boot/vmlinuz-3.13.0-43-generic root=UUID=6408c2d9-1b60-43d7-9a7f-2dceeb40de28 ro rootflags=subvol=@ quiet splash vt.handoff=7
  SourcePackage: apparmor
  Syslog:
   
  UpgradeStatus: No upgrade log present (probably fresh install)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1404762/+subscriptions