Re: clamav issue

Sorry for the delayed response.

Consider the following:

In a vast majority of installations, Maia runs as one dedicated 
user/group, while clamd runs as another user/group.  clamd runs as its 
own user/group IDs so as to secure the data it uses.  Maia runs as its 
own user/group IDs because a working directory it uses needs to be 
secured for reasons of both security and, more importantly, privacy. 
Using default installations for both packages, clamd cannot read that 
secured working directory that Maia uses, thus generating those errors 
you're seeing.

That said, those errors are being generated by clamd, not Maia.  clamd 
can't read the files that Maia is handling because Maia wants a working 
directory to have no outside access.

The easiest fix is to add the user clamd runs as to Maia's group, then 
restart clamd, allowing scans to work.

On a Debian/Ubuntu system, you can accomplish this very easily by 
running this one command (season to taste for your setup and/or userland 
tools; check those tools' manpages to be sure):

# usermod -a -G amavis clamav

Or use vigr, or whichever tools your system furnishes you with to add a 
user to a given group.

This adds the clamav user to the amavis group so clamd can read amavis' 
secured working directories.

Then restart clamd.  Test with EICAR and if it blocks it as a TEST 
PATTERN (I forget the actual message), you know you're golden.

A detailed explanation of why you're getting the error, as well as how 
clamd works, is as follows.

By design, clamd's socket is usable by absolutely anyone in the system. 
  This allows anyone to run clamdscan to scan something.  clamdscan only 
passes the pathname of the file to be scanned through that socket.  Maia 
does as well, by interacting with the socket directly.  For our case, 
the only thing the socket is actually used for is to tell clamd, "Hey, 
look at this file specified by <pathname> and report back whether it has 
viruses you know about," then clamd does the rest.  This alleviates the 
overhead associated with firing up and running clamscan, the "transient" 
command-line scanner.

As such, permissions on the socket are NOT the problem.  Permissions 
leading up to the file as well as the file itself ARE the problem, in 
this case, a directory Maia uses.

Both clamdscan and direct usage of the socket require that clamd can 
access the path leading to the file to be scanned as well as read the 
file itself in order for things to work.  For users, you make sure that 
all users have at least o+x set on the directories leading to the file, 
and o+r on the file itself.  For Maia, it's much easier and safer to add 
the clamd running-as user to Maia's running-as group.

Hope this helps.

--Ian.

On 01/19/2016 02:16, Richard B. Pyne wrote:
> What am I missing? I found and fixed permissions so that maiad can
> connect to the socket, but I'm still getting permission errors
>
>
> Jan 19 03:00:33 cloudmail maiad[13007]: (13007-01) ClamAV-clamd:
> Connecting to socket  /var/run/clamd.scan/clamd.sock
>
> Jan 19 03:00:33 cloudmail maiad[13007]: (13007-01) ClamAV-clamd: Sending
> CONTSCAN /var/lib/maia/tmp/maia-20160119T030032-13007/parts\n to UNIX
> socket /var/run/clamd.scan/clamd.sock
>
> Jan 19 03:00:33 cloudmail maiad[13007]: (13007-01) ask_av (ClamAV-clamd)
> result: /var/lib/maia/tmp/maia-20160119T030032-13007/parts: lstat()
> failed: Permission denied. ERROR\n
>
> Jan 19 03:00:33 cloudmail maiad[13007]: (13007-01) ask_av (ClamAV-clamd)
> FAILED - unexpected result:
> /var/lib/maia/tmp/maia-20160119T030032-13007/parts: lstat() failed:
> Permission denied. ERROR\n
>
>
> Thanks,
>
> --Richard
>
> _______________________________________________
> Maia-users mailing list
> [email protected]
> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

-- 
Ian R. Justman
UNIX hacker.  Anime fan.  Any questions?
ianj (at) ian-justman.com
Please direct business correspondence to my new address, biz (at) 
ian-justman.com. (04/27/2015)
_______________________________________________
Maia-users mailing list
[email protected]
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users