Closed mfld closed 7 months ago
anotherbugmaster
commented
2 years ago Hey @mfld! Just encountered the same issue, seems like you need to pass the file descriptor of user who owns the target file, like described here. Worked for me, hope it will for you too!
mfld
commented
2 years ago Hi, passing the file descriptor via fdpass generates a different error for me.
# /usr/bin/clamdscan --fdpass --stdout --config-file=/etc/clamd.d/scan.conf -m /etc/audit/auditd.conf
ERROR: Communication error
ERROR: Clamd closed the connection before scanning all files.
----------- SCAN SUMMARY -----------
Infected files: 0
Time: 0.000 sec (0 m 0 s)
Start Date: 2022:02:14 09:29:34
End Date: 2022:02:14 09:29:34
life5ign
commented
2 years ago Hey @mfld! Just encountered the same issue, seems like you need to pass the file descriptor of user who owns the target file, like described here. Worked for me, hope it will for you too!
Using --fdpass fixed this issue for me while scanning a file owned by root. My instance of clamd was running as the user clamav. Here's my config, the file scanned, a successful scan and the original failed scan:
θ67° [root:~] 2 # clamconf | grep -iE 'User|Socket'
LocalSocket = "/var/run/clamav/clamd.ctl"
LocalSocketGroup = "clamav"
LocalSocketMode = "666"
FixStaleSocket = "yes"
TCPSocket disabled
User = "clamav"
HTTPProxyUsername disabled
HTTPUserAgent disabled
θ67° [root:~] 2 # ls -la foo
-rw-r--r-- 1 root root 0 Apr 28 14:29 foo
θ67° [root:~] 2 # clamdscan --fdpass foo
/root/foo: OK
----------- SCAN SUMMARY -----------
Infected files: 0
Time: 0.000 sec (0 m 0 s)
Start Date: 2022:04:28 14:42:04
End Date: 2022:04:28 14:42:04
θ67° [root:~] 2 # clamdscan foo
/root/foo: File path check failure: Permission denied. ERROR
/root/foo: File path check failure: Permission denied. ERROR
----------- SCAN SUMMARY -----------
Infected files: 0
Total errors: 2
Time: 0.000 sec (0 m 0 s)
Start Date: 2022:04:28 14:42:11
End Date: 2022:04:28 14:42:11Hi @life5ign,
It is likely due to selinux rather than scanning with fdpass in it self. scanning /etc/audit/auditd.conf still results in error.
ls -lZ /etc/audit/auditd.conf
-rw-r-----. 1 root root system_u:object_r:auditd_etc_t:s0 872 Oct 26 2021 /etc/audit/auditd.conf
# clamdscan --fdpass /etc/audit/auditd.conf
/etc/audit/auditd.conf: no reply from clamd
----------- SCAN SUMMARY -----------
Infected files: 0
Total errors: 1
Time: 0.000 sec (0 m 0 s)
Start Date: 2022:04:29 12:52:50
End Date: 2022:04:29 12:52:50following your example with foo, no issues
# touch foo
# ls -lZ foo
-rw-r-----. 1 root root unconfined_u:object_r:admin_home_t:s0 0 Apr 29 12:40 foo
# clamdscan --fdpass foo
/root/foo: OK
----------- SCAN SUMMARY -----------
Infected files: 0
Time: 0.006 sec (0 m 0 s)
Start Date: 2022:04:29 12:40:23
End Date: 2022:04:29 12:40:23
funxiun
commented
2 years ago Hi @mfld
I have, I think, the exact problem on a RHEL 8.5 environment.
After fiddling around with different settings, I found that using the --stream parameter resolves my problem.
clamdscan --stream /home
Documentation states the following:
--stream
Forces file streaming to clamd. This is generally not needed as clamdscan detects automatically if streaming is required. This option only exists for debugging
and testing purposes, in all other cases --fdpass is preferred.
I guess the autodetect doesn't work properly.
I can only reproduce this error when I'm using TCPSocket. When using a LocalSocket I can use clamdscan with --fdpass without any problems.
RafiraRangga
commented
1 year ago I tried re-downloading and it worked
I was doing a clamscan failed file, and I re-downloaded it then tried again and it worked
ugogou
commented
5 months ago Hey @mfld! Just encountered the same issue, seems like you need to pass the file descriptor of user who owns the target file, like described here. Worked for me, hope it will for you too!
Using
--fdpassfixed this issue for me while scanning a file owned by root. My instance ofclamdwas running as the userclamav. Here's my config, the file scanned, a successful scan and the original failed scan:θ67° [root:~] 2 # clamconf | grep -iE 'User|Socket' LocalSocket = "/var/run/clamav/clamd.ctl" LocalSocketGroup = "clamav" LocalSocketMode = "666" FixStaleSocket = "yes" TCPSocket disabled User = "clamav" HTTPProxyUsername disabled HTTPUserAgent disabled θ67° [root:~] 2 # ls -la foo -rw-r--r-- 1 root root 0 Apr 28 14:29 foo θ67° [root:~] 2 # clamdscan --fdpass foo /root/foo: OK ----------- SCAN SUMMARY ----------- Infected files: 0 Time: 0.000 sec (0 m 0 s) Start Date: 2022:04:28 14:42:04 End Date: 2022:04:28 14:42:04 θ67° [root:~] 2 # clamdscan foo /root/foo: File path check failure: Permission denied. ERROR /root/foo: File path check failure: Permission denied. ERROR ----------- SCAN SUMMARY ----------- Infected files: 0 Total errors: 2 Time: 0.000 sec (0 m 0 s) Start Date: 2022:04:28 14:42:11 End Date: 2022:04:28 14:42:11
It works! Thank you!
Describe the bug
Running clamdscan on files with selinux context set results in permission denied errors on rhel 8.1 workstation and Rocky Linux 8.5.
Expected clamdscan to succeed on directories like /etc or /var/log when run as root (which also owns /var/run/clamd.scan/clamd.sock)
How to reproduce the problem
output of clamconf -n