In 12.10 to 14.04, I was using several ntfs partitions which got auto-mounted
by fstab entries, using
...uid=1000,gid=1000,x-gvfs-show,x-gvfs-name=something.
With a new PC I installed 14.04.2 64bit, and use ext4 for these shared disks.
Unfortunately, doing so had me hit by this bug. Since
clamd starts with:
1. aa-complain clamd
2. invoke-rc.d clamav-daemon restart
No clamd entries in syslog.
audit.log after starting clamd:
type=USER_AUTH msg=audit(1428468600.638:193): pid=8314 uid=1000 auid=4294967295
ses=4294967295 msg='op=PAM:authentication acct=hartwig exe=/usr/bin/sudo
As another try, I tried to disable the apparmor profile by
cd /etc/apparmor.d/disable
ln -s ./../usr.sbin.clamd
as described by Thomas above. Unexpectedly, that did not get rid of the message
ERROR: initgroups() failed.
I found I had a file usr.sbin(Kopie).clamd in that folder; this file was
Now, that on-access scan seems to be working, I tried some cases:
No detections when I copied some Eicar files around in subfolders of
/home/hartwig. However, I got a detection when I placed an Eicar file directly
into that folder (mentioned in /var/log/clamav/clamav.log). It looks like that
no any reaction?
Does that mean on-access scanning does not work with clamav (non-detection of
Eicar file)?
Because of lacking compatibility with apparmor?
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
some further info:
I now have installed auditd to have the log in /var/log/audit/audit.log.
I added to usr.bin.clamd:
capability setgid,
capability setuid,
and used aa-logprof to add some more items:
capability chown,
capability dac_override,
capability fsetid,
capability sys_admin,
I have the same problem, but the above does not help me.
aa-complain clamd needs to be done at every startup, otherwise clamd would not
start.
No /var/log/audit/audit.log
Eicar file can be copied despite clamav on-access running (acc clamav.log)
Details see
7 matches
Mail list logo
