[Bug 1313282] Re: apparmor="DENIED" for freshclam (CLAMAV)
This bug was fixed in the package clamav - 0.98.1+dfsg-4ubuntu1.1 --- clamav (0.98.1+dfsg-4ubuntu1.1) trusty-proposed; urgency=medium [ Tyler Hicks ] * debian/usr.bin.freshclam: Grant freshclam permission to read and write the clamd socket. AppArmor requires both permissions when applications connect to path-based UNIX domain sockets. (LP: #1313282) -- Scott KittermanMon, 28 Apr 2014 17:29:57 -0400 ** Changed in: clamav (Ubuntu Trusty) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/1313282 Title: apparmor="DENIED" for freshclam (CLAMAV) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1313282/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1313282] Re: apparmor="DENIED" for freshclam (CLAMAV)
** Branch linked: lp:debian/experimental/clamav -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/1313282 Title: apparmor="DENIED" for freshclam (CLAMAV) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1313282/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1313282] Re: apparmor="DENIED" for freshclam (CLAMAV)
** Tags removed: verification-needed ** Tags added: verification-done -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/1313282 Title: apparmor="DENIED" for freshclam (CLAMAV) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1313282/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1313282] Re: apparmor="DENIED" for freshclam (CLAMAV)
The changes to the freshclam AppArmor profile does do the trick. Now freshclam reports (as it should be); Clamd successfully notified about the update. Thanks for the quick fix, Matthijs -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/1313282 Title: apparmor="DENIED" for freshclam (CLAMAV) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1313282/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1313282] Re: apparmor="DENIED" for freshclam (CLAMAV)
This bug was fixed in the package clamav - 0.98.1+dfsg-5ubuntu2 --- clamav (0.98.1+dfsg-5ubuntu2) utopic; urgency=medium [ Tyler Hicks ] * debian/usr.bin.freshclam: Grant freshclam permission to read and write the clamd socket. AppArmor requires both permissions when applications connect to path-based UNIX domain sockets. (LP: #1313282) [ Scott Kitterman ] * Add electric-fence back to build-deps now that it is approved for main inclusion (LP: #1311984) -- Tyler HicksMon, 28 Apr 2014 16:10:10 -0500 ** Changed in: clamav (Ubuntu Utopic) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/1313282 Title: apparmor="DENIED" for freshclam (CLAMAV) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1313282/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1313282] Re: apparmor="DENIED" for freshclam (CLAMAV)
** Branch linked: lp:ubuntu/trusty-proposed/clamav -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/1313282 Title: apparmor="DENIED" for freshclam (CLAMAV) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1313282/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1313282] Re: apparmor="DENIED" for freshclam (CLAMAV)
Hello Matthijs, or anyone else affected, Accepted clamav into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/clamav/0.98.1+dfsg- 4ubuntu1.1 in a few hours, and then in the -proposed repository. Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users. If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision. Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance! ** Changed in: clamav (Ubuntu Trusty) Status: In Progress => Fix Committed ** Tags added: verification-needed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/1313282 Title: apparmor="DENIED" for freshclam (CLAMAV) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1313282/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1313282] Re: apparmor="DENIED" for freshclam (CLAMAV)
** Branch linked: lp:ubuntu/utopic-proposed/clamav -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/1313282 Title: apparmor="DENIED" for freshclam (CLAMAV) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1313282/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1313282] Re: apparmor="DENIED" for freshclam (CLAMAV)
** Description changed: - [Description] + [Impact] Freshclam is not able to notify clamd about new databases because AppArmor prevents it from connecting to the clamd socket. Clamd will still detect the database update and force reload, but freshclam should be able to notify clamd. AppArmor fixed a bug (LP: #1208988) in its path-based UNIX domain socket mediation in Saucy. AppArmor now requires both read and write permissions for those socket paths but freshclam's profile only grants write permission. I recently upgraded my Ubuntu server to 14.04 LTS and notice some error messages regarding Apparmor and Freshclam. So far I know I didn't had these error message with the previous version (13.10). Syslog reports: kernel: [ 113.304926] type=1400 audit(1398085083.946:37): apparmor="DENIED" operation="connect" profile="/usr/bin/freshclam" name="/run/clamav/clamd.ctl" pid=2372 comm="freshclam" requested_mask="r" denied_mask="r" fsuid=110 ouid=110 Freshclam log reports: WARNING: Clamd was NOT notified: Can't connect to clamd through /var/run/clamav/clamd.ctl [Test Case] * Make sure that /etc/clamav/freshclam.conf contains this line: - NotifyClamd /etc/clamav/clamd.conf + NotifyClamd /etc/clamav/clamd.conf * Manually remove the main database file - $ sudo rm /var/lib/clamav/main.cvd + $ sudo rm /var/lib/clamav/main.cvd * Run freshclam - $ sudo freshclam + $ sudo freshclam * Verify the following: - 1) It was successful - 2) There were no warnings about clamd not being notified (see Description) - 3) There were no AppArmor denials in the system logs (See Description) + 1) It was successful and printed "Clamd successfully notified about the +update." + 2) There were no warnings about clamd not being notified (see Impact) + 3) There were no AppArmor denials in the system logs (see Impact) [Regression Potential] There is essentially no regression potential since we're only loosening up the freshclam AppArmor profile by adding read permission on the clamd socket. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/1313282 Title: apparmor="DENIED" for freshclam (CLAMAV) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1313282/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1313282] Re: apparmor="DENIED" for freshclam (CLAMAV)
** Description changed: - Not sure if this is a bug, or by design (but I would like some - clarification) + [Description] - I recently upgraded my Ubuntu server to 14.04 LTS and notice some error messages regarding Apparmor and Freshclam. - So far I know I didn't had these error message with the previous version (13.10). + Freshclam is not able to notify clamd about new databases because AppArmor + prevents it from connecting to the clamd socket. Clamd will still detect the + database update and force reload, but freshclam should be able to notify clamd. + + AppArmor fixed a bug (LP: #1208988) in its path-based UNIX domain socket + mediation in Saucy. AppArmor now requires both read and write permissions for + those socket paths but freshclam's profile only grants write permission. + + I recently upgraded my Ubuntu server to 14.04 LTS and notice some error + messages regarding Apparmor and Freshclam. So far I know I didn't had these + error message with the previous version (13.10). Syslog reports: kernel: [ 113.304926] type=1400 audit(1398085083.946:37): apparmor="DENIED" operation="connect" profile="/usr/bin/freshclam" name="/run/clamav/clamd.ctl" pid=2372 comm="freshclam" requested_mask="r" denied_mask="r" fsuid=110 ouid=110 Freshclam log reports: WARNING: Clamd was NOT notified: Can't connect to clamd through /var/run/clamav/clamd.ctl - Any reason why freshclam may not read the clamd.ctl? - Of course clamd will detect database update and force reload. - But should freshclam not be able to notify clamd? + [Test Case] + + * Make sure that /etc/clamav/freshclam.conf contains this line: + + NotifyClamd /etc/clamav/clamd.conf + + * Manually remove the main database file + + $ sudo rm /var/lib/clamav/main.cvd + + * Run freshclam + + $ sudo freshclam + + * Verify the following: + + 1) It was successful + 2) There were no warnings about clamd not being notified (see Description) + 3) There were no AppArmor denials in the system logs (See Description) + + [Regression Potential] + + There is essentially no regression potential since we're only loosening up the + freshclam AppArmor profile by adding read permission on the clamd socket. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/1313282 Title: apparmor="DENIED" for freshclam (CLAMAV) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1313282/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1313282] Re: apparmor="DENIED" for freshclam (CLAMAV)
** Also affects: clamav (Ubuntu Utopic) Importance: High Assignee: Tyler Hicks (tyhicks) Status: Triaged ** Also affects: clamav (Ubuntu Trusty) Importance: Undecided Status: New ** Changed in: clamav (Ubuntu Trusty) Status: New => Fix Committed ** Changed in: clamav (Ubuntu Trusty) Status: Fix Committed => In Progress ** Changed in: clamav (Ubuntu Utopic) Status: Triaged => Fix Committed ** Changed in: clamav (Ubuntu Trusty) Importance: Undecided => High ** Changed in: clamav (Ubuntu Trusty) Assignee: (unassigned) => Scott Kitterman (kitterman) ** Changed in: clamav (Ubuntu Trusty) Milestone: None => ubuntu-14.04.1 -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/1313282 Title: apparmor="DENIED" for freshclam (CLAMAV) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1313282/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1313282] Re: apparmor="DENIED" for freshclam (CLAMAV)
Here's a debdiff that updates the freshclam AppArmor profile to grant both read and write permissions for the clamd socket file. Both permissions are now required by AppArmor when applications connect() to UNIX domain sockets. ** Patch added: "clamav_0.98.1+dfsg-5ubuntu2.debdiff" https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1313282/+attachment/4099894/+files/clamav_0.98.1%2Bdfsg-5ubuntu2.debdiff -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/1313282 Title: apparmor="DENIED" for freshclam (CLAMAV) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1313282/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1313282] Re: apparmor="DENIED" for freshclam (CLAMAV)
** Changed in: clamav (Ubuntu) Assignee: (unassigned) => Tyler Hicks (tyhicks) ** Changed in: clamav (Ubuntu) Importance: Medium => High -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/1313282 Title: apparmor="DENIED" for freshclam (CLAMAV) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1313282/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1313282] Re: apparmor="DENIED" for freshclam (CLAMAV)
It's not intentional. Thanks for the report. ** Changed in: clamav (Ubuntu) Status: New => Triaged -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/1313282 Title: apparmor="DENIED" for freshclam (CLAMAV) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1313282/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1313282] Re: apparmor="DENIED" for freshclam (CLAMAV)
** Changed in: clamav (Ubuntu) Importance: Undecided => Medium -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/1313282 Title: apparmor="DENIED" for freshclam (CLAMAV) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1313282/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
