[Bug 585026] Re: freshclam won't execute /etc/clamav/onupdateexecute.d scripts
This version has expired ** Changed in: clamav (Ubuntu) Status: Triaged = Invalid -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/585026 Title: freshclam won't execute /etc/clamav/onupdateexecute.d scripts To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/585026/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 585026] Re: freshclam won't execute /etc/clamav/onupdateexecute.d scripts
This sounds like a feature request - wishlist ? -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/585026 Title: freshclam won't execute /etc/clamav/onupdateexecute.d scripts To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/585026/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 585026] Re: freshclam won't execute /etc/clamav/onupdateexecute.d scripts
** Changed in: clamav (Ubuntu) Status: Incomplete = Triaged -- freshclam won't execute /etc/clamav/onupdateexecute.d scripts https://bugs.launchpad.net/bugs/585026 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in ubuntu. -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 585026] Re: freshclam won't execute /etc/clamav/onupdateexecute.d scripts
Thanks for reporting this issue. The default apparmor profile for the freshclam binary doesn't contain rules for scripts added to the /etc/clamav/onupdateexecute.d directory as we can't predict what those scripts will be doing. You can fix this is one of three ways: 1- Modify the /etc/apparmor.d/usr.bin.freshclam profile to add /bin/dash ixr, and other rules necessary for your script to run properly. (recommended) 2- Modify the /etc/apparmor.d/usr.bin.freshclam profile to add /bin/dash Uxr,, which will let scripts run unconfined. This is a security compromise. 3- Disable the freshclam profile by doing sudo touch /etc/apparmor.d/disable/usr.bin.freshclam. This disables apparmor security for the freshclam tool. This is not recommended. -- freshclam won't execute /etc/clamav/onupdateexecute.d scripts https://bugs.launchpad.net/bugs/585026 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in ubuntu. -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 585026] Re: freshclam won't execute /etc/clamav/onupdateexecute.d scripts
In the long run, the solution is to have freshclam use a helper application. The helper application would run unconfined but would only run stuff that is in those directories, and the main freshclam binary wouldn't be able to write to those directories. For now, about all I can do is extend the README a bit. This is the proposed text: The freshclam utility is also protected by an enforcing profile. If you want to add files to the /etc/clamav/onerrorexecute.d, /etc/clamav/onupdateexecute.d, or /etc/clamav/virusevent.d directories, appropriate rules need to be added to the apparmor profile. Please see https://wiki.ubuntu.com/AppArmor for information and documentation on modifying apparmor profiles. -- freshclam won't execute /etc/clamav/onupdateexecute.d scripts https://bugs.launchpad.net/bugs/585026 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in ubuntu. -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 585026] Re: freshclam won't execute /etc/clamav/onupdateexecute.d scripts
The result: [1754543.251421] type=1505 audit(1274733521.551:129): operation=profile_replace pid=25980 name=/usr/bin/freshclam [1765351.326452] type=1502 audit(1274744329.626:130): operation=exec pid=24546 parent=24545 profile=/usr/bin/freshclam requested_mask=::x denied_mask=::x fsuid=107 ouid=0 name=/bin/dash name2=/usr/bin/freshclam//null-12 [1765351.326826] type=1502 audit(1274744329.626:131): operation=open pid=24546 parent=24545 profile=/usr/bin/freshclam//null-12 requested_mask=::r denied_mask=::r fsuid=107 ouid=0 name=/etc/ld.so.cache [1765351.326884] type=1502 audit(1274744329.626:132): operation=open pid=24546 parent=24545 profile=/usr/bin/freshclam//null-12 requested_mask=::r denied_mask=::r fsuid=107 ouid=0 name=/lib/tls/i686/cmov/libc-2.11.1.so [1765351.326915] type=1502 audit(1274744329.626:133): operation=file_mmap pid=24546 parent=24545 profile=/usr/bin/freshclam//null-12 requested_mask=::mr denied_mask=::mr fsuid=107 ouid=0 name=/lib/tls/i686/cmov/libc-2.11.1.so [1765351.361355] type=1502 audit(1274744329.662:134): operation=exec pid=24547 parent=24546 profile=/usr/bin/freshclam//null-12 requested_mask=::x denied_mask=::x fsuid=107 ouid=0 name=/bin/run-parts name2=/usr/bin/freshclam//null-12//null-13 [1765351.366319] type=1502 audit(1274744329.666:135): operation=open pid=24547 parent=24546 profile=/usr/bin/freshclam//null-12//null-13 requested_mask=::r denied_mask=::r fsuid=107 ouid=0 name=/etc/ld.so.cache [1765351.366379] type=1502 audit(1274744329.666:136): operation=open pid=24547 parent=24546 profile=/usr/bin/freshclam//null-12//null-13 requested_mask=::r denied_mask=::r fsuid=107 ouid=0 name=/lib/tls/i686/cmov/libc-2.11.1.so [1765351.366410] type=1502 audit(1274744329.666:137): operation=file_mmap pid=24547 parent=24546 profile=/usr/bin/freshclam//null-12//null-13 requested_mask=::mr denied_mask=::mr fsuid=107 ouid=0 name=/lib/tls/i686/cmov/libc-2.11.1.so [1765351.379702] type=1502 audit(1274744329.678:138): operation=open pid=24547 parent=24546 profile=/usr/bin/freshclam//null-12//null-13 requested_mask=::r denied_mask=::r fsuid=107 ouid=0 name=/etc/clamav/onupdateexecute.d/ [1765385.616534] __ratelimit: 135 callbacks suppressed [1765385.616539] type=1502 audit(1274744363.918:184): operation=exec pid=24887 parent=24885 profile=/usr/bin/freshclam//null-12//null-13//null-14 requested_mask=::x denied_mask=::x fsuid=107 ouid=0 name=/bin/hostname name2=/usr/bin/freshclam//null-12//null-13//null-14//null-16 [1765385.619011] type=1502 audit(1274744363.918:185): operation=open pid=24887 parent=24885 profile=/usr/bin/freshclam//null-12//null-13//null-14//null-16 requested_mask=::r denied_mask=::r fsuid=107 ouid=0 name=/etc/ld.so.cache [1765385.619065] type=1502 audit(1274744363.918:186): operation=open pid=24887 parent=24885 profile=/usr/bin/freshclam//null-12//null-13//null-14//null-16 requested_mask=::r denied_mask=::r fsuid=107 ouid=0 name=/lib/tls/i686/cmov/libnsl-2.11.1.so [1765385.619100] type=1502 audit(1274744363.918:187): operation=file_mmap pid=24887 parent=24885 profile=/usr/bin/freshclam//null-12//null-13//null-14//null-16 requested_mask=::mr denied_mask=::mr fsuid=107 ouid=0 name=/lib/tls/i686/cmov/libnsl-2.11.1.so [1765385.619180] type=1502 audit(1274744363.918:188): operation=open pid=24887 parent=24885 profile=/usr/bin/freshclam//null-12//null-13//null-14//null-16 requested_mask=::r denied_mask=::r fsuid=107 ouid=0 name=/lib/tls/i686/cmov/libc-2.11.1.so [1765385.619206] type=1502 audit(1274744363.918:189): operation=file_mmap pid=24887 parent=24885 profile=/usr/bin/freshclam//null-12//null-13//null-14//null-16 requested_mask=::mr denied_mask=::mr fsuid=107 ouid=0 name=/lib/tls/i686/cmov/libc-2.11.1.so [1765385.630737] type=1502 audit(1274744363.930:190): operation=exec pid=24886 parent=24548 profile=/usr/bin/freshclam//null-12//null-13//null-14 requested_mask=::x denied_mask=::x fsuid=107 ouid=0 name=/usr/bin/mail name2=/usr/bin/freshclam//null-12//null-13//null-14//null-17 [1765385.639718] type=1502 audit(1274744363.938:191): operation=open pid=24886 parent=24548 profile=/usr/bin/freshclam//null-12//null-13//null-14//null-17 requested_mask=::r denied_mask=::r fsuid=107 ouid=0 name=/etc/ld.so.cache [1765385.646332] type=1502 audit(1274744363.946:192): operation=open pid=24886 parent=24548 profile=/usr/bin/freshclam//null-12//null-13//null-14//null-17 requested_mask=::r denied_mask=::r fsuid=107 ouid=0 name=/usr/lib/libmu_cfg.so.0.0.0 [1765385.649362] type=1502 audit(1274744363.950:193): operation=file_mmap pid=24886 parent=24548 profile=/usr/bin/freshclam//null-12//null-13//null-14//null-17 requested_mask=::mr denied_mask=::mr fsuid=107 ouid=0 name=/usr/lib/libmu_cfg.so.0.0.0 -- freshclam won't execute /etc/clamav/onupdateexecute.d scripts https://bugs.launchpad.net/bugs/585026 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in
[Bug 585026] Re: freshclam won't execute /etc/clamav/onupdateexecute.d scripts
** Attachment added: Dependencies.txt http://launchpadlibrarian.net/49028777/Dependencies.txt -- freshclam won't execute /etc/clamav/onupdateexecute.d scripts https://bugs.launchpad.net/bugs/585026 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in ubuntu. -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 585026] Re: freshclam won't execute /etc/clamav/onupdateexecute.d scripts
Please put apparmor in complain mode and provide the log results. The process is described in https://wiki.ubuntu.com/DebuggingApparmor I'm currently preparing a post-release update for clamav to update to clamav 0.96.1, so if we can get this answered quickly I ought to be able to include it. ** Changed in: clamav (Ubuntu) Status: New = Incomplete -- freshclam won't execute /etc/clamav/onupdateexecute.d scripts https://bugs.launchpad.net/bugs/585026 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in ubuntu. -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
